1 Simple Network Management ProtocolSNMP Simple Network Management Protocol

2 SNMP What is it?

3 SNMP Simple Network Management ProtocolPart of the internet protocol suite Defined by the Internet Engineering Task Force (IETF) Used by network management systems Monitor network-attached devices for conditions that warrant administrative attention Manage those systems e/g/ Set or reset their configuration

4 SNMP SNMP “exposes” management dataVariables on the managed systems Values within the system Variables can be queried by managing applications Some variables can be set

5 Overview and basic concepts

6 Overview and basic conceptsTypical SNMP environment: Large number of systems to be managed Via SNMP Agents By one or more system managers Via SNMP Managers

7 Overview and basic conceptsAn SNMP agent : Software component Runs on each managed system Reports information via SNMP to the managing systems

8 Overview and basic conceptsSNMP agents reports data of interest on the managed systems Variables such as: "free memory“ "system name“ "number of running processes“ "default route“ “toner cartridge status” etc.

9 Overview and basic conceptsManagers can retrieve the information through protocol operations GET GETNEXT GETBULK Agents can send data without being asked using special protocol operations TRAP INFORM

10 Overview and basic conceptsManagers can Send configuration updates Send controlling requests Uses the SET protocol operation to actively manage a system

11 Overview and basic conceptsMonitoring operations: Done by managers Usually performed on a regular basis E.g. periodic polling Configuration and Control operations: Only when changes are needed

12 Overview and basic conceptsSNMP Variables are organized in hierarchies called MIBs Management Information Bases Contains the data and metadata describing each variable’s type description

13 Management Information BasesMIBs Management Information Bases

14 Management Information BasesSNMP itself does not define the information within a managed system e.g. Specific systems variables SNMP is an extensible design Available information defined by management information bases a.k.a. MIBs System designers decide what info is appropriate for a particular device

15 Management Information BasesMIBs describe the structure data for a device or class of devices Use a hierarchical namespace containing object identifiers (OID) Each OID identifies a variable that can be read or set via SNMP MIBs use a notation defined by ASN.1

16 Management Information BasesMIB hierarchy can be depicted as: A tree with a nameless root Levels which are assigned by different organizations Top-level MIB OIDs belong to different standards organizations CCITT ISO Lower-level object IDs are defined by their organizations

17 Management Information BasesA managed object1 is a specified characteristic of a managed device Managed objects comprise one or more object instances which are essentially variables Identified by their OIDs 1sometimes called an MIB object, an object, or a MIB

18 Management Information BasesTwo types of managed objects exist: Scalar objects Define a single object instance Tabular objects Define multiple related object instances Grouped in MIB tables

19 Management Information BasesExample of a managed object on an HP printer Object identifier (or object ID or OID) Identifies the output capacity prtOutputIndex A scalar object that contains a single object instance An integer value 0 or larger 0 means out of paper

20 From the top example Start with the top level OID assignment Start with the top level OID assignment and work the way down

21 Other Examples Resource: Example: 3Com device Example 2: Example: 3Com device Example 2:

22 SNMP basic components

23 SNMP basic components SNMP-managed networks consist of three key components: Managed devices Agents Network-management systems (NMS)

24 SNMP basic components Act as servers on the network Managed deviceNetwork node that contains one or more SNMP agents Resides on a managed network Collect and store management information Make information available to NMSs using SNMP Managed devices Sometimes called network elements Act as servers on the network

25 SNMP basic components Managed devices can be any type of networked device including, but not limited to: Routers and access servers Switches and bridges Hubs IP telephones Computer hosts Printers File servers Web servers

26 SNMP basic components Agent Network-management software (NMS) moduleExecutable program Resides in a managed device Has local knowledge of management information Translates that information into a form compatible with SNMP

27 SNMP basic components Network Management SystemsExecute applications that monitor and control managed devices NMS provide Bulk of the processing Memory resources required for network management One or more NMS may exist on any managed network Act as clients on the network

28 SNMP oddity: Typical system has:Many servers Each managed device on the network is a server Few clients Usually one or two Devices that monitor and manage the “servers” “Backwards” from the usual client/server environment

29 Which are more common in an SNMP environmentClients Dwarves Magic Elves Servers Teabags

30 SNMP protocols

31 SNMP Versions SNMPv1 SNMPv2 SNMPv3

32 SNMPv1 MIB tables SNMPv1 defines highly structured tablesUsed to group instances of a tabular object Object that contains multiple variables Tables are composed of zero or more rows Indexed in a way that allows SNMP to retrieve or alter an entire row with a single Get, GetNext, or Set command

33 Data Types Integer Octet Strings Object IDs

34 Application-wide data typesSeven application-wide data types exist in the SNMPv1 SMI: Network addresses Counters Gauges Time ticks Opaques Integers Unsigned integers

35 SNMPv2

36 SNMPv2 and structure of management informationEnhancements to the v1 datatypes

37 SNMPv3

38 SNMPv3 SNMPv3 defined by RFC 3411–RFC 3418also known as 'STD0062' SNMPv3 primarily added security and remote configuration enhancements SNMPv3 is the current standard version of SNMP IETF considers earlier versions "Obsolete" or "Historical"

39 SNMPv3 SNMPv3 provides important security features: Message integrityEnsure that a packet has not been tampered with in transit Authentication Verify that the message is from a valid source Encryption of packets Prevent snooping by an unauthorized source

40 Other SNMP topics

41 Negative impact SNMP implementations vary across platform vendorsSNMP is often an added feature Not an element of the core design SNMP's tree structure and linear indexing may not always mate well with the internal data structures that are elements of a platform's basic design Using SNMP to query certain data sets may result in high CPU utilization Negative effects on operation One example of this would be large routing tables such as BGP or IGP

42 Security implicationsSNMP versions 1 and 2c are subject to packet sniffing The clear text community string from the network traffic No encryption All versions of SNMP are subject to brute force and dictionary attacks for guessing the community strings/authentication strings

43 Security implicationsSNMP's configuration capabilities can be misconfigured and used to cause much damage 'write' capabilities are very rarely used in practice Lack of security in SNMP versions before SNMPv3 Lack of security is particularly serious with SNMPv1 or v2c over UDP Clear text community strings can be intercepted and combined with IP spoofing SNMP tops the list of the SANS Institute's Common Default Configuration Issues The issue of default SNMP community strings set to ‘public’ and ‘private’ Number ten on the SANS The Top 10 Most Critical Internet Security Threats for the year 2000 For more detail on SNMP security implications see the CERT SNMP Vulnerabilities FAQ

44 Last Notes SNMPv3 is the most secure SNMPv1 is the most used1“easiest” Typical systems will try the most secure version first Then roll back towards v1 1https://www.digitalocean.com/community/tutorials/an-introduction-to-snmp-simple-network-management-protocol (2014)

45

46

47

48 SNMP can: Monitor devices Change devices Warn of errorsAll of the above None of the above

49 Summary SNMP is a protocol to define a framework for network management tasks By itself is just a definition Must be “made real” by products

50 More Info SNMP Data Types.pptx