What is - SNMP - Simple Network Management Protocol

FREE LINK EXCHANGE

What is My IP

URL

You are here:Home>>Tutorials

What is - SNMP - Simple Network Management Protocol

Simple Network Management Protocol (SNMP) is used as the transport protocol for network management. Network management consists of network management stations communicating with network elements such as hosts, routers, servers, or printers. The agent is the software on the network element (host, router, printer) that runs the network management software. Therefore when the word agent is used it is referring to the network element. The agent will store information in a management information base (MIB). Management software will poll the various network devices and get the information stored in them. RFC 1155, 1157, and 1213 define SNMP with RFC 1157 defining the protocol itself. The manager uses UDP port 61 to send requests to the agent and the agent uses UDP port 62 to s

end replies or messages to the manager. The manager can ask for data from the agent or set variable values in the agent. Agents can reply and report events.

There are three supporting pieces to TCP/IP network management:

1. Management Information BASE (MIB) specifies variables the network elements maintain.

2. A set of common structures and a way to reference the variables in the database.

3. The protocol used to communicate between the manager and the network element agent which is SNMP.

SNMP collects information two ways:

1. The devices on the network are polled by management stations.

2. Devices send alerts to SNMP management stations. The public community may be added to the alert list so all management stations will receive the alert.

SNMP must be installed on the devices to do this. SNMP terms:

Baseline - A report outlining the state of the network.

Trap - An alert that is sent to a management station by agents.

Agent - A program at devices that can be set to watch for some event and send a trap message to a management station if the event occurs.

The network manager can set the threshold of the monitored event that will trigger the sending of the trap message. SNMP enables counters for monitoring the performance of the network used in conjunction with Performance Monitor.

SNMP Communities

An SNMP community is the group that devices and management stations running SNMP belong to. It Simple Network Management Protocol helps define where information is sent. The community name is used to identify the group. A SNMP device or agent may belong to more than one SNMP community. It will not respond to requests from management stations that do not belong to one of its communities. SNMP default communities are:

Write = private

Read = public

SNMP Security

It SNMP should be protected from the internet with a firewall. Beyond the SNMP community structure, there is one trap that adds some security to SNMP.

Send Authentication Trap - When a device receives an authentication that fails, a trap is sent to a management station.
Other configuration parameters that affect security are:

Accepted Community Names - Only requests from computers in the list of community names will be accepted.

Accept SNMP Packets from Any Host - This is checked by default. Setting specific hosts will increase security.

Only Accept SNMP Packets from These Hosts - Only requests from hosts on the list of IP addresses are accepted. Use IP, or IPX address or host name to identify the host.

SNMP Message Types

There are five types of messages exchanged in SNMP. They are referred to by Protocol Data Unit (PDU) type.

PDU Type	Name	Description
0	get-request	Get one or more variables .(manager to element)
1	get-next-request	Get next variable after one or more specified variables. (manager to element)
2	set-request	Set one or more variables. (manager to element)
3	get-response	Return value of one or More variables. (element to manager)
4	trap	Notify manager of an event. (element to manager)

The SNMP message with PDU type 0-3 consists of:

Version of SNMP
Community - A clear text password character string
PDU type
Request ID - Used to associate the request with the response. For PDU 0-2, it is set by the manager.
error status - An integer sent by the agent to identify an error condition
error index - Specifies which variable was in error when an error occurred. It is an integer offset.

Error	Name	Description
0	no Error	OK
1	too big	Reply does not fit into one Message
2	no such name	The variable specified does not exist
3	bad value	Invalid value specified in a set request.
4	read only	The variable to be changed is read only.
5	general error	General error

name - The name of the variable (being set or read).
value - The value of the variable (being set or read)
any other names and values to get/set

The SNMP message with PDU type 4 (trap) consists of:

1. PDU type
2. Enterprise - The agents OBJECT IDENTIFIER or system objects ID. Falls under a node in the MIB tree.
3. agent addr - The IP address of the agent.
4. Trap type - Identifies the type of event being reported.
5. Specific code - Must be 0.
6. Time stamp - The time in 1/100ths of seconds since the agent initialized.
7. name
8. Value
9. Any other names and values

Types of data used:

INTEGER - Some have minimum and maximum values.

OCTET STRING - The number of bytes in the string is before the string.

DISPLAY STRING - Each byte must be an ASCII value

OBJECT IDENTIFIER - Specifies a data type allocated by an organization with responsibility for a group of identifiers. A sequence of integers separated by decimals which follow a tree structure.

NULL - Used as the value of all variables in a get request.

IpAddress - A 4 byte long OCTET STRING. One byte for each byte of the IP address.

PhysAddress - A 6 byte octet string specifying an ethernet or hardware address.

Counter - A 32 bit unsigned integer

GaugeAn unsigned 32 bit integer with a value that can increase or decrease but wont fall below a minimum or exceed a maximum.

TimeTicks - Time counter. Counts in 1/100 of seconds.

SEQUENCE - Similar to a programming structure with entries of type IPAddress called udpLocalAddress and type INTEGER called udpLocalPort.

SEQUENCE OF - An array with elements with one type.