The SNMP protocol is one of the application layer protocols that enables the transfer of management information between network elements and is actually a part of the TCP/IP protocol. This protocol is widely used for monitoring and managing network components.
Many vendors equip their production equipment with SNMP protocol to enable monitoring of their performance with the help of monitoring software. Currently, there are three versions of the SNMP protocol, SNMPv1, SNMPv2 and SNMPv3, which you will learn about the differences between these three versions of the SNMP protocol.
What are the main components of the SNMP protocol and familiarization with the function of each of them
To get to know the SNMP protocol, you must first get to know its main components:
SNMP Manager
Managed Devices
SNMP agent
Management Information Base (MIB)
SNMP Manager (or network management system)
An SNMP Manager, also known as a Network Management System (NMS), is responsible for communicating and exchanging information with SNMP Agents active in network equipment. In simpler words, an SNMP Manager is a computer on which a network monitoring software such as Bina network monitoring software is installed and is responsible for network monitoring. The tasks of an SNMP Manager are mainly:
Send inquiries to agents
Receive responses from agents
Setting variables in agents
Receiving trap messages from agents
Managed Devices (or network equipment)
Managed Device means all network devices on which SNMP Agent is activated, such as routers, switches, servers and firewalls.
SNMP Agent
An SNMP Agent is basically a program installed on network equipment to add SNMP functionality to them, and its main task is to respond to requests sent by the SNMP Manager. When the SNMP Agent is activated on a device, it starts recording the device’s indicators and information locally and makes this information available to NMSs.
These agents can be standard such as (Net-SNMP) or specific to a vendor such as (HP Insight Agent). In general, the tasks of an SNMP agent are:
Collect management information from the device it is installed on
Maintaining and recalling management information based on the relevant MIB
Send signal to network NMS.
Management Information Base – MIB (or management information database)
Each SNMP Agent has a database to introduce and describe the parameters that can be monitored and measured. In other words, SNMP Managers use this database to send requests to agents to receive the desired parameters and also interpret the responses according to the definitions made by the vendor.
In simple words, a MIB is a text database that specifies the list of monitorable parameters on the device and is the common language between Agent and Manager, we can say that MIB files are a set of questions that an NMS can ask from the device. Ask under monitoring.
Getting to know the MIB structure and introducing object identifiers (OID)
As we said, a MIB is a set of information for monitoring network components. More precisely, MIB contains a set of objects known as Object Identifier – OID.
Each OID is unique and refers to a specific feature of the device, for example one OID displays memory usage and another OID may return the fan speed of the device. The return value of OIDs may be different from each other, for example, text, number and counter or other types. In general, there are two types of OID: Scalar and Tabular, which may be easier to understand with the example.
Scalar (Scalar): Like the name of the device vendor, in principle the output can be only one value, which is the name of the device manufacturer, so the scalar OIDs have only one output value.
Tabular: like the CPU consumption of a quad-core processor, when we ask the value of this OID, four values are returned, one value for each processor core. By definition, tabular OIDs return the value of multiple related indexes that are in a group with different indexes.
Each OID is organized hierarchically in the MIB structure, basically MIBs have a tree and hierarchical structure. OIDs are displayed as dot-separated integers. For example, the OID for “SysDescr” is equal to 1.3.6.1.2.1.1.1
What are the basic commands of the SNMP protocol?
The simplicity of information exchange in the SNMP protocol has made this protocol widely used. In the following, you will get to know the main SNMP commands:
• Get: The Get command is an information request sent by the Manager to the Managed Device to receive one or more values from it.
• Get Next: This command is similar to the Get command, the main difference between the two commands is that Get Next calls the next OID value in the MIB tree.
• Get Bulk: GetBulk is used to get large amounts of data from large MIB tables.
• Set: With the help of this command, a Manager can change the values of some Managed Device settings.
• TRAPS: Unlike the above commands that are sent by the NMS to the target device, traps are sent by devices to the NMS when specified events occur.
• INFORM: This command is similar to TRAP sent by the Agent to the NMS, in addition, Managers use this command to confirm receiving information.
• RESPONSE: It is used to return values or signals sent by the Manager.
What is the application of SNMP TRAP?
With the help of SNMP TRAP, devices can send a message to the Manager when an important event occurs and inform it of the event. In a TRAP message, the value of sysUpTime is sent along with the OID representing the type of event, as well as the corresponding values, if any.
The destination of sending TRAP is determined according to the settings made, and the format of these messages has been changed in SNMPv2 and has been renamed to SNMPv2-Trap.
Getting to know the information exchange method of the SNMP protocol
As mentioned, the SNMP protocol is a subset of the TCP/IP protocol, and SNMP messages and commands are transmitted over the network via User Datagram Protocol (UDP) packets. By default, the SNMP port number is equal to 161, and the TRAP/INFORM commands use port 162. For a better understanding, pay attention to the following diagram:
Familiarity with different versions of SNMP protocol
Since the inception of SNMP, this protocol has undergone extensive changes and has been continuously improved. However, SNMPv1 and SNMPv2 versions are still the most widely implemented. Support for the third version, or in other words, SNMPv3, has been seriously started for some time, but despite the much higher security, it has not been able to gain a large share yet.
SNMPv1
This is the first version of SNMP defined in RFCs 1155 and 1157.
SNMPv2
This is the revised version of SNMPv1, which has been optimized a lot, the type of packets, the exchange method and even the MIB structure of this version have been optimized.
SNMPv3
This is the most secure and latest version of SNMP. Apart from the fact that performance has been improved in each version of SNMP, there has always been a great emphasis on the need to pay attention to the security of this protocol, and therefore, in this version, authentication and information encryption methods have been implemented.
Which version of SNMP should we use?
The answer to this question depends on your network environment, here are some general principles:
If your network is accessible via the Internet, perhaps you should pay attention to SNMPv3, because it is much better in terms of security, but you should also consider that encryption and security upgrades on this version will increase the workload of the devices to some extent. And as a result, the speed (Performance) decreases.
If your network is well protected by firewalls, using SNMPv1 and SNMPv2 versions may be sufficient.
From the point of view of monitoring, for example, for monitoring devices with Bina software, we suggest using the SNMPv2 protocol, which has a lower scan time and supports 64-bit counters.
