The RMON2 MIB extends the original RMON MIB to include groups to enable the RMON MIB to monitor protocol traffic above the MAC-level.
RMON2's capabilities mean that an RMON probe can monitor traffic on the basis of network-layer protocols and addresses, including the IP, thus the probe can see the traffic coming onto the LAN via routers, not just at the LAN to which it is attached. Secondly, RMON2's facility to decode and monitor application level traffic, such as email, file transfer and WWW protocols, means the probe can record to and from hosts for specific applications. Figure 1 shows the RMON extended structure.
Figure 1. RMON2 MIB group structure 