System information

308 Switched Observer
RMON and protocol analysis is not typically complementary in the way SNMP and
protocol analysis can be. Rather, RMON is the “protocol analysis” side of the SNMP
standard, and is an attempt to duplicate the functionality of a protocol analyzer within the
standards-based world of SNMP. A full implementation of RMON2 comes close to what
any high end protocol analyzer provides, if in a more cryptic format. In theory, what you
lose in ease of use, you gain in multi-vendor interoperability. Sadly, most switches to date
have either not implemented RMON at all, or have such a limited subset of RMON that
the RMON functionality is not of much use.
Port Mirroring
For switches that support port mirroring (i.e., spanning, tapping), Observer offers two
types of control and monitoring:
• Port capture, and
• Port looping.
Port capture (otherwise known as “static” monitoring) allows you to set a Probe to
capture all the data and traffic from one port and redirect it to the Probe management port.
For switches that support multiple port redirection, Observer allows you to specify
multiple ports to capture. This mode captures all packets that are found on the port and is
usually used for Packet Capture, but can also be used for any of the statistical modes of
Observer.
Looping is the ability to have a Probe “loop” through all ports on the switch and collect
statistics on the switch as a whole. This functionality is unprecedented in the world of
protocol analyzers and provides a view of your switch as a whole—which ports are being
used and to what extent; the total broadcast and cross-port jabber; the total data throughput
of your switch (and thus, its ultimate efficiency) and much more.
Looping is achieved by Observer’s telnet or SNMP interface controlling your switch’s
management interface and directing, in an ordered, timed, and controlled manner, the
redirection of standard port data flow to the Observer Probe port.
Observer’s Probe redirects data from a specific port for a specific amount of time, then
moves to the next port for the same amount of time. This continues until a loop is made of
all ports on the switch (not including the Observer Probe port) and then begins again.
Because Observer knows how long each port was sampled and how long it took to move
to the next port, it can put all of the data together using statistical sampling calculations
and provide a complete view of traffic on your entire switch.
The requirements to use Observer’s port looping and port capture functions are:
• your switch must support some sort of port redirection (often called mirroring,
spanning, or tapping), and
• the switch must support a telnet or SNMP interface for controlling the mirroring, and