SNMP Security

SNMP lacks any authentication capabilities, which results in vulnerability to a variety of security threats. These include masquerading occurrences, modification of information, message sequence and timing modifications, and disclosure. Masquerading consists of an unauthorized entity attempting to perform management operations by assuming the identity of an authorized management entity. Modification of information involves an unauthorized entity attempting to alter a message generated by an authorized entity so that the message results in unauthorized accounting management or configuration management operations.

Message sequence and timing modifications occur when an unauthorized entity recorders, delays or copies and later replays a message generated by an authorized entity. Disclosure results when an unauthorized entity extracts values stored in managed objects or learns of notifiable events by monitoring exchanges between managers and agents. Because SNMP does not implement authentication, many vendors do not implement Set operations, thereby reducing SNMP to a monitoring facility.

SNMPv2 is incompatible with SNMPv1 in two key areas: message formats and protocol operations. SNMPv2 message use different header and protocol data unit (PDU) formats than SNMPv1 message. SNMPv2 also uses two protocol operations that are not specified in SNMPv1. Furthermore, RFC 1908 defines two possible SNMPv1/v2 coexistence strategies: proxy agents and bilingual network-management systems.

SNMP Management

SNMP is a distributed-management protocol. A system can operate exclusively as either an NMS or an agent, or it can perform the functions of both. When a system operates as both an NMS and an agent, another NMS might require that the system query manage devices and provide a summary of the information learned or that it report locally stored management information.

SNMP and Data Representation

SNMP must account for and adjust to incompatibilities between managed devices. Different computers use different data representation techniques, which can compromise the capability of SNMP to exchange information between managed devices. SNMP uses a subset of Abstract Syntax Notation One (ASN.1) to accommodate communication between diverse systems.

SNMP Basic Commands

Managed devices are monitored and controlled using four basic SNMP commands: read, write, trap and traversal operations.

• The read command is used by an NMS to monitor managed devices. the NMS examines different variable that are maintained by managed devices.

• The write command is used by an NMS to control managed devices. The NMS changes the values of variable stored within managed devices.

• The trap command is used by managed devices to asynchronously report events to the NMS. When certain types of events occur, a managed device sends a trap to the NMS.

• Traversal operations are used by the NMS to determine which variables a managed device supports and to sequentially gather information in variable tables, such as a routing table.

SNMP Version 2

SNMP version 2 (SNMPv2) is an evolution of the intial, SNMPv1. Originally, SNMPv2 was published as a set of proposed Internet standards in 1993; currently, it is a draft standard. As with SNMPv1, SNMPv2 functions within the specifications of the Structure of Management Information (SMI). In theory, SNMPv2 offers a number of improvements to SNMPv1, including additional protocol operations.

The structure of Management Information (SMI) defines the rules for describing management information, using ASN.1. The SNMPv2 SMI is described in RFC 1902. It makes certain additions and enhancements to the SNMPv1 SMI-specific data types, such as including bit strings, network addresses and counters. Bit strings are defined only in SNMPv2 and comprise zero or more named bits that specify a value. Network addresses represent an address from a particular protocol family. SNMPv1 supports only 32-bit IP addresses, but SNMPv2 can support other types of addresses as well. Counters are non-negative integers that increase until they reach a maximum value and then return to zero. In SNMPv1, a 32-bit counter size is specified. In SNMPv2, 32-bit and 64-bit counters are defined.

The SNMPv2 SMI also specifies information modules, which specify a group of related definitions. Three types of SMI information modules exists: MIB modules, compliance statements, and capability statements. MIB modules contain definitions of interrelated managed objects. Compliance statements provide a systematic way to describe a group of managed objects that must be implemented for conformance to standard. Capability statements are used to indicate the precise level of support that an agent claims with respect to a MIB group. An NMS can adjust its behavior toward agents according to the capabilities statements associated with each agent.

SNMP Version 1

SNMP version 1 (SNMPv1) is the initial implementation of the SNMP protocol. It is described in Request For Comments (RFC) 1157 and functions within the specifications of the Structure of Management Information (SMI). SNMPv1 operates over protocols such as User Datagram Protocol (UDP), Internet Protocol (IP), OSI Connectionless Network Service (CLNS), AppleTalk Datagram-Delivery Protocol (DDP) and Novell Internet Packet Exchange (IPX), SNMPv1 is widely used and is the de facto network-management protocol in the Internet community.

The Structure of Management Information (SMI) defines the rules for describing management information, using Abstract Syntax Notation One (ASN.1). The SNMPv1 SMI is defined in RFC 1155. The SMI makes three key specifications: ASN.1 data types, SMI-specific data types and SNMP MIB tables.

The SNMPv1 SMI specifies that all managed objects have a certain subset of Abstract Syntax Notation One (ASN.1) data types associated with them. Three ASN.1 data types are required: name syntax and encoding. The name serves as the object identifier (object ID). The syntax defines the data type of the object (for example, integer or string). The SMI uses a subset of the ASN.1 syntax definitions. The encoding data describes how information associated with a managed object is formatted as a series of data items for transmission over the network.

The SNMPv1 SMI specifies the use of a number of SMI-specific data types, which are divided into two categories: simple data types and application-wide data types. Three simple data types are defined in the SNMPv1 SMI, all of which are unique values: integers, octet strings, and object IDs. The integer data type is a signed integer in the range of -2,147,483,648 to 2,147,483,647. Octet strings are ordered sequences of 0 to 65,535 octets. Object IDs come from the set of all object identifiers allocated according to the rules specified in ASN.1.

Seven application-wide data types exist in the SNMPv1 SMI: network addresses, counters gauges, time ticks, opaques, integers and unsigned integers. Network addresses represent an address from a particular protocol family. SNMPv1 supports only 32-bit IP addresses. Counters are non-negative integers that increase until they reach a maximum value and then return zero. In SNMPv1, a 32 bit counter size is specified. Gauges are non-negative integers that can increase or decrease but that retain the maximum value reached. A time tick represents a hundredth of a second since some event. A opaque represents an arbitrary encoding that is used to pass arbitrary information strings that do not conform to the strict data typing used by the SMI. An integer represents signed integer-valued information. This data type redefines the integer data type, which has arbitrary precision in ASN.1 but bounded precision in the SMI. An unsigned integer represents unsigned integer-valued information and is useful when values are always non-negative. This data type redefines the integer data type, which has arbitrary precision in ASN.1 but bounded precision in the SMI.

Simple Network Management Protocol (SNMP)

Simple Network Management Protocol (SNMP) is an application-layer protocol that facilitates the exchange of management information between network devices. It is part of the Transmission Control Protocol/Internet Protocol (TCP/IP) protocol suite. By using SNMP to access management information data, network administrators can more easily manage network performance and find and solve network problems and plan for network growth. Two versions of SNMP exist namely:

• SNMP version 1 (SNMPv1)
• SNMP version 2 (SNMPv2)

An SNMP-managed network consists of three key components: managed devices, agents and network-management systems (NMSs). A managed device is a network node that contains an SNMP agent and that resides on a managed network. Managed devices collect and store management information and make this information available to NMSs using SNMP. Managed devices, sometimes called network elements, can be routers and access servers, switches and bridges, hubs, computer hosts or printers.

An agent is a network-management software module that resides in a managed device. An agent has local knowledge of management information and translates that information into a form compatible with SNMP. An NMS executes application that monitor and control managed devices. NMSs provide that bulk of the processing and memory resources required for network management. One or more NMSs must exist on any managed network.

Accounting Management

The goal of accounting management is to measure network utilization parameters so that individual or group uses on the network can be regulated appropriately. Such regulation minimizes network problems (because network resources can be apportioned based on resource capacities) and maximizes the fairness of network access across all users.

In performance management, the first step toward appropriate accounting management is to measure utilization of all important network resources. Analysis of the results provides insight into current usage patterns and usage quotas can be set at this point. Some correction, of course, will be required to reach optimal access practices. from this point, ongoing measurement of resource use can yield billing information as well as information used to assess continued fair and optimal resource utilization.

Security Management

The goal of security management is to control access to network resources according to local guidelines so that the network cannot be sabotaged (intentionally or unintentionally) and sensitive information cannot be accessed by those without appropriate authorization. A security management subsystem, for example, can monitor users logging on to a network resource and can refuse access to those who enter inappropriate access codes.

Security management subsystems work by partitioning network resources into authorized and unauthorized areas. For some users, access to any network resource is inappropriate, mostly because such users are usually company outsiders. For other (internal) network users, access to information originating from a particular department is inappropriate. Access to Human Resource files, for example, is inappropriate for most users outside the Human Resources department.

Security management subsystems perform several functions. They identify sensitive network resources (including systems, files, and other entities) and determine mappings between sensitive network resources and user sets. They also monitor access points to sensitive network resources and log appropriate access to sensitive network resources.

• Authentication: Authentication is the process of identifying users, including login and password dialog, challenge and response and messaging support. Authentication is the way a user is identified prior to being allowed access to the router or switch. There is a fundamental relationship between authentication and authorization. The more authorization privileges a user receives, the stronger the authentication should be.

• Authorization: Authorization provides remote access control, including one-time authorization and authorization for each service that is requested by the user. On a Cisco router, the authorization level range for users is 0 to 15 with 0 being the lowest level and 15 the highest.

• Accounting: Accounting allows for the collecting and sending of security information used for billing, auditing, and reporting, such as user identities, start and stop times and executed commands. Accounting enables network managers to track the services that users are accessing as well as the amount of network resources they are consuming.

Performance Management

The goal of performance management is to measure and make available various aspects of network performance so that internetwork performance can be maintained at an acceptable level. Example of performance variables that might be provided include network throughput, user response times and line utilization.

Performance management involves three main steps. First, performance data is gathered on variables of interest to network administrators. Second, the data is analyzed to determine normal (baseline) levels. Finally, appropriate performance thresholds are determined for each important variable so that exceeding these thresholds indicates a network problem worthy of attention.

Management entities continually monitor performance variables. When a performance threshold is exceeded, an alert is generated and sent to the network management system.

Each of the steps just described is part of the process to set up a reactive system. When performance becomes unacceptable because of an exceeded user-defined threshold, the system reacts by sending a message. Performance management also permits proactive methods: For example, network simulation can be used to project how network growth will affect performance metrics. Such simulation can alert administrators to impending problems so that counteractive measures can be taken.

Fault Detection and Notification

The purpose of fault management is to detect, isolate, notify and correct faults encountered in the network. Network devices are capable of alerting management stations when a fault occurs on the systems. An effective fault management system consists of several subsystems. Fault detection is accomplished when the devices send SNMP trap messages, SNMP polling, remote monitoring (RMON) thresholds and syslog messages. A management system alerts the end user when a fault is reported and corrective actions can be taken.

Fault detection and monitoring of network elements can be expanded from the device level to the protocol and interface levels. For a network environment , fault monitoring can include Virtual Local Area Network (VLAN), asynchronous transfer mode (ATM), fault indications on physical interfaces and so forth.

Troubleshooting Infrastructure

Trivial File Transfer Protocol (TFTP) and system log (syslog) servers are crucial components of a troubleshooting infrastructure in network operations. The TFTP server is used primarily for storing configuration files and software images for network devices. Routers and switches are capable of sending system log messages to a syslog server. The messages facilitate the troubleshooting function when problems are encountered.

Network Management Platforms

A network management platform deployed in the enterprise manages an infrastructure that consists of multivendor network elements. The platform receives and processes events from network elements in the network. Events from servers and other critical resources can also be forwarded to a management platform. The following commonly available functions are included in a standard management platform:

• Network discovery


• Topology mapping of network elements


• Event handler


• Performance data collector and grapher


• Management data browser.

Network management platforms can be viewed as the main console for network operations in detecting faults in the infrastructure. The ability to detect problems quickly in any network is critical. Network operations personnel can rely on a graphical network map to display the operational states of critical network elements such as routers and switches.

Network management platforms such HP OpenView, Computer Associates Unicenter and SUN Solstice can perform a discovery of network devices. Each network device is represented by a graphical element on the management platform's console. Different colors on the graphical elements represent the current operational status of network devices. Network devices can be configured to send notifications, called SNMP traps, to network management platforms. Upon receiving the notifications, the graphical element representing the network device changes to a different color depending on the severity of the notification received. The notification, usually called an event, is placed in a log file.

A number of network management platforms are capable of managing multiple geographically distributed sites. This is accomplished by exchanging management data between management consoles at remote sites with a management station at the main site. The main advantage of a distributed architecture is that it reduces management traffic, thus, providing a more effective usage of bandwidth. A distributed architecture also allows personnel to locally manage their networks from remote sites with systems.

A recent enhancement to management platforms is the ability to remotely management network elements using a web interface. This enhancement eliminates the need for special client software on individual user stations to access a management platform.

A typical enterprise is comprised of different network elements. However, each device normally requires vendor-specific element management systems in order to effectively manage the network elements. Therefore, duplicate management stations may be polling network elements for the same information. The data collected by different systems is stored in separate databases, creating administration overhead for users. This limitation has prompted networking and software vendors to adopt standards such as Common Object Request Broker Architecture (CORBA) and Computer-Integrated Manufacturing (CIM) to facilitate the exchange of management data between management platforms and element management systems. With vendors adopting standards in management system development, users can expect interoperability and cost savings in deploying and managing the infrastructure.

Fault Management

The goal of fault management is to detect, log, notify users of and (to the extent possible) automatically fix network problems to keep the network running effectively. Because faults can cause downtime or unacceptable network degradation, fault management is perhaps the most widely implemented of the ISO network management elements.

Fault management involves first determining symptoms and isolating the problem. Then the problem is fixed and the solution is tested on all-important subsystems. Finally, the detection and resolution of the problem is recorded.

Configuration Management

The goal of configuration management is to monitor network and system configuration information so that the effects on network operation of various versions of hardware and software elements can be tracked and managed.

Each network device has a variety of version information associated with it. An engineering workstation, for example, may be configured as follows:

• Operating system, Version 3.2
• Ethernet interface, Version 5.4
• TCP/IP software, Version 2.0
• NetWare software, Version 4.1
• NFS software, Version 5.1
• Serial communication controller, Version 1.1
• X.25 software, Version 1.0
• SNMP software, Version 3.1

Configuration management subsystems store this information in a database for easy access. When a problem occurs, this database can be searched for clues that may help solve the problem.

Internet and IEEE Network Management Standards

The Internet is a computer network made up to thousands of networks worldwide. All computers on the Internet communicate with one another using the Transmission Control Protocol/Internet Protocol suite, abbreviated to TCP/IP. Computers on the Internet use a client/server architecture. This means that the remote server machine provides files and services to the user's local client machine. Software can be installed on a client computer to take advantage of the latest access technology.

The Internet consists primarily of variety of access protocols. Many of these protocols feature programs that allow users to search for and retrieve material made available by the protocol. An Internet user has access to a wide variety of services: electronic mail, file transfer, vast information resources, interest group membership, interactive collaboration, multimedia displays, real-time broadcasting, shopping opportunities, breaking news and much more.

The World Wide Web (abbreviated as the Web or WWW) is a system of Internet servers that supports hypertext to access several Internet protocols on a single interface Almost every protocol type available on the Internet is accessible on the Web. This include e-mail, FTP, Telnet, and Usenet News. In addition to these, the World Wide Web has its own protocol: HyperText Transfer Protocol, or HTTP.

The World Wide Web provides a single interface for accessing all these protocols. This creates a convenient and user-friendly environment. It is no longer necessary to be conversant in these protocols within separate, command-level environments. The Web gathers together thse protocols into a single system. Because of this feature, and because of the Web's ability to work with multimedia and advanced programming languages, the World Wide Web is the fastest-growing component of the Internet.

IEEE has developed a set of network standards. They include:

IEEE 802.1 - Specifies Network Management Standards.

IEEE 802.2 - Specifies the General standard for the OSI Reference Model data link layer.

IEEE 802.3 - Defines the Media Access Control layer for bus networks that use CSMA/CD.

IEEE 802.4 - Defines the Media Access Control layer for bus networks that use a token-passing mechanism.

IEEE 802.5 - Defines the MAC layer for token Ringh Network.

IEEE 802.6 - Defines MAN's (Metropolitan Area Network) Standard.

IEEE 802.7 - Broadband Technical advisory group.

IEEE 802.8 - Fibre Optic Technical advisory group.

IEEE 802.9 - ISDN (Integrated Services Digital Network).

IEEE 802.10 - Specifies Network Security Standards.

IEEE 802.11 - Specifies Wireless Network Standards.

IEEE 802.12 - Specifies 100 VG Any LAN Standards.

IEEE 802.14 - Specifies Cable Modem Standards.

Overview of OSI - Layer Model

Layer 1 of the layer model is the Physical Layer and defines the physical and electrical characteristics of the network. The NIC cards in the PC and the interfaces on the routers all run at this level and eventually have to pass strings of ones and zeros down the wire.

Layer 2 is known as the Data Link Layer. It defines the access strategy for sharing the physical medium, including data link and media access issues. Protocols such as PPP, SLIP and HDLC exist here.

On an Ethernet, of course, access is governed by a device's MAC address, the six byte number that is unique to each NIC. Devices which depend on the level include bridges and switches, which learn which segment's devices are on by learning the MAC addresses of devices attached to various ports.

This is how bridges are eventually able to segment off a large network, only forwarding packets between ports of two devices on separate segments need to communicate. Switches quickly learn a topology map of the network and can thus switch packets between communicating devices very quickly. It is for this reason that migrating a device between different switch ports can cause the device to lose network connectivity for a while, until the switch, or bridge, re-ARP's.

Layer 3 is the Network Layer, providing a means for communicating open systems to establish, maintain and terminate network connections. The IP protocol exists at this layer and so, do some routing protocols. All the routers in the network are operating at this layer.

Layer 4 is the Transport Layer, and is where TCP exists. The standard says that "The Transport Layer relieves the Session Layer of the burden of ensuring data reliability and integrity". It is for this reason that people are becoming very excited about the new Layer 4 switching technology.

Before these devices became available, only software operated at this layer. Hopefully, you will now also understand why TCP/IP is uttered in one breath. TCP over IP, since Layer 4 is above (over) Layer 3. It is at this layer that, should a packet fail to arrive (perhaps due to misrouting, or because it was dropped by a busy router), it will be retransmitted, when the sending party fails to receive an acknowledgement from the device with which it is communicating.

The more powerful routing protocols also operate here, OSPF and BGP, for example, are implemented as protocols directly over IP.

Layer 5 is the Session Layer. It provides for two communicating presentation entities to exchange data with each other.

The Session Layer is very important in the E-commerce field since, once a user starts buying items and filling their "shopping basket" on a Web server, it is very important that they are not load-balanced across different servers in a server pool. This is why, clever as Layer 4 switching is , these devices still operate software to look further up the layer model. They are required to understand when a session is taking place, and not to interfere with it.

Layer 6 is the Presentation Layer. This is where application data is either packed or unpacked, ready for use by the running application. Protocol conversions, encryption/decryption and graphics expansion all takes place here.

Finally, Layer 7 is the Application Layer. This is where you find your end-user and end-application protocols, such as telnet, ftp and mail (pop3 and smtp).

The Stack Our imaginary listener, eavesdropping on the conversations of network engineers, would hear them refer to IP stacks quite frequently. They are called stacks because, in order to get a packet from an application running on device A to an application running on device B, the packets have to descend and then re-ascent the layers (the stack).

Consider the following example:

An application forms a packet of data to be sent; this takes place at Layer 7. As the packet descents the stack, it is wrapped in headers and trailers, as required by the various protocols, until, having reached Layer 1, it is transmitted as a frame across the medium in use.

Upon reaching device B, it reascends the stack, as the device strips off the appropriate headers and trailers, delivering just the application data to the application. The OSI tried to keep to as few layers as possible for the sake of simplicity. The fact that the 7-Layer model is universally used to describe where a device or protocol sits in the scheme of things shows that the designers did an excellent job of achieving their aims.

Bridges, switches and most network devices keep a table mapping IP addresses to Media Access addresses. Moving a device between ports invalidates these tables and hence the device's view of the world.

Fortunately, the devices age their table entries, typically clearing them out five minutes after the last time a packet was seen from a particular entity. This is sometimes called re-ARPing. Most bridges and switches provide management functions to allow you to clear the ARP entry manually, should you have needed to move a device due to a failed port.

Overview of OSI

The ISO (International Standards Organization) has created a layered model, called the OSI (Open Systems Interconnect) model, to describe defined layers in a network operating system. The purpose of the layers is to provide clearly defined functions that can improve Internetwork connectivity between "computer" manufacturing companies. Each layer has a standard defined input and a standard defined output.

The OSI Reference model defines seven layers that describe how applications running upon network-aware devices may communicate with each other. The model is generic and applies to all network types, not just TCP/IP and all media types, not just Ethernet. It is for this reason that any network technician will glibly throw around the term "Layer 4" and expect to be understood.

It should be noted however, that most protocols in day-to-day use work on a slightly modified layer system. TCP/IP, for example, uses a 6-rather that a 7-layer model. Nevertheless, in order to ease the exchange of ideas, even those who only ever use TCP/IP will refer to the 7-layer model when discussing networking principles with peers from a different networking background.

Confusingly, the OSI was a working group within the ISO (International Standards Organisation) and therefore,many people refer to the OSI Reference model as the ISO Reference model. They are referring to the same thing.

Traditionally, layer diagrams are drawn with Layer 1 at the bottom and Layer 7 at the top. The remainder of this article describes each layer, starting from the bottom and explains some of the devices and protocols that may be found in the data centre operating at this layer.

Hubs

Provide full bandwidth to each client, unlike BUS networks where the bandwidth is shared. Often include buffering of packets and filtering, so that unwanted packets (or packets which contain errors) are discarded. In standard ethernet, all stations are connected to the same network segment in bus configuration. Traffic on the bus is controlled using the CSMA protocol and all stations share the available bandwidth.

Hubs dedicate the entire bandwidth to each port (workstation). The workstations attach to the hub using UTP. The hub provides a number of ports, which are logically combined using a single backplane, which often runs at a much higher data rate than that of the ports. Ports can also be buffered, to allow packets to be held in case the hub or port is busy. As each workstation has their own port, they do not contend with other workstations for access, having the entire bandwidth available for their exclusive use.

The ports on a hub all appear as one single ethernet segment. In addition, hubs can be stacked or cascaded (using master /slave configurations) together, to add more ports per segment. As hubs do not count as repeaters, this is a better option for adding more workstations than the use of a repeater.

Hub options also include SNMP (Simple Network Management Protocol) agent. This allows the use of network management software to remotely administer and configure the hub. Detailed statics related to port usage and bandwidth is often available, allowing informed decisions to be made concerning the state of the network.

Routers

Packets are only passed to the network segment they are destined for. They work similar to bridges and switches in that they filter out unnecessary network traffic and remove it from network segments. Routers generally work at the protocol level. Routers were devised in order to separate networks logically. For instance, a TCP/IP router can segment the network based on IP subnets. Filtering at this level ( on IP addresses) will take longer than that of a bridge or switch which only looks at the MAC layer.

Most routers can also perform bridging functions. A major feature of routers, because they can filter packets at a protocol level, is to act as a firewall. This is essentially a barrier, which prevents unwanted packets either entering or leaving the network.

Typically, an organization which connects to the Internet will install a router as the main gateway link between their network and the outside world. By configuring the router with access lists (which define what protocols and what hosts have access ) this enforces security by restricted (or allowing) access to either internal or external hosts.

For example, an internal WWW server can be allowed IP access from external networks, but other company servers which contain sensitive data can be protected, so that external hosts outside the company are prevented access.