|
|
A domain is a subset of network traffic. When installed on an agent, you can direct the agent to collect information for a specific domain. The agent stores a new set of statistics for the traffic that matches the domain. Use Domain Editor to define two types of domains, protocol and generic.
Protocol domains require RMON2 support in the probe. Select protocol domains when you want traffic classified by network and application layer protocols. RMON2 SwitchProbes support both custom and proprietary protocols. Protocol domains use relatively few resources in the agent.
Generic domains require RMON1 and the TrafficDirector enhanced RMON technology. You select proprietary generic domains for all other traffic classifications. Generic domains are available only for use on SwitchProbes, and are especially powerful because they are not limited to protocol aspects of a packet. Instead, you can define a generic domain on any portion of a packet that you can uniquely define using a filter. Because generic domains are resource-intensive, you should use them only for the following reasons:
When you boot a SwitchProbe, it can immediately monitor a wide range of protocols. However, because of the unique needs of your organization, you may need to install additional protocols. Whether you implement protocol or generic domains is up to you.
Keep in mind that protocol domains are also available for all RMON-based probes. Protocol domains use the RMON2 protocol directory and distribution groups. Generic domains, on the other hand, are available only for SwitchProbes. You cannot set up a generic domain for any other type of third-party probe.
Protocol domains work above the DLCI layer, and cannot access physical layer statistics. This is why certain physical layer applications such as Segment Zoom, will not launch when you have selected a protocol domain. Each probe keeps track of all the protocol domains currently installed on it. The internal architecture of a probe also recognizes the base protocol, associated children protocols, and the encapsulation type. Each probe contains 24 predefined domains as a base; you can add up to 256 protocol domains.
Available only on SwitchProbes, generic domains provide great flexibility because you can set up filters on virtually any aspect of a packet. This feature lets you pinpoint the exact packets you want to monitor. Once you set up a generic domain, you can apply one or more filters to use with that domain.
The RMON domain is the only generic domain designed to be used without filters. You should not apply any filters to the RMON domain--you can easily create a new generic domain with the filters you want by using the Filter Editor instead.
When you use the TrafficDirector Filter Editor to apply a filter to a domain, each filter defines the type of packets you want the probe to observe. A filter is a logical bit pattern that the probe compares to every packet it sees on the selected interface. When you use the Filter Editor to create a filter, you are actually defining a specific bit pattern. This bit pattern is downloaded into the agent when you install a generic domain.
When you are monitoring a generic domain, you are actually monitoring a logical data stream formed by packets that match the filters specified in the domain definition. You can associate up to eight filters with a single generic domain. A packet must successfully match at least one filter to be accepted by the channel, or generic domain. Keep in mind that packets can match multiple domains and can be counted multiple times. For example, a Transmission Control Protocol (TCP) packet is counted as both TCP and IP. Packets that match the characteristics of three generic domains are counted for all three domains.
The filter component of a generic domain makes it flexible, but also restricts the number of generic domains that you can install on an agent. The maximum number of domain-related filters (filters downloaded into the agent as part of a generic domain) is 32. As a result, you can install up to 32 generic domains on the probe, providing that you select only a single filter per domain. You can install only eight generic domains if four filters are selected for each, for a total of 32 domain-related filters. Because you can define up to 8 filters per generic domain, you can install only 4 such domains in the probe. This is important to remember when you edit filters that are already installed on your probes, or when you are installing new filters. See "Defining Generic Domains."
Both protocol and generic domains collect one or more sets of statistics. The statistics either type of domain collects are defined when you install the domain on the agent.
Table 15-1 lists the primary statistics supported for both protocol and generic domains, and the RMON1 and RMON2 groups associated with each.
| Domain | Statistics | Short-Term History | Long-Term History | Host | Conversation |
|---|---|---|---|---|---|
|
Protocol | RMON2 Protocol Distribution Group | RMON1 History group. Only octets and packets supported | RMON1 History group. Only octets and packets supported | RMON2 Network Layer and Application Layer Host groups | RMON2 Network Layer and Application Layer Matrix groups |
| Generic | RMON1 Statistics group | RMON1 History group | RMON1 History group | RMON1 Host group | RMON1 Matrix group |
Generic domains use more resources than protocol domains because the probe collects and stores statistics for the domain--primarily Host and Conversations statistics, which consume the most resources when installed on a domain. Because generic domains are based on RMON1, separate Host and Conversation tables are created for each domain installed on each interface. For example, RMON1 uses the following tables to track host and conversations: the hostcontrolTable, hostTable, hostTimeTable, matrixControlTable, matrixSDTable, and matrixDSTable.
For example, you have a multiport Ethernet probe that has twelve Ethernet UTP ports. If you choose to install 2 generic domains on each port, and then enable Host and Conversation statistics for each of the 24 domains, the probe must create 3 host-related tables plus 3 conversation-related tables for all 24 domains--for a total of 144 tables.
Protocol domains use RMON2 technology to handle Host and Conversations in a more resource-efficient manner. Instead of every domain creating its own set of host and conversation tables, all protocol domains on any given interface share a common set of network- and application-layer host and conversation tables. RMON2 uses the following tables to track network layer hosts and conversations: the nlHostControlTable, nlHostTable, nlMatrixControlTable, nlMatrixSDTable, nlMatrixDSTable.
For example, if you install 2 protocol domains on all 12 ports of the same multiport Ethernet probe, and enable network-layer Hosts and Conversations for each domain; the agent would only have to create 2 host tables plus 3 conversations for each port, for a total of 60 tables to track the requested host and conversation statistics.
If you increased the protocol domains installed on each interface to ten protocol domains, the probe does not need to create additional tables to track the requested statistics. Any new protocol domains share the existing tables, so the number of host and conversation tables remain the same at 60.
Protocol domains are useful because they require fewer resources in the agent and you can deploy them in large numbers. Depending on resources in the agent (primarily memory), you can install up to 256 protocol domains in any single agent.
Use the Domain Editor application to define new protocol domains to track specific traffic classified by MAC, network-, and application-layer protocols. You must install the new domains on the agent(s) or switch you want by using Property Editor to add the domains to a shared properties file. See Chapter 8, "Property Editor."
To define a new protocol domain, take the following steps:
Step 1 Launch TrafficDirector and select the Admin radio button.
Step 2 Click the Domain Editor icon.
The TrafficDirector Domain Editor window (Figure 15-1) opens.
Step 3 Select the Protocol radio button.
Step 4 Select Tools>New Domain, or click New.
The New Protocol Domain window (Figure 15-2) opens.
Step 5 In the Domain Name field, enter a name for the new domain. This can be a maximum of 20 characters and must begin with a letter. You can use only letters, numbers, dashes, and underscores. The name is case insensitive.
Step 6 Click the selection button to the right of the Data Link Layer field.
The Datalink layer list box opens.
Step 7 Select the Datalink layer that best suits your needs, then click OK to accept the selection or Cancel to close the list box without selecting a Datalink layer. Select from the following:
Step 8 Click the selection button to the right of the Network Layer field.
The Network layer list box opens and lists the parent protocols you can select. Parent protocols are high-level protocols. The list shows the protocol name, and a number that maps to an RMON2 definition. The listed protocols work on the Datalink layer you selected in Step 6.
Step 9 Select a parent protocol and click OK.
Step 10 Click the selection button to the right of any Application Layer field (1 through 5). These fields are optional; you can define none, some, or all five.
A list of protocol children displays. Children protocols are related to the protocols you selected in Step 8. You can examine multiple children protocols running on a level above the selected parent protocols. The list shows the children protocol name, as well as a number that maps to an RMON2 definition.
Step 11 Highlight any children protocols and click OK.
Step 12 Click OK to save your choices, or click Cancel to close the New Protocol Domain window without saving your definition.
Generic domains are extremely powerful and flexible, but depending on their content, they can drain agent resources if you use them in large numbers. The number of generic domains you can install on an agent varies, depending on the probe resources and the makeup of each domain. You can install up to 32 domain-related filters on any probe. This means that you can install 32 generic domains with one filter each, 8 generic domains with four filters each, or 2 domains with 10 filters, and 6 domains with 2 filters.
You can define generic domains only on probes. After you define a new domain, you must add it on an agent by creating or editing a properties file using the Property Editor. See Chapter 8, "Property Editor."
To define a generic domain, take the following steps:
Step 1 Click the Domain Editor icon in the TrafficDirector main window.
The TrafficDirector Domain Editor window (Figure 15-1) opens.
Step 2 Select the Generic radio button.
Step 3 Select Tools>New Domain, or click New Domain.
The New Generic Domain window (Figure 15-3) opens.
Step 4 Enter a domain name in the Domain Name field. This can be a maximum of 15 letters and must begin with a letter. You can use only letters, numbers, dashes, and underscores. The name is case insensitive.
Step 5 Select how you want host addresses displayed: MAC, NET, or SUBNET.
Step 6 Select one of the following from the Domain Type list:
Step 7 Select one of the following from the Packet Type list:
Step 8 Select up to eight filters from the Selected Filters field. You can mix and match any of the network layer protocols displayed.
The filters you select determine the type of packets that the new generic domain recognizes as follows:
Step 9 Click OK to define the new generic domain with your choices, or click Cancel to close the window without saving your choices.
You can change the definition of a domain when you want to monitor a different subset of network traffic. You can also edit a previously defined domain whether it is attached to an agent or not.
To change the definition of an existing domain, take the following steps:
Step 1 Select the domain you want to edit from the Domain Editor window.
Step 2 Select Edit>Edit Domain, or click Edit Domain.
If you selected a protocol domain and clicked Edit, the Edit Protocol Domain window (Figure 15-4) opens.
If you selected a generic domain and clicked Edit, the Edit Generic Domain window opens.
Step 3 Edit any of the displayed information.
Step 4 Click OK to modify the domain, or click Cancel to return to the Domain Editor window without saving the changes
When you no longer need to monitor the subset of network traffic defined by a domain, you can delete the domain definition to save resources on the client workstation. To delete a domain definition from TrafficDirector take the following steps:
Step 1 Select the domain you want to delete from the Domain Editor window.
Step 2 Select Edit>Delete Domain from the menu bar, or click the Delete Domain icon on the tool bar. A cautionary prompt appears, asking if you want to continue.
Step 3 Click OK to delete the domain definition, or Cancel to return to the Domain Editor window.
|
|
