In this article we present the Structure of Management Information from SNMP, for all three versions of SNMP, as well as the main differences between them. In the first part, two version of SNMP are presented: version 1, version 2; and in the last part the third version, that uses a security model for information protection, is presented

Oancea DANIEL

Directory of Open Access Journals

THE ANNALS OF "DUNAREA DE JOS" UNIVERSITY OF GALATIFASCICLE III, 2003 ISSN 1221-454XELECTROTECHNICS, ELECTRONICS, AUTOMATIC CONTROL, INFORMATICSThis paper was recommended for publication by Luminiţa DUMITRIU82STRUCTURE OF MANAGEMENT INFORMATION IN SNMPOancea DanielAbstract. In this article we present the Structure of Management Information fromSNMP, for all three versions of SNMP, as well as the main differences between them.In the first part, two version of SNMP are presented: version 1, version 2; and in the lastpart the third version, that uses a security model for information protection, is presented.Keywords:1. INTRODUCTIONAppeared as a necessity related to the growth of thenetwork and to the higher and higher complexity oftheir management, SNMP have been imposed in theInternet World as being able to find and resolve theoccurring network problems.The Structure of Management of Information (SMI)from SNMPv1 defines the rules for describing themanagement information, using Abstract SyntaxNotation One (ASN.1). The  SMI SNMPv1 specifiesthat all managed objects have a subset of AbstractSyntax Notation One (ASN.1) data types associatedwith them.Three ASN.1 data types are required: name, syntaxand encoding. The name serves as the objectidentifier (object ID). The Syntax defines the datatype of the object (for example, integer or string).The encoding field describes how the informationassociated with the managed object is formatted to betransmitted in the network.2. SNMP AND ASN.1 DATA TYPESThe SMI SNMPv1 specifies the use of a number ofSMI-specific data types, which are divided into twocategories: simple data types and application-widedata types.Three simple data types are defined in the SNMPv1SMI, all of which are unique values: integers, octetstrings and object IDs.The integer data type is a signed integer in the rangeof -2,147,483,648 to 2,147,483,647.Octet strings are ordered sequences of 0 to 65,535octets.Object IDs come from the set of all object identifiersallocated according to the rules specified in ASN.1Seven application-wide data types exist in theSNMPv1 SMI: network addresses, counters, gauges,timeticks, opaques, integers, and unsigned integers.Network addresses represent an address from aparticular protocol family.3. SNMP MIB TABLESThe SNMPv1 SMI defines structured tables that areused to group the instances of a tabular object (anobject that contains multiple variables). Tables arecomposed of zero or more rows, which are indexedin a way that allows SNMP to retrieve or alter anentire row with a simple Get,  GetNext, or Setcommand.THE ANNALS OF "DUNAREA DE JOS" UNIVERSITY OF GALATIFASCICLE III, 2003 ISSN 1221-454X834. SNMP PROTOCOL OPERATIONSSNMP is in fact a simple request/response protocol.The network-management system issues a request,and managed devices, residing in the network,process the information and return responses. Thisbehavior is implemented using one of four protocoloperations: Get, GetNext, Set, and Trap.In the case Get command is used, the NetworkManagement System (NMS) retrieves the value ofone or more object instances from an agent. If theagent responding to the Get operation cannot providevalues for all the object instances in a list, it does notprovide any values.The  GetNext operation is used by the NMS toretrieve the value of the next object instance in atable or a list within an agent.The  Set operation is used by the NMS to set thevalues of object instances within an agent.The  Trap operation is used by agents toasynchronously inform the NMS of a significantevent.5. SNMPV 2SNMP version 2 (SNMPv2) is an evolution of theinitial version, SNMPv1. Originally, SNMPv2 waspublished as a set of proposed Internet standards in1993; currently, it is a draft standard. Similarly toSNMPv1, SNMPv2 functions within thespecifications of the Structure of ManagementInformation (SMI). Theoretically, SNMPv2 offers anumber of improvements to SNMPv1, includingadditional protocol operations. It makes certainadditions and enhancements to the SNMPv1 SMI-specific data types, such as including bit strings,network addresses, and counters. Representatives forSNMPv2 are bit strings; they comprise zero or morenamed bits that specify a value. In the networkaddress case version1 supports only 32-bit IPaddresses, while the second version can support othertypes of addresses as well. There are also 64 bitcounters. In SNMPv1, a 32-bit counter size isspecified. In SNMPv2, 32-bit and 64-bit counters aredefined.6. SNMP MANAGEMENTSNMP is a distributed-management protocol. Asystem can operate exclusively either as an NMS oras an agent, or it can perform the functions of both.When a system operates as both a NMS and an agent,another NMS might require that the system querymanages devices and provides a summary of theinformation learned, or that it reports locally storedmanagement information.7. SNMP SECURITYIn what concerns the security, the first two versionsof in SNMP do not provide authentication andsupport for such a capability. Therefore there it isvulnerable in security. These include masqueradingoccurrences, modification of information, messagesequence, timing modifications and disclosure.Masquerading consists of an unauthorized entityattempting to perform management operations byassuming the identity of an authorized managemententity.Modification of information involves anunauthorized entity attempting to alter a messagegenerated by an authorized entity so that the messageresults in unauthorized accounting management orconfiguration management operations.Message sequence and timing modifications occurwhen an unauthorized entity reorders, delays, orcopies and later replays a message generated by anauthorized entity.Disclosure is involved when unauthorized entityextracts values stored in managed objects, or learnsof noticeable events by monitoring exchangesbetween managers and agents.Because SNMP does not implement authentication,many vendors do not implement Set operationsWe can resume that SNMPv2 provides extendedcapabilities: message format transmitted over thenetwork and a new set of operations protocol.SNMPv2 uses a different header format message andProtocol Data Unit beside SNMPv1. SNMPv2 alsodefines two new protocol operations: GetBulk andInform. The  GetBulk operation is used by the NMS toefficiently retrieve large blocks of data, such asmultiple rows in a table. GetBulk fills a responsemessage with as much of the requested data as willfit.The Inform operation allows one NMS to send trapinformation to another NMS and to receive aresponse.Can these two versions coexist in a network?Furthermore, RFC 1908 defines two possibleSNMPv1/v2 coexistence strategies: proxy agents andbilingual network-management systems.7.1. Proxy AgentsA SNMPv2 agent can act as a proxy agent on behalfof SNMPv1 managed devices, as follows:-  When an SNMP NMS issues a commandintended for a SNMPv1 agent, theTHE ANNALS OF "DUNAREA DE JOS" UNIVERSITY OF GALATIFASCICLE III, 2003 ISSN 1221-454X84NMS(Network Management System) sends theSNMP message to the SNMv2 proxy agent.-   The proxy agent forwards the Get, GetNext, andSet messages to the SNMPv1 agent unchanged,while GetBulk messages are converted by theproxy agent to GetNext messages and areforwarded to the SNMPv1 agent.-  The proxy agent maps SNMPv1 trap messagesto SNMPv2 trap messages and then forwardsthem to the NMS.7.2. Bilingual Network-Management NetworkIf bilingual Network Management System is used, itsmanagement applications must contact an agent. TheNMS then examines the information stored in a localdatabase to determine whether the agent supportsSNMPv1 or SNMPv2. Based on the information inthe database, the NMS communicates with the agentusing the appropriate version of SNMP.8. SNMPV3The Security model, used by the SNMPv3, is  theUser Security Model (USM) it is specified defined byRFC2574. The USM provides authentication andprivacy services for SNMP and it is designed tosecure against the following threats: modification ofinformation, masquerading, message streammodification and disclosure.A SNMP community is a relationship between aSNMP agent and a set of SNMP managers thatdefines authentication, access control and proxycharacteristics. The managed system establishes onecommunity for each desired combination ofauthentication, access control and proxycharacteristics. Each community is given a unique(within the agent) community name, and themanagement stations within that community areprovided with and must employ the community namein all Get and Set operations.Still, the community name may be read from aSNMPv1/SNMPv2 message using a packet captureapplication; v1/v2 messages are not encrypted.SNMPv3 message consists of three sectionsmsgGlobalData (header), msgSecurityParameters andmsgData (scopedPdu). The middle section dependson the security model in use. SNMPv3 defines USMas a security model of choice but vendors are free toimplements their own security models. The last fieldin the message header is an integer that represents thesecurity model used for this message. If USM is usedthis field contains the value 3. The header alsocontains a flag field that carry information about thesecurity level applied to the message. Possiblecombinations are: no security applied, the message isauthenticated, the message is authenticated andencrypted.The msgSecurityParameters field consists of sixfields that ensure protection against the securitythreats listed above. Note that USM does not preventDenial of Service and Traffic Analysis attacks.  Notall fields in this section are used in every exchange.Which fields are used depends on the security level.Two fields that are always used aremsgAuthoritativeEngineID (the snmpEngineID ofthe authoritative SNMP engine involved in theexchange of this message) and msgUserName (theuser on whose behalf the message is beingexchanged).The Principal field identifies the entity on whosebehalf services are provided or processing takesplace. A principal can be, among other things, anindividual acting in a particular role; a set ofindividuals, each of them acting in a particular role;an application or a set of applications; andcombinations thereof. With other words it’s possibleto consider an application or an application set.SecurityName is a human readable stringrepresenting a principal. It has a model independentformat, and can be used outside a particular SecurityModel. Model-depend security ID is the model-specific representation of a securityName within aparticular Security Model. Model-dependent securityIDs may or may not be human readable, and have amodel-dependent syntax.8.1. Message ExchangeLet’s see how message exchange is performed. In thefirst place, as mentioned above, even if no security isapplied to the message, two fields from themsgSecurityParameters section must be populated:authoritative engine ID and user name.A manager that wants to retrieve/modify an object inthe agent has to know that agent’s engine id and hasto insert into the message the appropriate user name.If we want to assure the authenticity of thecommunication between the manager and the agent(the agent wants to be sure that the message comesfrom the manager that it claims, and vice versa, themanager wants to be sure that the response reallycomes from the targeted agent), then the sender hasto calculate the message digest (using MD5 or SHAhash functions) and insert it intomsgAuthenticationParameters field of themsgSecurityParameters. The receiver removes thedigest from the message, stores it into a temporarylocation, fills in the empty space with zero octets andcalculates the message digest. If the calculated digestis the same as the received digest then the message isauthentic; otherwise, a possible impostor is trying toillegally perform the operation.THE ANNALS OF "DUNAREA DE JOS" UNIVERSITY OF GALATIFASCICLE III, 2003 ISSN 1221-454X85In order to prevent replay attack, USM usestimeliness mechanism. The idea is simple. Theauthoritative engine maintains two objects,snmpEngineBoots and snmpEngineTime that referthe local time. Non-authoritative engines mustremain loosely synchronized with each authoritativeSNMP engine with which it communicates. For thatpurpose non-authoritative engines keep a local copyof three variables per remote engine ID:snmpEngineBoots, snmpEngineTime andlatestReceivedEngineTime.8.2. SNMP EntitiesThe following three types of applications have beendefined (see the figure above):-  Command Generator Application that initiatesthe protocol operations: Get, GetNext, GetBulkand Set;-  Command Response Application where SNMPGet, GetNext, GetBulk and/or Set requests arereceived;-  Notification Generator Application whichmonitors the system events and generates Trapand/or Inform messages based on these;-  Notification Receiver Application that behaveslike a notification messages listener andgenerates response messages when a messagescontaining an Inform PDU is received and-  Proxy Forwarder Application that forwardsSNMP messages.9. CONCLUSIONSThere are several differences the between StructureManagement Information data types used in theversion one and two. In what concerns protocoloperation: the Get, GetNext, and Set operations usedin SNMPv1 are exactly the same as those used inSNMPv2. However, SNMPv2 adds and enhancessome protocol operations. The SNMPv2 Trapoperation, for example, serves the same function asthat used in SNMPv1, but it uses a different messageformat and is designed to replace the SNMPv1 Trap.SNMPv2 also defines two new protocol operations:GetBulk and Inform. In SNMPv2, if the agentresponding to GetBulk operations cannot providevalues for all the variables in a list, it provides partialresults.SNMPv3 is much more complex than SNMPv1 orSNMPv2c. Complexity comes from the securitymechanism used in SNMPv3. SNMPv1 andSNMPv2c provide only a primitive and limitedcapability for security based on community names. Itis obvious that community based security does notprovide protection against the threats.Encryption without authentication is not valid.msgSecurityParameters section consists of six fieldsthat ensure protection against security.We intend to continue our studies on a new securitymodel, USM-based, enhanced with powerful cryptingalgorithms.Two major algorithms are considered interesting asadditional data coding protocols, namely, AES andTriple DES. The Internet Engineering Task Force isattempting to implement AES as an additional codingsolution.10. REFERENCESInternetworking Technologies Handbook Reference:SNMPv2 Message Format. Simple NetworkManagement Protocol SNMP  Hands onSNMPv3 Tutorial & Demo Manual – NuDesignTeam Inc.John Larmouth (1999) ASN.1 Complete by Prof. JohnLarmouth –Open Systems SolutionsMichael Pott (1997) .HP OpenViewIT/Administration  HP OpenViewSerban Simu–-Managementul de retea, de la simplula complex  Computer Press Agora

Structure Of Management Information In SNMP

Abstract

Similar works

Full text

Available Versions

Directory of Open Access Journals