1 Network Management Security Behzad Akbari Fall 2009 In the Name of the Most High.
1 SNMP Communication and Functional Models by Behzad Akbari Fall 2008 In the Name of the Most High.
-
Upload
sharleen-burns -
Category
Documents
-
view
214 -
download
0
Transcript of 1 SNMP Communication and Functional Models by Behzad Akbari Fall 2008 In the Name of the Most High.
2
Overview
• We have covered the organization and information models of SNMPv1.
• Here we will address the SNMPv1 communication and functional models
• SNMPv1 does not formally define a functional model
– What was the functional model?
• Deals with the user oriented requirements: (configuration, fault, performance, security, and accounting)
– The functions are actually built in the community based access policy of the SNMP administrative model
3
SNMP Architecture
Network
Data link
SNMP
UDP
IP
SNMP Manager SNMP Agent
SNMP ManagerSNMP ManagerApplicationApplication
Get-
Request
Get-
Request
GetN
ext-
Request
GetN
ext-
Request
Set-
Request
Set-
Request
Get-
Resp
onse
Get-
Resp
onse
Tra
pTra
p
Data link
SNMP
UDP
IP
SNMP AgentSNMP AgentApplicationApplication
Get-
Request
Get-
Request
GetN
ext-
Request
GetN
ext-
Request
Set-
Request
Set-
Request
Get-
Resp
onse
Get-
Resp
onse
Tra
pTra
p
4
SNMP Messages
• Get-Request• Get-Next-Request• Set-Request• Get-Response• Trap
• Generic trap• Specific trap
5
SNMP Trap Messages
• Generic trap
– coldStart
– warmStart
– linkDown
– linkUp
– authenticationfailure
– egpNeighborLoss
– enterpriseSpecific
• Specific trap
– for special measurements such as statistics
• Time stamp: Time since last initialization
6
Administrative Model
• Based on community profile and policy• SNMP Entities:
• SNMP application entities - Reside in management stations and network elements - Manager and agent
• SNMP protocol entities - Communication processes (PDU handlers) - Peer processes that support application entities
7
SNMP Community
• Security in SNMPv1 is community-based• Authentication scheme in manager and agent • Community: Pairing of two application entities• Community name: String of octets• Two applications in the same community
communicate with each other• Application could have multiple community
names• Communication is not secured in SNMPv1 - no
encryption
8
SNMP Community
Community Relationship between an Agent and Managers.
Community Name Used to validate the SNMP messages. SNMP PasswordPassword. Default ‘Get’ community name: “public”.
Authentication Failure Agent sends “Authentication Failure Trap” to
Manager.
10
Community Profile
• MIB view• An agent is programmed to view only a subset
of managed objects of a network element• Access mode
• Each community name is assigned an access mode:: read-only and read-write
• Community profile = MIB view + access modeCommunity profile = MIB view + access mode• Operations on an object determined by community
profile and the access mode of the object• Total of four access privileges• Some objects, such as table and table entry are
non-accessible
12
Access Policy
• Administration model is SNMP access policy• SNMP community paired with SNMP
community profile is SNMP access policy
17
Default UDP Ports for SNMP
Data link
SNMP
UDP
IP
Manager
ManagementStation
Network Elements (NEs)
Data link
SNMP
UDP
IP
Agent
162 Any 161 Any
18
Protocol Entities
•Protocol entities support application entities
• Communication between remote peer processes
• Message consists of
• Version identifier
• Community name
• Protocol Data Unit
• Message encapsulated and transmitted
19
SNMP Message SNMP Message
Version Identifier Community Name Protocol Data Unit
The length of SNMP messages should not exceed 484 octets.
Message ::= SEQUENCE {
version INTEGER {version-1(0)},community OCTET STRING,data ANY
}
Version Community SNMP PDU
21
SNMP PDUPDU ::= SEQUENCE {
request-id INTEGER,error-status INTEGER {
noError(0),tooBig(1),noSuchName(2),badValue(3),readOnly(4),genErr(5)},
error-index INTEGER,variable-bindings
SEQUENCE OF {name ObjectName,value ObjectSyntax
}}
GetRquest ::=GetNextRequest ::=
GetResponse ::=SetRequest ::=
Trap ::=
[0] PDU[1] PDU[2] PDU[3] PDU[4] Trap-PDU
Five SNMP PDUs:
PDU: Protocol Data Unit
22
SNMP PDU (cont.)
PDU type request-id 0 0 variable-bindings
GetRequest, GetNextRequest, SetRequest
PDU type request-id error-status error-index variable-bindings
GetResponse
variable-bindings
name value name value name value. . .
24
Trap-PDUTrap-PDU ::= [4]
IMPLICIT SEQUENCE {enterprise OBJECT IDENTIFIER,agent-addr NetworkAddress,
generic-trap INTEGER { coldStart(0), warmStart(1), linkDown(2), linkUp(3), authenticationFailure(4), egpNeighborLoss(5), enterpriseSpecific(6)},
specific-trap INTEGER,time-stamp TimeTicks,variable-bindings VarBindList
}
EnterpriseEnterprise: Type of Object generating trap.
Agent AddressAgent Address:Address of object generating trap.
Generic TrapGeneric Trap:Generic trap type.
Specific TrapSpecific Trap:Enterprise specific trap.
Time StampTime Stamp:Time elapsed between the last initialization of the network entity andthe generation of the trap.
Variable BindingsVariable Bindings“Interesting” information
PDU type
enterprise agent-addr generic-trap variable-bindingsspecific-trap time-stamp
26
Generic Trap Example
Enterprise: .1.3.6.1.4.1.311.1.1.3.1.1
Agent-Address: 10.10.13.137
Generic-Trap: 4
Specific-Trap: 0
Timestamp: 29756264
#VarBinds: 0
27
Enterprise-Specific Traps
Traps defined by enterprises Identification of Enterprise-Specific Traps
Enterprise Enterprise OID Generic-Trap 6 Specific-Trap an Integer
28
Enterprise Trap Example
Enterprise: .1.3.6.1.4.1.522Agent-Address: 10.10.13.24Generic-Trap: 6Specific-Trap: 4Timestamp: 143739963VariableBindings: (4) .1.3.6.1.4.1.522.3.14.23.1.2.11687128: 02:18:25 .1.3.6.1.4.1.522.3.14.23.1.3.11687128: 14 .1.3.6.1.4.1.522.3.14.23.1.4.11687128: (Info): Station 00092d142581 Associated .1.3.6.1.4.1.522.3.14.23.1.5.11687128: AssociationOK
31
Get-Next Request
:Non-Leaf Object
:Leaf Object1 2 3
4 5 6
MIB Tree :In SNMP, In SNMP, Only leaf objects have Only leaf objects have values.values.
*
35
SNMP Get-Request Example>>>>snmpgetsnmpget -d 10.144.18.118 .1.3.6.1.2.1.1.1.0-d 10.144.18.118 .1.3.6.1.2.1.1.1.0Transmitted 41 bytes to camry (10.144.18.118) port 161:Transmitted 41 bytes to camry (10.144.18.118) port 161:Initial Timeout: 0.80 secondsInitial Timeout: 0.80 seconds 0: 30 0: 30 2727 02 01 02 01 0000 04 06 04 06 70 75 62 6c 69 6370 75 62 6c 69 63 a0 a0 1a1a 02 0'.....public... 02 0'.....public... 16: 02 16: 02 18 bc18 bc 02 01 02 01 0000 02 01 02 01 0000 30 0e 30 0c 06 08 30 0e 30 0c 06 08 2b2b .........0.0...+ .........0.0...+ 32: 32: 06 01 02 01 01 01 0006 01 02 01 01 01 00 05 00 -- -- -- -- -- -- -- ................ 05 00 -- -- -- -- -- -- -- ................ 0: SNMP MESSAGE (0x30): 0: SNMP MESSAGE (0x30): 3939 bytes bytes 2: INTEGER VERSION (0x2) 1 bytes: 2: INTEGER VERSION (0x2) 1 bytes: 00 (SNMPv1) (SNMPv1) 5: OCTET-STR COMMUNITY (0x4) 6 bytes: "5: OCTET-STR COMMUNITY (0x4) 6 bytes: "publicpublic"" 13: GET-REQUEST-PDU (0xa0): 13: GET-REQUEST-PDU (0xa0): 2626 bytes bytes 15: 15: INTEGER REQUEST-ID (0x2) 2 bytes: INTEGER REQUEST-ID (0x2) 2 bytes: 63326332 19: 19: INTEGER ERROR-STATUS (0x2) 1 bytes: INTEGER ERROR-STATUS (0x2) 1 bytes: noError(0)noError(0) 22: 22: INTEGER ERROR-INDEX (0x2) 1 bytes: INTEGER ERROR-INDEX (0x2) 1 bytes: 00 25: 25: SEQUENCE VARBIND-LIST (0x30): 14 bytesSEQUENCE VARBIND-LIST (0x30): 14 bytes 27: 27: SEQUENCE VARBIND (0x30): 12 bytesSEQUENCE VARBIND (0x30): 12 bytes 29: 29: OBJ-ID (0x6) 8 bytes: OBJ-ID (0x6) 8 bytes: .1.3.6.1.2.1.1.1.0.1.3.6.1.2.1.1.1.0 39: 39: NULL (0x5) 0 bytesNULL (0x5) 0 bytes
36
SNMP Get-Response ExampleReceived 69 bytes from 10.144.18.118 port 161:Received 69 bytes from 10.144.18.118 port 161: 0: 30 0: 30 4343 02 01 02 01 0000 04 06 04 06 70 75 62 6c 69 6370 75 62 6c 69 63 a2 36 02 0C.....public.6. a2 36 02 0C.....public.6. 16: 02 16: 02 18 bc18 bc 02 01 02 01 0000 02 01 02 01 0000 30 2a 30 28 06 08 30 2a 30 28 06 08 2b2b .........0*0(..+ .........0*0(..+ 32: 32: 06 01 02 01 01 01 0006 01 02 01 01 01 00 04 1c 04 1c 53 75 6e 20 53 4e 4d53 75 6e 20 53 4e 4d .........Sun SNM .........Sun SNM 48: 48: 50 20 41 67 65 6e 74 2c 20 53 55 4e 57 2c 55 6c50 20 41 67 65 6e 74 2c 20 53 55 4e 57 2c 55 6c P Agent, SUNW,Ul P Agent, SUNW,Ul 64: 64: 74 72 61 2d 3174 72 61 2d 31 -- -- -- -- -- -- -- -- -- -- -- tra-1........... -- -- -- -- -- -- -- -- -- -- -- tra-1........... 0: SNMP MESSAGE (0x30): 0: SNMP MESSAGE (0x30): 6767 bytes bytes 2: INTEGER VERSION (0x2) 1 bytes: 2: INTEGER VERSION (0x2) 1 bytes: 00 (SNMPv1) (SNMPv1) 5: OCTET-STR COMMUNITY (0x4) 6 bytes: "5: OCTET-STR COMMUNITY (0x4) 6 bytes: "publicpublic"" 13: RESPONSE-PDU (0xa2): 54 bytes13: RESPONSE-PDU (0xa2): 54 bytes 15: 15: INTEGER REQUEST-ID (0x2) 2 bytes: INTEGER REQUEST-ID (0x2) 2 bytes: 63326332 19: 19: INTEGER ERROR-STATUS (0x2) 1 bytes: INTEGER ERROR-STATUS (0x2) 1 bytes: noError(0)noError(0) 22: 22: INTEGER ERROR-INDEX (0x2) 1 bytes: INTEGER ERROR-INDEX (0x2) 1 bytes: 00 25: 25: SEQUENCE VARBIND-LIST (0x30): 42 bytesSEQUENCE VARBIND-LIST (0x30): 42 bytes 27: 27: SEQUENCE VARBIND (0x30): 40 bytesSEQUENCE VARBIND (0x30): 40 bytes 29: 29: OBJ-ID (0x6) 8 bytes: OBJ-ID (0x6) 8 bytes: .1.3.6.1.2.1.1.1.0.1.3.6.1.2.1.1.1.0 39: 39: OCTET-STR (0x4) 28 bytes: "OCTET-STR (0x4) 28 bytes: "Sun SNMP Agent, SUNW,Ultra-1Sun SNMP Agent, SUNW,Ultra-1""system.sysDescr.0 : DISPLAY STRING- (ascii): Sun SNMP Agent, SUNW,Ultra-1system.sysDescr.0 : DISPLAY STRING- (ascii): Sun SNMP Agent, SUNW,Ultra-1
37
SNMP-Walk- Use of SNMP Get-Next Request
snmpwalk 10.144.18.118 .1.3.6.1.2.1.1snmpwalk 10.144.18.118 .1.3.6.1.2.1.1system.sysDescr.0system.sysDescr.0 : DISPLAY STRING- (ascii): : DISPLAY STRING- (ascii): Sun SNMP Agent, Sun SNMP Agent,
SUNW,Ultra-1SUNW,Ultra-1
system.sysObjectID.0system.sysObjectID.0 : OBJECT : OBJECT IDENTIFIER: IDENTIFIER: .iso.org.dod.internet.private.enterprises.42.2.1.1.iso.org.dod.internet.private.enterprises.42.2.1.1
system.sysUpTime.0system.sysUpTime.0 : Timeticks: (198219958) : Timeticks: (198219958) 22 days, 22:36:39.5822 days, 22:36:39.58
system.sysContact.0system.sysContact.0 : DISPLAY STRING- (ascii): : DISPLAY STRING- (ascii): [email protected]@ms.chttl.com.tw
system.sysName.0system.sysName.0 : DISPLAY STRING- (ascii): : DISPLAY STRING- (ascii): camrycamry
system.sysLocation.0system.sysLocation.0 : DISPLAY STRING- (ascii): : DISPLAY STRING- (ascii): Information Technology Information Technology Laboratory 3FLaboratory 3F
system.sysServices.0system.sysServices.0 : INTEGER: : INTEGER: 72 72 (01001000)B(01001000)B
38
SNMP Trap ExampleTransmitted 64 bytes to 10.144.18.100 port 162:Transmitted 64 bytes to 10.144.18.100 port 162: 0: 30 3e 02 01 00 04 06 70 75 62 6c 69 63 a4 31 06 0>.....public.1.0: 30 3e 02 01 00 04 06 70 75 62 6c 69 63 a4 31 06 0>.....public.1. 16: 09 2b 06 01 04 01 84 64 01 01 40 04 0a 90 12 74 [email protected]: 09 2b 06 01 04 01 84 64 01 01 40 04 0a 90 12 74 [email protected] 32: 02 01 06 02 03 01 86 9f 43 01 00 30 13 30 11 06 ........C..0.0..32: 02 01 06 02 03 01 86 9f 43 01 00 30 13 30 11 06 ........C..0.0.. 48: 04 2b 06 01 01 04 09 54 72 61 70 20 74 65 73 74 .+.....Trap test48: 04 2b 06 01 01 04 09 54 72 61 70 20 74 65 73 74 .+.....Trap test 0: SNMP MESSAGE (0x30): 62 bytes0: SNMP MESSAGE (0x30): 62 bytes 2: INTEGER VERSION (0x2) 1 bytes: 2: INTEGER VERSION (0x2) 1 bytes: 00 (SNMPv1) (SNMPv1) 5: OCTET-STR COMMUNITY (0x4) 6 bytes: "5: OCTET-STR COMMUNITY (0x4) 6 bytes: "publicpublic"" 13: V1-TRAP-PDU (0xa4): 49 bytes13: V1-TRAP-PDU (0xa4): 49 bytes 15: 15: OBJ-ID ENTERPRISE (0x6) 9 bytes: OBJ-ID ENTERPRISE (0x6) 9 bytes: .1.3.6.1.4.1.612.1.1.1.3.6.1.4.1.612.1.1 26: 26: IPADDRESS AGENT-ADDR (0x40) 4 bytes: IPADDRESS AGENT-ADDR (0x40) 4 bytes: 10.144.18.11610.144.18.116 32: 32: INTEGER GENERIC-TRAP (0x2) 1 bytes:INTEGER GENERIC-TRAP (0x2) 1 bytes: 6 6 35: 35: INTEGER SPECIFIC-TRAP (0x2) 3 bytes: INTEGER SPECIFIC-TRAP (0x2) 3 bytes: 9999999999 40: 40: TIMETICKS TIME-STAMP (0x43) 1 bytes: TIMETICKS TIME-STAMP (0x43) 1 bytes: 00 (0x0) (0x0) 43: 43: SEQUENCE VARBIND-LIST (0x30): 19 bytesSEQUENCE VARBIND-LIST (0x30): 19 bytes 45: 45: SEQUENCE VARBIND (0x30): 17 bytesSEQUENCE VARBIND (0x30): 17 bytes 47: 47: OBJ-ID (0x6) 4 bytes: OBJ-ID (0x6) 4 bytes: .1.3.6.1.1.1.3.6.1.1 53: 53: OCTET-STR (0x4) 9 bytes: "OCTET-STR (0x4) 9 bytes: "Trap testTrap test""
39
Get System Information
Get “System Group” of MIB II Use get_request or get_next_request
sysDescr .1.3.6.1.2.1.1.1.0
sysObjectID .1.3.6.1.2.1.1.2.0
sysUptime .1.3.6.1.2.1.1.3.0
sysContact .1.3.6.1.2.1.1.4.0
sysName .1.3.6.1.2.1.1.5.0
sysLocation .1.3.6.1.2.1.1.6.0
40
Get Interface Information
Get “Interface Group” of MIB II Repeatedly Use “get_next_request” Note: We don’t know the ifIndex values in
ifTable. First get the next object of .ifTable.ifEntry.0 Then repeatedly “get_next” Until the whole subtree is visited.
41
Traffic Monitoring
Get “ifInOctets” and “ifOutOctets” of MIB II Interface Group
t1: C1 t2: C2
(C2 - C1 ) 8
(t2 - t1) Bandwidth 100%Utilization (%) =
43
snmp(mib-2 11)
snmpInPkts(1)
snmpOutPkts (2)
snmpInBadVersions (3)
snmpInCommunityNames (4)
snmpInBadCommunityUses (5)
snmpInASNParseErrors (6)
-- not used (7)
snmpInTooBigs (8)
snmpInNoSuchNames (9)
snmpInBadValues (10)
snmpInReadOnlys (11)
snmpEnableAuthenTraps (30)
snmpOutTraps (29)
snmpOutGetResponses (28)
snmpOutSetRequests (27)
snmpOutGetNexts (26)
snmpOutGetRequests (25)
snmpOutGenErrs (24)
-- not used (23)
snmpOutBadValues (22)
snmpOutNoSuchNames (21)
snmpOutTooBigs (20)
snmpInGenErrs (12)
snmpInTotalReqVars (13)
snmpInTotalSetVars (14)
snmpInGetRequests (15)
snmpInTraps (19)snmpInGetResponses
(18)snmpInSetRequests (17)
snmpInGetNexts (16)
Figure 5.21 SNMP Group
Page Page 223~224223~224
SNMP MIB GroupSNMP MIB Group