Embedding RMON in large LAN switches

A remote network monitoring management (RMON) agent monitors all traffic on a network segment. In a switched LAN, the only device where all traffic can be seen is the LAN switch. Thus, the most appropriate place to insert an RMON probe is in the LAN switch. In this article issues in implementing various RMON groups in a LAN switch are studied, and some approaches are proposed. The centralized solution turns out to be impractical because it is prohibitively expensive. A distributed design is presented that is suitable for implementation on multiprocessor switches. A simple analytical model is used to compare the alternatives. We investigate empirically the cost of performing typical filtering operations in an operational network. This shows that reverse filtering is often much more computationally efficient than forward filtering. We show that the distributed design can provide full RMON capability on all ports simultaneously at affordable cost