Network Management (NETW-1001)

Transcription

1 Network Management (NETW-1001) Dr. Mohamed Abdelwahab Saleh IET-Networks, GUC Spring 2017

2 TOC 1 SNMPv1 Messages 2

3 SNMP messages Two main purposes: Monitoring and configuration. SNMP version 1 defines five types of messages: GET: From manager to agent to inquire about the value of a certain object. GETNEXT: From manager to agent to inquire about the value of object(s) SET: From manager to agent to set the value of an object GETRESPONSE: From agent to manager as response to a get request. TRAP: From agent to manager to notify it with some information.

4 SNMP GET Review Informal definition The NMS wants to get the value of a certain instance of a managed object. So, which managed object and what information? The object has to be one that is listed in the MIB implemented by the agent. Informal Syntax GET(RequestID request-id, ErrorStatus error-status, ErrorIndex error-index, VarBindList variable-bindings)

5 GET Parameters Name Type Description request-id RequestID An integer identifying the request. error-status ErrorStatus An enumeration of error codes {0, 1, 2, 3, 4, 5}. error-index ErrorIndex A number giving information about the error, if any. variable-bindings VarBindList A variable is an instance of a managed object. A variable binding is a variable name along with its value. A variable binding list is a sequence of variable bindings. Note: in a GET PDU variable values are left empty.

6 GET Example root ccitt 0 iso 1 joint 2 org 3 dod 6 internet 1 directory 1 management 2 experimental 3 private 4 MIB-II 1 System 1 ip 21 SysLocation 6 iprouteentry 1 iproutedest 1 iproutenexthop 7 iprouteage 10 GET(5, 0, 0, ) GET(5, 0, 0, ) = 3 Note variable names for scalars and tables

7 SNMP GETRESPONSE Informal definition The agent responds with values of variables for each variable name mentioned in a GET or GETNEXT. Note: The agent may also respond with error codes, e.g., object not found, an error is identified by an error index. Informal Syntax GETRESPONSE(RequestID request-id, ErrorStatus error-status, ErrorIndex error-index, VarBindList variable-bindings) Parameters have the same meaning as in the GET request.

8 SNMP GETNEXT Informal definition To get the values of variables whose variable names are next to the ones listed in GETNEXT Next here means, the one after it in lexicographic ascending order. Informal Syntax GETNEXT(RequestID request-id, ErrorStatus error-status, ErrorIndex error-index, VarBindList variable-bindings) Parameters have the same meaning as in the GET request.

9 GETNEXT Example root ccitt 0 iso 1 joint 2 org 3 dod 6 internet 1 directory 1 management 2 experimental 3 private 4 MIB-II 1 System 1 ip 21 SysLocation 6 iprouteentry 1 iproutedest 1 iproutenexthop 7 iprouteage 10 GETNEXT(5, 0, 0, ) is next to , but how about tables?

10 GETNEXT and tables Recall instance names. Example: iproutedest iproutenexthop iprouteage Name= Name= Name= OID of iproutedest = OID of iproutenexthop = OID of iprouteage = GETNEXT will fetch the value Why? In the table is directly next to GETRESPONSE will have the binding = Now we can issue GETNEXT(..., ) GETRESPONSE will have the binding = Now we can issue GETNEXT(..., ) So, we can go through all rows.

11 SNMP SET Informal definition To change the values of variables listed in the PDU. Informal Syntax SET(RequestID request-id, ErrorStatus error-status, ErrorIndex error-index, VarBindList variable-bindings) Parameters have the same meaning as in the GET request. A variable binding is a variable name and a value for the variable.

12 SNMP TRAP Informal definition A trap is sent from the agent to the NMS to notify it with something. Informal Syntax TRAP(OBJECT IDENTIFIER enterprise, NetworkAddress agent-address, INTEGER which-generic-trap, INTEGER which-specific-trap, TimeTicks time-stamp, VarBindList variable-bindings)

13 TRAP Parameters Name Type Description enterprise OID OID of the organization defining the trap. agent-address NetworkAddress Address of the agent sending the trap. which-generic-trap INTEGER An enumeration in {0, 1, 2, 3, 4, 5, 6}. which-specific-trap INTEGER Number representing a specific trap. time-stamp TimeTicks Time of trap from last reset. variable-bindings VarBindList Value of variables associated with this trap.

14 Generic Predefined Traps There exist six generic trap types that are predefined: Name Num. Description coldstart 0 Agent reboot, resetting variables. warmstart 1 Agent restart, no resets. linkdown 2 Interface is down, interface OID is mentioned in the variable bindings. linkup 3 Interface is up, interface OID is mentioned in the variable bindings. authenticationfailure 4 Agent was queried with wrong community string. egpneighborloss 5 For agents in networks impelementing EGP (now obsolete). enterprisespecific 6 Indicates that this trap is defined by a private enterprise.

15 How are generic traps defined? An example from RFC-1215: coldstart TRAP-TYPE ENTERPRISE snmp DESCRIPTION The sending protocol entity is reinitializing itself such that the agents configuration or the protocol entity implementation may be altered ::= 0 The trap name is coldstart. The keyword TRAP-TYPE indicates that we are defining a trap. The keyword ENTERPRISE indicates the enterprise defining the trap. For generic traps it is always snmp. The keyword DESCRIPTION introduces a textual description. This trap has no variables associated with it. The trap type number is 0.

16 Another Example linkdown TRAP-TYPE ENTERPRISE snmp VARIABLES { ifindex } DESCRIPTION whatever ::= 2 When this trap is sent, the value of the ifindex variable is sent with it.

17 Specific Traps Private enterprises can specify their own traps in their MIBs. name TRAP-TYPE ENTERPRISE enterprise name VARIABLES list OIDs DESCRIPTION any text ::= trap number name Name of trap. enterprise name The name of the private enterprise in the OID tree. list OIDs Variables whose values will be sent in the trap PDU. trap number The number identifying the trap, to be sent in the PDU.

18 Standard MIBs There exists some standard MIBs with the most commonly needed managed object definitions. One of these is MIB-II (OID ), it defines the following groups: system, interfaces, at, ip, icmp, tcp, udp, egp, cmot, transmission, snmp, rmon, etc. The remote monitoring (rmon) group whose OID is provides capabilities to gather network statistics at the MAC layer. It is a very important group since its main focus is the network rather than a specific device. Physically a device having rmon capabilities is called a remote monitoring probe.

19 RMON and RMON Probes An RMON probe is a device that collects MAC frames in a subnet. RMON probes are very important to monitor the performance of network nodes. An RMON probe implementing an SNMP agent can be connected to a NMS implementing an SNMP manager. This way valuable statistics about the network can be collected and integrated in the NMS. The rmon group defined in MIB-II has the following subgroups: Statistics, History, Alarm, Host, HostTopN, Matrix, Filter, Capture, Event.

20 Some RMON Groups 1 The Statistics group: The purpose is to provide counters of packets detected in MAC frames. The packets counted are those that have specific characteristics. For instance, we can count broadcast packets. The Host group: The purpose is to record information about hosts in the subnet in which the probe is connected. For instance, the MAC addresses of all hosts detected in the subnet are stored in a table.

21 Some RMON Groups 2 The Filter group: The purpose is to define the characteristics of packets that should be processed by the probe. Characteristics are defined by two filters : The data filter and the status filter. Data filters are defined over packet contents, whereas status filters are defined over the error status of packets. Many filters may be defined, each filter is a row in the filtertable object. Packets that satisfy the conditions in filter constitute a channel. The Capture group: The purpose is to define how much data, of a certain channel, will be stored and sent to the NMS. For instance, we can specify the maximum number of bytes in the packet that will be captured and stored.

22 RMON1 and RMON2 Objects defined in the rmon group in MIB-II are very useful for network troubleshooting. However, they only analyze traffic at the MAC layer. More information was needed, for which we need to analyze traffic at the network and upper layers. RMON2 was developed for this purpose. It provides needed statistics such as which application layer protocols use the most bandwidth, what services are running on the network, etc.