PV090: SNMP a monitoring siete

Michal Raček, <xracek@fi.muni.cz>

Protokol SNMP

Popis

Field Description
IP Header Identifies source/destination IP addresses and routing information for delivering the SNMP message across networks.
UDP Header Contains source/destination ports (typically UDP/161 for requests, UDP/162 for traps) and length/checksum for SNMP transport.
Version SNMP protocol version used (v1, v2c, v3).
Community Community string used for authentication in SNMP v1/v2c (e.g., “public”, “private”).
PDU Type Indicates SNMP operation (GetRequest, GetNextRequest, GetResponse, SetRequest, Trap, etc.).
Request-ID Unique identifier used to match requests and responses.
Error-Status Indicates success or specific error (e.g., noError, tooBig, noSuchName).
Error-Index Points to the variable binding that caused the error (if any).
Variable Bindings List of OIDs with their corresponding values (null for requests, filled for responses).

Network Stack

Komunikujúce strany:

Verzie SNMP

Verzia Popis
SNMPv1 Pôvodná verzia SNMP so základnými metódami. Bez šifrovania.
SNMPv2c Vylepšená oproti SNMPv1. Zachovává metódy. Bez šifrovania. Vylepšenie protokolových operacií a typu dát. Pridáva metódy GetBulk, INFORM.
SNMPv3 Zavádza bezpečnostné funkcionality, šifrovanie a overovanie. Vylepšenie integrity dát.

Metódy SNMP

Názov metódy CLI nástroj SNMPv1 SNMPv2c SNMPv3 Popis
GET snmpget ✅ ✅ ✅ získa zoznam presne zadaných objektov
GETNEXT snmpgetnext, snmpwalk ✅ ✅ ✅ získa ďalší objekt v MIB strome (inorder)
GETBULK snmpgetbulk ❌ ✅ ✅ podobné GETNEXT, vracia viac nasledujúcich objektov naraz
SET snmpset ✅ ✅ ✅ pošle konfiguráciu alebo príkaz SNMP agentovi
TRAP snmptrap ✅ ✅ ✅ jednosmerná asynchrónna správa od agenta smerom k NMS
INFORM snmpinform ❌ ✅ ✅ skoro ako TRAP, len sa očakáva odpoveď druhej strany
RESPONSE - ✅ ✅ ✅ odpoveď na všetky ostatné typy správ (okrem: TRAP, REPORT, RESPONSE)
REPORT - ❌ ❌ ✅ interná správa protokolu, väčšinou komunikačná chyba

Autentizácia v SNMP

SNMPv1 a SNMPv2c

SNMPv3

Strom MIB-2, OIDs

Príklad stromu: objekt sysName s OID .1.3.6.1.2.1.1.5:

  • OID tool

    • SNMP trap a inform

    Konfigurácia SNMP

    Možnosti

    1. Interaktívny nástroj snmpconf
    2. Konfiguračné súbory

    Príklad konfigurácie pre SNMPv1/SNMPv2c

    
agentAddress udp:161,udp6:[::1]:161

# Do not log every TCP connecion
dontLogTCPWrappersConnects yes

sysLocation    "rabbit hole"
sysContact     "<unix@fi.muni.cz>"
sysName        "white-rabbit"

view my_systemview  included   .1.3.6.1.2.1.1
view my_systemview  included   .1.3.6.1.2.1.25.1

view my_monitorview included   .1.3.6.1.2.1.25
view my_monitorview excluded   .1.3.6.1.2.1.25.4.2

# source means accessibility

#           community                   source          oid
rocommunity my_ro_community         10.0.0.0/24     -V my_systemview
rwcommunity my_rw_community         10.0.10.0/24    -V my_monitorview
rocommunity my_ro_localhost_system      localhost       system

#============================================================================================

# More Complex access control

# Maps comunity to security name
#           sec.name        source              community
com2sec     my_sec_name     localhost           my_secret_community
com2sec     my_sec_name     10.0.0.0/24         my_secret_community
com2sec6    my_6_sec_name   default             public
com2sec6    my_6_sec_name   fd00:dead:beef::1   my_secret_community

# Maps security name to group
#                   sec.model   sec.name
group   my_group    any         my_sec_name
group   my_group    v2c         my_sec_name
group   my_group    v1          my_sec_name


# Maps MIBs to views
#                   incl/excl   subtree             mask
view    my_view     excluded    .1                  ff
view    my_view     included    sysUpTime.0         ff
view    my_view     included    ifNumber            ff

# Maps view to groups
#                   context sec.model   sec.level   match   read    write   notif
access  my_group    ""      any         noauth      exact   my_view none    none

# Runs script and provides output as value
extend mdstat /bin/cat /proc/mdstat

    Pre SNMPv3

    MRTG grafy

    RRDTool

    Monitoring siete a služieb

    SmokePing

    Nagios

    Arpwatch

    ndpmon

    Zdroje