Network traffic contains many symptoms of various network faults. Symptoms of faults aggregate and are manifested in the aggregate traffic characteristics generally observed by a traffic monitor. It is very difficult for a manager or an NMS (Network Management Station) to isolate the symptoms manifested in the aggregate traffic characteristics. Especially, transit networks, like a backbone network, deal with many types of traffic. So, symptom isolation must be efficient. In this paper, we propose a powerful algorithm for symptom isolation. This algorithm is based on the popular SNMP-based RMON technology. Using dynamically constructed aggregate, fresh symptoms can be isolated efficiently. We apply the algorithm to two operational transit networks which connects some LANs and WANs, and evaluate it using trace data collected from these networks. The results show a significant improvement in the fault management capability and accuracy. Furthermore, the characteristics of fault symptoms and the various factors for effective system configuration are discussed.