Simple Network Management
Protocol
CIT 443 – Enterprise Network
Management
Simple Network Management Protocol
The features of SNMP which make it
popular:
Its design is simple, making it is easier to
implement on networks of any size
Its simple design makes it easy for a user to
program variables they would like to have
monitored.
It is popular and extensible,
a device manufacturer can easily add new registers for
monitoring
SNMP Architecture and Model
Network
Management
Organization Information Communication Functional
Model Model Model Model
Similar to OSI Model
SNMP Model
Organization Model
Relationship between network element, agent, and
manager
Hierarchical architecture
Information Model
Uses ASN.1 syntax
SMI (Structure of Management Information)
MIB ( Management Information Base)
Communication Model
Transfer syntax
SNMP over TCP/IP
Communication services addressed by messages
Security framework community-based model
SNMP Architecture and Model
Network
Management
Organization Information Communication Functional
Model Model Model Model
Two-Tier Organization Model
SNMP SNMP SNMP
Manager Manager Manager
SNMPAgent Network Agent
Network Network
Element Element
(a) One Manager - One Agent Model (b) Multiple Managers - One Agent Model
Three-Tier Organization Model: RMON
SNMP
Manager
RMON
Probe
Managed
Objects
Three-Tier Organization Model:
Proxy Server
SNMP
Manager
Proxy
Server
Non-SNMP SNMP
Managed Managed
Objects Objects
SNMP Messages
Get-Request
Sent by manager requesting specific data from agent
Get-Next-Request
Sent by manager requesting data on the next MO to the
one specified
Set-Request
Initializes or changes the value of network element
Get-Response
Agent responds with data for get and set requests from
the manager
Trap
Alarm generated by an agent
SNMP Architecture and Model
Network
Management
Organization Information Communication Functional
Model Model Model Model
ASN.1 Format
RFCs Define Specifics
Managed Object: Multiple Instances
Object
Object Object
Type Instance 3
Object
Instance 2
Name:
Syntax: Encoding: Object
OBJECT
ASN.1 BER Instance 1
IDENTIFIER
Figure 4.11 Managed Object : Type with Multiple Instances
Object Naming
internet OBJECT IDENTIFIER ::=
{iso org(3) dod(6) 1 }.
Uniquely defined by
DESCRIPTOR AND
OBJECT IDENTIFIER
Management Information Base
Hierarchy of information about a
device
Think of a MIB as a simple database
Uniquely identifies specific information
on a specific device
Object Type
Name
Allowable Operations
Structure of Management
Information (SMI)
Defines standard unique names for
objects
Defines standard formats for objects
for use in MIB
Length
Data type
etc
MIB II
Internet
{1 3 6 1}
directory mgmt experimental private
(1) (2) (3) (4)
mib-2
(1)
system (1) snmp (11)
interfaces (2) transmission (10)
at (3) cmot (9)
ip (4) egp (8)
icmp (5) udp (7)
tcp (6)
Figure 4.26 Internet MIB-II Group
Chapter 4
Internet Subnodes
Internet
{1 3 6 1}
directory mgmt experimental private
(1) (2) (3) (4)
Figure 4.13 Subnodes under Internet Node in SNMPv1
Chapter 4
Private MIB Example
Internet
{1 3 6 1}
private
(4)
enterprises
(1)
cisco hp 3Com Cabletron
(9) (11) (43) (52)
Figure 4.14 Private Subtree for Commercial Vendors
SNMP Architecture and Model
Network
Management
Organization Information Communication Functional
Model Model Model Model
SNMP Communication
SNMP Manager SNMP Agent
Manage- SNMP Manager SNMP Agent
ment Application Application
Data
GetNext-Request
GetNext-Request
Get-Request
Get-Request
Get-Response
Set-Request
Set-Request
Get-Response
Trap
Trap
SNMP SNMP
UDP UDP
IP IP
DLC DLC
PHY PHY
Physical Medium
Simple Network Management
Protocol (SNMP)
The features of SNMP which made it
popular:-
Its design is simple, hence it is easy to
implement on a large network
Its simple design makes it easy for a user to
program variables they would like to have
monitored.
It is popular and extensible, a device
manufacturer can easily add new registers
for monitoring
SNMP V2
Enhancements of SNMPv2:
Expanded data types (e.g., 64 bit
counter)
Improved efficiency and performance
(get-bulk operator)
Confirmed event notification & inter NMS
communication (inform operator)
Richer error handling (errors and
exceptions)
SNMP V2
SNMP Interoperability:-
As presently specified, SNMPv2 is
incompatible with SNMPv1 in two key areas:
message formats
protocol operations.
SNMPv2 messages use different header and
protocol data unit (PDU) formats than SNMPv1
messages. SNMPv2 also uses two protocol
operations that are not specified in SNMPv1.
SNMP V2
Bilingual Network-Management System:
Bilingual SNMPv2 network-management systems
support both SNMPv1 and SNMPv2.
To support this dual-management environment, a
management application in the bilingual NMS must
contact an agent. The NMS then examines information
stored in a local database to determine whether the agent
supports SNMPv1 or SNMPv2. Based on the information
in the database, the NMS communicates with the agent
using the appropriate version of SNMP.
SNMP V2
However, the SNMPv2 Framework, as described in
these documents, is incomplete in that it does not
meet the original design goals of the SNMPv2
project.
The unmet goals included provision of security and
administration with authentication, privacy authorization,
access control and suitable remote configuration and
administration capabilities for these features.
.
SNMPv2 SECURITY: WHAT HAPPENED?
APRIL 1993:
Standard Proposed w/ 4 Editors
Security Based on PARTIES
1st prototypes appeared shortly thereafter
JUNE 1995:
PROPOSED STANDARD REJECTED BY TWO OF THE
ORIGINAL EDITORS!
AUGUST 1995:
Agreement that Party-based Model is too complex
NEW PROPOSALS:
SNMPv2C: COMMUNITY BASED
SNMPv2U: USER BASED
...
1997:
SNMPv3 Working Group Formed
With ALL NEW Editors
SNMP v3
The SNMPv3 Management Framework,
addresses the significant deficiencies of
v2.
addressing the missing links:
security
administration
in the process made invaluable contributions
to the state-of-the-art of management
SNMPv3 ARCHITECTURE
SNMP ENTITY
SNMP APPLICATIONS
COMMAND NOTIFICATION PROXY OTHER NOTIFICATION COMMAND
OTHER
GENERATOR RECEIVER FORWARDER ORIGINATOR RESPONDER
SNMP Manager SNMP Agent
SNMP ENGINE
MESSAGE PROCESSING SECURITY ACCESS CONTROL
DISPATCHER
SUBSYSTEM SUBSYSTEM SUBSYSTEM
SNMPv3 ARCHITECTURE:
MANAGER
COMMAND NOTIFICATION
GENERATOR RECEIVER
PDU MESSAGE PROCESSING SECURITY SUBSYSTEM
DISPATCHER SUBSYSTEM
SNMPv1 COMMUNITY BASED
SECURITY MODEL
MESSAGE
DISPATCHER SNMPv2C
USER BASED
SECURITY MODEL
SNMPv3
OTHER
TRANSPORT SECURITY MODEL
OTHER
MAPPINGS
USM: SECURITY THREATS
THREAT ADDRESSED? MECHANISM
REPLAY YES TIME STAMP
MASQUERADE YES MD5 / SHA-1
INTEGRITY YES (MD5 / SHA-1)
DISCLOSURE YES DES
DENIAL OF SERVICE YES
TRAFFIC ANALYSIS YES
Questions?