From: mwr@tridom.uucp (Mark Reardon)
Newsgroups: comp.protocols.tcp-ip
Subject: Re: wanted, traffic monitor with snmp access
Date: 28 Jul 92 16:06:18 GMT
Reply-To: mwr@tridom.uucp (Mark Reardon)
Organization: AT&T Tridom; Marietta, Georgia

In article <1992Jul28.133252.19798@macc.wisc.edu>, dorl@vms.macc.wisc.edu (Michael (NMI) Dorl) writes:
|> I have a need for a ethernet monitor that would gather
|> statistics on all traffic to or from a given ethernet
|> address for IP traffic with a given IP network number. 
|> Information must be retrievable with snmp. 
|> 
|> What I have in mind would be something like a PC or a
|> Unix worskstation with an ethernet interface.  The PC
|> would spy on all traffic on the ethernet and would
|> select traffic to or from a given set of ethernet
|> addresses. It would examine the source and destination
|> IP numbers of this traffic for a set of IP network
|> numbers (IP addresses anded with a mask would be nice)
|> and accummulate in/out tarffic stats (bytes plus
|> packets) for each IP network number.   It would be 
|> great if the device made this information available via 
|> snmp router interface mib variables (each network would
|> be a kind of pseudo interface) but other snmp access 
|> would be acceptable.
|> 
|> The application is to measure the traffic passing
|> through a router for a set of IP network numbers. 
|> 
|> Is there such a thing?  If not, is there any software
|> available in source that might make it's developement 
|> easier?
|> 
|> Replies by email please.
|> 
|> Michael Dorl              (608) 262-0466  fax (608) 262-4679
|> dorl@vms.macc.wisc.edu    MACC / University of Wisconsin - Madison
|> dorl@wiscmacc.bitnet      1210 W. Dayton St. / Madison, WI 53706

How about a box that supports the RMON MIB for SNMP?  RMON, which
stands for Remote Network Monitoring, is detailed in an RFC as a
standard way for an SNMP Agent to present network traffic information
to an SNMP Manager.  This RFC is available in the archie systems and
is quite comprehensive.  I don't think that too many hosts are going
to implement it though.  Remember that a node on a LAN that is doing
a good job of monitoring can be hit with a lot of data.  A PC that
is in promiscuous mode can usually not do anything else.

WARNING!! PRODUCT RECOMMENDATION!!  Hit n if you don't want to see it.



That is why I would recommend you look at something like the NAT
EtherMeter or Remote EtherMeter for $1495 and $1795 respectively
(no, I am not affiliated with NAT nor do I have any relationship
with them).  NAT can be reached at (800)543-8887.  Though I am
sure others are implementing RMON, NAT is the only product I 
know of that is currently available.  They also offered us a 30
day trial if I could get a no cost PO cut to assure return of the
box.  I have not used this box myself but they have a good 
reputation.

-- 
Mark

---------------------------------------------------------------------
| Mark Reardon           |  AT&T Tridom                             |
| mwr@eng.tridom.com     |  840 Franklin Court                      |
|                        |  Marietta, GA 30067                      |
---------------------------------------------------------------------
 
Newsgroups: comp.protocols.tcp-ip