Understanding SNMP, MIBs, and ASN.1 in Network Management

1. Ch. 31 Q and A IS 333 Spring 2016 Victor Norman

2. SNMP, MIBs, and ASN.1 • SNMP defines the protocol used to send requests and get responses. • MIBs are like database schema, defined for common stuff on machines: interfaces, IP statistics, routing tables, ARP tables; and for device-specific values and tables. • ASN.1 is how the values and table entries are defined and encoded in requests and responses. • It is a very nasty encoding – bit oriented in some places.

3. SNMP, MIBs, and ASN.1 (cont) “SNMP defines the format of packets (or protocol) used to get and set MIB variables on an agent. The packets are formatted using ASN.1 encoding.” Variables are identified with a quadruple: (object-id, type, len, value)

4. ASN.1 Q: How does ASN.1 work? A: ASN.1 is an encoding standard. It defines how you encode data for different types: how to send an integer, a string, a bit string, an object-id, a real number, a null, etc. It also tries to minimize the space it takes to encode things. As a result, it is barf-making. A truly evil thing. (As a result, when you build the SNMP data part, you build it backwards in memory, and then reverse-copy it into the packet memory to be sent.)

5. SNMP: what layer? Q: What layer does SNMP live at? A: Layer 5. It is carried over UDP typically, ports 161 and 162. Q: Will SNMP work with IPv6? A: Yes, no problems.

6. Controlling devices Q: How is SNMP used to control a device exactly? It uses the fetch and store paradigm and it talks about resetting a counter, but what about other operations? A: Most of the time SNMP is used for monitoring – getting the status of devices (routers, switches, network file servers, etc.). When stuff is configured, SNMP sets are done to write the correct values to the MIBs on the devices. E.g., you could change the default route on all routers with a set of SNMP set requests. Or clear all ARP caches.

7. Element Management Q: Are element management systems still used today? They seem really time-consuming. A: They are very much used today. When we configured the Cisco Catalyst router in lab, we were doing element management. Everything we did could have been done via SNMP and/or a GUI tool provided by Cisco or a third party.

8. Why Element Management? Q: If element management is so labor intensive and prone to errors, then why is it done? What is a better way? A: It is labor intensive if you have 10s or 100s of devices in your network. A better way to go is to have a tool in which you can select your devices and an operation to do on them all, and click a button.

9. Managers, agents, etc. • A manager is a client, of one or more agents. • Application that gets/sets data on the agents. • sends SNMP queries. • An agent runs on a managed device • router, switch, NAT, etc. • responds to SNMP queries. • Summary: manager = client, agent = server.

10. How are ‘set’s handled? Q: Does the system constantly check to see if a value is set (e.g., to set a value to cause the system to reboot)? A: No. SNMP is typically implemented as a separate layer that makes function calls into the system to perform operations: get or set values. Just like the CLI does.

11. Traps/Notifications • SNMP agents can be configured to send updates to managers when some event happens. • Link goes down/up. • Link use gets near to capacity. • User logs in to system. • Service starts up or goes down • etc.

12. FCAPS Q: In the working world how is the responsibility of the FCAPS shared? Is one person's job or does this depend on the size of the organization? A: AFAIK, the jobs are distributed. A team in the NOC (Network operations center) handles errors (“faults”). Another team is responsible for provisioning/configuration – because they are dealing with customer requests, etc. Accounting and billing are a totally different department.

13. Root-cause Analysis • Figuring what what is really wrong in a network when you get various reports. • SNMP agents can be configured to generate “traps” – sent to the manager when something goes wrong. • link goes down, utilization hits 60%, etc. • Usually when something goes wrong, you’ll get multiple traps, which can be automatically analyzed to determine the root cause. • power failure, mis-configuration, ethernet cut, etc.

14. Network Management Tools Q: Are many of the networking management tools (in 31.5) automatic or do they have to be actively used? A: A lot of these tasks can be automated. Configuration is not often automated (AFAIK). Neither is planning. Discovery is automated, with help.

15. Old Slides

16. Why ASN.1? Q: Why exactly does SNMP use ASN.1 encoding? A: Because it is general and was there… Or because some group was feeling nasty and decided that misery loves company… Or maybe it was an April Fool’s joke that “went viral”…

17. How/where are values stored? Q: In the fetch-store paradigms used for SNMP, how and where are the values stored in a device? A: They are stored somewhere on the device in memory – in the device drivers or OS somewhere. We stored our data in the OS and then queries to values retrieved them out of the OS, and formatted them to be returned.

18. MIB discovery Q: How can you discover all of the valid fields in the MIB for a given device? A: 1. You read the MIB – or use a management app that has them built in. 2. You use the app to “walk” the MIB tree on the device, using repeated get-next requests. This is how you discover all the interfaces on a machine, e.g., or if the machine will report its ARP table.

19. SNMP Traps • SNMP also has something called “Traps” or “Alerts” • A machine for network management configures managed devices to send errors to it when they happen. The net mgmt application displays/summarizes them so that a network manager can see when something really bad happens. The manager then has to find the root cause.