e-dokumen.com

F5 White PaperSNMP: SimplifiedThe Simple Network Management Protocol defines a methodfor managing devices that connect to IP networks. The“simple” in SNMP refers to the requirements for a manageddevice, not the protocol. This white paper defines the history,frequently used terms, and implementation of SNMP.by Peter Murray and Paul StalvigTechnical Marketing Managers

White PaperSNMP: 5Implementation8Perspective9Conclusion92

White PaperSNMP: SimplifiedIntroductionIt’s no secret that managing networks and applications are complex tasks. Multipletechnologies are in use today, often by the same organization. This article presentsan overview of one technology: the Simple Network Management Protocol (SNMP).SNMP offers a method to monitor and manage network devices and hosts. Thisdocument offers a simplified view of SNMP fundamentals and explains how thefundamental components work together. We’ll look at concepts including networkelements, the Network Management Station (NMS), SNMP and RMON probes, theManagement Information Base (MIB), Object Identifiers (OID), and more.Reading this can help you to achieve two objectives: 1) to better understandSNMP’s purpose and history, and 2) to help you better understand how itscomponents work together to deliver management information and controlnetwork devices.HistoryPrior to SNMP, most network devices were managed as individual elements byproprietary network management software. These software point productscould only manage a single vendor’s devices, and some were merely text-basedcommand-line utilities.The lack of functionality and interoperability resulted in overly complexmanagement implementations. Using a multitude of management systemsand network-related commands made troubleshooting network-related issuesextremely difficult, and prevented IT administrators from being able to see asingle, more complete view of the end-to-end network.Defined by the Internet Engineering Task Force (IETF) in the late ‘80s, SNMP wasdesigned to help monitor complex multi-vendor networks. Since then, two moreSNMP versions have been ratified by the Internet Engineering Task Force (IETF).SNMP v1 provided the basic structure and process required to define networkmanagement information, retrieve information from network devices, controldevices, and allow unsolicited messages—called Traps—to be sent to a NMS.The public, or generic, portion of the SNMP MIB defines generic deviceinformation, some limited performance information, and higher level performanceinformation. The public portion defines information that is primarily useful for3

White PaperSNMP: Simplifiedend stations. Device information and limited network information is available inthe public MIB.The lasting power of SNMP developed out of the capability for otherorganizations to extend the MIB. Most network equipment manufacturers haveadded private extensions to the SNMP MIB that define proprietary equipmentinformation. For example, an Ethernet switch manufacturer may offer a privateMIB extension that includes per-port traffic, user, and error information.SNMP VersionsSNMP v1 has been extended several times to incorporate new features,SNMP v2 added several features, including the capability to retrieve data inbulk rather than individually, and added the capability for the NMS toacknowledge a trap message. SNMP v3 added encryption both for thecommunity strings that are used to access to a network device and the SNMPdata transmitted between devices.SNMP Data CollectionSNMP was primarily used for device-based management, and was designed to beas non-invasive as possible. An important requirement for SNMP was to minimizemanaged-element processing overhead. SNMP was therefore designed to collectand report information, but not to provide sophisticated information processing.For example, an SNMP-managed node doesn’t report information such as linkthroughput; rather, SNMP defines the information to be collected and relies onthe NMS to retrieve and process the information to produce a derived value.In this example, determining link throughput requires an NMS to collect two itemsfrom a managed node—the packet count from a network interface, and systemtime. Collection must be performed twice. The NMS then calculates the numberof bits sent or received over the specified time period.RMON MIB ExtensionsThe Remote MONitoring (RMON) extensions to SNMP, including RMON 1 andRMON 2, were defined by the IETF to add “flow-based” monitoring, as opposedto “device-based” monitoring, which is what SNMP primarily delivers. The firstversion, RMON 1, defined ten management groups that focused on OSI Layer 1and Layer 2 information in Ethernet and Token Ring networks, which help tomonitor LANs. The second version, RMON 2, included ten more groups thatadded support for network protocol- and application-layer monitoring. Comparedto standard SNMP agents, agents that fully support RMON management requiremore processing capability. Because of this requirement, full RMON managementis typically carried out by one or more probes designed specifically for RMON.4

White PaperSNMP: SimplifiedWhen implemented fully, RMON can provide many of the features andfunctionality offered by network analyzers. The disadvantage to RMON is thatRMON agents shoulder a greater management burden because they must collectinformation from managed elements and process that information to providehigher-level data.Many network devices lack the processing horsepower required for extensiveprocessing and instead implement only a small subset of the RMON groups. Infact, a device must only support statistics, history, alarms and events, the first fourRMON 1 groups, to be labeled as RMON-compliant.SMON MIB ExtensionsThe Switch MONitoring (SMON) definition further extended RMON to includedetailed (typically Ethernet-based) LAN switch information. SMON enableddevice-wide reporting and control for the one or more virtual LANs (VLANs)defined on the switch.DefinitionsOften technologies like SNMP change over time due to proprietary vendorextensions and implementations, requiring users to learn numerous new terms.Oddly, SNMP terms have remained true to the initial terminology. While thismay seem irrelevant, it actually shows the full commitment and support vendorshave made to SNMP. Below are the necessary definitions for understandinghow SNMP works.Network Element(s): “Network elements are devices such as hosts, gateways,terminal servers, and the like, which have management agents responsible forperforming the network management functions requested by the networkmanagement stations” (J. Case, 1990). Quite simply, a network element is amonitored device. An element is often referred to as a node or a managednode. The (managed) node construct allows SNMP administrators to referencenetwork elements without the complexity normally associated with other systemadministrators. SNMP administrators may use agent to refer to the softwarerunning on a given network element.Network Management Station (NMS): A server that runs the networkmanagement application. It is the primary recipient that network elementscommunicate with to relay the management and control information; it alsoprovides the methods and means to analyze and report significant information.5

White PaperSNMP: SimplifiedSNMP Relay Device (also known as SNMP Probe, SNMP Collection Point,SNMP Proxy Agent): A node that polls Network Elements to collect informationas a proxy for one or more NMSs. The collecting device may itself be an NMS, forexample, residing in a regional data center. An SNMP Relay Device helps localizeSNMP polling and trap reception, thereby reducing SNMP traffic across enterprisebackbones and WAN links. An SNMP Relay Device may do local processing tosummarize data that can then be sent in bulk to the NMS.RMON Probe: An RMON probe, which resides on a specific LAN, collectsinformation for that LAN, performs more sophisticated processing than anSNMP agent, and reports more complex information such as link and individualLayer 2 throughput.Stand-alone RMON probe appliances are another solution that often deliversmore complete RMON feature support than that found in most networkequipment. RMON and SMON enabled administrators to place probes in thenetwork to perform remote polling, logging, and trap forwarding functions.Probes typically have the extra processing power to analyze and distill informationbefore it is transferred to an NMS.Management Information Base (MIB): The MIB is a database containingObject Identifier (OID) information. The MIB can be depicted as a hierarchicaltree-based structure where the MIB is the “tree” and each individual object isa “leaf.” Each individual object is identified by an OID. Levels within the MIBare assigned by different organizations. The top-level MIB OIDs belong tovarious standards organizations, while lower-level OIDs belong to associatedorganizations such as Network Equipment Manufacturers, who assign OIDs thatextend the MIB with proprietary values.Object Identifier (OID): Object Identifiers identify individual entries, or objects,within the MIB. OIDs are specified using an “x,y” naming convention, definedby Abstract Syntax Notation One (ASN.1). In this naming convention, “x” is anumeric value identifying an OID’s position within the MIB tree and “y” is ahuman-readable OID name, also called a variable name. The numerical OIDsmake searching through the MIB and reporting “human readable information”an easier process. Figure 1 represents the F5 OID hierarchy, which defines all OIDsthat reside below the string beginning with 1.3.6.1.4.1.3375.6