Table 5-3 compares RMON, DSMON, SMON, and ART and relates them to the fundamental questions discussed in Chapter 2, "Data Collection Methodology."

Table 5-3. Comparison of RMON, DSMON, SMON, and ART
What to collect (data collection details)?RMON 1: Network traffic at Layer 2 (MAC), including host details, alarms, statistics, and top talkersRMON 2: Network traffic at Layer 3 and at the application layerMonitor QoS-specific network traffic and application layer details for DSCP values (0 to 63)Network Layer 2 (MAC) details in switched networks. Supports the 802.1Q VLAN standard.End-to-end traffic response time statistics for well-known TCP ports
Where to collect?Edge or core, limited functionality at network elements. Dedicated RMON probes required for all details.Edge or core, LAN or WAN. Implemented only at dedicated probes/Cisco NAM module.Layer 2 and 3 switchesOn the NAM module, close to source and destination of monitored areas in the network
How to configure?CLI (scripts), SNMPNAM CLI (scripts), SNMPCLI (scripts), SNMPNAM CLI (scripts), SNMP
How to collect?Pull model: CLI (scripts) SNMPPull model: CLI (scripts) SNMPPull model: CLI (scripts) SNMPPull model: CLI (scripts) SNMP
How to identify the user?RMON 1: MAC addressRMON 2: IP address or application portIP addressMAC addressPer application
Use case exampleNetwork monitoring and planning, user monitoring, usage-based billingNetwork QoS monitoring and planningNetwork monitoring and planning in switched networksApplication-specific response time reporting
Counter supportSupports only 32-bit SNMP counters, unless RFC 3273 (HC-RMON) is used32-bit and 64-bit SNMP counters32-bit and 64-bit SNMP counters32-bit and 64-bit SNMP counters
Support and initial IOS versionIOS 11.2(1) for RMON1; 12.0(5)T for HC-RMON; RMON2 is exclusively supported in the NAM moduleOnly in the NAM moduleIOS 12.0(5)T (available only for the switches)Only in the NAM module

Part II: Implementations on the Cisco Devices