\bs
\heading{Introduction and Goals}
\bi
\item An introduction to {\em practical} SNMP use
\item Provide a simple overview or survey of what is possible
\item ``Industry acceptable practices''
\item Some basic tool coverage
\item Relatively independent of operating systems, etc.
\ei
\es

\bs
\heading{What is SNMP?}
\bi
\item Simple Network Management Protocol
\item Defined in Internet Standard 15, RFC 1157
\item A method to query and control ``devices'' connected to a network
% \item What is possible depends on device vendor's implementation
\item Transaction based, uses UDP
% (User Datagram Protocol)
ports 161 and 162
\item Implemented by virtually every device on an IP network now
%\ei
%\es
%
%\bs
%\heading{SNMP History}
%\bi
%\item First defined/outlined
%in the late 1980's, a successor to the little known
%Simple Gateway Monitoring Protocol (SGMP -- see RFC 1028)
%\item Ongoing refinement
\item Used for almost all network management and monitoring now
\item Less used for computer system management and monitoring, but also
very useful in that area
\ei
\es

\bs
\heading{SNMP Basics}
\bi
\item Two systems involved
  \bt
  \item Agent -- the device on the network
  \item Manager -- sends queries to and receives responses from the agent
  \et
\item Three goals
  \bt
  \item Easy and small to implement
  \item Extensible to accomodate changing needs
  \item System and architecture independent
  \et
\ei
\es

\bs
\heading{Protocol Basics}
\bi
\item There are five types of SNMP messages
  \bt
  \item Get
  \item GetNext
  \item Set
  \item Response
  \item Trap e.g. coldStart, linkUp, linkDown, etc.
  \et
\item Simple, short, easy to contruct, ``unreliable'' UDP datagrams
% \item MIBs, MIB variables and SNMP communities (passwords) discussed later
\ei
\es




\bs
\heading{Some Simple Examples}
\% \command{snmpget host1 pswd system.sysUpTime.0}
\\
\result{system.sysUpTime.0 = Timeticks: (28946675) 3 days, 8:24:26}

\% \command{snmpget localhost pswd system.sysContact.0 }
\\
\result{system.sysContact.0 = jsellens@uunet.ca}

\% \command{snmpset localhost wrpswd \mybackslash \\
\myindent system.sysContact.0 s jsellens@gnac.com}
\\
\result{system.sysContact.0 = jsellens@gnac.com}

\% \command{snmpget localhost pswd system.sysContact.0}
\\
\result{system.sysContact.0 = jsellens@gnac.com}

\es


\bs

\heading{Some More Simple Examples}


\% \command{%
snmpget host1 pswd interfaces.ifTable.ifEntry.ifDescr.5 \mybackslash \\
\myindent interfaces.ifTable.ifEntry.ifPhysAddress.5 \mybackslash \\
\myindent interfaces.ifTable.ifEntry.ifOperStatus.5 \mybackslash \\
\myindent interfaces.ifTable.ifEntry.ifSpeed.5 \mybackslash \\
\myindent interfaces.ifTable.ifEntry.ifInOctets.5}
\\
\result{interfaces.ifTable.ifEntry.ifDescr.5 = ed0 \\
interfaces.ifTable.ifEntry.ifPhysAddress.5 = 0:60:97:93:4e:5b \\
interfaces.ifTable.ifEntry.ifOperStatus.5 = up(1) \\
interfaces.ifTable.ifEntry.ifSpeed.5 = Gauge: 10000000 \\
interfaces.ifTable.ifEntry.ifInOctets.5 = 38675277}

\es


\bs

\heading{Even More Simple Examples}

\% \command{%
env PREFIX=.iso.org.dod.internet.private.enterprises.ucdavis \mybackslash \\
\myindent snmpget localhost pswd disk.diskPath.3 \mybackslash \\
\myindent disk.diskUsed.3 disk.diskAvail.3 disk.diskTotal.3 \mybackslash \\
\myindent disk.diskPercent.3}
\\
\result{enterprises.ucdavis.disk.diskPath.3 = /tmp \\
enterprises.ucdavis.disk.diskUsed.3 = 33 \\
enterprises.ucdavis.disk.diskAvail.3 = 28863 \\
enterprises.ucdavis.disk.diskTotal.3 = 31408 \\
enterprises.ucdavis.disk.diskPercent.3 = 8}

\% \command{snmpwalk localhost public} \\
\result{\ldots{} lots of output \ldots}

\es


\bs
\heading{SNMP Variables, MIBs, and OIDs}
\bi
\item Every object is a variable, with a hierarchical name \\
    e.g.  iso.org.dod.internet.mgmt.mib-2.system.sysUpTime.0
\item A ``Management Information Base'' is a
textual description of a set of SNMP variables and the possible values
\item An ``Object Identifier'' is 
the numeric equivalent
% of a fully qualifed SNMP variable
\\
    e.g.  1.3.6.1.2.1.1.3.0
\item You can typically query by either name (full or partial) or OID
\item MIB-II (RFC 1213) is expected
% to be implemented by
on every device
\item The final number is (usually) an index into a table of values
\\ e.g. the interface or disk volume tables
\ei
\es



%\bs
%\heading{What's That Number at the End?}
%\bi
%\item Each fully qualified name or OID ends with a number
%\item This number indicates the ``instance'' of the variable
%\item Some variables have only 1 instance e.g. system.sysUpTime.0
%\item Some have ``tables'' of multiple values
%e.g. network interfaces or disks, such as
%interfaces.ifTable.ifEntry.ifDescr.3
%\item There will typically be a varible that indicates the size of the
%table e.g., interfaces.ifNumber.0 tells you how many interfaces there
%are on a device
%\ei
%\es



\bs
\heading{SNMP Security}
\bi
\item In SNMP v1, interactions are governed by shared secrets knows as
``community strings'' - usually a ``read'' and a ``write''
\item This is not a ``high-security'' mechanism
  \bt
  \item Everything is clear text, and it's all or nothing
  \item No challenge response, no one time passwords
    \bt
    \item But this is a result of the typical intended use of the protocol
    i.e., automated, not commands initiated by humans at a keyboard
    \et
  \et
\item v2 and v3 improve things, as does the
``View-Based Access Control Model'' (RFC2275), but are (currently) less used
\ei
\es

\bs
\heading{Device and OS Specific Information}
\bi
\item Most vendor SNMP agents also implement private enterprise MIBs
  \bt
  \item Often have to resort to reading the raw MIBs to understand
  \et
\item e.g. Cisco has an environmental MIB, NT has domain and DHCP MIBs,
NetApp has disk-related MIBs
\item Different vendors are better or worse, some information is hard
to find and/or use
\item But the vendor MIBs often have the most worthwhile variables
\ei
\es



%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\bs
\heading{SNMP Applied: Monitoring}
\bi
\item Monitoring is for trends and exceptions
  % \bi
  \item Poll or Trap
  \item Collect history for analysis and execption identification
  \item Accounting or session data, traffic or activity levels
  \item Ripe for automation
  \item Have tools ready for investigation when needed
  \item Can do a lot with only the standard MIBs
  % \ei
\ei
\es


\bs
\heading{Monitoring: How to Notice Problems?}
\bi
\item Catch traps
  \bt
  \item as long as the agent will trap what you want
  \item and as long as you don't lose the trap packet
  \et
\item Periodic poll
  \bt
  \item put the last polled value in a file, complain if changed
  \item some variables are ``last change time'' which is convenient
  for noticing transient changes
  \item Polling is a nice backup mechanism for traps
  \et
\item Perl/VB/Tcl script or large commercial application
\item Some sort of notification mechanism
\ei
\es


\bs
\heading{Monitoring: How to Watch Trends?}
\bi
\item Some sort of historical database, and some sort of visualization
\item MRTG (and its successor Cricket) is the way to go
\item Very easy to track just about anything, and low overhead
\item Favorite things to graph: memory, CPU, disk, network, uptime,
users, mail waiting to be read, queue lengths, \ldots
\ei
\begin{latexonly}
\centerline{\hbox{\epsfxsize=15.50\semcm\epsffile{images/daily.ps}}}
\end{latexonly}
\begin{rawhtml}
<center>
<img src="daily.gif" alt="daily graph">
</center>
\end{rawhtml}
\es


\bs
\heading{Monitoring: What?}
\bi
\item State changes e.g. network interface up/down
  \bt
  \item Or last change time, which is easier to notice when flapping
  \et
\item Threshold limits e.g. disk more than 99.99\% full
  \bt
  \item Queue sizes, traffic levels, users, web hits, \ldots
  \item Also watch for minimum thresholds
    \bt
    \item e.g. less than 3 users in the daytime might be a problem
    \et
  \et
\item Directional changes e.g. uptime should always be increasing
\item Security related stuff -- \# users in user database, failed
authentications, etc.
\ei
\es

\bs
\heading{SNMP Applied: Management}
\bi
\item Management is for manipulation and administration
  % \bi
  \item Remote configuration and manipulation
  \item Device configuration backups
  \item Kick unruly users off dialup ports
  \item More often triggered manually
  \item Some tasks are well automated e.g. config backups
  % \ei
\ei
\es


\bs
\heading{Management: How?}
\bi
\item Depends largely on vendor-specific MIBs and implementation
\item And often the vendor's applications or OpenView addons
\item But you can accomplish a lot with a few simple SNMP gets and sets
  \bt
  \item Usually best if wrapped by a script for ease of use
  \et
\item Change management and version control are problematic
  \bt
  \item Consider doing periodic config file backup and doing revision
  control on that
  \et
\ei
\es


\bs
\heading{Management: What?}
\bi
\item Really depends on the agent's capabilities and the device type
\item Networking devices:
  \bt
  \item Enable/disable/configure ports on routers or switches
  \item Some routing tweaks e.g. weights, gateways
  \et
\item Computers:
  \bt
  \item Typically fewer things that you can change on the OS
  \item The NT MIBs imply a reasonable level of remote control
  \et
\item Like any remote manipulation, don't shoot yourself in the foot
\item Prediction: this will get better and be more effective soon
\ei
\es


\bs
\heading{Basic SNMP Tools - 1}
\bi
\item A basic tool set for interactive or script use
\item I'm not counting commercial applications as ``basic'' tools
\item Primarily UNIX in origin, but also on NT (mostly)
\item Not surprisingly, these tools happen to be freely available
\item Current OS releases typically include an agent, and perhaps some tools
\ei
\es


\bs
\heading{Basic SNMP Tools - 2}
\bi
\item UCD / CMU SNMP
  \bi
  \item Command line tools in C for manager and agent
% \item management tools include
% snmpget, snmpgetnext, snmpwalk, snmpset, snmptranslate, snmpstatus,
% snmptrapd
% \item agent tools include snmpd, snmptrap
  \item Implements standard MIB-II, Host Resources MIB,
    plus the ``ucdavis'' MIB
  %\item tracks disk, memory, load average, and selected processes
  %\item uses local somewhat manual config for snmpd
  \item Extensible - can monitor anything
  \item libsnmp for writing applications
  \item UCD agent not (yet) available for Windows
  \item Better than ``snmputil'' from the NT reskit
  \ei
\ei
\es

\bs
\heading{Basic SNMP Tools - 3}
\bi
\item Scotty -- Tcl Extensions
  \bi
  \item The Scotty package contains the Tnm Tcl extension,
  and the Tkined interactive network editor application
  \item Tnm provides a very good library of SNMP-related functions,
  written in Tcl
  \item scotty is a Tcl shell that includes Tnm
  \item Very nice, well documented, worth learning Tcl for
  %\bt
  %\item Handy for examining and exploring MIBs, variables and OIDs
  % \item See "man mib" for the Tnm mib command
  %\et
  \item version 3 beta works under Windows
  \ei
\ei
\es


\bs
\heading{Basic SNMP Tools - 4}
\bi
\item Perl
  \bi
  \item Simon Leinen's SNMP\_Session.pm provides the basic SNMP functions
  in a native Perl module
  \item Works, but is currently somewhat rudimentary
  \item No support for MIBs, so everything is specified as an OID
  \item Mike Mitchell's SNMP\_util.pm
  provides convenient covers for some of the SNMP\_Session.pm
  functions, and a labelling mechanism for SNMP variables
  \ei
\item Windows-specific tools - I'm not familiar enough to say
\ei
\es



\bs
\heading{Basic SNMP Applications - 1}
\bi
\item There are many applications, commercial and non-commercial, that
use SNMP
\item These are typically for network monitoring and management, though
they usually have some flexibility
\item What follows is a quick overview of some ``well known''
applications
\ei
\es


\bs
\heading{Basic SNMP Applications - 2}
\bi
\item MRTG -- Multi Router Traffic Grapher
  \bi
  \item An AMAZINGLY useful tool by Tobias Oetiker -- you need MRTG (or
  Cricket below)
  \item Generates graphs of almost anything over time, using a simple
  config file, and makes them available through a web server
  \item Typically used to monitor traffic counts on routers and other
  network devices, but can graph anything e.g., temperature, uptime,
  messages in mail queue, disk usage, etc.
  \item Very widely used, lots of examples on the web site
  \item Works on Windows NT and UNIX
  \ei
\ei
\es


\bs
\heading{Basic SNMP Applications - 2}
\bi
\item MRTG Successors
  \bi
  \item MRTG is not as fast as one would like it to be, and if you're
  monitoring lots of things, you can generate a non-trivial load
  \item RRD Tool is Oetiker's next generation tool -- Round Robin Database
  tool
    \bt
    \item major speed improvement over the MRTG engine
    \et
  \item Cricket by Jeff Allen
  is a high performance replacement for MRTG that uses RRD Tool
  as it's engine
    \bt
    \item easy, tree-structured configuration, flexible
    \item very fast
    \et
  \item MRTG is more mature, but Cricket is getting there
  \ei
\ei
\es


\bs
\heading{Basic SNMP Applications - 2}
\bi
\item Other Freely Available SNMP Applications
  \bt
  \item NOCOL/NetConsole (Network Operation Center On-Line) is a system
  and network monitoring tool that uses SNMP for some of its polling
  \item Big Brother has similar goals but approaches them differently
  \et
\item Some Commercial SNMP Applications
  \bt
  \item Typically for mapping, monitoring and management, with lots of
  graphics
  \item HP OpenView - very popular, with lots of plug-ins
  \item Cabletron Spectrum -- an OpenView alternative
  \item Netcool from Micromuse
    \bt
    \item Similar to nocol, but far more sophsticated, fewer graphics
    \et
  \et
\ei
\es



\bs
\heading{Summary}
\bi
\item If you're not using SNMP yet, start now
\item The state of the art is advancing
\item More and more SNMP tools, more and more SNMP applications
\item Better security and control models
\ei
%\es
%
%
%
%\bs
%\heading{Questions, etc.?}
\bi
\item Modest collection of SNMP pointers at: \\
\htmladdnormallink{http://www.generalconcepts.com/resources/snmp/}{%
  http://www.generalconcepts.com/resources/snmp/}
\item Questions?
\ei
\es

\endinput


\bs
\heading{XXXX}
\bi
\item XXXX
\ei
\es

