Monitoring Network Activity

Introduction

The DIGITAL VNswitch provides two methods for monitoring network activity:

About the VNswitch Mirror Feature

The VNswitch 900 mirror feature lets you diagnose network activity by sampling incoming and outgoing packets from a specified VNswitch interface. Packets received or transmitted on specified interfaces can be copied to the mirror destination.

The mirror destination interface is a dedicated interface that accepts only mirrored packets. These mirrored packets are derived from specific VNswitch Ethernet-like interfaces and can be forwarded to any destination interface on the VNswitch with an Ethernet interface. By attaching an external network analyzer to the destination interface, you can evaluate packets and troubleshoot the network.

Mirror Restrictions and Mirroring Effect on VNswitch Performance

Mirror Restrictions

Mirroring Effect on VNswitch Performance

Mirroring does not adversely affect the performance of the VNswitch. If more packets are sent to the destination than can be handled, the packets are dropped. Although the packets will not be available for viewing, operation of the VNswitch is unaffected.

Configuring the Mirror Interface

Accessing the Mirror Prompt

You can access the mirror feature either at the Configuration prompt (Config>), or the Monitor prompt (Monitor>). To access the mirror feature from the Config> prompt, perform the following steps:

Step Action

1

To access the mirror prompt, at the Config> prompt, enter mirror.

2

Press Return. The Mirror prompt (Mirror Config>) is displayed.

Disabling Bridging on the Destination Interface

Before the destination interface is activated, bridging on the specified destination interface must be disabled. If you try to enable a mirror destination while bridging for the destination interface is active, you are prompted with the following message:

The interface that you are setting as the mirror destination is currently functioning as an active bridge port. It is a requirement of the mirror functionality that bridging is disabled. Would you like to proceed? If you proceed, bridging will be disabled on this port and it will be set as the mirror destination.

Once bridging is disabled on the destination interface and mirroring is enabled and you attempt to enable bridging on the destination interface, you are prompted with the following message:

The interface that you are attempting to enable is currently set up as the destination mirror, to proceed, this interface must be disabled as the destination mirror. Would you like to proceed? If you answer yes, bridging will be enabled and this interface will no longer be the mirror destination.

Interaction with SNMP
You cannot activate a mirror destination port and have the bridge port enabled simultaneously. Therefore, if a port is configured as the mirror destination and someone attempts to use SNMP to enable the bridge port (for example, by setting the dot1dStpPortEnable.X bit) the SNMP set will fail. The only way to reconfigure the mirror port destination is through the local CLI of the VNswitch.

Enabling Bridging After Using the Mirror Interface
Disabling the mirror destination does not automatically re-enabling bridging. To re-enable bridging on the destination interface, use the BRIDGE config> set port command. However, when the mirror destination is disabled, the you are prompted to determine if bridging should be enabled. If you answer YES, bridging is re-enabled. When you disable the destination port, you are prompted with the following message: Bridging is currently disabled on interface n. Do you want to enable bridging?

Setting the Mirror Interface

You can configure the mirror interface to mirror the following types of packets:

In addition to setting a mirror interface, you must also set a mirror destination interface using the enable command. Only one destination interface per VNswitch module is allowed.

The steps in the following example set a mirror interface to mirror the packets received and transmitted on Ethernet interface 2, and sets the destination interface to 5:

Step Action

1

At the Mirror Config> prompt, enter set both 2.

2

Press Return. A mirror interface on interface 2 is set to transmit and receive.

3

To set a mirror destination, at the Mirror Config> prompt, enter enable 5

4

Press Return. A mirror destination is set on interface 5.

Setting Multiple Mirror Interfaces

With the mirror feature, you can simultaneously set multiple interfaces with the set command. For example, you can set all 12 Ethernet ports on the VNswitch 900EX to a mirror interface with one command.

The steps in the following example set mirror interfaces to transmit on Ethernet interfaces 1 through 5, 7 through 12, and enables the destination interface 6:

Step Action

1

At the Mirror Config> prompt, enter set transmit 1-5, 7-12. Press Return.

2

At the Mirror Config> prompt, enter enable 6. Press Return.

A mirror destination is set on interface 6.

Changing the Mirror Destination Port

In the example above, Ethernet interfaces 1 through 5 and 7 through 12 are set to mirror transmit packets, and the destination is enabled for Ethernet interface 6. The steps in the following example change the destination from interface 6 to interface 3, and mirrors traffic transmitted on interface 6:

Step Action

1

At the Mirror Config> prompt, enter set neither 3. Press Return.

2

At the Mirror Config> prompt, enter set transmit 6. Press Return.

3

At the Mirror Config> prompt, enter enable 3. Press Return.
The mirror destination interface is now changed to interface 3.

Listing Mirror and Destination Interfaces

You can display all the receive and transmit mirror interfaces, and the destination interface using the list command. To list all the mirror interfaces, perform the following steps:

Step Action

1

At the Mirror Config> prompt, enter list.

2

Press Return. All mirror interfaces are displayed.

Clearing Mirror and Destination Interfaces

You can clear all the mirror interfaces and the destination interface with the clear command. To clear all the mirror interfaces, perform the following steps:

Step Action

1

At the Mirror Config> prompt, enter clear.

2

Press Return. All mirror interfaces and the destination port are cleared.

You can also clear specific mirror interfaces using the set command. To clear specific mirror interfaces, perform the following steps:

Step Action

1

At the Mirror Config> prompt, enter set neither 3,4

2

Press Return. Packets on mirror interfaces 3 and 4 are not copied to the destination interface.

Mirroring Multiple VNswitch Modules

You can configure your mirror destination interface for each VNswitch to connect to a repeater. This section gives an example of how to mirror multiple VNswitch modules with one network analyzer on a DIGITAL DECrepeater. The configuration criteria for this example are:

The VNswitch module must be configured to conform to the requirements in the Mirror Restrictions section.

To configure multiple VNswitch modules using one network analyzer (Figure 13-1), perform the following steps:

Step Action

1

Configure your first VNswitch to the mirror interfaces and destination interface you want to use.

2

Configure each additional VNswitch to the mirror interfaces and destination interface you want to use.

3

Ensure that your DIGITAL DECrepeater has enough available ports to handle each destination interface and a port to connect a network analyzer.

4

Using DIGITAL clearVISN software, connect the destination interface from the first VNswitch to an available repeater port.

5

Repeat step 4 for each VNswitch you want to configure.

6

Connect a network analyzer to an available repeater port.

Your network analyzer is now capable of receiving packets from each VNswitch connected to the repeater.

To avoid losing packets to the network analyzer, ensure that the combined traffic from all destination interfaces connected by clearVISN to the DECrepeater does not exceed 10 Mb/s.

Figure 13-1: Using clearVISN to Connect a Mirror Destination Interface

10396.gif (15695 bytes)

Mirror Commands

The following table provides a list of the mirror commands, with a description and example of each:

Command

Description

Clear

Clears the destination interface, all the transmit interface, and all the receive interfaces.

Example: Mirror Config> clear

Enable/Disable

Enables/disables the mirror destination interface to which mirror packets will be sent. Only one destination interface per VNswitch are allowed.

Example 1: Mirror Config> enable 5
Enables interface 5 as the destination interface.

Example 2: Mirror Config> disable
Disables the destination interface.

List

Displays the destination interface, all the transmit interfaces and all the receive interfaces.

Example: Mirror Config> list

Set

Sets a mirror interface on an Ethernet port. The interface can be set to mirror receive packets, transmit packets, both or none. When an interface is set to none, the mirror interface is disabled.

Example 1: Mirror Config> set transmit 1-5
Copies transmit packets from interfaces 1 through 5 to the destination interface.

Example 2: Mirror Config> set receive 2,3,4
Copies receive packets from interfaces 2, 3, and 4 to the destination interface.

Example 3: Mirror Config> set both 1-12
Copies both transmit and receive packets from interfaces 1 through 12 to the destination interface.

Example 4: Mirror Config> set neither 6
Disables mirror interface 6.

About the VNswitch RMON Agent

The VNswitch Remote Network Monitoring (RMON) agent allows you to configure the VNswitch so that it independently monitors its own MIB variables and network traffic. The VNswitch RMON agent supports the Alarm and Event MIB groups and adheres to RMON MIB RFC 1757 for Ethernet objects.

RMON Alarm and Event Groups

The alarm group allows you to configure the VNswitch so that it monitors its own MIB variables. If the value of a monitored variable crosses its configured thresholds, the RMON agent generates an event. The event group associates an event with a set of actions. Two actions are defined: generate an SNMP trap message and add an entry to the event group log table.

You can configure alarms and events from a network management application, such as a MIB browser, that uses SNMP. You can also use the VNswitch CLI to read and write MIB variables in the alarm and event groups.

You can separately configure the Event Logging System (ELS) to generate an ELS event whenever an alarm generates an RMON event. Otherwise, the RMON event group and ELS are independent of each other.

Alarms and events are stored in NVRAM (nonvolatile RAM) memory and are preserved if you power cycle the VNswitch. You can delete individual table entries by using the RMON CLI delete command or you can use SNMP to set the table entry status to invalid. You can also use the clear RMON command from the Config prompt to delete all RMON table entries.

If you use SNMP to create, delete, or modify alarm and event table rows, you must follow the conventions for EntryStatus as specified in the RMON MIB (RFC 1757). You are not required to follow the EntryStatus conventions when you configure alarm and event table rows from the CLI.

The CLI correctly transitions row status.

The number of alarm and event table entries is limited to 256.

You cannot write more than one alarm table or event table row at a time in a single SNMP set PDU (Protocol Data Unit). If you do not specify all the values for a row in a set PDU, the default values specified in Table 13-1 and Table 13-2 are used. The CLI uses these default values only the first time you enter an alarm or event from the CLI. Then the CLI uses the values you last entered as a default.

Table 13-1 shows the variables and the default values for the set alarm command.

Table 13-1: RMON Set Alarm Command Parameters

Alarm Variable

Default Value

Alarm Index

1

Alarm Status

valid

Alarm Interval

1

Alarm Variable

[0.0]

Alarm Sample Type

deltaValue

Alarm Value

0

Startup Alarm

risingOrFallingAlarm

Rising Alarm Threshold

0

Falling Alarm Threshold

0

Rising Event Index

0

Falling Event Index

0

Alarm Owner

Null string

Alarm Description

Null string

Table 13-2 shows the variables and the default values for the set event command.

Table 13-2: RMON Set Event Command Parameters

Event Variable

Default Value

Event Index

1

Event Status

valid

Event Description

Null string

Event Type

log-and-trap

Event Community

Null string

Event Owner

Null string

RMON Command Line Interface

You can configure RMON alarms and events from a network management application, such as a MIB browser, that uses SNMP. You can also use the VNswitch CLI to read and write MIB variables in the alarm and event groups.

Accessing the RMON Configuration Process

To access the RMON configuration process using the CLI, perform the following steps:

Step Action

1

From the Main prompt (Main>), enter the following command:
Main> config
The Config> prompt is displayed.

2

At the Config> prompt, enter the following command:
Config> rmon

3

Press Return. The following prompt is displayed:
RMON Config>

Once you have entered the RMON configuration process, you can execute the commands in Table 13-3.

Table 13-3: RMON Configuration Commands

Command

Command Parameters

add

alarm
event

set

alarm
event
log-table-max

delete

alarm
event
log

list

alarm
all
event
log

Accessing the RMON Monitor Process

To access the RMON monitor process through SNMP, perform the following steps:

Step Action

1

From the Main prompt (Main>), enter the following command:
Main> monitor
The Monitor> prompt is displayed.

2

At the Monitor> prompt, enter the following command:
Monitor>rmon

3

Press Return. The following prompt is displayed:
RMON user console
RMON>

Once you have entered the RMON monitor process, you can execute the commands in Table 13-4.

Table 13-4: RMON Monitor Commands

Command Type

Command Parameters

delete

log table

list

alarm
all
event
log

exit

 

Clearing RMON Configuration Information

To clear all configuration information for RMON, perform the following steps:

Step Action
1 From the Main prompt (Main>), enter the following command:

Main> config

The Config> prompt is displayed.

2 At the Config> prompt, enter the following command:

Monitor>clear rmon

3 Press Return. The following message is displayed:

You are about to clear all RMON configuration information

*** WARNING *** This will invoke an automatic RESTART

Are you sure you want to do this (Yes or [No]):

4 If you are certain you want to clear the information, enter Yes.

Displaying RMON Statistics

To display RMON information, perform the following steps:

Step Action
1 From the Main prompt (Main>), enter the following command:

Main> monitor

The Monitor> prompt is displayed.

2 At the Monitor> prompt, enter the following command:

Monitor> interface statistics n

where n is the interface number for which you want statistics.

3 Press Return. RMON statistics information is displayed in the format shown in the example, along with other interface information.

 

RMON Example

The following sections provide a configuration example. In this example, whenever the number of received SNMP packets increases, the VNswitch generates a risingAlarm trap to the community rmon-trap that has an IP address of 16.20.48.46.

Configuring an SNMP Community

The following procedure describes how to configure SNMP with a new community named rmon-trap with an IP address of 16.20.48.46:

Step Action

1

At the Config> prompt, enter snmp.
SNMP Config> add comm rmon-trap
SNMP Config> add addr rmon-trap
IP address [0.0.0.0]? 16.20.48.46
IP Mask [255.255.255.255]?

2

Press Return. The SNMP community rmon-trap is now configured.

Configuring an RMON Trap

The following sections describe how to configure RMON so that it generates a rising alarm trap if the MIB variable snmpInPkts.0 (oid 1.3.6.1.2.1.11.1.0) increases by more than zero over a 1-second interval. This is accomplished by creating an event entry and an alarm entry.

Creating an Event Entry

To create an event entry with an event type snmp-trap and an event community rmon-trap, perform the following steps:

Step Action

1

At the Config> prompt, enter rmon.

2

At the RMON Config> prompt, enter add event.

3

Enter the event description, type, community, and owner.
Event Description []?
Enter the ascii string for event description and press Return.
Event Type [log-and-trap]? snmp-trap.
Enter the trap type and press Return.
Event Community []? rmon-trap
Event Owner []? Enter the ascii string for the event owner and press Return.

4

Press Return. The following is displayed:
Creating Event with index n
The RMON event entry is complete.

Creating an Alarm Entry

To create an alarm entry for the above event entry, perform the following steps:

Step Action

1

At the RMON Config> prompt, enter add alarm.
Enter the alarm values and descriptions as requested by the prompts.
Alarm Interval [1]?
Alarm Variable []? 1.3.6.1.2.1.11.1.0
Alarm Sample Type [deltaValue]?
Startup Alarm [risingOrFallingAlarm]? risingalarm
Rising Alarm Threshold [0]? 1
Falling Alarm Threshold [0]?
Rising Event Index [0]? n (Use the value from the add event entry.)
Falling Event Index [0]?
Alarm Owner []?
Alarm Description []?

2

Press Return. The following is displayed:
Creating Alarm with index n
The RMON alarm entry is complete.

Summary

In the RMON example, whenever the VNswitch receives an SNMP request (snmpInPkts.0 increases by 1 or more), it sends an RMON risingAlarm trap.