In the Name of the Most High SNMPv

In the Name of the Most High SNMPv 2 by Behzad Akbari Fall 2011 These slides are based in parts upon slides of Prof. Dssouli (Concordia university) 1

Overview q q q SNMPv 1 was developed as an interim solution to an eventual adoption of OSI. This never came about: OSI was not as widely adopted as originally hoped. SNMPv 2, released in 1996, was basically major revisions added to SNMP. 2

SNMPv 1 n n n SNMPv 1 Protocol q RFC 1157 – Simple Network Management Protocol SMIv 1 Data Definition Language Full Standards: q RFC 1155 - Structure of Management Information q RFC 1212 - Concise MIB Definitions Informational: q RFC 1215 - A Convention for Defining Traps SMIv 1 MIB Modules Full Standards: q RFC 1213 - Management Information Base II q RFC 1643 - Ethernet-Like Interface Types MIB 3

SNMPv 2 n n SMIv 2 Data Definition Language Full Standards: q RFC 2578 - Structure of Management Information q RFC 2579 - Textual Conventions q RFC 2580 - Conformance Statements SMIv 2 MIB Modules Full Standards: q RFC 2819 - Remote Network Monitoring MIB q RFC 3411 - SNMP Framework MIB q RFC 3412 - SNMPv 3 MPD MIB q RFC 3413 - SNMP Applications MIBs q RFC 3414 - SNMPv 3 USM MIB q RFC 3415 - SNMP VACM MIB q RFC 3418 - SNMP MIB 4

Major Changes q q q Bulk data transfer q Request and receive bulk data using the get-bulk message Manager-to-manager message q Enhances interoperability and allows for managing large distributed networks Enhancements to SMI: SMIv 2 q Module definitions: MODULE-IDENTITY macro q Object definitions: OBJECT-TYPE macro (same as before) q Trap definitions: NOTIFICATION-TYPE macro Textual conventions: define new data types Conformance statements q Help customers compare features of various products q Keeps vendors open to their product’s compatibility with SNMP

Major Changes q q Row creation and deletion in table q A table can also be expanded by augmenting another table MIB enhancements q Two new subgroups: security and snmp. V 2 Transport mappings q UDP remains the preferred transport protocol; however, other protocols can also be used with SNMPv 2 Security features, originally to be in SNMPv 2 moved to SNMPv 3 q SNMPv 2 is community-based administrative framework Internet {1 3 6 1} SNMPv 2 directory (1) mgmt (2) experimental (3) private (4) SNMPv 2 Internet Group security (5) snmpv 2 (6)

SNMP PDU Physical Medium SNMP UDP UDP IP IP IP DLC DLC PHY PHY snmp. V 2 -trap response set-request Application PDU get-bulk-request SNMP Manager get-next-request SNMP Manager Application get-request snmp. V 2 -trap response set-request Application PDU get-bulk-request SNMP Manager get-next-request get-request SNMP Manager Application inform-request snmp. V 2 -trap response set-request get-bulk-request get-next-request get-request inform-request SNMPv 2 System Architecture SNMP Agent Application

Additional Messages q inform-request q q get-bulk-request q q manager-to-manager message The receiving manager responds with a response message Enhances interoperability transfer of large data, e. g. retrieval of table data SNMPv 2 -trap q Similar to trap messages in SNMPv 1

SMIv 2 - Modules Definitions q q Defines and describe semantics of an information module (info. related to network management) q added to provide administrative information regarding the informational module and the revision history MODULE-IDENTITY macro defines the module definitions

SMIv 2 - Object Definitions r OBJECT IDENTIFIER, OBJECT-IDENTITY, OBJECT-TYPE m OBJECT IDENTIFIER defines the administrative identification of a node in the MIB m OBJECT-IDENTITY macro (defines info. about OID) assigns an object identifier to a class of managed objects in the MIB (e. g. , defining a class of routers!) • m OBJECT-TYPE macro defines the type of a managed object (e. g. , a specific router type) • m The object itself is not managed Focuses on the details of implementation NOTE: • OBJECT-IDENTITY is high level description • OBJECT-TYPE details description needed for implementation

OBJECT-TYPE MACRO : : = BEGIN TYPE NOTATION : : = "SYNTAX" Syntax Units. Part "MAX-ACCESS" Access "STATUS" Status "DESCRIPTION" Text Refer. Part Index. Part Def. Val. Part VALUE NOTATION : : = value(VALUE Object. Name) 11

"SYNTAX" Syntax : : = -- Must be one of the following: -- a base type (or its refinement), -- a textual convention (or its refinement), or -- a BITS pseudo-type | "BITS" "{" Named. Bits "}“ Named. Bits : : = Named. Bit | Named. Bits ", " Named. Bit : : = identifier "(" number ")“ -- number is nonnegative 12

(Example) SYNTAX BITS protocol. Dir. Type OBJECT-TYPE SYNTAX BITS { extensible(0), address. Recognition. Capable(1) } MAX-ACCESS read-only STATUS current DESCRIPTION “…” : : = { protocol. Dir. Entry 5 } 13

Units. Part: UNITS Units. Part : : = "UNITS" Text | empty hr. Disk. Storage. Capacity OBJECT-TYPE SYNTAX KBytes UNITS "KBytes" MAX-ACCESS read-only STATUS current DESCRIPTION "The total size for this long-term storage device. If the media is removable and is currently removed, this value should be zero. " : : = { hr. Disk. Storage. Entry 4 } Back to OBJECT-TYPE 14

"MAX-ACCESS" Access : : = "not-accessible" | "accessible-for-notify" | "read-only" | "read-write" | "read-create" ordered from least to greatest: "not-accessible": not-accessible indicates an auxiliary object "accessible-for-notify": accessible-for-notify accessible only via a notification "read-only": read only read-only "read-write": read and write, but create read-write does not. 15

"STATUS" Status : : = "current" | "deprecated" | "obsolete" “current”: current the definition is current and valid. “deprecated”: indicates an obsolete definition, it perm deprecated new/continued implementation. “obsolete”: obsolete the definition is obsolete and should not be implemented. 16

Refer. Part : : = "REFERENCE" Text | empty ip. Forward. Table OBJECT-TYPE SYNTAX SEQUENCE OF Ip. Forward. Entry MAX-ACCESS not-accessible STATUS obsolete DESCRIPTION "This entity's IP Routing table. " REFERENCE "RFC 1213 Section 6. 6, The IP Group“ : : = { ip. Forward 2 } 17

Object Definitions, example NOTE: A specific instance of router. Isi 123 could be identified by its IP address 10. 1. 2. 3

Table Definition q Static Tables o o q Dynamic Table o o o q Tables completely controlled by the agent. Access is read-only, and readwrite These are useful when the number of rows corresponds to a fixed attribute (e. g. , # physical interfaces) or a quantity controlled only by agent Allows row creation/deletion by a manager Access includes also read, write and create privileges A table can be initialized with no rows and expanded as needed SNMPv 2: Augmentation of a table (dependent table) o Adds additional columns to an existing table (base table) Number of rows is not affected INDEX of the second table is the same as the first table o One to one correspondence between rows of two tables o o

Augmentation of Tables Base table Table 2 Table 1 table 1 (T 1) table 2 (T 2) table 1 Entry (E 1) table 2 Entry (E 2) Augmented table T 1. E 1. C 1. 1 T 1. E 1. C 2. 1 T 1. E 1. C 3. 1 T 2. E 2. C 4. 1 T 2. E 2. C 5. 1 T 1. E 1. C 1. 2 T 1. E 1. C 2. 2 T 1. E 1. C 3. 2 T 2. E 2. C 4. 2 T 2. E 2. C 5. 2 T 1. E 1. C 1. 3 T 1. E 1. C 2. 3 T 1. E 1. C 3. 3 T 2. E 2. C 4. 3 T 2. E 2. C 5. 3 T 1. E 1. C 1. 4 T 1. E 1. C 2. 4 T. E 1. C 3. 4 T 2. E 2. C 4. 4 T 2. E 2. C 5. 4 Index: First columnar object in Table 1 Conceptual rows: 1. T 1. E 1. C 1. 1 2. T 1. E 1. C 1. 2 3. T 1. E 1. C 1. 3 4. T 1. E 1. C 1. 4 Example Columnar object: T 2. E 2. C 4 Index: T 1. E 1. C 1. 2 Value: T 2. E 2. C 4. 2

Augmentation of Tables --Conceptual row extension Example: a vendor can easily specify vendor-specific objects as extensions to standard MIB table. It should be easier for applications to access these objects than if they were defined as new, separate table A clause used to increase the number of columns in a table w/out rewriting the table definition The resulting table is therefore treated the same way as if it was defined in a single table definition

Row Creation q q A new feature in SMIv 2 2 methods q Create a row and make it active (or available) q Create a row and make it available at a later time q definition of the status of a row Used by agent to send responses to a manager Used by manager for row creation/deletion

Row Creation table 1 entry 1 status. 1 index. 1 data. 1 status. 2 index. 2 data. 2 status. 3 index. 3 data. 3 Row to be created/deleted 2 states for Row. Status: create. And. Go, create. And. Wait

Create and Go Manager Process Agent Process Set. Request ( status. 3 = 4, index. 3 = 3, data. 3 = Def. Data ) Response ( status. 3 = 1, index. 3 = 3, data. 3 = Def. Data ) q Create Instance Created Manager initiates a Set. Request-PDU to create a new row q q Managed Entity status = 4, i. e. , create and go Agent interacts with the management entity and successfully create an instance; subsequently a response is transmitted to the manager q status = 1, indicates that the row is active

Create and Wait Manager Process Agent responds with “not. Ready” (no default value) Agent Process Set. Request ( status. 3 = 5, index. 3 = 3 ) Response ( status. 3 = 3, index. 3 = 3 ) Get. Request ( data. 3 ) Data value is missing Value of data is sent Response ( status. 3 = 2 data. 3 = Def. Data ) Set. Request ( status. 3 = 1 ) Row activated Get the data for the row Response ( data. 3 = no. Such. Instance) Set. Request ( data. 3 = Def. Data ) Agent responds with not. In. Servcie Create and wait, no default data specified Response ( status. 3 = 1 ) Manager requests to activate the row

Row Deletion Manager Process Agent Process Set. Request ( status. 3 = 6 ) Response ( status. 3 = 6 ) Managed Entity Delete Instance Deleted

Textual Conventions r r Enables defining new data types Makes semantics of data types consistent and human readable Creates new data types using existing ones and applies restrictions to them An important textual convention in SNMPv 2, Row. Status creates and deletes rows SNMPv 2 SNMPv 1 A string of up to 255 characters (refer to table 6. 2 for more rules)

Textual Conventions-Macro TEXTUAL-CONVENTION MACRO : : = BEGIN TYPE NOTATION : : = Display. Part "STATUS" Status "DESCRIPTION" Text Refer. Part "SYNTAX" Syntax VALUE NOTATION : : = value(VALUE Syntax) Display. Part : : = "DISPLAY-HINT" Text | empty Status : : = "current" | "deprecated" | "obsolete“ Refer. Part : : = "REFERENCE" Text | empty ……………. . END Example: Hundredths : : = TEXTUAL-CONVENTION DISPLAY-HINT “d-2”. . . SYNTAX INTEGER (0. . 10000) suggests that a Hundredths value of 1234 be rendered as "12. 34"

Textual Conventions- example Row. Status : : = TEXTUAL-CONVENTION STATUS current DESCRIPTION "The Row. Status textual convention is used to manage the …” SYNTAX INTEGER { -- the following two values are states: -- these values may be read or written active(1), not. In. Service(2), -- the following value is a state: -- this value may be read, but not written not. Ready(3), -- the following three values are -- actions: these values may be written, -- but are never read create. And. Go(4), create. And. Wait(5), destroy(6) }

SNMPv 2 Protocol q Overall, 8 messages with almost common message format to improve the efficiency and performance q Significant improvement is that trap message has the same format PDU Type Request. ID Error Status Index Var. Bind 1 name value . . . Var. Bind n name value SNMPv 2 PDU Indicate the type of PDU (e. g. , Request-PDU, etc) Indicate the status of the error (e. g. , no. Error, too. Big, etc. ) identifies the first variable binding in the variable-binding list that caused the error NOTE: • SNMPv 1 operations (e. g. , GET-REQUEST) are atomic: • either all values are returned or none! • In SNMPv 2: a binding list (with corresponding values) is prepared even if one variable cannot be returned an (error-status), (error-index) are returned in the case of anomaly.

SNMPv 2 Protocol Error index is set to “ 0” if there is no error; otherwise, it identifies the first variable binding in the variable binding list that caused the error

SNMPv 2 Protocol PDU Type Request. ID Non- Max Repeaters Repetitions Var. Bind 1 name value . . . Var. Bind n name value SNMPv 2 Get. Bulk. Request PDU q Get. Bulk. Request enables the retrieval of data in bulk q q q Error status field replaced by Non-repeaters q q Uses the same selection principle as Get. Nex. Request (i. e. , next object instance) Retrieval of multiple rows of data from table (constrained by the max. message size) Non-repeaters indicates the number of non repetitive (scalar) field values requested Error index field replaced by Max repetitions q Max repetitions designates the maximum number of table rows requested to be returned in the response message q q NOTE 1: value depends on the size of the SNMP message and buffer size in implementation NOTE 2: no one to one relationship between the Var. Bind. List of request and response messages

Get. Bulk. Request-PDU Operation A A B T B Z T E E 1. 1 2. 1 3. 1 1. 2 2. 2 3. 2 1. 3 1. 4 2. 3 2. 4 T. E. 1. 1 T. E. 2. 1 T. E. 3. 1 T. E. 1. 2 T. E. 2. 2 T. E. 3. 2 T. E. 1. 3 T. E. 2. 3 T. E. 3. 3 T. E. 1. 4 T. E. 2. 4 T. E. 3. 4 3. 3 3. 4 Z

Get. Bulk. Request-PDU Operation Manager Process Get. Request ( A, B ) Get. Response (A, B) Get. Next. Request (T. E. 1, T. E. 2, T. E. 3) Get. Response (T. E. 1. 1, T. E. 2. 1, T. E. 3. 1) Get. Next. Request (T. E. 1. 1, T. E. 2. 1, T. E. 3. 1) Get. Response (T. E. 1. 2, T. E. 2. 2, T. E. 3. 2) Get. Next. Request (T. E. 1. 2, T. E. 2. 2, T. E. 3. 2) Get. Response (T. E. 1. 3, T. E. 2. 3, T. E. 3. 3) Get. Next. Request (T. E. 1. 3, T. E. 2. 3, T. E. 3. 3) Get. Response (T. E. 1. 4, T. E. 2. 4, T. E. 3. 4) Get. Next. Request (T. E. 1. 4, T. E. 2. 4, T. E. 3. 4) Get. Response (T. E. 2. 1, T. E. 3. 1, Z) Agent Process

Get. Bulk. Request-PDU Operation A 2 non repetitive objects (A, B) Manager Process 3 repetitive instances Of the columnar object T. E. 1, T. E. 2, T. E. 3 B Agent Process T Get. Bulk. Request ( 2, 3, A, B, T. E. 1, T. E. 2, T. E. 3 ) Response ( A, B, T. E. 1. 1, T. E. 2. 1, T. E. 3. 1 T. E. 1. 2, T. E. 2. 2, T. E. 3. 2 T. E. 1. 3, T. E. 2. 3, T. E. 3. 3 ) E 3 more rows Get. Bulk. Request ( 0, 3, T. E. 1. 3, T. E. 2. 3, T. E. 3. 3 ) Response ( T. E. 1. 4, T. E. 2. 4, T. E. 3. 4, Z , " end. Of. Mib. View") Z is next in the lexicographic order T. E. 1. 1 T. E. 2. 1 T. E. 3. 1 T. E. 1. 2 T. E. 2. 2 T. E. 3. 2 T. E. 1. 3 T. E. 2. 3 T. E. 3. 3 T. E. 1. 4 T. E. 2. 4 T. E. 3. 4 Z

Get. Bulk. Request-PDU Operation

SNMPv 2 Trap PDU Type q q q Request. ID Error Status Var. Bind 1 Var. Bind 2. . . Index sys. Up. Time value snmp. Trap. OID value Error Addition of NOTIFICATION-TYPE macro Positions 1 and 2 in Var. Bind. List are sys. Up. Time and snmp. Trap. OID Inform-Request behaves as trap in that the message goes from one manager to another unsolicited o The receiving manager sends response to the sending manager

Conformance Statements for SMIv 2 (RFC 2580) 38

n I E MI TCs OIs OTs NTs OGs NGs MCs MIB MODULE IMPORTS q EXPORTS q MODULE-IDENTITY q TEXTUAL-CONVENTION q OBJECT IDENTIFIER q Application Data Types q OBJECT-TYPE q NOTIFICATION-TYPE q OBJECT-GROUP q NOTIFICATION-GROUP q MODULE-COMPLIANCE q 39

OI MI I datatypes data OI TC TC NG OG OG E NT OT OT OT NT OT NG NT OG OG NG NG NT NT MC MC 40

Four Macros in SNMPv 2 -CONF n n OBJECT-GROUP macro NOTIFICATION-GROUP macro MODULE-COMPLIANCE macro AGENT-CAPABILITIES macro 41

Conformance: OBJECT-GROUP • Conformance defined by • OBJECT-GROUP macro • NOTIFICATION-GROUP macro • OBJECT-GROUP • Compiled during implementation, not at run time • OBJECTS clause names each object • Every object belongs to an OBJECT-GROUP • Access defined by MAX-ACCESS, the maximum access privilege for the object 42

OBJECT-GROUP MACRO : : = BEGIN TYPE NOTATION : : = Objects. Part "STATUS" Status "DESCRIPTION" Text Refer. Part VALUE NOTATION : : = value(VALUE OBJECT IDENTIFIER) Objects. Part : : = "OBJECTS" "{" Objects "}" Objects : : = Object | Objects ", " Object : : = value(Object. Name) Status : : = "current" | "deprecated" | "obsolete" Refer. Part : : = "REFERENCE" Text | empty Text : : = value(IA 5 String) END 43

OBJECT-GROUP Example hr. SWRun. Group OBJECT-GROUP OBJECTS { hr. SWOSIndex, hr. SWRun. Name, hr. SWRun. ID, hr. SWRun. Path, hr. SWRun. Parameters, hr. SWRun. Type, hr. SWRun. Status } STATUS current DESCRIPTION "The Host Resources Running Software Group. " : : = { hr. MIBGroups 4 } 44

Conformance: NOTIFICATION-GROUP • Contains trap entities defined in SMIv 1 • NOTIFICATIONS clause identifies the notifications in the group • NOTIFICATIONS-GROUP macro compiled during implementation, not at run time 45

NOTIFICATION-GROUP MACRO : : = BEGIN TYPE NOTATION : : = Notifications. Part "STATUS" Status "DESCRIPTION" Text Refer. Part VALUE NOTATION : : = value(VALUE OBJECT IDENTIFIER) Notifications. Part : : = "NOTIFICATIONS" "{" Notifications "}" Notifications : : = Notification | Notifications ", " Notification : : = value(Notification. Name) Status : : = "current" | "deprecated" | "obsolete" Refer. Part : : = "REFERENCE" Text | empty Text : : = value(IA 5 String) END 46

NOTIFICATION-GROUP Example link. Up. Down. Notifications. Group NOTIFICATION-GROUP NOTIFICATIONS { link. Up, link. Down } STATUS current DESCRIPTION "The notifications which indicate specific changes in the value of if. Oper. Status. " : : = { if. Groups 14 } 47

Compliance • Compliance has two classes of groups • MANDATORY-GROUPS. . . Required • GROUP …Optional 48

MODULE-COMPLIANCE MACRO : : = BEGIN TYPE NOTATION : : = "STATUS" Status "DESCRIPTION" Text Refer. Part Module. Part VALUE NOTATION : : = value(VALUE OBJECT IDENTIFIER) 49

Module. Part : : = Modules : : = Module | Modules Module : : = "MODULE" Module. Name Mandatory. Part Compliance. Part Module. Name : : = identifier Module. Identifier | empty Module. Identifier : : = value(OBJECT IDENTIFIER) | empty Mandatory. Part : : = "MANDATORY-GROUPS" "{" Groups "}“ | empty Groups : : = Group | Groups ", " Group : : = value(OBJECT IDENTIFIER) 50

Compliance. Part (1/2) Compliance. Part : : = Compliances | empty Compliances : : = Compliance | Compliances Compliance : : = Compliance. Group | Object Compliance. Group : : = "GROUP" value(OBJECT IDENTIFIER) "DESCRIPTION" Text Object : : = "OBJECT" value(Object. Name) Syntax. Part Write. Syntax. Part Access. Part "DESCRIPTION" Text 51

Compliance. Part (2/2) Syntax. Part : : = "SYNTAX" Syntax | empty -- must be a refinement for object's SYNTAX clause Write. Syntax. Part : : = "WRITE-SYNTAX" Syntax | empty Syntax : : = type | "BITS" "{" Named. Bits "}" Named. Bits : : = Named. Bit | Named. Bits ", " Named. Bit : : = identifier "(" number ")" Access. Part : : = "MIN-ACCESS" Access | empty Access : : = "not-accessible" | "accessible-for-notify" | "read-only" | "read-write" | "read-create" 52

MODULE-COMPLIANCE hr. MIBCompliance MODULE-COMPLIANCE Example STATUS current DESCRIPTION "The requirements for conformance to the Host Resources MIB. " MODULE -- this module MANDATORY-GROUPS { hr. System. Group, hr. Storage. Group, hr. Device. Group } OBJECT hr. System. Date MIN-ACCESS read-only DESCRIPTION "Write access is not required. “ GROUP hr. SWRun. Group DESCRIPTION "The Running Software Group. Implementation of this group is mandatory only when the hr. SWRun. Perf. Group is implemented. " … 53

OBJECT if. Admin. Status SYNTAX INTEGER { up(1), down(2) } MIN-ACCESS read-only DESCRIPTION "Write access is not required, nor is support for the value testing(3). " 54

OBJECT-GROUP 55

Agent Capabilities • AGENT-CAPABILITIES macro • SUPPORTS modules and includes groups • VARIATION identifies additional features 56

AGENT-CAPABILITIES 57

SNMPv 2 Internet Group 58

NOTIFICATION-TYPE 59

Object Types for SNMPv 2 Traps 60

Inform-Request • Inform-Request behaves as trap in that the message goes from one manager to another unsolicited • The receiving manager sends response to the sending manager 61

SNMPv 2 - Decentralized management Agent Element manager Management server SNMPv 2 Manager/agent SNMPv 2 agent MIB Management Applications SNMPv 2 manager MIB SNMPv 2 Manager/agent MIB SNMPv 2 Configuration

Compatibility with SNMPv 1 q q q SNMPv 2 MIB is not backward compatible with SNMPv 1 Compatibility with SNMPv 1 2 evolution paths: o Bilingual Manager o Proxy Server Bilingual Manager expensive in resource and operation Agent Profile Bilingual Manager SNMPv 1 Interpreter SNMPv 1 Agents SNMPv 2 Interpreter SNMPv 2 Agents SNMP Bilingual Manager Both interpreters are required!

SNMP Proxy Server SNMPv 2 Manager Proxy Server SNMPv 1 Agents SNMPv 2 Manager Get. Request Get. Next. Request Set. Request Get. Bulk. Request SNMPv 2 Agents SNMP v 2 -v 1 Proxy Server SNMPv 1 Agent Pass-Through Get. Request Pass-Through Get. Next. Request Pass-Through Set: 1. non-repeaters = 0 2. max-repetitions = 0 Set. Request Get. Next. Request Pass-Through Response SNMPv 2 -Trap Exception: For 'too. Big' error, contents of variable-bindings field removed. Prepend Var. Bind: 1. sys. Up. Time. 0 2. snmp. Trap. OID. 0 SNMP v 2 -v 1 Proxy Server Get. Response Trap

SNMPv 2 MIB 65