1.
Rob Hassing
Rob.hassing@deltics.nl
@rhassing
SNMP Explained!

2.
Introduction
Deltics / OSMC

3.
SNMP
Deltics / OSMC
WHY?
Simple network management protocol
Availability
Supported by most vendors
No third party software needed

4.
Deltics / OSMC

5.
How does it work?
Deltics / OSMC
UDP ports 161 & 162
SNMP header
● SNMP version
● Community (in version 1 and 2c)
● PDU type (what do we want to do?)
SNMP versions
● SNMPv1
● SNMPv2c
● SNMPv3
Most commonly used
Supports encryption, overhead, not used very often

6.
How does it work?
Deltics / OSMC
NMS Router
Check interface status!
GET
REPLY
E1

7.
How does it work?
Deltics / OSMC
NMS Router
E1
TRAP!

8.
Deltics / OSMC

9.
SNMP: Protocol
Deltics / OSMC
Community
PDU (Protocol Data Units)
● 0 – get
● 1 – get-next
● 2 – response
● 3 – set
● 4 – trap
● 5 – getbulkrequest (version > 2c)
● 6 – getinformrequest (version > 2c)

10.
SNMP: Protocol (wireshark)
Deltics / OSMC

11.
SNMP: Protocol (wireshark)
Deltics / OSMC

12.
Deltics / OSMC

13.
SNMP: Variables
Deltics / OSMC
mib-2 (1)
system (1) printer (43)
enterprises
(1)
Cisco (9)
Microsoft
(311)
Apple (63)
directory (1) mgmt (2)
experimental
(3)
private (4)
iso (1)
org (3)
iso (1)
dod (6)
internet (1)

14.
SNMP: simple example
Deltics / OSMC
● The path in the OID tree:
● iso.org.dod.internet.mgmt.mib-2.system.sysContact.0
● (= .1.3.6.1.2.1.1.4.0)
● iso.org.dod.internet.mgmt.mib-2.system.sysName.0
● (= .1.3.6.1.2.1.1.5.0)
● iso.org.dod.internet.mgmt.mib-2.system.sysLocation.0
● (= .1.3.6.1.2.1.1.6.0)
● Or we can use a shorter method
● sysContact
● sysName
● sysLocation

15.
SNMP: What are MIBs?
Deltics / OSMC

16.
SNMP: What are MIBs?
Deltics / OSMC
● Easier to read, like DNS for an IP address
● Different type of variables:
● Integer, Timestamp, Counter, IpAddress, Displaystring, …..
● Standardized SMIv2 (RFC2579)
● Max access:
● Not-accessible / read-only / read-write
● Status
● Current / Obsolete / Deprecated
● Description

17.
SNMP: SNMPv2-MIB
Deltics / OSMC
sysUpTime OBJECT-TYPE
SYNTAX TimeTicks
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The time (in hundredths of a second) since the
network management portion of the system was last
re-initialized."
::= { system 3 }
sysContact OBJECT-TYPE
SYNTAX DisplayString (SIZE (0..255))
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The textual identification of the contact person for
this managed node, together with information on how
to contact this person. If no contact information is
known, the value is the zero-length string."
::= { system 4 }

18.
Deltics / OSMC

19.
SNMP: Tables (Storage)
Deltics / OSMC
For a variable number of values
(eg. networkinterface, Storagedevices)
snmpwalk -v2c -c public 192.168.1.1 .1.3.6.1.2.1.25.2.3.1
Index Type Description AllocationUnits Size Used
1 Other Memory Buffers 1024 bytes 2065816 144968
2 RAM Real Memory 1024 bytes 2065816 1996312
3 VirtualMemory Swap Space 1024 bytes 4192760 84908
4 FixedDisk / 4096 bytes 117738760 8718286
5 FixedDisk /boot 1024 bytes 101018 22542

20.
SNMP: Tables (Storage)
Deltics / OSMC
SNMP creates an index number for each individual device
For example:
HOST-RESOURCES-MIB::hrStorageIndex.1 = INTEGER: 1
HOST-RESOURCES-MIB::hrStorageIndex.2 = INTEGER: 2
HOST-RESOURCES-MIB::hrStorageIndex.3 = INTEGER: 3
HOST-RESOURCES-MIB::hrStorageIndex.4 = INTEGER: 4
HOST-RESOURCES-MIB::hrStorageIndex.5 = INTEGER: 5
Table variables can be recognized by the index value that NOT equals 0
If a variable is not part of an table, the index value will always be 0.

21.
SNMP: Tables (Storage)
Deltics / OSMC
The index number corresponds with the device number:
In this example the .4 corresponds with all information about
the / (root) partition.
The size is: 117738460 blocks of 4096 bytes:
That makes the partition: 117738460 x 4096 / 1024 / 1024 / 1024 = 450GB
HOST-RESOURCES-MIB::hrStorageIndex.4 = INTEGER: 4
HOST-RESOURCES-MIB::hrStorageIndex.5 = INTEGER: 5
HOST-RESOURCES-MIB::hrStorageDescr.4 = STRING: /
HOST-RESOURCES-MIB::hrStorageDescr.5 = STRING: /boot
HOST-RESOURCES-MIB::hrStorageAllocationUnits.4 = INTEGER: 4096 Bytes
HOST-RESOURCES-MIB::hrStorageAllocationUnits.5 = INTEGER: 1024 Bytes
HOST-RESOURCES-MIB::hrStorageSize.4 = INTEGER: 117738760
HOST-RESOURCES-MIB::hrStorageSize.5 = INTEGER: 101018

22.
SNMP: Tables (Storage)
Deltics / OSMC
Tables are defined in the MIB files (short example):
hrStorageEntry OBJECT-TYPE
SYNTAX HrStorageEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A (conceptual) entry for one logical storage area on
the host. As an example, an instance of the
hrStorageType object might be named hrStorageType.3"
INDEX { hrStorageIndex }
::= { hrStorageTable 1 }
HrStorageEntry ::= SEQUENCE {
hrStorageIndex Integer32,
hrStorageType AutonomousType,
hrStorageDescr DisplayString,
hrStorageAllocationUnits Integer32,
hrStorageSize Integer32,
hrStorageUsed Integer32,
hrStorageAllocationFailures Counter32
}

23.
Deltics / OSMC

24.
SNMP: Tools (CLI)
Deltics / OSMC
SNMPGET
snmpget -v2c -c public 192.168.1.1 sysContact.0
SNMPWALK
snmpwalk -v2c -c public 192.168.1.1 system
SNMPSET
snmpset -v2c -c secret 192.168.1.1 syscontact.0 string noc@deltics.nl
SNMPNETSTAT
snmpnetstat -v2c -c public -Ca 192.168.1.1

25.
SNMP: Tools (iReasoning)
Deltics / OSMC

26.
SNMP: Tools (iReasoning)
Deltics / OSMC

27.
SNMP: Tools (iReasoning)
Deltics / OSMC

28.
Deltics / OSMC

29.
SNMP: SNMPTRAP
Deltics / OSMC
● An SNMPTRAP is send by a device when a status
change occurs
● A single UPD package on port 162
● Mostly unreadable by human, just an OID
● Configuration in /etc/snmp/snmptrapd.conf

30.
SNMP: SNMPTRAP config
Deltics / OSMC
Configuration in /etc/snmp/snmptrapd.conf
####
authCommunity log,execute public
traphandle default /usr/sbin/snmptt
####
● This means the SNMPTRAP is authenticated by a communitystring
● log the details of the notification
● pass the details of the trap to a specified handler program
● All traps are send to the program snmptt

31.
Deltics / OSMC

32.
SNMP: SNMPTT
Deltics / OSMC
SNMPTRAP Translator:
● Makes SNMPTRAPS more “Human Readable”
● Define the actions in a config file
● MIB files can be used to create config files
(snmpttconvertmib)

33.
SNMP: SNMPTT
Deltics / OSMC
snmpttconvertmib --in=aruba-trap.my
--out=snmptt.aruba
--exec=”/usr/local/bin/snmptrap.sh $r
snmptrap OK “$* $x - $X: $D”
This command will convert all traps defined in aruba-
trap.my to a snmptt config file called snmptt.aruba with
a default action.

34.
Deltics / OSMC
#!/bin/sh
# $1 = host_name (Short name of host that the service is
# associated with)
# $2 = svc_description (Description of the service)
# $3 = state_string (A string representing the status of
# the given service - "OK", "WARNING", "CRITICAL"
# or "UNKNOWN")
# $4 = plugin_output (A text string that should be used
# as the plugin output for the service checks)
#
# Convert the state string to the corresponding return code
return_code=-1
case "$3" in
OK)
return_code=0
;;
WARNING)
return_code=1
;;
CRITICAL)
return_code=2
;;
UNKNOWN)
return_code=-1
;;
esac
/usr/bin/printf "%st%st%st%sn" "$1" "$2" "$return_code" "$4" |
/usr/sbin/send_nsca 127.0.0.1 -c /etc/nagios/send_nsca.cfg
/usr/local/bin/snmptrap.sh

35.
Deltics / OSMC

36.
How does it work?
Deltics / OSMC
NMS Router
E1
TRAP!
/.../snmptrap.sh
$r snmptrap-interface
CRITICAL
"link down"
/usr/bin/printf
"%st%st%st%sn"
"$1" "$2"
"$return_code" "$4"
| /usr/sbin/send_nsca 127.0.0.1
-c /etc/nagios/send_nsca.cfg
Snmptrapd:
oid
.1.3.6.1.6.3.1.1.5.3

37.
Deltics / OSMC
SNMP: Nagios

38.
Deltics / OSMC