Outline. SNMP Simple Network Management Protocol. Before we start on SNMP. Simple Network Management Protocol

Transcription

1 Outline SNMP Simple Network Management Protocol Several slides are courtesy of the Addison Wesley companion web site for textbook by Liebeherr and El Zarki and others added by M. Veeraraghavan, Univ. of Virginia 1 Purpose of network management SNMP protocol - five messages MIBs Tree structure Object identifiers (OIDs) Instance identifiers Lexicographic ordering Traps Versions Format of SNMP message SNMP Security 2 Before we start on SNMP Simple Network Management Protocol Network management functions: Performance management measure, report and control the performance Fault management detect and recover from faults Configuration management track hardware and software on network elements Accounting management usage quota, usage-based charging Security management control access by setting policies SNMP is a framework that provides facilities for managing and monitoring network resources on the Internet. Components of SNMP: SNMP agents SNMP managers Management Information Bases (MIBs) SNMP protocol itself Managed devices IP router SONET switch 3 Ethernet switch 4 1

2 Simple Network Management Protocol SNMP SNMP agent is software that runs on a piece of network equipment (host, router, printer, or others) and that maintains information about its configuration and current state in a database Information in the database is described by Management Information Bases (MIBs) An SNMP manager is an application program that contacts an SNMP agent to query or modify the database at the agent. SNMP protocol is the application layer protocol used by SNMP agents and managers to send and receive data. Interactions in SNMP Traps Replies Queries Access objects Data Traps 5 6 Outline SNMP Protocol Purpose of network management SNMP protocol - five messages MIBs Tree structure Object identifiers (OIDs) Instance identifiers Lexicographic ordering Traps Versions Format of SNMP message SNMP Security 7 SNMP manager and an SNMP agent communicate using the SNMP protocol Generally: Manager sends queries and agent responds Exception: Traps are initiated by agent. SNMP manager Port 162 get-request get-next-request set-request trap get-response get-response get-response Port 161 Port 161 Port 161 SNMP agent 8 2

3 SNMP Protocol Outline Get-request. Requests the values of one or more objects Get-next-request. Requests the value of the next object, according to a lexicographical ordering of OIDs. Set-request. A request to modify the value of one or more objects Get-response. Sent by SNMP agent in response to a getrequest, get-next-request, or set-request message. Trap. An SNMP trap is a notification sent by an SNMP agent to an SNMP manager, which is triggered by certain events at the agent (will come back to this later) Purpose of network management SNMP protocol - five messages MIBs Tree structure Object identifiers (OIDs) Instance identifiers Lexicographic ordering Traps Versions Format of SNMP message SNMP Security 9 10 MIBS Managed Objects A MIB specifies the managed objects MIB is a text file that describes managed objects using the syntax of ASN.1 (Abstract Syntax Notation 1) ASN.1 is a formal language for describing data and its properties In Linux, MIB files are in the directory /usr/share/snmp/mibs Multiple MIB files MIB-II (defined in RFC 1213) defines the managed objects of TCP/IP networks Each managed object is assigned an object identifier (OID) The OID is specified in a MIB file. An OID can be represented as a sequence of integers separated by decimal points or by a text string: Example: iso.org.dod.internet.mgmt.mib-2.ip.ipforwdatagrams When an SNMP manager requests an object, it sends the OID to the SNMP agent

4 Organization of managed objects Structure of Management Information Managed objects are organized in a tree-like hierarchy and the OIDs reflect the structure of the hierarchy. Each OID represents a node in the tree. The OID (iso.org.dod.internet.mgmt. mib-2) is at the top of the hierarchy for all managed objects of the MIB-II. Manufacturers of networking equipment can add product specific objects to the hierarchy. Data type INTEGER OBJECT IDENTIFIER OCTET STRING IpAddress PhysAddress Counter SEQUENCE SEQUENCE OF Meaning no restrictions (like MTU) specific values (like IP forwarding flag of 1 if enabled and 2 if disabled) min and max (like UDP and TCP port numbers) Sequence of integers separated by decimal points A string of 0 or more bytes A 4-byte OCTET STRING A 6-byte OCTET STRING A nonnegative integer that counts upto and then wraps back to 0 like a C-language structure vector with all elements having the same structure 13 From TCP/IP Vol. I by Stevens 14 Example of SEQUENCE and SEQUENCE OF The structure of UDP group udpentry udplocaladdress, of type IpAddress, containing the local IP address udplocalport, of type INTEGER, in the range 0 to 65335, specifying the local port number SEQUENCE udptable: 2D array (udpentry) udplocaladdress udplocalport an IpAddress an INTEGER between SEQUENCE OF udpentry mib (1) udp (7) udpindatagrams (1) udpnoports (2) udpinerrors (3) udpoutdatagrams (4) udptable (5) udpentry (1) udplocaladdress (1) udplocalport (2) From TCP/IP Vol. I by Stevens 15 From TCP/IP Vol. I by Stevens 16 4

5 Simple variables in the udp group Variables in udptable Name udpindatagrams udpnoports udpinerrors udpoutdatagrams Datatype Counter Counter Counter Counter R/W (empty if read-only) Description Number of datagrams delivered to user processes Number of received UDP datagrams for which no application process was at the destination port Number of undeliverable UDP datagrams for reasons other than no application at destination port (e.g. UDP checksum error) Number of UDP datagrams sent UDP listener table, index = <udplocaladdress>.<udplocalport> Name udplocaladdress udplocalport Datatype IpAddress INTEGER R/W (empty if read-only) Description Local IP address for this listener. indicates that the listener is willing to receive datagrams on any interface Local port number for this listener From TCP/IP Vol. I by Stevens 17 From TCP/IP Vol. I by Stevens 18 Sample UDP listener table Instance identification udplocaladdress udplocalport When an SNMP get-request is issued, the purpose is to obtain the value for a specific instance of an object For simple variables, the object identifier is sufficient to identify the instance e.g., if object name specified is the object identifier , the manager can obtain the number of udpindatagrams For tables, the object identifier is insufficient why? there is one instance of each object for every row in the table but the object identifier only identifies the column e.g identifies the udplocaladdress column So if the manager wants to get the value in a specific instance, how can it identify the instance? From TCP/IP Vol. I by Stevens

6 Instance identification in tables Example Look at the index specification for the table The index specifies which columns are required to uniquely identify a particular entry for example in a class database, your IDs are unique and therefore that column would suffice as an index To identify the instance in row R, add the values of the index columns in that row to the end of the object identifier. The index columns in the udptable were both the udplocaladdress and udplocalport (see slide 18) Therefore to identify the instance in column 1 of row 1 of the udptable on slide 14, we would use the instance identifier: The object identifier, which identifies the column of the table, is The particular row is identified by the values in the index columns for this table. The first row has values and 67. So together they are added to the object identifier to make the instance identifier Instance identification for simple variables in the udptable Instance identification for simple variables in the udptable - adding other rows Object identifier Value 67 udplocalport (second colum) Object identifier Value 67 udplocaladdress (first column) hence the value field is 67 hence the value field is

7 Lexicographic ordering in MIB tables Human-friendly names and abbreviations Object identifier Value Object identifier Human-friendly name (abbreviated) udplocaladdress..67 udplocalport..67 Value 67 The 1's come before the 2's. Abbreviation: Drop the iso, org, etc An example where not all columns are Definition of managed objects in a MIB See RFC 1213 for the tcpconntable Question: Which columns form the index? Question: what is the instance identifier for the first row, second-column entry in the table below, and what is the value? tcpconns tate tcpconnlocal Address tcpconnlo calport tcpconnre maddress tcpconnremport Specification of ipforwdatagrams in MIB-II. ipforwdatagrams OBJECT-TYPE SYNTAX Counter ACCESS read-only STATUS mandatory DESCRIPTION "The number of input datagrams for which this entity was not their final IP destination, as a result of which an attempt was made to find a route to forward them to that final destination. In entities which do not act as IP Gateways, this counter will include only those packets which were Source-Routed via this entity, and the Source- Route option processing was successful." ::= { ip 6 } From SNMP, SNMPv2 and CMIP by Stallings

8 Outline Traps Purpose of network management SNMP protocol - five messages MIBs Tree structure Object identifiers (OIDs) Instance identifiers Lexicographic ordering Traps Versions Format of SNMP message SNMP Security Traps are messages that are sent asynchronously by an agent to a manager Traps are triggered by an event Defined traps include: linkdown: Event that an interface went down coldstart - unexpected restart (i.e., system crash) warmstart - soft reboot linkup - the opposite of linkdown (SNMP) AuthenticationFailure SNMP Versions Outline Three versions are in use today: SNMPv1(1990) SNMPv2c(1996) Adds GetBulk function and some new types Adds RMON (remote monitoring) capability SNMPv3 (2002) SNMPv3 started from SNMPv1 (and not SNMPv2c) Addresses security All versions are still used today Many SNMP agents and managers support all three versions of the protocol. Purpose of network management SNMP protocol - five messages MIBs Tree structure Object identifiers (OIDs) Instance identifiers Lexicographic ordering Traps Versions Format of SNMP message SNMP Security

9 Format of SNMP Packets SNMP Security SNMPv1 Get/Set messages: SNMPv1 uses plain text community strings for authentication as plain text without encryption Cleartext string that is used as a password PDU type, e.g.: 32: SNMPv1 Get 64: SNMPv2 Get Unique ID to match requests with replies Sequence of name-value pairs 33 SNMPv2 was supposed to fix security problems, but effort derailed (The c in SNMPv2c stands for community ). SNMPv3 has numerous security features: Ensure that a packet has not been tampered with (integrity), Ensures that a message is from a valid source (authentication) Ensures that a message cannot be read by unauthorized users (privacy). 34 SNMP Security Security levels in SNMPv3 Security model of SNMPv3 has two components: 1. Instead of granting access rights to a community, SNMPv3 grants access to users. 2. Access can be restricted to sections of the MIB (Versionbased Access Control Module (VACM). Access rights can be limited by specifying a range of valid IP addresses for a user or community, or by specifying the part of the MIB tree that can be accessed. SNMP has three security levels: noauthnopriv: Authentication by matching a user name. authnopriv: Authentication with MD5 or SHA message digests. authpriv: Authentication with MD5 or SHA message digests, and encryption with DES encryption Compare this to SNMPv1 and SNMPv2c: SNMPv1, SNMPv2: Authentication with matching a community string

10 References RFC 1157, A Simple Network Management Protocol (SNMP) RFC 1213, Management Information Base for Network Management of TCP/IP-based internets: MIB-II RFC 2570, Introduction to Version 3 of the Internet-standard Network Management Framework RFC 2574, User-based Security Model (USM) for version 3 of the Simple Network Management Protocol (SNMPv3) 37 10