Simple Network Management Protocol
The purpose of a protocol is to facilitate communication, and whenever a particular type of communication has distinctive and definable characteristics, you are likely to find a corresponding protocol. Simple Network Management Protocol (SNMP) is a protocol designed for managing and monitoring remote devices on a network. SNMP supports a system that enables a single network administrator operating from a single workstation to remotely manage and monitor computers, routers, and other network devices.
Figure 21.1 shows the principle components of the SNMP architecture:
As you've learned elsewhere in this book, a protocol provides a scheme for communication, but the actual interaction occurs between applications running on the communicating devices. In the case of SNMP, a program called an agent runs on the remote node and communicates with the management software running on the network monitor (see Figure 21.2).
Figure 21.2. An agent program running on the remote node sends information on the node to the network monitor and receives requests for changes to configuration settings.
The monitor and the agent use the SNMP protocol to communicate with each. SNMP uses UDP ports 161 and 162. Older versions of SNMP did not require any form of user logon security. Security was provided by the community name, which is referred to as the community string. (You had to know the community string in order to connect.) In some cases, you could also configure the agent to only receive data from specific IP addresses. This type of security, however, is considered weak by contemporary standards. The most recent version of SNMP, SNMP v3, addresses these concerns, providing authentication, privacy, and better overall security for the system.
You might be wondering what the monitor and the agent communicate about. What kind of data passes between the monitor and the agent through SNMP? As you'll learn in the next section, SNMP defines a vast collection of management parameters. The network monitor uses the parameters of this Management Information Base (MIB) to request information from the agent and change configuration settings.
The SNMP Address Space
The SNMP process is predicated on both the monitor and agent software being capable of exchanging information regarding specific addressable locations within the MIB. The MIB, shown in Figure 21.3, allows the monitor and agent to exchange information accurately and unambiguously. Both the monitor and the agent require identical MIB structures, because they must be capable of uniquely identifying a specific unit of information.
The MIB is a hierarchical address space that includes a unique address for each piece of information. Note that MIB addresses aren't like network addresses in that they don't represent a location or an actual device. The MIB is really a collection of parameters arranged hierarchically into an address space. This hierarchical address arrangement ensures that all SNMP devices refer to a specific setting the same way. This approach also allows for convenient decentralization. For instance, a specific vendor can define the MIB settings (often referred to simply as MIBs) that apply to the vendor's products, or a standards organization can manage the part of the MIB tree devoted to its standard. The MIB uses dotted notation to identify each unique address within the MIB object.
By the Way
The MIB has been described in several RFCs, including RFC 1158 and RFC 1213. You'll find the official description of SNMP in RFC 1157. The latest version, SNMP v3, is described in RFC 2570 and a number of other RFCs.
The majority of the addressable locations within the MIB refer to counters, which are obviously numeric. An example of a counter is ipForwarding, shown in Figure 21.3, or ipInReceives (not shown), which counts the number of inbound IP datagrams received since either the networking software was started or the counter was last reset.
MIB information could be in any of several forms: numeric, textual, IP addresses, and so on. Another example of MIB configuration information is ipDefaultTTL. The ipDefaultTTL setting holds the numeric value of the TTL (Time To Live) parameter inserted into every IP datagram that originates on a computer.
The MIB structure is addressed by always starting at the root and progressing down through the hierarchy until you have uniquely identified the setting you want to read. For example, to address the ipDefaultTTL and ipInReceives MIBs, the SNMP monitor would send the following MIB addresses to the SNMP agent:
Every location of the MIB tree also has an equivalent numeric address. You can refer to a MIB by either its alphanumeric string or by its numeric address. In fact, it's the numeric form that the network monitor uses when querying information from the agent:
The MIB address provides a common nomenclature to ensure that the monitor and the agent can reliably refer to specific parameters. These MIB parameters are then included in commands, as described in the next section.
The network monitoring agent software responds to three commands: get, getnext, and set. These commands perform the following functions:
The following example illustrates query and response commands used by SNMP. This example uses a diagnostic utility called snmputil, which allows a technician to simulate a monitor. Through the utility, a technician can issue commands to the agent. In this case, the agent is located on a computer with an IP address of 126.96.36.199, and the agent is a member of a community named public. Notice the .0 at the end of the first two commands; this is used as a suffix when reading simple variables such as counters.
D:\>snmputil get 188.8.131.52 public .184.108.40.206.220.127.116.11.0 Variable = ip.ipDefaultTTL.0 Value = INTEGER - 128 D:\>snmputil getnext 18.104.22.168 public .22.214.171.124.126.96.36.199.0 Variable = ip.ipInReceives.0 Value = Counter - 11898
The default community name on many SNMP systems is public. The admin in this example should have changed the name to something else. You give an attacker a head start when you use a default name.