[Note] SNMP learning note
===
###### tags: `note`, `protocol`, `SNMP`, `SNMP v1, v2c, v3`, `MIB`, `OID`, `Trap`

[Toc]
# Introduction
SNMP is
- an abbreviation of Simple Network Management Protocol which is used for network management.
- a client/server protocol.
- a manager/agent protocol in SNMP terminology.
- a request/response protocol.
- currently used with three versions
- v1 (RFC 1157)
- v2 (RFC 1902)
- v3 (RFC 2271~2275)
- used to manage objects such as NIC, Ports or Vlan by OID and these OID is tree-identified and stored in MIB (Management Information Base).
- a in the application layer of OSI model based on UDP.
- using UDP port 161 to communicate between SNMP manager and SNMP agent while using UDP port 162 to receive a trap from the agent.
- encoding its PDU by ASN-1 (Abstract Syntax Notation - One)

> [^first]The agent (the server) runs on the device being managed, which is called the Managed Network Entity. The agent monitors the status of the device and reports that status to the manager.
> The manager (the client) runs on the Network Management Station (NMS). The NMS collects information from all of the different devices that are being managed, consolidates it, and presents it to the network administrator.

# Protocol Specification
## PDU format

### Overview
All implementations of the SNMP support the five PDUs:
1. GetRequest-PDU
2. GetNextRequest-PDU
3. GetResponse-PDU
4. SetRequest-PDU
5. Trap-PDU.

>| Operation[^fifth]| Description |
>| -------- | ------------------------------------------------------------------------------------------------
>| GET | Retrieve data from a network node
>| GETNEXT | Retrieve the next element from a network node (more on this later)
>| SET | Send configuration or control commands to a network node
>| TRAP | A network node can send a notification to the management station
>| INFORM | An acknowledged trap (network nodes can try and send it again if no acknowledgement is received)

Below figure[^second] shows PDU formats of SNMPv1 and SNMPv2.
>

 -- top-level message
             Message ::=
                     SEQUENCE {
                          version        -- version-1 for this RFC
                             INTEGER {
                                 version-1(0)
                             },

                         community      -- community name
                             OCTET STRING,

                         data           -- e.g., PDUs if trivial
                             ANY        -- authentication is being used
                     }
                     
-- protocol data units
             PDUs ::=
                     CHOICE {
                         get-request
                             GetRequest-PDU,

                         get-next-request
                             GetNextRequest-PDU,

                         get-response
                             GetResponse-PDU,

                         set-request
                             SetRequest-PDU,

                         trap
                             Trap-PDU
                          }

### 0. Common Structure
**SNMPv1** PDU type includes 4 as shown below table.

| Type | Action |
| ---- | ---------------- |
| 0 | Get-Request |
| 1 | Get-Next-Request |
| 2 | Set Request |
| 3 | Get-Response |

**SNMPv2** PDU type includes 7 as shown below table.

| Type | Action |
| ---- | ---------------- |
| 0 | Get-Request |
| 1 | Get-Next-Request |
| 2 | Set Request |
| 3 | Get-Response |
| 4 | Reserved |
| 5 | Get-Bulk-Request |
| 6 | Inform-Request |
| 7 | SNMPv2 Trap |

#### Error Status
In SNMPv1, there are 5 Error Status defined.
In SNMPv2, it adds the other 13 ones.

| Type | Name |
| ---- | ------------------- |
| 0 | noError |
| 1 | tooBig |
| 2 | noSuchName |
| 3 | badValue |
| 4 | readOnly |
| 5 | GenErr |
| 6 | noAccess |
| 7 | wrongType |
| 8 | wrongLength |
| 9 | wrongEncoding |
| 10 | wrongValue |
| 11 | noCreation |
| 12 | inconsistentValue |
| 13 | resourceUnavailable |
| 14 | commitFailed |
| 15 | undoFailed |
| 16 | authorizationError |
| 17 | notWritable |
| 18 | inconsistentName |

-- request/response information

                  RequestID ::=
                          INTEGER

                  ErrorStatus ::=
                          INTEGER {
                              noError(0),
                              tooBig(1),
                              noSuchName(2),
                              badValue(3),
                              readOnly(4)
                              genErr(5)
                          }

                  ErrorIndex ::=
                          INTEGER


                  -- variable bindings

                  VarBind ::=
                          SEQUENCE {
                              name
                                  ObjectName,

                              value
                                  ObjectSyntax
                          }

                  VarBindList ::=
                          SEQUENCE OF
                              VarBind

### 1. GetRequest-PDU

GetRequest-PDU ::=
                          IMPLICIT SEQUENCE {
                              request-id
                                  RequestID,

                              error-status        -- always 0
                                  ErrorStatus,

                              error-index         -- always 0
                                  ErrorIndex,

                              variable-bindings
                                  VarBindList
                          }

### 2. GetNextRequest-PDU

GetNextRequest-PDU ::=
                          IMPLICIT SEQUENCE {
                              request-id
                                  RequestID,
                                  
                              error-status        -- always 0
                                  ErrorStatus,

                              error-index         -- always 0
                                  ErrorIndex,

                              variable-bindings
                                  VarBindList
                          }

### 3. GetResponse-PDU

GetResponse-PDU ::=
                          IMPLICIT SEQUENCE {
                              request-id
                                  RequestID,

                              error-status
                                  ErrorStatus,

                              error-index
                                  ErrorIndex,

                              variable-bindings
                                  VarBindList
                          }

### 4. SetRequest-PDU

SetRequest-PDU ::=
                          IMPLICIT SEQUENCE {
                              request-id
                                  RequestID,

                              error-status        -- always 0
                                  ErrorStatus,

                              error-index         -- always 0
                                  ErrorIndex,

                              variable-bindings
                                  VarBindList
                          }

### 5. Trap-PDU

Trap-PDU ::=

              IMPLICIT SEQUENCE {
                 enterprise          -- type of object generating
                                     -- trap
                     OBJECT IDENTIFIER,

                 agent-addr          -- address of object generating
                     NetworkAddress, -- trap

                 generic-trap        -- generic trap type
                     INTEGER {
                         coldStart(0),
                         warmStart(1),
                         linkDown(2),
                         linkUp(3),
                         authenticationFailure(4),
                         egpNeighborLoss(5),
                         enterpriseSpecific(6)
                     },

                 specific-trap     -- specific code, present even
                     INTEGER,      -- if generic-trap is not
                                   -- enterpriseSpecific

                 time-stamp        -- time elapsed between the last
                   TimeTicks,      -- (re)initialization of the network
                                   -- entity and the generation of the
                                      trap

                 variable-bindings   -- "interesting" information
                      VarBindList
             }

## SNMP operating procedure
>
:::info
A **SNMP Manager** might be a NMS; A **SNMP Agent** might be a DUT.
</br>

Note over SNMP Manager: Set
SNMP Manager->SNMP Agent: set-request
Note right of SNMP Agent: UDP:161
SNMP Agent-->SNMP Manager: get-response

Note over SNMP Manager: Get/GetNext
SNMP Manager->SNMP Agent: get-request
Note right of SNMP Agent: UDP:161
SNMP Agent-->SNMP Manager: get-response

Note over SNMP Agent: Trap
SNMP Agent->SNMP Manager: trap
Note left of SNMP Manager: UDP:162

:::

## SNMP trap
> [^third]SNMP Traps are alert messages sent from a remote SNMP-enabled device to a central collector, the "SNMP manager". In more technical terms, SNMP Traps are asynchronous, unacked messages used to notify an entity, i.e. central management, of significant issues and events.
> Below figure is **a traditional SNMP poll (left) vs an async SNMP trap (right)**
> 
> A Trap might tell you that a device is overheating, for example. (As you'll recall, SNMP is one possible protocol that devices can use to communicate.) Trap messages are the main form of communication between an SNMP Agent and an SNMP Manager. They are used to inform an SNMP manager when an important event happens at the Agent level. A benefit of using Traps for reporting alarms is that they trigger instantaniously, rather than waiting for a status request from the manager.

# MIB (Management Information Base)
MIB is used to describe the data structure of managed SNMP objects.
Each SNMP object is described in an Ojbect Identified Tree.
In a MIB tree, each node stands for management group such as internet, private and snmp or management object like system, ip and tcp. And the leaf is the information of SNMP object with an OID as shown below figure.
> 

# Demo
Here, I will show the captured packets of SNMP v1, v2c and v3 through Wireshark. And these PDUs including GetRequest, GetResponse and SetRequest.

In this demonstration, I will utilize MG-SOFT MIB browser as the manager while a L2 management switch as the agent, and with below operation:
1. Get the value of *rstpHelloTime*.
2. Set the value of *rstpHelloTime* to 4.
3. Set the value of *rstpHelloTime* to an invalid value 1314520.


BTW, there is a question that **how do it check if the value we set to *rstpHelloTime* is valid or invalid**?

In fact, the agent here is running net-snmp, and in the path *net-snmp/agent/xxxMIB/rstp.c* we should do this like[^fourth]

int write_rstpXXXX (int action,
                    u_char * var_val,
                    u_char var_val_type,
                    size_t var_val_len,
                    u_char * statP, oid * name, size_t name_len)
{
    switch(action)
    {
        case xxxx:
        if (var_val_type != ASN_INTEGER) {
        DEBUGMSGTL(("snmpRSTP",
                    "write to rstpHelloTime not ASN_INTEGER\n"));
        return SNMP_ERR_WRONGTYPE;
    }
        if (*(long *)(var_val < 1) || *(long *)(var_val > 10))
            return SNMP_ERR_WRONGVALUE;
    }
}

Besides, this object *rstpHelloTime* is defined in a MIB as shown below.

rstpHelloTime  OBJECT-TYPE
    SYNTAX      Integer32
    MAX-ACCESS  read-write
    STATUS      current
    DESCRIPTION "The number of seconds between the transmission of
                 Spanning-Tree Protocol configuration messages.
                 Enter a number 1 through 10
                 Note: 2*(Forward Delay Time-1) should be greater than or
                 equal to the Max Age. The Max Age should be greater
                 than or equal to 2*(Hello Time + 1).
                 This item can't be modified, if rstpStatus was disabled."
    ::= { rstp 4 }

## SNMPv1
**Operation Sequence**

### GetRequest PDU
This PDU is a request to get the value of *rstpHelloTime*.


### GetResponse PDU
This PDU is a response after the request to get the value of *rstpHelloTime* = 2.


### SetRequest PDU
#### 1. SetRequest without an error
This PDU is a request to set the value = 4 of *rstpHelloTime*.


This PDU is a response without an error after above SetRequest.


#### 2. SetRequest with an error
This PDU is a request to set the value of *rstpHelloTime* with an invalid value = 1314520.


This PDU is a response with an error after above SetRequest.


### Trap PDU
#### 1. Link down

#### 2. Link up

## SNMPv2c
**Operation Sequence**
![Uploading file..._68n18bv6c]()

### GetRequest PDU
This PDU is a request to get the value of *rstpHelloTime*.


### GetResponse PDU
This PDU is a response after the request to get the value of *rstpHelloTime* = 2.


### Trap PDU
#### 1. Link down

#### 2. Link up

### SetRequest PDU
#### 1. SetRequest without an error
This PDU is a request to set the value = 5 of *rstpHelloTime*.


This PDU is a response without an error after above SetRequest.


#### 2. SetRequest with an error
This PDU is a request to set the value of *rstpHelloTime* with an invalid value = 1314520.


This PDU is a response with an error after above SetRequest.


## SNMPv3
Configuration in SNMP agent.

User Name: test
Security Level: Authentication
Authentication Level: MD5
Authentication Password: ********

**Operation Sequence**


### GetRequest PDU
This PDU is a request to get the value of *rstpHelloTime*.


### GetResponse PDU
This PDU is a response after the request to get the value of *rstpHelloTime* = 2.


### SetRequest PDU
#### 1. SetRequest without an error
This PDU is a request to set the value = 6 of *rstpHelloTime*.


This PDU is a response without an error after above SetRequest.


#### 2. SetRequest with an error
This PDU is a request to set the value of *rstpHelloTime* with an invalid value = 1314520.


This PDU is a response with an error after above SetRequest.


### Trap
>[^trap]

[Download these captured PDUs here.](https://drive.google.com/open?id=11SrQ01_cKUfnCh7sE9RFlK--L0PX2mRH)

# Security

From above demo, we can obvious see that it is insecure in SNMP v1 and v2c because community strings are clear-text passwords. We can retrieve them easily. It could enable a man-in-the-middle or replay attack. Therefore, SNMP v3 was later developed to secure this protocol.

Below figure shows SNMPv3 architecture.
> 

Our DUT only supports USM[^last] here.

VACM[^vacm] is View Access Control Model. In this model, there are four steps.
> 1. Map the community name (COMMUNITY) into a security name.
> 2. Map the security names into group names.
> 3. Create a view for us to let the groups have rights to
> 4. Grant the groups access to their views

####
# First, map the community name (COMMUNITY) into a security name
# (local and mynetwork, depending on where the request is coming
# from):

#       sec.name  source          community
com2sec local     localhost       secret42
com2sec cust1_sec 192.168.1.0/24  public
com2sec cust2_sec 192.168.2.0/24  public

####
# Second, map the security names into group names:

#               sec.model  sec.name
group MyRWGroup v1         local
group MyRWGroup v2c        local

group cust1_grp v1         cust1_sec
group cust1_grp v2c        cust1_sec

group cust2_grp v1         cust2_sec
group cust2_grp v2c        cust2_sec

####
# Third, create a view for us to let the groups have rights to:

#           incl/excl subtree                              mask
view all    included  .1

view cust1_v excluded  .1
view cust1_v included  sysUpTime.0
view cust1_v included  interfaces.ifTable.ifEntry.ifIndex.1 ff.a0

view cust2_v excluded  .1
view cust2_v included  sysUpTime.0
view cust2_v included  interfaces.ifTable.ifEntry.ifIndex.2 ff.a0

####
# Finally, grant the groups access to their views:

#                context sec.model sec.level match  read     write  notif
access MyRWGroup ""      any       noauth    exact  all      all    none
access cust1_grp ""      any       noauth    exact  cust1_v  none   none
access cust2_grp ""      any       noauth    exact  cust2_v  none   none

For more information of SNMPv3, you can reference to this[^this].

# Reference
[^first]: http://web.deu.edu.tr/doc/oreily/networking/tcpip/ch11_09.htm
[^second]: http://www.tsnien.idv.tw/Internet_WebBook/Book_PDF/%E7%AC%AC%E5%8D%81%E5%85%AD%E7%AB%A0%20SNMP%20%E7%B6%B2%E8%B7%AF%E7%AE%A1%E7%90%86%E5%8D%94%E5%AE%9A.pdf
[^third]: https://www.dpstele.com/snmp/trap-basics.php
[^fourth]: https://github.com/haad/net-snmp/blob/master/agent/mibgroup/snmpv3/snmpEngine.c
[^fifth]: http://net-snmp.sourceforge.net/wiki/index.php/Tutorials
[^last]: http://www.etop.org.tw/index.php?c=adm11252&m=getReportFile&d=adm&i=245177
[^this]:http://net-snmp.sourceforge.net/wiki/index.php/TUT:Security
[^vacm]: http://net-snmp.sourceforge.net/wiki/index.php/Vacm
[^trap]: https://prng0.wordpress.com/2013/06/18/wireshark-v1-6-7-supports-snmp-v3-traps-decode/