1. SNMP Management: Organization and Information Model by Behzad Akbari Fall 2008 In the Name of the Most High

2. Overview SNMP is the most widely used network management protocol When we say SNMP management, we are really referring to Internet management. (SNMP itself is a com protocol). SNMP management model:  Organization Model Relationship between network element, agent, and manager Hierarchical architecture  Information Model Uses ASN.1 syntax SMI (Structure of Management Information MIB ( Management Information Base)  Communication Model Transfer syntax SNMP over TCP/IP Communication services addressed by messages Security framework community-based model

3. Managed LAN NMS on subnet 192.168.252.1 manages the router and the hubs on subnet 172.16.46.1 across the backbone network Figure 4.1 A Managed LAN Network

4. Managed Hubs: System Information Information obtained querying the hubs Data truly reflects what is stored in the hub Title: System Information: 172.16.46.2 Name or IP Address: 172.16.46.2 System Name: System Description: 3Com LinkBuilder FMS, SW version:3.02 System Contact: System Location: System Object ID:.iso.org.dod.internet.private.enterprises.43.1.8.5 System Up Time: (2475380437) 286 days, 12:03:24.37 Title: System Information: 172.16.46.3 Name or IP Address: 172.16.46.3 System Name: System Description: 3Com LinkBuilder FMS, SW version:3.12 System Contact: System Location: System Object ID:.iso.org.dod.internet.private.enterprises.43.1.8.5 System Up Time: (3146735182) 364 days, 12:55:51.82

5. Managed Router: System Information Title: System Information: router1.gatech.edu Name or IP Address: 172.16.252.1 System Name: router1.gatech.edu System Description: Cisco Internetwork Operating System Software : IOS (tm) 7000 Software (C7000-JS-M), Version : 11.2(6),RELEASE SOFTWARE (ge1) : Copyright (c) 1986-1997 by Cisco Systems, Inc. : Compiled Tue 06-May-97 19:11 by kuong System Contact: System Location: System Object ID: iso.org.dod.internet.private.enterprises.cisco.ciscoProducts.cisco 7000 System Up Time: (315131795) 36 days, 11:21:57.95

6. Managed Hub: Port Addresses Information acquired by the NMS on hub interfaces Index refers to the interface on the hub Link address is the MAC address The second row data is a serial link

7. Managed Router: Port Addresses Information acquired by NMS on the router interfaces Index refers to the interface on the router LEC is the LAN emulation card Ethernet 2/0 interface refers to the interface card 2 and port 0 in that card

8. Internet Management History 1970s: Advanced Research Project Agency Network (ARPANET) comes up with Internet control Message Protocol (ICMP) Internet Engineering Task Force (IETF)  1990 SNMPv1  1995 SNMPv2  1998 SNMPv3 Internet documents:  Request for Comments (RFC)  IETF STD Internet Standard  FYI For your information

9. SNMP Related RFCs Figure 4.4 SNMP Document Evolution

10. SNMP Organization Model

11. System Overview Physical Medium Figure 4.9 SNMP Network Management Architecture

12. SNMP System Architecture Network DL SNMP UDP IP SNMP UDP IP SNMP UDP IP ManagerAgent... Management Station HostRouter Network Elements (NEs) Network Management Protocol SNMP DL

13. SNMP Services Four Services  Get, Set, GetNext, Trap Five SNMP Messages  GetRequest, SetRequest, GetNextRequest, GetResponse, Trap ManagerAgent(s) Get, Set, GetNext Request Get Response Trap

14. SNMP Services Get Request Get Response ManagerAgent GetNext Request Get Response Manager Agent Set Request Get Response ManagerAgent Trap Request ManagerAgent GetGetNextSetTrapGetGetNextSetTrap

15. SNMP Services (cont.) Get Request:  Retrieve the values of objects in the MIB of an agent. Get-Next Request:  Retrieve the values of the next objects in the MIB of an agent. Set Request:  Update the values of objects in the MIB of an agent. Trap Request  Report extraordinary events to the manager.

16. Information Model Structure of Management Information (SMI) (RFC 1155, RFC 1212) Managed Object Scalar Aggregate or tabular object Management Information Base (RFC 1213)

17. Managed Object Object TypeObject Instance

18. Managed Object: Multiple Instances Object TypeObject Instance

19. Object Name Object is uniquely defined by DESCRIPTOR OBJECT IDENTIFIER

20. Internet Subnodes directoryOBJECT IDENTIFIER ::= {internet 1} mgmtOBJECT IDENTIFIER ::= {internet 2} experimentalOBJECT IDENTIFIER ::= {internet 3} privateOBJECT IDENTIFIER ::= {internet 4}

21. root ccitt iso joint-iso-ccitt directory 0 1 2 std reg authority member body org 0 1 2 3 dod internet 6 1 1 2 3 4 mgmt experimental private MIB II system 1 interface 2 at 3 IP 4 ICMP 5 TCP 6 UDP 7 EGP 8 Trans. 10 SNMP 11 1 1 enterprises 1.3.6.1.2.1.2 1.3.6.1.4.1 1.3.6.1.2.1 MIB II interface enterprises

22. Private MIB Example Enterprise Number http://www.isi.edu/in-notes/iana/assignments/enterprise-numbers http://www.iana.org/

23. SNMP ASN.1 Data Type

24. Primitive Data Types subtype: INTEGER (0..255) OCTET STRING (SIZE 0..255) OCTET STRING (SIZE 8)

25. Enumerated Special case of INTEGER data type

26. Defined or Application Data Type

27. Constructor or Structured Data Type: SEQUENCE List Marker SEQUENCE {,,…, } IpAddrEntry ::= SEQUENCE{ ipAdEntAddrIpAddress, ipAdEntIfIndexINTEGER, ipAdEntNetMaskIpAddress, ipAdEntBcastAddrINTEGER, ipAdEntReasmMaxSizeINTEGER (0..65535) }

28. Constructor or Structured Data Type: SEQUENCE OF SEQUENCE OF where is a list constructor ipAddrTable OBJECT-TYPE SYNTAX SEQUENCE OF IpAddrEntry ACCESS not-accessible STATUS mandatory DESCRIPTION "The table of addressing information relevant to this entity's IP addresses." ::= { ip 20 }

29. Example: IP Address Table Each row (table entry) is a sequence: IpAddrEntry. The ipAddrTable table is a sequence of rows (entries), i.e. a sequence of ipAddrEntry.

30. Encoding Basic Encoding Rules (BER) - Type, Length, and Value (TLV)

31. SNMP Data Types and Tags TypeTag OBJECT IDENTIFIERUNIVERSAL 6 SEQUENCEUNIVERSAL 16 IpAddressAPPLICATION 0 CounterAPPLICATION 1 Gauge APPLICATION 2 TimeTicksAPPLICATION 3 OpaqueAPPLICATION 4

32. Managed Object: Structure

33. SMIv1, SMIv2 SMIv1:  SMI (RFC 1155)RFC 1155  Concise MIB (RFC 1212)RFC 1212  Trap-Type (RFC 1215)RFC 1215 SMIv2:  SMIv2 (RFC 2578)  Textual Conventions (RFC 2579)  Conformance Statements (RFC 2580)

34. OBJECT-TYPE MACRO ::= BEGIN TYPE NOTATION ::="SYNTAX" type (TYPE ObjectSyntax) TYPE NOTATION ::="SYNTAX" type (TYPE ObjectSyntax) “ACCESS" Access “ACCESS" Access "STATUS" Status "STATUS" Status VALUE NOTATION ::= value (VALUE ObjectName) VALUE NOTATION ::= value (VALUE ObjectName) Access ::= "read-only" | "read-write“ | "write-only | "not-accessible" Access ::= "read-only" | "read-write“ | "write-only | "not-accessible" Status ::= "mandatory” | "optional“ | "obsolete" Status ::= "mandatory” | "optional“ | "obsolete"END Object-Type Macro (RFC 1155)

35. OBJECT-TYPE MACRO (RFC1212) OBJECT-TYPE MACRO ::= BEGIN TYPE NOTATION ::= "SYNTAX" type(ObjectSyntax) "ACCESS" Access "STATUS" Status DescrPart ReferPart IndexPart DefValPart VALUE NOTATION ::= value (VALUE ObjectName)    ObjectName ::= OBJECT IDENTIFIER    

36. OBJECT-TYPE Example sysLocation OBJECT-TYPE SYNTAX DisplayString (SIZE (0..255)) ACCESS read-write STATUS mandatory DESCRIPTION "The physical location of this node (e.g., `telephone closet, 3rd floor')." ::= { system 6 } DisplayString ::= OCTET STRING (SIZE (0..255))

37. "SYNTAX" type(ObjectSyntax) ObjectSyntax ::= CHOICE { simple SimpleSyntax, application-wide ApplicationSyntax } SimpleSyntax ::= CHOICE { numberINTEGER, stringOCTET STRING, objectOBJECT IDENTIFIER, empty NULL } ApplicationSyntax ::= CHOICE { addressNetworkAddress, counterCounter, gaugeGauge, ticksTimeTicks, arbitraryOpaque }

38. ApplicationSyntax NetworkAddress ::= CHOICE { internetIpAddress } IpAddress ::= [APPLICATION 0] IMPLICIT OCTET STRING (SIZE (4)) Counter ::= [APPLICATION 1] IMPLICIT INTEGER (0..4294967295) Gauge ::= [APPLICATION 2] IMPLICIT INTEGER (0..4294967295) TimeTicks ::= [APPLICATION 3] IMPLICIT INTEGER (0..4294967295) Opaque ::= [APPLICATION 4] IMPLICIT OCTET STRING 0.. 2 32 -1 Back to OBJECT TYPE

39. "ACCESS" Access "STATUS" Status Access ::= "read-only" | "read-write" | "write-only" | "not-accessible Status ::= "mandatory" | "optional" | "obsolete" | "deprecated" Back to OBJECT TYPE

40. DescrPart DescrPart ::= "DESCRIPTION" value (description DisplayString) | empty ReferPart ::= "REFERENCE" value (reference DisplayString) | empty ReferPart Back to OBJECT TYPE  

41. DefValPart ifNumber OBJECT-TYPE SYNTAX INTEGER ACCESS read-only STATUS mandatory DEFVAL 1 DESCRIPTION "The number of network interfaces (regardless of their current state) present on this system.“ ::= { interfaces 1 } DefValPart ::= "DEFVAL" "{" value (defvalue ObjectSyntax) "}" | empty Example: Back to OBJECT TYPE

42. IndexPart IndexTypes ::= IndexType | IndexTypes "," IndexType IndexType ::= value (indexobject ObjectName) | type (indextype) IndexSyntax ::= CHOICE { number INTEGER (0..MAX), string OCTET STRING, object OBJECT IDENTIFIER, address NetworkAddress, ipAddress IpAddress } IndexPart ::= "INDEX" "{" IndexTypes "}"

43. instance-identifier ( INDEX) integer-valued  3  3 string-valued, fixed-length strings  ‘004096563c2e’H  0.64.150.86.60.46 string-valued, variable-length strings  “IIS Admin”  9.73.73.83.32.65.100.109.105.110 object identifier-valued  1.3.6.1.2  5. 1.3.6.1.2 NetworkAddress-valued  163.22.20.16  1.163.22.20.16 IpAddress-valued  163.22.20.16  163.22.20.16

44. Index - variable-length string svSvcTable OBJECT-TYPE SYNTAX SEQUENCE OF SvSvcEntry ACCESS not-accessible STATUS mandatory DESCRIPTION "A list of service entries describing network services installed on this server.“ ::= { server 3 } svSvcEntry OBJECT-TYPE SYNTAX SvSvcEntry ACCESS not-accessible STATUS mandatory DESCRIPTION "The names of the network services installed on this server." INDEX { svSvcName } ::= { svSvcTable 1 } Back to OBJECT TYPE

45. OBJECT-TYPE Example dot1dBasePortEntry OBJECT-TYPE SYNTAX Dot1dBasePortEntry ACCESS not-accessible STATUS mandatory DESCRIPTION "A list of information for each port of the bridge." REFERENCE "IEEE 802.1D-1990: Section 6.4.2, 6.6.1" INDEX { dot1dBasePort } ::= { dot1dBasePortTable 1 }

46. Aggregate Object A group of objects tabular objectsAlso called tabular objects Can be represented by a table with Columns of objects Rows of instances Table of Objects List of Objects Objects

47. Aggregate M.O. Macro: Table Object ipAddrTable OBJECT-TYPE SYNTAX SEQUENCE OF IpAddrEntry ACCESS not-accessible STATUS mandatory DESCRIPTION "The table of addressing information relevant to this entity's IP addresses." ::= {ip 20}

48. Aggregate M.O. Macro: Entry Object ipAddrEntry OBJECT-TYPE SYNTAX IpAddrEntry ACCESS not-accessible STATUS mandatory DESCRIPTION "The addressing information for one of this entity's IP addresses." INDEX { ipAdEntAddr } ::= { ipAddrTable 1 } ipAddrEntry: OBJECT-TYPE IpaddrEntry: SYNTAX

49. Aggregate M.O. Macro: Entry Object IpAddrEntry ::= SEQUENCE { ipAdEntAddrIpAddress, ipAdEntIfIndexINTEGER, ipAdEntNetMaskIpAddress, ipAdEntBcastAddrINTEGER, ipAdEntReasmMaxSizeINTEGER (0..65535) }

50. Aggregate M.O. Macro: Columnar Objects ipAdEntAddr OBJECT-TYPE SYNTAX IpAddress ACCESS read-only STATUS mandatory DESCRIPTION "The IP address to which this entry's addressing information pertains.” ::= { ipAddrEntry 1 }

51. Tabular Representation of Aggregate Object

53. Multiple Instances of Aggregate Managed Object

54. Example

55. Identification of Managed Objects Use Object Identifier (OID) OID = Object Type OID. Instance Identifier Object Type OID:  Each Object type has a unique OID Instance Identifier:  Identify instances of object type E.g.mib-2.interface.ifTable.ifEntry.ifDescr. 2

56. Two Kinds of Managed Objects Type-Specific Objects:  sysDescr OBJECT-TYPE SYNTAX DisplayString (SIZE(0..255)) ::= {system 1}  OID: mib-2.system.1. 0 Columnar Objects  OID: mib-2.interface.ifTable.ifEntry.ifDescr.2 mib-2.interface.ifTable.ifEntry.ifDescr.6 mib-2.interface.ifTable.ifEntry.ifType.2 mib-2.interface.ifTable.ifEntry.ifType.6

57. Columnar Objects ifTable OBJECT-TYPE SYNTAX SEQUENCE OF IfEntry … ::= { interface 2 } IfEntry ::= SEQUENCE { ifIndexINTEGER, ifDescrDisplayString, ifTypeINTEGER, … } ifEntry OBJECT-TYPE SYNTAX IfEntry … INDEX {ifIndex } ::= { ifTable 1} ifDescr OBJECT-TYPE SYNTAX DisplayString (SIZE(0..255)) ACCESS read-only STATUS madatory... ::= {ifEntry 2}

58. Columnar Objects ifIndex ifDescr ifType... 1 le0 6... 6 llc0 1... 7 lo0 24... 9 le1 6....ifTable.ifEntry.1 (1.3.6.1.2.1.2.2.1.1).ifTable.ifEntry.2 (1.3.6.1.2.1.2.2.1.2).ifTable.ifEntry.3 (1.3.6.1.2.1.2.2.1.3) 1.3.6.1.2.1.2.2.1.3.71.3.6.1.2.1.2.2.1.2.6

59. Index in MIB II ifEntry{ifIndex} atEntry{atNetIfIndex, atNetAddress} ipAddrEntry{ipAdEntAddr } ipRouteEntry{ipRouteDest} ipNetToMediaEntry{ipNetToMediaIfIndex, ipNetToMediaNetAddress} tcpConnEntry {tcpConnLocalAddress, tcpConnLocalPort, tcpConnRemoteAddress, tcpConnRemotePort} udpEntry{udpLocalAddress, udpLocalPort} egpNeighEntry{egpNeighAddr}

60. Index Example To get the state of the TCP connection: 10.10.13.137: 3125 ===> 61.30.91.235: 80 Use snmp_get_req. to get the “tcpConnState” of the tcpConnTable in MIB II. tcpConnState ==> 1.3.6.1.2.1.6.13.1.1 1.3.6.1.2.1.6.13.1.1.10.10.13.137.3125.61.30.91.235.80

61. tcpConnTable