--- # System prepended metadata title: '[Note] SNMP learning note' tags: [OID, Trap, protocol, MIB, note, 'SNMP v1, v2c, v3', SNMP] --- [Note] SNMP learning note === ###### tags: `note`, `protocol`, `SNMP`, `SNMP v1, v2c, v3`, `MIB`, `OID`, `Trap` [Toc] # Introduction SNMP is - an abbreviation of Simple Network Management Protocol which is used for network management. - a client/server protocol. - a manager/agent protocol in SNMP terminology. - a request/response protocol. - currently used with three versions - v1 (RFC 1157) - v2 (RFC 1902) - v3 (RFC 2271~2275) - used to manage objects such as NIC, Ports or Vlan by OID and these OID is tree-identified and stored in MIB (Management Information Base). - a in the application layer of OSI model based on UDP. - using UDP port 161 to communicate between SNMP manager and SNMP agent while using UDP port 162 to receive a trap from the agent. - encoding its PDU by ASN-1 (Abstract Syntax Notation - One) > [^first]The agent (the server) runs on the device being managed, which is called the Managed Network Entity. The agent monitors the status of the device and reports that status to the manager. > The manager (the client) runs on the Network Management Station (NMS). The NMS collects information from all of the different devices that are being managed, consolidates it, and presents it to the network administrator. ![](https://i.imgur.com/YZt8PGO.png) # Protocol Specification ## PDU format ### Overview All implementations of the SNMP support the five PDUs: 1. GetRequest-PDU 2. GetNextRequest-PDU 3. GetResponse-PDU 4. SetRequest-PDU 5. Trap-PDU. >| Operation[^fifth]| Description | >| -------- | ------------------------------------------------------------------------------------------------ >| GET | Retrieve data from a network node >| GETNEXT | Retrieve the next element from a network node (more on this later) >| SET | Send configuration or control commands to a network node >| TRAP | A network node can send a notification to the management station >| INFORM | An acknowledged trap (network nodes can try and send it again if no acknowledgement is received) Below figure[^second] shows PDU formats of SNMPv1 and SNMPv2. >![](https://i.imgur.com/juyylql.png) ``` javascript -- top-level message Message ::= SEQUENCE { version -- version-1 for this RFC INTEGER { version-1(0) }, community -- community name OCTET STRING, data -- e.g., PDUs if trivial ANY -- authentication is being used } -- protocol data units PDUs ::= CHOICE { get-request GetRequest-PDU, get-next-request GetNextRequest-PDU, get-response GetResponse-PDU, set-request SetRequest-PDU, trap Trap-PDU } ``` ### 0. Common Structure **SNMPv1** PDU type includes 4 as shown below table. | Type | Action | | ---- | ---------------- | | 0 | Get-Request | | 1 | Get-Next-Request | | 2 | Set Request | | 3 | Get-Response | **SNMPv2** PDU type includes 7 as shown below table. | Type | Action | | ---- | ---------------- | | 0 | Get-Request | | 1 | Get-Next-Request | | 2 | Set Request | | 3 | Get-Response | | 4 | Reserved | | 5 | Get-Bulk-Request | | 6 | Inform-Request | | 7 | SNMPv2 Trap | #### Error Status In SNMPv1, there are 5 Error Status defined. In SNMPv2, it adds the other 13 ones. | Type | Name | | ---- | ------------------- | | 0 | noError | | 1 | tooBig | | 2 | noSuchName | | 3 | badValue | | 4 | readOnly | | 5 | GenErr | | 6 | noAccess | | 7 | wrongType | | 8 | wrongLength | | 9 | wrongEncoding | | 10 | wrongValue | | 11 | noCreation | | 12 | inconsistentValue | | 13 | resourceUnavailable | | 14 | commitFailed | | 15 | undoFailed | | 16 | authorizationError | | 17 | notWritable | | 18 | inconsistentName | ``` javascript -- request/response information RequestID ::= INTEGER ErrorStatus ::= INTEGER { noError(0), tooBig(1), noSuchName(2), badValue(3), readOnly(4) genErr(5) } ErrorIndex ::= INTEGER -- variable bindings VarBind ::= SEQUENCE { name ObjectName, value ObjectSyntax } VarBindList ::= SEQUENCE OF VarBind ``` ### 1. GetRequest-PDU ``` javascript GetRequest-PDU ::= IMPLICIT SEQUENCE { request-id RequestID, error-status -- always 0 ErrorStatus, error-index -- always 0 ErrorIndex, variable-bindings VarBindList } ``` ### 2. GetNextRequest-PDU ``` javascript GetNextRequest-PDU ::= IMPLICIT SEQUENCE { request-id RequestID, error-status -- always 0 ErrorStatus, error-index -- always 0 ErrorIndex, variable-bindings VarBindList } ``` ### 3. GetResponse-PDU ``` javascript GetResponse-PDU ::= IMPLICIT SEQUENCE { request-id RequestID, error-status ErrorStatus, error-index ErrorIndex, variable-bindings VarBindList } ``` ### 4. SetRequest-PDU ``` javascript SetRequest-PDU ::= IMPLICIT SEQUENCE { request-id RequestID, error-status -- always 0 ErrorStatus, error-index -- always 0 ErrorIndex, variable-bindings VarBindList } ``` ### 5. Trap-PDU ``` javascript Trap-PDU ::= IMPLICIT SEQUENCE { enterprise -- type of object generating -- trap OBJECT IDENTIFIER, agent-addr -- address of object generating NetworkAddress, -- trap generic-trap -- generic trap type INTEGER { coldStart(0), warmStart(1), linkDown(2), linkUp(3), authenticationFailure(4), egpNeighborLoss(5), enterpriseSpecific(6) }, specific-trap -- specific code, present even INTEGER, -- if generic-trap is not -- enterpriseSpecific time-stamp -- time elapsed between the last TimeTicks, -- (re)initialization of the network -- entity and the generation of the trap variable-bindings -- "interesting" information VarBindList } ``` ## SNMP operating procedure >![](https://i.imgur.com/phXYDpQ.png) :::info A **SNMP Manager** might be a NMS; A **SNMP Agent** might be a DUT.
```sequence Note over SNMP Manager: Set SNMP Manager->SNMP Agent: set-request Note right of SNMP Agent: UDP:161 SNMP Agent-->SNMP Manager: get-response Note over SNMP Manager: Get/GetNext SNMP Manager->SNMP Agent: get-request Note right of SNMP Agent: UDP:161 SNMP Agent-->SNMP Manager: get-response Note over SNMP Agent: Trap SNMP Agent->SNMP Manager: trap Note left of SNMP Manager: UDP:162 ``` ::: ## SNMP trap > [^third]SNMP Traps are alert messages sent from a remote SNMP-enabled device to a central collector, the "SNMP manager". In more technical terms, SNMP Traps are asynchronous, unacked messages used to notify an entity, i.e. central management, of significant issues and events. > Below figure is **a traditional SNMP poll (left) vs an async SNMP trap (right)** > ![](https://i.imgur.com/j5hWaF7.png) > A Trap might tell you that a device is overheating, for example. (As you'll recall, SNMP is one possible protocol that devices can use to communicate.) Trap messages are the main form of communication between an SNMP Agent and an SNMP Manager. They are used to inform an SNMP manager when an important event happens at the Agent level. A benefit of using Traps for reporting alarms is that they trigger instantaniously, rather than waiting for a status request from the manager. # MIB (Management Information Base) MIB is used to describe the data structure of managed SNMP objects. Each SNMP object is described in an Ojbect Identified Tree. In a MIB tree, each node stands for management group such as internet, private and snmp or management object like system, ip and tcp. And the leaf is the information of SNMP object with an OID as shown below figure. > ![](https://i.imgur.com/Mnc6wl5.png) # Demo Here, I will show the captured packets of SNMP v1, v2c and v3 through Wireshark. And these PDUs including GetRequest, GetResponse and SetRequest. In this demonstration, I will utilize MG-SOFT MIB browser as the manager while a L2 management switch as the agent, and with below operation: 1. Get the value of *rstpHelloTime*. 2. Set the value of *rstpHelloTime* to 4. 3. Set the value of *rstpHelloTime* to an invalid value 1314520. ![](https://i.imgur.com/XuL3Rwg.png) BTW, there is a question that **how do it check if the value we set to *rstpHelloTime* is valid or invalid**? In fact, the agent here is running net-snmp, and in the path *net-snmp/agent/xxxMIB/rstp.c* we should do this like[^fourth] ``` C= int write_rstpXXXX (int action, u_char * var_val, u_char var_val_type, size_t var_val_len, u_char * statP, oid * name, size_t name_len) { switch(action) { case xxxx: if (var_val_type != ASN_INTEGER) { DEBUGMSGTL(("snmpRSTP", "write to rstpHelloTime not ASN_INTEGER\n")); return SNMP_ERR_WRONGTYPE; } if (*(long *)(var_val < 1) || *(long *)(var_val > 10)) return SNMP_ERR_WRONGVALUE; } } ``` Besides, this object *rstpHelloTime* is defined in a MIB as shown below. ```javascript rstpHelloTime OBJECT-TYPE SYNTAX Integer32 MAX-ACCESS read-write STATUS current DESCRIPTION "The number of seconds between the transmission of Spanning-Tree Protocol configuration messages. Enter a number 1 through 10 Note: 2*(Forward Delay Time-1) should be greater than or equal to the Max Age. The Max Age should be greater than or equal to 2*(Hello Time + 1). This item can't be modified, if rstpStatus was disabled." ::= { rstp 4 } ``` ## SNMPv1 **Operation Sequence** ![](https://i.imgur.com/MNuFzC7.png) ### GetRequest PDU This PDU is a request to get the value of *rstpHelloTime*. ![](https://i.imgur.com/EDSFAS5.png) ### GetResponse PDU This PDU is a response after the request to get the value of *rstpHelloTime* = 2. ![](https://i.imgur.com/Jjpzy8s.png) ### SetRequest PDU #### 1. SetRequest without an error This PDU is a request to set the value = 4 of *rstpHelloTime*. ![](https://i.imgur.com/2CUogQo.png) This PDU is a response without an error after above SetRequest. ![](https://i.imgur.com/ZqM9aAC.png) #### 2. SetRequest with an error This PDU is a request to set the value of *rstpHelloTime* with an invalid value = 1314520. ![](https://i.imgur.com/S8QaZ8h.png) This PDU is a response with an error after above SetRequest. ![](https://i.imgur.com/xu203Wi.png) ### Trap PDU #### 1. Link down ![](https://i.imgur.com/yA0dWRM.png) #### 2. Link up ![](https://i.imgur.com/wekaeaP.png) ## SNMPv2c **Operation Sequence** ![Uploading file..._68n18bv6c]() ### GetRequest PDU This PDU is a request to get the value of *rstpHelloTime*. ![](https://i.imgur.com/SAUFzeJ.png) ### GetResponse PDU This PDU is a response after the request to get the value of *rstpHelloTime* = 2. ![](https://i.imgur.com/Si25fMs.png) ### Trap PDU #### 1. Link down ![](https://i.imgur.com/B5uaTJ9.png) #### 2. Link up ![](https://i.imgur.com/WIJlaT1.png) ### SetRequest PDU #### 1. SetRequest without an error This PDU is a request to set the value = 5 of *rstpHelloTime*. ![](https://i.imgur.com/T7NW0ZM.png) This PDU is a response without an error after above SetRequest. ![](https://i.imgur.com/CSoXjBe.png) #### 2. SetRequest with an error This PDU is a request to set the value of *rstpHelloTime* with an invalid value = 1314520. ![](https://i.imgur.com/d05CLn6.png) This PDU is a response with an error after above SetRequest. ![](https://i.imgur.com/qm72n4Q.png) ## SNMPv3 Configuration in SNMP agent. ``` javascript User Name: test Security Level: Authentication Authentication Level: MD5 Authentication Password: ******** ``` **Operation Sequence** ![](https://i.imgur.com/sehnGtg.png) ### GetRequest PDU This PDU is a request to get the value of *rstpHelloTime*. ![](https://i.imgur.com/TRxcFmg.png) ### GetResponse PDU This PDU is a response after the request to get the value of *rstpHelloTime* = 2. ![](https://i.imgur.com/WHuhxbV.png) ### SetRequest PDU #### 1. SetRequest without an error This PDU is a request to set the value = 6 of *rstpHelloTime*. ![](https://i.imgur.com/EoQQvF4.png) This PDU is a response without an error after above SetRequest. ![](https://i.imgur.com/o1fTmFl.png) #### 2. SetRequest with an error This PDU is a request to set the value of *rstpHelloTime* with an invalid value = 1314520. ![](https://i.imgur.com/j9aeMv3.png) This PDU is a response with an error after above SetRequest. ![](https://i.imgur.com/utYy6jE.png) ### Trap >![](https://i.imgur.com/OsqgNqs.png)[^trap] [Download these captured PDUs here.](https://drive.google.com/open?id=11SrQ01_cKUfnCh7sE9RFlK--L0PX2mRH) # Security From above demo, we can obvious see that it is insecure in SNMP v1 and v2c because community strings are clear-text passwords. We can retrieve them easily. It could enable a man-in-the-middle or replay attack. Therefore, SNMP v3 was later developed to secure this protocol. Below figure shows SNMPv3 architecture. > ![](https://i.imgur.com/JMJsmhG.png) Our DUT only supports USM[^last] here. VACM[^vacm] is View Access Control Model. In this model, there are four steps. > 1. Map the community name (COMMUNITY) into a security name. > 2. Map the security names into group names. > 3. Create a view for us to let the groups have rights to > 4. Grant the groups access to their views ```cs= #### # First, map the community name (COMMUNITY) into a security name # (local and mynetwork, depending on where the request is coming # from): # sec.name source community com2sec local localhost secret42 com2sec cust1_sec 192.168.1.0/24 public com2sec cust2_sec 192.168.2.0/24 public #### # Second, map the security names into group names: # sec.model sec.name group MyRWGroup v1 local group MyRWGroup v2c local group cust1_grp v1 cust1_sec group cust1_grp v2c cust1_sec group cust2_grp v1 cust2_sec group cust2_grp v2c cust2_sec #### # Third, create a view for us to let the groups have rights to: # incl/excl subtree mask view all included .1 view cust1_v excluded .1 view cust1_v included sysUpTime.0 view cust1_v included interfaces.ifTable.ifEntry.ifIndex.1 ff.a0 view cust2_v excluded .1 view cust2_v included sysUpTime.0 view cust2_v included interfaces.ifTable.ifEntry.ifIndex.2 ff.a0 #### # Finally, grant the groups access to their views: # context sec.model sec.level match read write notif access MyRWGroup "" any noauth exact all all none access cust1_grp "" any noauth exact cust1_v none none access cust2_grp "" any noauth exact cust2_v none none ``` For more information of SNMPv3, you can reference to this[^this]. # Reference [^first]: http://web.deu.edu.tr/doc/oreily/networking/tcpip/ch11_09.htm [^second]: http://www.tsnien.idv.tw/Internet_WebBook/Book_PDF/%E7%AC%AC%E5%8D%81%E5%85%AD%E7%AB%A0%20SNMP%20%E7%B6%B2%E8%B7%AF%E7%AE%A1%E7%90%86%E5%8D%94%E5%AE%9A.pdf [^third]: https://www.dpstele.com/snmp/trap-basics.php [^fourth]: https://github.com/haad/net-snmp/blob/master/agent/mibgroup/snmpv3/snmpEngine.c [^fifth]: http://net-snmp.sourceforge.net/wiki/index.php/Tutorials [^last]: http://www.etop.org.tw/index.php?c=adm11252&m=getReportFile&d=adm&i=245177 [^this]:http://net-snmp.sourceforge.net/wiki/index.php/TUT:Security [^vacm]: http://net-snmp.sourceforge.net/wiki/index.php/Vacm [^trap]: https://prng0.wordpress.com/2013/06/18/wireshark-v1-6-7-supports-snmp-v3-traps-decode/