SNMP In Depth SNMP u u Simple Network

  • Slides: 22
Download presentation
SNMP In Depth

SNMP In Depth

SNMP u u Simple Network Management Protocol – The most popular network management protocol

SNMP u u Simple Network Management Protocol – The most popular network management protocol – Hosts, firewalls, routers, switches…UPS, power strips, ATM cards -- ubiquitous “One of the single biggest security nightmares on networks today”

SNMP Transport Mechanism Flaws u UDP Based – Unreliable - packets may or may

SNMP Transport Mechanism Flaws u UDP Based – Unreliable - packets may or may not be received – Easily forged - trivial to forge source of packets

Management Information Base u u MIB -- Management Information Base – MIBs describe object

Management Information Base u u MIB -- Management Information Base – MIBs describe object attributes – Some MIBs are pre-loaded – Additional MIBs are needed » Loaded manually » Downloaded from manufacture’s WEB sites Standard MIBs – MIB-II – RMON 2 – Bridge – Repeater

MIB Structure iso (1) org (3) dod (6) internet (1) directory (1) mgmt (2)

MIB Structure iso (1) org (3) dod (6) internet (1) directory (1) mgmt (2) experimental mib-2 (1) system (1) interfaces (2) snmp (11) sys. Object. ID (2) sys. Descr (1) private (4) enterprises (1) cisco (9) hp(11) novell(23)

SNMP Basics Get Response Manager Set Retrieve MIB Data Agent alter SNMP Trap Router,

SNMP Basics Get Response Manager Set Retrieve MIB Data Agent alter SNMP Trap Router, etc. · Get request - Reads a value from a specific variable Get. Next request - Traverse information from a table of specific variables Get. Bulk request - · Get response - Replies to a get or a set request · Set request - Writes a value into a specific variable Trap or Notification - A message initiated by the agent without requiring the management station to send a request · · ·

SNMP Popular Defaults u Popular – – – – – defaults public private write

SNMP Popular Defaults u Popular – – – – – defaults public private write “all private” monitor manager security admin lan – – – – – default password tivoli openview community snmpd system and on. . .

SNMP v 1 Information Disclosure u Routing tables u Network topology u Network traffic

SNMP v 1 Information Disclosure u Routing tables u Network topology u Network traffic patterns u Filter rules

SNMP Options u u u u SNMP configuration Event Configuration – Customize event notification

SNMP Options u u u u SNMP configuration Event Configuration – Customize event notification messages – Define the type of event notification – Define automatic actions when an event is received. – Create/modify alarm categories – Configure additional actions for the operator – Configure event correlations SNMP data collection and threshold SNMP MIB application builder Load/unload MIB Network polling configuration License password

SNMP Tools u u u Remotely turn on the power of a PC Web

SNMP Tools u u u Remotely turn on the power of a PC Web base access Terminal Connect- provides the ability to establish a telnet session from a local system in order to manage a remote system SNMP MIB Browser- provides a functional tool that can be used to explore, query, and set MIB values DMI Browser

Agent Data Collection u Network data collected using – SNMPv 1 ; SNMPv 2

Agent Data Collection u Network data collected using – SNMPv 1 ; SNMPv 2 – IP Protocol » TCP/IP » UDP » ICMP » ARP/RARP – IPX – DMI » Desktop Management Interface for accessing information about PC and their components

Auto-discovery u u u Auto discovery of network objects based on – IP Protocol

Auto-discovery u u u Auto discovery of network objects based on – IP Protocol – Routing data on routers (ARP table) – SNMP data Auto assignments of symbols to represent objects Auto arrangement of symbols on the maps and submaps

SNMP Event Generation u u u SNMP agents continuously watch for certain incidents to

SNMP Event Generation u u u SNMP agents continuously watch for certain incidents to occur When an incident occurs, an event is generated Events are categorized based on the alarm type – Alarm types are user definable u Events are displayed with color coded severity – Severity and color codes are user definable u Event trap configuration – Pre-defined – User-defined generic traps – User-defined specific traps

Event Correlation u Event correlation – Discovers events that are either the same event

Event Correlation u Event correlation – Discovers events that are either the same event and/or related events – Presents these events as a single main event – Allow drill down of the main event to view the related events u Provides – – four pre-defined correlations: Connector Down Correlation Scheduled Maintenance Correlation Repeated Event Correlation Pair Wise Correlation u Additional correlations may be obtained – From web page – From a 3 rd party for a fee – Developed by yourself -- not recommended

Performance Management u u Network activities – Status of the interfaces – Error rate

Performance Management u u Network activities – Status of the interfaces – Error rate and percentage – Ethernet traffic – SNMP authentication failures, traffic, errors – List of TCP connections Graph CPU load and disk space usage Graph SNMP data collected with MIB data collector Graph data based on Interface status polling and SNMP node polling

Configuration Management u u Network Configuration (at selected remote SNMP node) – List interface

Configuration Management u u Network Configuration (at selected remote SNMP node) – List interface properties – List IP and link addresses – List routing table – List ARP cache table – List the supported services List the services for which the selected remote SNMP nodes are configured to support List the management systems (by IP Address) that are configured to receive traps Run the Microsoft Windows NT operating system Registry Editor

Performance Management u u Network activities – Status of the interfaces – Error rate

Performance Management u u Network activities – Status of the interfaces – Error rate and percentage – Ethernet traffic – SNMP authentication failures, traffic, errors – List of TCP connections Graph CPU load and disk space usage (HP-UX only) Graph SNMP data collected with MIB data collector Graph data based on Interface status polling and SNMP node polling

Fault Management u u u Alarms -- show all alarms of selected nodes Network

Fault Management u u u Alarms -- show all alarms of selected nodes Network Connectivity – Poll node -- information about selected objects – Status poll -- status about selected objects – Capability poll -- check for remote DMI, web-management, and web server capabilities. – Ping – Remote ping – Locate route via SNMP Test IP/TCP/SNMP Interface Status -- Graphic display of number and rate of bad packets Window NT Event Viewer Window NT Diagnostic tool

SNMPv 1 Security Flaws u u u Transport Mechanism – Data manipulation – Denial

SNMPv 1 Security Flaws u u u Transport Mechanism – Data manipulation – Denial of Service – Replay Authentication – Host Based – Community Based Information Disclosure

SNMP Authentication Flaws u u Host Based – Fails due to UDP transport –

SNMP Authentication Flaws u u Host Based – Fails due to UDP transport – DNS cache poisoning Community Based – Cleartext community – Community name prediction/brute forcing – Default communities

RMON and RMON 2 Security u u SNMPv 1’s flaws additional hazards by introducing

RMON and RMON 2 Security u u SNMPv 1’s flaws additional hazards by introducing “action invocation” objects collects extensive info on subnet packet captures

SNMP Fixes u u u Disable it ACL It Read-Only

SNMP Fixes u u u Disable it ACL It Read-Only