【教学课件】第三章SNMP(一).ppt

1,计算机网络管理主讲教师：王继龙清华大学信息网络工程研究中心,2,上次作业：Juniper、Lucent、3COM、Nortel、Alcatel、华为、中兴的历史、现状及其产品线。最后提交时间：11月5号提交方式：由助教李锁刚通知（）,3,第三章SNMP,SNMP的管理模型SNMP协议及协议的操作SNMP的管理信息库SNMP的发展RMON举例,4,Simple Network Management Protocol,more than just a protocol代表了互联网管理的体系结构几乎所有网络管理教科书的主体和核心内容Doesnt SNMP solve all these problems?Dont be silly!SNMP在本门课程中的地位：非常重要，但绝对不是网络管理的全部我们结合互联网管理的历史、发展、功能需求来介绍SNMP，目标：理解原理、掌握应用,5,Q1：网络管理的体系结构？,6,体系结构,网络管理要考虑那些问题？体系结构是一个概念模型，相对于无规律的列举，在归纳总结的基础上，针对各种问题给出逻辑条理清晰的阐述：分成几个层次、几个方面，从上倒下，从左到右，由内尔外，。,7,实施网络管理要考虑的问题？,8,网络管理的体系结构举例,组织和结构模型：包括哪些实体？相互关系？信息模型：信息的需求？信息的定义?通信模型（协议）：信息的传递?系统模型：功能和实现？,9,SNMP Structure,10,Q2：网络管理信息需求？,诊断/监控一个故障诊断/监控性能诊断/监控安全配置管理需求、指标、数据结构、产生、传递,11,网络管理信息需求,Status：通断（精仪，李晗）：线路、主机（服务器、路由器）流量（负载）：叶绍志，定位瓶颈，TraceRT，分段链路性能指标，延时、流量、丢包日志（电机系黎灿兵）：事件：服务请求（行为特征查找、IP、）配置：主机：类型（核研院 耿文骥）、端口数、服务（网络中心 王亚磊）、管理员、口令、位置、IOS、拓扑子网,12,SNMP网络管理信息（MIB2）,System：关于系统的总体信息;Interface：网络接口的信息;at(address translation)：描述internet到subnet的地址映射;ip：关于系统中IP的实现和运行信息;icmp：关于系统中ICMP的实现和运行信息;tcp：关于系统中TCP的实现和运行信息;udp：关于系统中UDP的实现和运行信息;egp：关于系统中EGP的实现和运行信息;dot3(transmission)：有关每个系统接口的传输模式和访问协议的信息。snmp：关于系统中SNMP的实现和运行信息,13,System,14,interfaces,15,Interface,16,interface,17,interface,18,address translation,19,ip,20,ip,21,ip,22,ICMP,23,ICMP,24,TCP,25,UDP,26,egp,27,Q4：网络管理信息的定义？,28,SNMP中网管信息的定义,数据结构defines data structure using ASN.1信息组织SMI defines structure of MIBManagement Information Base(MIB),29,Structure of Management Information(SMI),RFC1155在ASN.1的基础上，定义了四个宏，八个新数据类型来定义SNMP的数据结构SMI首先将变量定义为“对象”（object），相关的对象被集合成“组”（group），组最后被汇集成“模块”（module）。,30,Object Identifier,OBJECT IDENTIFIERsequence of integers that describe a pathway taken in traversing a tree of options,must be unique e.g.or iso org dod internet mgmt mib system sysDescrthe base of the tree is defined by ISO,sections are defined by other authorities,31,SNMP NAMES,32,管理信息库MIB,SNMP的MIB包含10个组。网络管理工作站通过使用SNMP协议，向被管理节点中的SNMP代理发出请求，查询这些对象的值。每个对象有以下四个属性：对象类型(object type)：定义了对象的名字。语法(syntax)：指定了数据类型。存取(access)：表示了对象的存取级别，合法的值有只读、只写、读写和不可存取。状态(status)：定义了对象的实现需要，必备的：被管理结点必须实现该对象可选的：被管理结点可能实现该对象已经废弃的：被管理结点不需要实现该对象,33,34,MIB-2,35,Q5：网络管理信息的生成？,36,SNMP Agents,provided by all router vendorsmany expanded(enterprise)MIBs,37,Q6：网络管理信息的传输？,38,SNMP：Overview,defines three query messages to get information from an agent being monitoreddefines a set message to be used in managing an agentdefines a response message for an agent to use in responding to a query or set messagedefines a set of trap messages by which an agent can send notification of a status change to a management stationdefines an inform message for reliable communications,39,SNMP:Query Messages,GetRequestrequest to an agent to return the current value of a specific MIB variable can take more than one variable in one request.GetNextRequestrequest to an agent to return the next MIB variable used to walk the tree in an agentGetBulkRequestrequest to an agent to return large blocks of data,40,SNMP:Set Message,SetRequestrequest to an agent to change the values of one or more MIB variables to specific new values.if there is an error in the SetRequest and one or more variables cannot be set,none will be seterror conditions1/one or more objects not available for set operation,given access controls2/contents of value field does not correspond to definition3/size of response message would be larger than local limitations4/some other reason a value cannot be altered,41,SNMP:Response Message,Responsemessage from an agent to a NMS in response to a GetRequest,a GetNextRequest or a SetRequestused to return requested values or to indicate success or failure of set requestincludes an error status and an error index,42,SNMP:Trap Message,trap message:message from an agent to a NMS in response to a status change or event in the agenttrap conditions:coldStartwarmStartlinkDownlinkUpauthenticationFailureegpNeighborLossenterpriseSpecific,43,SNMP:InformRequest,like a“reliable trap”designed to be used between network management stationsexpanding to other usesresent until acknowledged,44,SNMP:Communities,provides trivial securitylike a passwordcommunity name sent in clear over net with each messagesome agents have more than one community for different access modesthese are know as viewssome agents can link access to community name and IP address of NMS,45,Summary,Simple Network Management Protocolmostly a query-response systemlittle network traffic initiated by agentcurrently only a primitive security systemSNMPv2 was to have real security but working group fragmented,SNMPv3 now readyuses database defined in MIBcan have enterprise extensions to MIBSMI defines structure of MIBSMI defines data structure using ASN.1,Use CMU packge:snmpwalk,ftp:/sunsite.unc.edu/pub/Linux/system/network/admin/cmu-snmp-linux-3.2-bin.tar.gz,47,作业任选1题：SNMPv2、SNMPv3、RMON，分组完成，下堂课每组25分钟介绍并回答提问。,48,分组,SNMPv2；黎灿兵、李晗、王亚磊、耿文骥SNMPv3：叶绍志、李贺武、陈旭春、练锴、许静芳RMON：刘亮、冯伟、杨超、杨继章,Brief on SNMP,RFC1098 Simple Network Management Protocol(SNMP).J.D.Case,M.Fedor,M.L.Schoffstall,C.Davin.Apr-01-1989.(Format:TXT=71563 bytes)(Obsoletes RFC1067)(Obsoleted by RFC1157)(Status:UNKNOWN),SNMPv1SNMPv2c,SNMPv2*,SNMPv2u,SNMPv3,50,SNMPv3,add security to SNMPv2secure SET supportprotect against modification of information masquerade message stream modification disclosuredoes not deal with denial of service traffic analysis,51,SNMPv3,contd.,three levels of securityno authentication,no privacyauthentication,no privacyauthentication&privacycan support more than one security modeluser-based security model definedsecurity based on“name”of a usernew message formatto add security informationoverview in RFC 2261,RMON,Remote Network MonitoringDefines remote monitoring MIB that supplements MIB-II and is a step towards internetwork managementIt extends SNMP functionality though it is simply a specification of a MIBProblem w/MIB-IICan obtain info that is purely local to individual devicesCannot easily learn about LAN traffic as a whole(eg like LANanalyzers or“remote monitors”),RMON1/RMON2 structure,54,