RMON is generally an easy task, can be tricky but usually on CCIE workbooks the task are fair. The hardest part for me is to find the MIB to monitor.

This is the task: monitor interface Vlan1, send a trap if it receives more than 100 packets every 30 seconds, send a trap if it goes under 50 packets every 30 seconds.

First step: find Vlan1 ifindex.

R#sh snmp mib ifmib 

ifindex Vlan99: Ifindex = 10 
Virtual-Access2: Ifindex = 13 
FastEthernet4: Ifindex = 5 
FastEthernet0: Ifindex = 1 
FastEthernet2: Ifindex = 3 
Loopback0: Ifindex = 12 
Null0: Ifindex = 6 
Virtual-Access1: Ifindex = 11 
Vlan1: Ifindex = 7
Virtual-Template1: Ifindex = 9 
NVI0: Ifindex = 8 
FastEthernet1: Ifindex = 2 
FastEthernet3: Ifindex = 4

So Vlan1 has ifIndex value 7.

Now how do we find the MIB of incoming packets?

My method is to grep the output of command “sh snmp mib” and it usually works:

R#sh snmp mib | i ifIn 

ifIndex
ifInOctets
ifInUcastPkts
ifInNUcastPkts
ifInDiscards
ifInErrors
ifInUnknownProtos
ifInMulticastPkts
ifInBroadcastPkts

Here it is: ifInUcastPkts is the right MIB entry.

Since we’re looking for the entry related to Vlan1, ifIndex 7, we should use ifInUcastPkts.7 on the rmon command.

R(config)#rmon alarm 1 ifInUcastPkts.7 30 delta rising-threshold 100 1 falling-threshold 50 2 owner ADMIN

If we write a wrong snmp object we get an error like Unknown object:

If you know a better method write me.

And remember, even if it’s not required, don’t forget to apply

R(config)#snmp-server ifindex persist

because ifIndex could change at the next reboot breaking our configuration.