SNMP-Network Management

 

Simple Network Management Protocol (SNMP) is an Internet Standard protocol for collecting and organizing information about managed devices on IP networks and for modifying that information to change device behavior. Devices that typically support SNMP include cable modems, routers, switches, servers, workstations, printers, and more.

SNMP is widely used in network management for network monitoring. SNMP exposes management data in the form of variables on the managed systems organized in a management information base (MIB) which describes the system status and configuration. These variables can then be remotely queried (and, in some circumstances, manipulated) by managing applications.

If an organization has 1000 devices then to check all devices, one by one every day, are working properly or not is a hectic task. To ease these up, Simple Network Management Protocol (SNMP) is used.

SNMP is an application layer protocol that uses UDP port number 161/162. SNMP is used to monitor the network, detect network faults, and sometimes even used to configure remote devices.

SNMP components:

There are three components of SNMP.

1. SNMP Manager:

It is a centralized system used to monitor the network. It is also known as Network Management Station (NMS).

2. SNMP agent:

It is a software management software module installed on a managed device. Managed devices can be network devices like PC, routers, switches, servers, etc.

3. Management Information Base:

MIB consists of information on resources that are to be managed. This information is organized hierarchically. It consists of object instances which are essentially variables.

SNMP architecture:

SNMP is based on the manager/agent model consisting of a manager, an agent, a database of management information, managed objects, and the network protocol. The manager provides the interface between the human network manager and the management system. The agent provides the interface between the manager and the physical devices being managed, such as bridges, hubs, routers, or network servers, these managed objects might be hardware, configuration parameters, performance statistics, and so on. These objects are arranged in what is known as a virtual information database, called a Management Information Base, also called MIB. SNMP allows managers and agents to communicate to access these objects.

SNMP architecture

SNMP uses the UDP (User Datagram Protocol) as the transport protocol for passing data between manager and agent. Here UDP was chosen over TCP because it is connectionless. This means no need for an end-to-end connection is made. Because UDP is unreliable, there is no acknowledgment of lost datagram (packets). It’s the job of SNMP to find out if datagrams are lost and retransmit them if it is needed.

SNMP messages:

Different variables are:

1. GetRequest:

SNMP manager sends this message to request data from the SNMP agent. It is simply used to retrieve data from SNMP agents. In response to this, the SNMP agent responds with the requested value through a response message.

2. GetNextRequest:

This message can be sent to discover what data is available on an SNMP agent. The SNMP manager can request data continuously until no more data is left. In this way, the SNMP manager can take knowledge of all the available data on the SNMP agent.

3. GetBulkRequest:

This message is used to retrieve large data at once by the SNMP manager from the SNMP agent. It is introduced in SNMPv2c.

4. SetRequest:

It is used by the SNMP manager to set the value of an object instance on the SNMP agent.

5. Response:

It is a message sent from the agent upon a request from the manager. When sent in response to Get messages, it will contain the data requested. When sent in response to Set messages, it will contain the newly set value as confirmation that the value has been set.

6. Trap:

These are the messages sent by the agent without being requested by the manager. It is sent when a fault has occurred.

7. InformRequest:

It was introduced in SNMPv2c, used to identify if the trap message has been received by the manager or not. The agents can be configured to set trap continuously until it receives an Inform message. It is the same as a trap but adds an acknowledgment that the trap doesn’t provide.

SNMP Layered Communication:

Simple Network Management Protocol focusing specifically on the layered communication model used to exchange information. We just saw on the structure of SNMP messages above, however, an SNMP message is not sent by itself. It is wrapped in the User Datagram Protocol (UDP), which in turn is wrapped in the Internet Protocol (IP). These are commonly referred to as layers and are based on a four-layer model. SNMP resides in what is called the Application layer, UDP resides in the Transport layer and IP resides in the Internet layer. The fourth layer is the Network Interface layer where the assembled packet is interfaced to some kind of transport media (for example, twisted pair copper, co-axial, or fiber). This multi-layer model isolates the tasks of communication and ultimately assists in designing and implementing a network.

Traversing the Layers:

To illustrate the function of this layered model, let’s look at a single SNMP Get request from the agent’s perspective.

The SNMP manager wants to know what the Agent’s System Name is and prepares a Get message for the appropriate OID. It then passes the message to the UDP layer. The UDP layer adds a data block that identifies the manager port to which the response packet should be sent and the port on which it expects the SNMP agent to be listening for messages. The packet thus formed is then passed to the IP layer. Here a data block containing the IP and Media Access addresses of the manager and the agent is added before the entire assembled packet gets passed to the Network Interface layer. The Network Interface layer verifies media access and availability and places the packet on the media for transport.

After working its way across bridges and through routers based on the IP information, the packet finally arrives at the agent.

Here it passes through the same four layers in exactly the opposite order as it did at the manager. First, it is pulled off the media by the Network Interface layer. After confirming that the packet is intact and valid, the Network Interface layer simply passes it to the IP layer. The IP layer verifies the Media Access and IP address and passes it on to the UDP layer where the target port is checked for connected applications. If an application is listening at the target port, the packet is passed to the Application layer. If the listening application is the SNMP agent, the Get request is processed. The agent response then follows the identical path in reverse to reach the manager.

Protocol Layers in SNMP communication

SNMP security levels:

It defines the type of security algorithm performed on SNMP packets. These are used in the only SNMPv3. These are three security levels namely:

1. noAuthNoPriv:

This (no authentication, no privacy) security level uses community string for authentication and no encryption for privacy.

2. authNopriv:

This security level (authentication, privacy) uses HMAC with Md5 for authentication, and encryption is used for privacy.

3. authPriv:

This security level (authentication, privacy) uses HMAC with Md5 or SHA for authentication and encryption uses the DES-56 algorithm.

SNMP versions:

There are three versions of SNMP:

1. SNMPv1:

It uses community strings for authentication and uses UDP only.

2. SNMPv2c:

It uses community strings for authentication. It uses UDP but can be configured to use TCP.

3. SNMPv3:

It uses Hash-based MAC with MD5 or SHA for authentication and DES-56 for privacy. This version uses TCP. Therefore, the conclusion is the higher the version of SNMP, the more secure it will be.