CS Efficient Network Management. Class 4. Danny Raz

Transcription

1 CS Efficient Network Management Class 4 Danny Raz 1

2 Minhalot Midterm: 12/12 in class Will be Moed B 9/1/06 during tirgul time Exercise1 is due NEXT WEEK No tirgulim until 12/12/05 2

3 Objectives MIB SMI Tables Basic - review Complex Complex data relations Encoding SNMP messages NAT + MPAT 3

4 Last Class MIB: basic concepts TABLES 4

5 YAM: Yet Another MIB TUNNEL-MIB DEFINITIONS ::= BEGIN IMPORTS MODULE-IDENTITY, OBJECT-TYPE, transmission, Integer32, IpAddress FROM SNMPv2-SMI RowStatus FROM SNMPv2-TC MODULE-COMPLIANCE, OBJECT-GROUP FROM SNMPv2-CONF ifindex, InterfaceIndexOrZero FROM IF-MIB; tunnelmib MODULE-IDENTITY LAST-UPDATED " Z" -- August 24, 1999 ORGANIZATION "IETF Interfaces MIB Working Group" CONTACT-INFO " Dave Thaler Microsoft Corporation One Microsoft Way Redmond, WA DESCRIPTION "The MIB module for management of IP Tunnels, independent of the specific encapsulation scheme in use." REVISION " Z" -- August 24, 1999 DESCRIPTION "Initial version, published as RFC 2667." ::= { transmission 131 } 5

6 The OID tree iso (1) org (3) dod (6) Internet (1) Mgmt (2) system (1) interfaces (2) address translation (3) icmpp (5) ip (4) tcp (6) egp (8) oim (9) Transmission (10) snmp (11) tunnelmib (131) 6

7 MIB Tables -- the IP Tunnel MIB-Group -- a collection of objects providing -- information about -- IP Tunnels tunnelmibobject (1) tunnelmib (131) tunnel (1) tunneliftable OBJECT-TYPE SYNTAX SEQUENCE OF TunnelIfEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION tunneliftable (1) "The (conceptual) table containing information on configured tunnels." ::= { tunnel 1 } 7

8 MIB entry tunnelmib (131) tunnelmibobject (1) tunnelifentry OBJECT-TYPE SYNTAX TunnelIfEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION tunnel (1) tunneliftable (1) tunnelifentry (1) "An entry (conceptual row) containing the information on a particular configured tunnel." INDEX { ifindex } ::= { tunneliftable 1 } 8

9 MIB Entry tunnelifentry OBJECT-TYPE. ::= { tunneliftable 1 } Capital first letter TunnelIfEntry ::= SEQUENCE { tunneliflocaladdress IpAddress, tunnelifremoteaddress IpAddress, tunnelifencapsmethod INTEGER, tunnelifhoplimit Integer32, tunnelifsecurity INTEGER, tunneliftos Integer32 } Short versions 9

10 tunneliftable =? ifindex 7 Local Address (1) Remote Address (2) Encaps Method (3) 8 (UDP) HopLimit (4) 0 Securit y 2 (ipsec) TOS (UDP) 0 2 (ipsec) (other) 32 2 (ipsec) (other) (ipsec) (other) (ipsec) 0 10

11 Relationship between tables One to one AUGMENT use AUGMENTS instead of INDEX Sparse relationship use Index with index of primal table (like tunneliftable ) specified in the MIB only by text Expansion use Index with index of primal table + extra indices. Again specified in the MIB only by text 11

12 Complex indexing tcp.tcpconntable.tcpconnentry.tcpconnstate = listen(2) tcp.tcpconntable.tcpconnentry.tcpconnstate = listen(2) tcp.tcpconntable.tcpconnentry.tcpconnstate = listen(2) tcp.tcpconntable.tcpconnentry.tcpconnstate = listen(2) tcp.tcpconntable.tcpconnentry.tcpconnstate = listen(2) tcp.tcpconntable.tcpconnentry.tcpconnstate = listen(2) tcp.tcpconntable.tcpconnentry.tcpconnstate = listen(2) tcp.tcpconntable.tcpconnentry.tcpconnstate = established(5) tcp.tcpconntable.tcpconnentry.tcpconnstate = listen(2) tcp.tcpconntable.tcpconnentry.tcpconnstate = established(5) tcp.tcpconntable.tcpconnentry.tcpconnstate = established(5) tcp.tcpconntable.tcpconnentry.tcpconnstate = established(5) tcp.tcpconntable.tcpconnentry.tcpconnstate = established(5) tcp.tcpconntable.tcpconnentry.tcpconnstate = established(5) The index is localip.port.remoteip.port What if we want to sort by remote IP? 12

13 MIB tables - issues Indexing easy access manger Vs. agent simple Vs. complex multiple indexing Relations among tables augment, sparse expansion, dense expansion Complex Data structures lists multidimensional tables 13

14 MIB tables efficiency How much time (bandwidth) it takes to retrieve information? Get we get the entire table? Will be back to this point Also depends on the actual encoding 14

15 BER SNMP encoding type length value integer 1 octet 75 02H 01H 4BH

16 type class p/m primitive constructed number of tag class name bit H Universal integer H Universal OID H Universal SEQUENCE H Application Ipaddress H Context-specific GetRequest A0H Context-specific GetResponse A2H Context-specific GetNextRequest A1H 16

17 length Up to 127 octets short Number of octets in the value field MSB LSB long Number of octets in the length indicator octet1 octet n 17

18 Example - raz 04H Octet string 03H Length = 3 72H r = H a = 97 7AH z =

19 Example oid H Object Identifier 06H Length = = 43 2BH = H = H = H = H = H =

20 Example SEQUENCE OF 30H SEQUENCE 33H Length = 51 06H = OID H = H = integer H =

21 Example IP address 40H IP Address 04H Length = 4 80H = H = 150 A1H = H =

22 SNMP message Version Community PDU 30H EH SEQUENCE Length = 94 02H = integer 01H = 1 00H = ver H = Oct stg 06H = H = 160 = p

23 SNMP PDU PDU type Request ID Error status Error index variables A0H H GetRequest Length = 81 02H = integer 01H = H = integer 01H = H = RID H = no error

24 BER SNMP encoding 0000: E 0A F B4 8C CA 0010: 87 B4 8C A1 04 4C 00 4A C3 8C E 0020: C A F : 04 7E 23 7D 3C F : B B : C 81 4A B4 8C CA 0000: IP HEADER _ 0010: UDP HEADER _ PDU L= : VER=0 com = p u b l i c GetResponse : request id error st error in SO L = 31 SO 0040: L = 27 OID L= : IP L=

25 Economically Managing Multiple Private Data Networks 25

26 The Problem How to manage two or more private networks that use the same address space from a single management station? x.y x.y x.y x.y A typical case: NM service provider x.y x.y 26

27 NAT - Network Address Translation Address translation: the management station will see two different sets of addresses, while in fact both networks are using the same address domain x.y NAT x.y NAT is more complicated than that, it can dynamically assign addresses and map many devices to a single IP address. However, since we want to manage the devices we have to use a static one to one translation x.y 27

28 NAT and SNMP NAT works very well with many applications: telnet, ftp, http (WEB). But not for SNMP: x.y NAT x.y typically the NM application uses address information in the payload of packets when the NM application is unaware of NAT it gets confused x.y 28

29 Overview The problem Possible solutions MPAT - Management Payload Address Translation architecture technical description Implementation issues Conclusions 29

30 Possible Solutions Reassign addresses to all elements shortage of addresses major reconfiguration problem Make the NM application NAT aware conceptually preferred expensive and complicated Translate the payload of the SNMP messages transparent and do not require global reconfiguration introduces additional complexity to the system can it be done efficiently? 30

31 MPAT - Management Payload Address Translator Translates IP address(es) in packet payload or data area Scans all data in SNMP packets (PDUs), and detects data that is an IP address Checks the translation tables and replaces this part of the packet if needed Computation intensive - needs to work in line speed 31

32 The Architecture Management Payload Address Translator (MPAT) To networks PDU PDU PDU PDU PDU x.y PDU PDU COTS router with NAT PDU PDU PDU Management station SNMP packets to/from a non-translated network 32

33 The Architecture Management Payload Address Translator (MPAT) TCP TCP TCP TCP To networks TCP TCP TCP TCP TCP TCP TCP TCP x.y COTS router with NAT Management station TCP packets to/from a translated network 33

34 The Architecture To networks PDU Management Payload Address Translator (MPAT) PDU How do detect IP PDUaddresses in the PDU? PDU PDU PDU PDU Do we need to PDUparse the MIB? x.y PDU PDU Should we translate GetRequest PDU PDU COTS router with NAT What should be translated? What address should we translate to? PDU PDU PDU (outgoing PDUs)? Management station SNMP packets from a translated network 34

35 SNMP PDU 0000: E 0A F B4 8C CA 0010: 87 B4 8C A1 04 4C 00 4A C3 8C E 0020: C A F : 04 7E 23 7D 3C F : B B : C 81 4A B4 8C CA 0000: IP HEADER _ 0010: UDP HEADER _ PDU L= : VER=0 com = p u b l i c GetResponse : request id error st error in SO L = 31 SO 0040: L = 27 OID L= : IP L=

36 Fast Parsing START. pointer points to the first object object type length object Object is of type IP ADDRESS yes Check and replace IP address. Advance pointer by 5 no Object is of type OID yes Check and replace OID. Advance pointer by object length + object length length no Advance pointer by object length + object length length no Object is of type SEQUENCE yes Advance pointer by object length length 36

37 Advanced Address Translation Changing the packet size (MTU) translating 12 to 134 requires one more byte IP address as an index (attable, ipaddrtable..) encoding is different from IPAddress type may change the lexicographic order and create a problem with GetNext Cannot be fully transparent 37

38 Implementation Need to combine COTS NAT with MPAT Prototype for MPAT was implemented (~2500 lines of C code), and is being used by a large network management service provider A provision and configuration problem (both NAT and MPAT should use the same translation tables) A unified GUI 38

39 The GUI To networks x.y Translation tables COTS router with NAT Management station 39

40 Conclusions An appealing solution to an acute problem Challenging research problems exist even at the byte level Very now (IPV6, new management software) Main ideas in an Internet draft ( 40

41 Next time Traps Control using SNMP RMON 41