OpenNMS 101 - Module 6: SNMP Review Video Lecture | A Complete Guide: OpenNMS - IT & Software

hello and welcome to another edition of
open international 101 the training
course that gets you up to speed on the
open and immense network management
platform this lesson I'm almost going to
call it open an immense light because
we're going to be very very little with
opening a mess and instead we're going
to either review or introduce you to
SNMP the simple network management
protocol it's not the simple Network
mail protocol as some websites have
reported in the past instead it is the
protocol for managing networks now in
open and amass SP is it's a service and
it's more I mean we can monitor is SP up
or down but that's not very very useful
what we really is SP for is to get a
performance data and information about
the things on the network that we're
monitoring and we're going to spend the
piece of code we actually will spend a
lot of time with in this lesson is the
net STP agent I am an unabashed fanboy
of net SP it's a very very powerful
agent and we can utilize it to get a lot
of information into open an MS and we
will in future chapters okay the first
thing you need to brain around when
we're talking about SMP is is what is it
it makes there's a lot of things that
make up STP this actually SP was
ratified by the internet Engineering
Task Force the IETF in April of 1989 for
those of you who are familiar on the way
the IETF works is you submit a request
for comment
it goes back and forth and finally if it
gets ratified it becomes a standard and
then known as RFC and RFC 1082 a 1052
sorry was ratified in 1989 which
established this framework for managing
the internet and it consisted of many
other parts of one of those was how are
we going to structure this information
what type of information can we share
and how do we transmit this information
from a device or an agent to a manager
and those are covered in
the network management protocol SNP and
we're going to talk about management
information bases mids now used to be
very very easy to find myth information
until the movie men and black came out
now when you type in move into any
search engine chances are you're going
to get a reference to that movie and not
the management information base the
management information base is just a
data structure I like to think of it as
a codebook so basically if you're an
SNMP agent you have a codebook that
describes how your information is laid
out and as a manager I can ask for a
specific piece of information and if you
support that nib you can return that
information back and it's actually
written in a language called abstract
syntax notation asn.1 you don't really
need to know this but in the interest of
know magic we're going to spend some
time working on it I have one one quick
example just for extra credit okay what
type of data can the network management
protocol share or there's integers more
numbers 1 2 3 4 5 etc your new string
like what type of device I am the two
main data objects we look at especially
for performance data our counters and
gauges and a counter is a number that
constantly increases and the usefulness
of a counter is it's very very useful to
measure rates some SNMP agents might
implement a five-minute load average
value and so you're set at looking at a
5-minute load average what if you want a
10 minute or 15 minute load average with
a counter you can choose your rate so
the way I think about it is this um
let's say so I grew up in a small town
in North Carolina and we didn't have
sports teams we didn't have a major
league football team or baseball team or
anything like that and so for fun we
would often go to baseball games hosted
by the Veterans of Foreign Wars VFW and
the VFW there was post 45 was in
North Carolina we go to watch post 45
baseball games and they're free and when
you walk to the to the baseball field
you'd walk by there was a guy at the
entrance who had we call it as a clicker
it was a little little device and every
time someone walked by he would press a
button and on it was a three-digit
counter so when no one was there he
reset it to zero the first person comes
by he hit click second person to buy he
hit click and they would increment the
counter so if I was the the interested
in how many people would come through I
might say hey Z what's your counter e
and there were 31 and then five minutes
later I could say hey Zeke what's your
counter read and you might say I don't
know 56 and then I know I can take 56
minus 31 and I could say in the time
between the times I'd ask Zeke what the
counter was 25 people come up so if that
was every five minutes I would know that
[Music]
25 people came by in five minutes or an
average of five every minute if I need
to know faster I can just annoy him more
a Zeke what's it read as equal to the
read or I can sit back and wait and just
get a less granular data that's account
now engage is like a temperature gauge
or a gas gauge you read the
instantaneous value so if I'm looking at
a thermometer it might be 20 Celsius it
might be twenty point five Celsius it
might go down to nineteen self-same I go
up to 21 Celsius so it's not a counter
you're interested in whatever the exact
value is and that's a gauge now there's
a special counter called time ticks and
time ticks is the number of hundredths
of a second so if I turn on something
one second later it's up time in time
tips would be one hundred two seconds
later b200 etcetera so we end up getting
hundreds of a say this is a special way
of representing time within linux and
then also within SMP so there are a
bunch of other different types of data
objects confusing language in numbers
and strings counters and gauges and time
ticks which if you remember is a special
type of counter that measures time in
hundreds of a second okay
now this data so we have all this data
that we want to monitor and it's put in
this this object ID structure this tree
structure we call it I'm never going to
see this I keep thinking about this dude
this is a picture from Wikipedia of Carl
Linnaeus Carl Linnaeus was a Swedish guy
in the 1700s who was considered the
father of taxonomy and this is the study
of organizing life and he also created
basically a big tree so if you think
about it you can sit there and say well
um in in in this case it was like in the
general case it was okay I want to
analyze life so I might have plants and
animals and within animals
I might have those with spinal cords in
those without spinal cords and in those
with spinal cords I might have mammals
and reptiles and fish and it's basically
a way of organizing vast amount of data
in this structure this is something
about the internet which shows you that
living organisms and they break it into
you know bacteria like prokaryotic
bacteria eukaryotic bacteria and then
you've got single-celled Protista and
then multicellular organisms and from
those you've got plants and animals and
fungi and then you can go and divide it
all that way and that's kind of the way
they started out with the odds ID this
was started out with the international
standards organization I so I think it's
something else in French but
international standards organization
fits with the abbreviation and so
everywhere on this screen here we see a
vertice a little point think of that as
a dot so the root of this tree is a dot
I so is one so dot one now ISO has a
bunch of tree structures underneath it
but one we're interested in is
organizations so it'd be dot one dot
three and now the organization
responsible for the events Research
Projects administration or ARPA which
founded ARPANET was the United States
Department of Defense
and its organizational number is 6 so
that 1.3 that 6.1 is the first structure
of this tree of organization we're going
to look at and almost every object we
are interested in is going to start off
about 1.2 a you got six that one does
that make sense so again think about it
we're trying to organize all of
information into some sort of structure
and we're going to limit or preface the
stuff we're interested in for SNP to be
the internet which happens to be ISO
organization Department events internet
1.3 that's our problem now underneath
the internet there are a bunch of other
branches there's a directory branch I'm
not an LDAP expert I don't know much
about LDAP but I think object IDs are
used somehow in LDAP and I think it
follows under this directory tree the
two main branches of the internet tree
that we're interested in is the
management branch which is got to and
the private branch which is dot for I
have worked on experimental which is dot
three and this is kind of where new data
structures are tried out before they're
actually approved and moved into the
management branch but we're not going to
work too much on that here so dot one
dot squared F 6.1 is internet dot 2.1 is
mid - I don't know whatever happened to
mid one ever since I started studying SP
it was always mid - so I don't know
haven't into mid one but anything under
here is basically something that was
created by committee it is a standard if
someone says I support mid - it means
they support the objects underneath the
mid - branch now I've got a handout so
these paper references out they hang out
suicide a piece of paper if you want a
copy and I really think you should get
one go to WWE my knee and underneath the
training you will see capital T training
you'll see a slides directory that's the
stretch we here and if you click on it
it's this s
MP reference PDF so this SP reference
PDF is what goes in on that it says
that's what we need to look at now so
we're going to do the if you want to go
and click on that print out that hit
pause on the video it will be useful
because we're going to use this to kind
of talk about the mid structure oh wait
no I won't wait go ahead and press that
press pause if you need to wait we're
going back to the slides okay so here is
mid to as you can see it's pretty
involved and this is just a very very
very small function in the to now the
branch is under mid to are very generic
and to get more specific like there is a
system branch and this contains
information about what device I'm
talking to is it a Windows server is it
a Cisco router is an achene / switch
that is in the system tree now after the
system tree is the interface tree
because of course on devices you're
gonna have interfaces network interfaces
you have at least one or else it really
wouldn't you wouldn't be connected the
Internet's going to have at least one
network interface now notice the
interfaces says nothing about protocols
there's nothing about IP or anything
here that's in another branch
so there's IP information there's TCP
information is UDP information etc it's
all in this this mid-to tree now there
are two main types of data there are
scalars these are things that will
actually end in a dot 0 these are things
that exist only once in your min so the
system description what am I looking at
it is a Windows server or it is it's
just a router it's not both I can't have
multiple system descriptions it is
something even if it was a combo device
even there was a checkpoint firewall
running on Windows that would be the
description now the way you navigate to
that is you would ask for an object ID
that starts off not 1.3 that 6.1
remember that's internet ISO or
Department of Defense 6 Internet 2.1
which is the management mid-to so
management is not to a
the mid-to is dot one the system branch
is dot one system description is dot one
and then the dot zero tells the protocol
that it only exists once I want that
instance things that exist once or like
this inscription is number how many
interfaces I have etc now there's
another type of data in here
and it's represented if you look by
anywhere this indents and that's tabular
data so it's data that's actually
represented in a table because we may
not know how many interfaces are on here
there may be one there may be three
thousand and so this table represents
things that can actually just grow and
we index our way into a table and so
here is interface description again for
this object that you notice it starts
off dot 106.1 internet 2.1 mid 2.2 which
is the interface branch again look at R
and out dot two is AF table dot one is
is entry dot 2 is if' description and
this dot three says I want to go to the
third index index three in this table
and return whatever the interface
description is now this is important so
I actually did a a walk and that's the P
walk on my juniper switch and and this
is what I came up with so again remember
I have table is that one's a 20 X 6.1 I
so or Department events Internet 2.1 mid
to 2.2 is interfaces AF table dot two is
I have entry actually there should be
dot one I'm not only do this slide that
should be dealt one I'll redo it for my
class but I have interests dot once it
should be dealt 1.3 that 6.1.2 dot one
dot two to two dot one and then you've
got in this table dot one is I have
index by twos ifs curve dot trees eyes
tight got for is into u dot five is
speed and then there's there's physical
address admin status operational status
etcetera
a bunch other stuff here now the index
is the key that I wanted to talk to you
about so if we go back here to this
slide we're looking for this dot 3 or if
we look the dot 3 is this eyes index
which says the if' Desco would be FX p2
so if I went and looked and said what is
the description of the third interface
so if I said what is 1 2 3 that 6.1.2
dot 1 got to got to got 1.2.3 it would
return and tell me it is SXP and it's i
have typed there's an entire eye of type
table 6 just happens to be Ethernet one
of the other common ones is 24 which is
a loopback address you can see there's a
loopback address here we've got empty
use which is again 15 14 is 1,500 tends
to be the MTU for Ethernet this is
actually what the 4 I have speed force
all these interfaces it returns zero
I thought about redoing the walk and
coming up with something a little more
interesting but what I found out was
that I wanted to point this out for the
no magic piece in this case for these
interfaces the SP agent on this juniper
switch says the eye speed is zero now
the chamber that's not you know that's
not really true I mean with a loopback I
definitely have an interface speed I can
make queries to move back I can run
traffic so you loop back address but the
cons the agent is telling me the ISP to
0 open in a mess we're trying to do
bandwidth utilization it's going to end
up and running into a problem because
you want to divide by I F speed to get
overall utilization and you can't divide
by zero so this is not a problem with
opening a mash it's a problem with the
fact this particular agent for whatever
reason I mean I don't think there is a
defined speed so I don't think this is
necessarily a bug but I wanted to show
that there's no magic here it any
management platform including open NMS
is limited to the information it gets
back from S&P and if that information
happens to be wrong or not what you
expect you can't blame the management
platform you can either change it or you
can deal with it in other ways
again this is a table and so the key is
this entry to the table is going to be
some kind of index and in this case it's
I have index if I went here and actually
actually asked instead of 4.2 I actually
asked for dot 1.3 I would get 3 because
that's the eyes index for the if' index
of 3 these don't have to be in order as
you can see this was 3 4 there is no 5 6
7 8 9 that's just an artifact of the SRX
that we use and this can be in some
cases it could be a string this could be
an IP address but for most tables that
will be just an American integer where
entry one is one entry to visit to try
to make sense so the key takeaways here
I want to make sure everyone is on board
with this is scalars ending 0 and then
tables end in some nonzero number so if
I go to the end of my object ID and the
last value here is not a zero I will
know that it's a not a scalar that it's
some sort of tabular data
so here's an ASN one example this is for
system description and system
description here is it's an object it
consists of a display string of up to
255 characters and some the size it's
read-only meaning no one can change it
you really you really want the agent to
report the system description and you
don't necessarily want to management
station to be able to send the command
to the agent to change it so that's why
it's read-only there are some values
such as maybe at this contact or system
location that is rewrite the chat if you
have permissions you can change it to
the management station status is current
another status could be deprecated the
time I saw this remember I'm an old guy
and I was working in this industry
before y2k before year 2000 and in many
cases years were represented by display
string of two digits so would be a size
of two that would represent the last two
digits severe so 97 would mean 19
97 well instead of getting you don't go
you rarely go back and change these
things and so rather than make that
particular object a four digit or five
digit er and limited digit string what
it did was a limited character string
what it did was just they deprecated
with the 2 character version and they
created a new object which represented
the year in four characters so you can
still we use it as long as you were
aware that it was up to you to determine
what those two characters meant so if
you solve seventeen you knew it was 2017
and not 1917 and notice that this system
description you get this video
description a textual description of the
entity this I should include the full
name and version identification of the
system start with type software
operating system and networking software
so so there's a description and then
notice you got this weird equality this
colon colon equals system one this just
means that the system description is
item one under the system tree it is
amid somewhere it'll say there will be a
definition of what system is it'll be
item one is nib two and then 2 will be
item 1 if management and management will
be item 2 of Internet all the way back
to the root of I so now I'm going to
jump ahead just a little bit because I
want to demonstrate kind of drive home
this kind of no magic thing so here I'm
up on my I'm up on my virtual machine
that I've been using for open an MS and
I want to install net SNP so I'm going
to do a yum install net - recipe and net
that's SP utils this will install the
nasty agent and the I forget that I
haven't starred this law this will go
and install the net SP agent as well as
some utilities that we can use and the
utility I want to use is that's the P
watt and so if I type SP P walk I'm
going to do version - C - C is community
name in public I want to go to - my
router
to the 170 2021 101 and asked for the
system description and so if I go to the
router it notice it's a string notice it
goes system desk or 0 and constraint
says Juniper Networks SRX 240 be
internet router it's running this
particular kernel and there's a few
other informations who built it etc and
if you go back and look at our slide
textual descriptions the annotation
include the full name and version
identification systems hardware type
software operating system and networking
software so that is just a query that I
made and this comes from somewhere on
the on the in the Juniper system itself
ok so it's an X or X 240 B tells you
what version will run in ok except again
no magic ok now I told you back here
that there were two branches we were
going to deal with management and
private now there's a lot of mids in the
under the management branch owner mid to
I mean you've got the printer mem you've
got the frame really mid you've got the
coffee maker myth it's an actual myth
and if someone says hey I support the
coffee maker lid then you would know
what the object that means they would be
defined somewhere as a standard now the
question comes about what if I'm juniper
or Cisco were foundry or anybody and I
want to make mids that are very very
specific to my equipment now if it's a
standard I could probably go to the IETF
and sit on the panels and I could say
hey I think we should collect these data
objects etc blah blah blah but that can
take a long time and if I'm someone like
a Cisco I mean I want to tip my hand to
all my competitors about what I'm
working on so there is a way of actually
getting this to work by using the
private enterprise name so basically
what happens is that 1.06 dot one is
internet dot four is private dot 1 is
enterprises the number that comes after
that is assigned by the internet
assigned numbers Authority so 2 is IBM
- Cisco the 11 is HP open an MS is five
eight one three and we should be able to
go sometimes this doesn't load very well
Firefox but we'll see
so enterprise doesn't work so i na org
there we go there press numbers this
takes a really long time to load because
it's huge
does anyone want to guess how many
enterprise numbers there all right now
as Firefox proceeds to die
there's just shy fifty thousand so yeah
this is this is going to be very unhappy
as you can see it's just capable Firefox
I have no idea no idea why that does it
works fine into chromium so let me bring
up chrome here so I am a fireman in the
Proverbs
so let me pull this up as you can see
[Music]
make this a little bigger if I go down
here to the bottom come on just taking
this time get big this is a huge tech
problem we're not super you should
should be causing this much problems
abroad er there we go let's try to go
smaller one more so as you can see if we
go down here to the bottom we're just
shy of so 49 4 7 8 so we have just shy
50,000 enterprise numbers and you don't
fly it does it it doesn't cost anything
you can go get your own enterprise
number if you want I happen to have mine
so if you look for my name's Horace
let's go there's two four three two so I
have a fairly low number um Enterprise
number yeah it is kind of like a pride
thing if you need a bunch of network
management geeks at conferences they'll
talk about who is a smaller enterprise
number it's not really a big deal when
you consider that the there's one called
black pigs of death which is 2288 so
it's a little lower than mine but anyway
that's your private enterprise numbers
so we're still been here I'm going to
need to get back to that so we'll go
ahead and kill that and come back to it
okay getting back to our slides
so private enterprise numbers do a
couple of things first of all you can
load in mids so cisco tends to load in a
whole bunch of meds and every time they
come out with a new protocol they tend
to add isapi support for it so you get a
lot of data around it so you can load
those meds and the
Chinese nose meds for the example of
Cisco is going to start off by 1.3 26.1
Internet 4.1 private enterprise 9
Francisco another use of private
enterprise meds is in something called
the system project of the if you look
here in the system tree there's this
thing called the system object ID and
the system object ID is it says on
object ID that points to another object
ID and so if we go scroll back to them
here if we go look we walked down the
system tree you'll see here is the
system object of a again notice it's
zero there's only one and it's
enterprises which is that dot one dot
three that 6.1.2 6:36 happens to be
junipers number and then 1 1 1 to 39
this will actually tell me if I go and
look at junipers nib because they have
to define this it'll tell me this is an
X our X 240 be the desert it's a switch
you
first of all um there's it tells us what
kind of device we're dealing with so
when we talk to an IBM device or an HP
device or Cisco device or a Microsoft
device there's no reason for us to try
to collect on object IDs they don't
exist I mean there's no way that
Microsoft Windows is going to support a
Cisco object Eddy the other thing is if
you've ever seen a pretty Network map
where there's icons and the icons show
you different types of devices nothing
magical about it they literally just
have somewhere a map that says this
object ID this system objectivity mapped
to this icon how we do with open an MS
if we're looking at something with the
system objects that you've dealt one
dots we have six dot one dot 4 dot 1.8
Oh 72 that's 3.2 that 10 and then it's a
Linux box so I can put up a little
picture of a server with a tux or
something that tells me it's Linux so
again the two things to take away from
this is it tells us what device we're
dealing with so we can use a potato
collection and then we can also use it
for graphical representation etc so make
sense kind of thrown a lot at you so
we've got your standard object at ease
which is usually under the nib to which
are satisfied committee and the
standards you can download documents
tell you exactly what they are and then
you've got private enterprise modes
which allow you to get vendor specific
information and a lot of the stuff
that's useful that comes out of up
another message than your specific okay
so we've talked about mids okay that's
the data structure how do we get
information to and from a manager to an
agent well that's this side of the
handout that I gave you um there are
only five commands in S&P version one
it's simple
doesn't mean it's not powerful you can
you turn the stuff with these commands
but there's only five commands as the V
version 2 as if you more but if V
version 1 baughman
all you should ever need the first one
is a get request if I'm back here and I
want to know hey mister device what's
your value for dot 1.3 that 6.1.2 dot
1.2.0 1.2.3 I want to make a get request
let make a get request to the device it
will come back with a get response it
will say hey my value for dot one two
three five six dot one dot 4.1.2 two
1.2.3 is SXP oh one or whatever now when
I'm never gating the table I can use a
get next requesting say hey mister agent
I got your value for not 1.3 that 6.12
4.1.2 that - that one or two or whatever
what come next and I can either get the
next object ID in the get response or I
can get an error that says we're done
with into the table and so that's kind
of the get part so that's getting data
and getting data from an agent from a
management station now there is another
another command called asset request the
reason I kind of roll my eyes and pause
a little bit we talked about set request
is that SP sets for the longest time
we're not very secure they're incredibly
useful cisco used to have a variable
value an object ID that would sit at
zero and if it ever changed to 1 it
would reboot the device so let's say I
needed to install a new operating system
or something I could queue it up on the
system and then write a script and says
hey at 2:00 in the morning do an SP set
set this from 0 1 and then the system
will automatically reboot and of course
we assume you've tested it nollans ready
to go so you're safe doing that
but sets allow a manager to make changes
on the agent it's not used very much to
be perfectly honest just because is a
the up until IP version 3 it was the
passwords that you use for all this were
in plain text and so the bad kids
started rebooting things right in the
middle of the day so they pretty much
from that functionality off anyway so
get requests can response get next
that's all about getting data from an
agent to a manager set request is the
ability for a manager to change
something on the agent and finally
there's a trap so the PDU type 4 which
is the
it's ordinal so zero through four PDA
you type of four is a trap and this is
the ability of an agent to send an event
asynchronously to the manager like help
I'm overheating help someone's trying to
break in to me help my disk is full
things like that that's a trap so
because all these gets and sets are
initiated by the manager to the agent
and a trap is where an agent can
actually send information back and we'll
spend a lot of time talking about as to
be traps because they're very very
useful problems with SMT version one
now I mentioned security security was
done by community names the community
name was basically a password and there
were two main types public and private
and the public was a read-only password
and private was a right only password
although usually the in most
implementations if you used the private
key in a read it would work as well so
if you use the private key and again you
would actually get that information back
you can have others I mean I saw one
device I remember had like four or five
different community names so for normal
stuff you had a private key which could
do some basic sets but if you wanted to
do the major stuff you have a special
community name again pretty useless
because if anyone can sniff the network
that this was on into the traffic you
can easily see the communion in being
used so another way kind of around this
was device based security a lot of
agents would implement hey I'm only
going to spawn from commands from
certain IP addresses so if you try to do
an SP walk using public on my router you
wouldn't be able to get there because I
don't allow SNMP traffic into my router
from the outside world but you can do
device basically I only bring this up
because if you ever have open ms
installed and you change the IP address
of the open and the server sometimes you
may have to go out to your remote
devices and allow the new IP address
again this is how another problem that
people complain about is that
SNP is udp-based there's nothing wrong
with you VP a lot of the Internet as UDP
but the difference between TCP and UDP
is like a phone call versus sending a
letter in the mail so if I send a letter
in the mail I just I don't get any
verification that I just assumed it gets
there so I put something in the mail I
see the get center with TCP you actually
make a connection it's like making a
phone call dial number hello hey how are
you you got a little handshake so the
problem is if I want to send an SNMP
trap and a GDP I'm not sure it gets
there and the other problem was it was
limited to 32 bit counters now 2 to the
32 minus 1 is a very very large number
but it turns out that you can especially
in today's high-speed networks end up
having um counters that basically is
counter wrap so if you remember my xik
example so Zeek sitting there at
Portsmouth Post 45 baseball and he's got
his clicker and it's three digits on it
so if I say hey Zeek what's your what
you counter read me says 996 and then I
say hey Zeek what's your counter read
and he says five I would know that there
was nine people had gone through because
if the counter graphed it had gone 96 99
6 9 and 7 9 9 8 9 9 9 and then it had
reset to zero however if I have a lot of
if I had thousands of people going
through I may not be able to keep up so
I might say you know what your counter
reduce is 54 and then what's your
counter read 20 what's your countering
417 what's your counter read 312
um and that actually does happen in the
networking especially with the number of
bytes that go through a circuit I mean
we have 10 gig circuits out there so we
needed some other solution and so SNP
version 2 came along now this is an old
slide if you remember SPU started in
1988 it was ratified in 1999 fairly
short process activity version 2 was
started in the early 90s these were some
of the architects of it I've met Jeffrey
case in fact I took a complete course
whichever case
and by MIT marshal rose but I haven't
met the other guys here Keith McCloskey
or Steve Walden buster but they were the
main architects of every version - and
they all wanted to do a ton of stuff and
they all had fairly strong egos and they
basically couldn't decide on anything
and so he finally said well what can we
decide on and so in 1996 you know eight
years after they originally started S&P
version 1 came out with S&P version 2
and it's often called SMC version 2c
because one of the complaints they had
dealt with how are we going to do
security how are we going to do this
authentication they finally just said
screw it we can't really deal with it
right now let's just do community based
security like we used to do so if you
think about it I mean this is 1996 what
was the the most powerful CPU was like a
Pentium 2 this is the ability to do
strong encryption that we like take for
granted right now
it was hard back then and quite
frequently I mean this was at a time
where all these vendors were trying to
vie to be the fastest router vendor etc
so quite frequently if you threw enough
traffic at something it was going to
actually to stop doing like ACL checks
or it just stopped the firewall or
definitely SP is such a low priority in
these systems nowadays we're lucky we
don't have to worry about it so in 1999
they came out with s complete version 3
which is basically SMT version 2 with
encryption we'll talk about that second
so what did we get out of essence
rewritten - we got some new data types
the big one was counter 64 so we now got
a 64 bit counter two to the 32 is a
large number - D - 64 is an
incomprehensibly huge number it's one of
those thought exercises where you have a
chess board with 64 squares and you put
a grain of sand on the first square you
put two grains of sand on the second for
the next 8 on the next 15 on the next
etc there's like not enough sand in the
world to cover that 64th same - this is
a huge number and the only time I ever
really see counter rats on a 64-bit
counter is
when the device itself is resent because
you'll be at some high number in order
drop to zero the other really cool thing
we got was a get bulk request now if I'm
trying to walk an interface table that
has hundreds of thousands of interfaces
and trust me we've actually done work
with some junipers gear which had
300,000 interfaces in the interface
table now these weren't physical
interfaces there were virtual interfaces
but they still count and trying to
actually ask for every single object ID
was kind of nut the performance set but
with SNP version two we can do a get
bulk request and we can say hey send me
your interface table and cram it in as
few packets as possible and so open and
ms will use get bulk request if SNP
version to lose its configured and it is
by default so I would definitely use it
I can be virgin 3 it just has to be
version 2 of security so you can encrypt
the authentication so instead of sending
my password in plain text I can actually
send the hash an encrypted password that
can be read by the UH by the agent and
the agent can choose to respond on
whether or not the password is it's
valid you can encrypt the payload some
people don't care about the actual
payload they just want to make sure that
the device is making the queries are are
valid but you can include the payload
you can do both or you need it and if
you do neither it's just SP version 2
with a lot of extra configuration
there's a few extra steps which I'm not
going to cover but you can look on our
wiki etc for setting up SP fewer than 3
but you basically have to set up some
some strong passwords and what method
you use to encrypt is ok net SP as I
mentioned before I am an unabashed
fanboy MSP this grew out of the
University of California Davis the UC
Davis agent I think after the guys
graduated they started their own project
called an FTP it's usually configured
what this installed is configuring a
file called SNMP decomp we have to edit
it for permissions by default we don't
get
[Music]
we don't get access to the whole mend by
default none SP limits you to the system
tree and one other one other resource
now as I mentioned in here with nib to
the IDE interface table interface table
right here doesn't have anything to do
with like IP addresses that is in the IP
type in the IP branch there's this IP
address table which Maps a particular IP
address to a particular is index and
since I might know hey is index 1 is my
land connection I might be very very
interested in the amount of traffic
going through there I need some way to
relate the interface to the if' index
and so I have to have permission to look
at that
now I already installed with this yum
install management PHP utils so I'm
going to go back over here and I'm going
to go to at CSP as the psp-3000 tv.com
file now so this is one of those
depending on the operating your system
system is using this file might be
heavily documented it may not these
commands should work regardless of
whether or not you see what I see this
is on CentOS and it's very very well
documented and so this first I'm just
following the instruction first map the
community name to a security name so
this is the default community name here
called public we're not going to use it
so what I'm going to do is I'm going to
add community to security name and I'm
going to call it the O NMS user now the
source is default um that should allow
queries from anywhere here's where you
would limit what IP addresses could use
it you could actually put an IP address
or a network range in here under the
source and that would limit who could
use that community string and actually
get a response and this is an actual
community name used by one of my
customers many years ago why are you so
nosy so we're going to put that in I
notice case matters so capital I our
capital u s o nsv I just I don't know
why cased all that
but we have to make it so that the
hackers can't find it but anyway so I'm
going to create a new community name
called why are you so nosy and I'm going
to map it to the ONS user now the next
thing I have to do is I have to map the
security name on to a group so I'm just
going to grab these two limes and I'm
going to call this my OMS group and I
want to map it to my OMS user that I
used above again case matters make sure
I get that right
okay so I'll make this pretty because I
have OCD issues just level all that up
because I got to do it okay so what this
says is that we're going to create this
group called the OMS group includes OMS
user with this security model so we've
got version 1 version 2 if I left one of
those lines out I would not be able to
use that protocol would not be able to
use one or version 2c to access this
device using that community name this is
also where you end up putting in your s
petites 3 security model which is called
the USM again there's examples now the
third step again I'm just following
instructions create a view so we've got
our system view which says 1.3 to 6.1
remember dot 1.3 96.1 is internet dot -
it's management that one is nib 2.1 is
system that allows us to get to the
system tree and then it also includes
this other object ID 25 which is the
host resources nib there's a branch
dealing with hosts and this happens to
be the host
uptime when we talk about the system up
time you'll see system uptime in here
that is the uptime of the agent so if I
restart the agent it's going to restart
the system uptime
the host resources uptime is the actual
uptime of the device since it's been
restarted so we want to include that so
what we're going to do here is
we're going to add a new view call it
all of you included and I'm just will
put dot one that gives me everything I
sew down so that one now you can't
exclude branches I've actually had to
use this once we many years ago we hit a
bug there's actually I think a net s2p
bug that caused over the mess to have
problems it would scan a certain branch
in the mid and it would fail uh so what
we did is we created a workaround we
created an x crude rule for that object
so we just never returned to open an MS
open and that's what never experienced
the error and so we'd never have a
problem and then finally we have to UM
map the group in this case own immense
group to the view and I call it all of
you
so notice that this says if I'm into not
config group which is up here and not
configure user I'm only going to get the
system view but if I'm in the open in
math group about all of you and that
should get me I use why are you so nosy
it should give me so I'm going to jump
back to the slides there's a few other
things we need to do I'm going back to
slides
so again map the community name why are
you so nosy to the user OMS user map the
security name OMS user to a group name
OMS group create a view called all view
and map that to the group so this will
allow they open an domestic route the
OMS group to actually see everything in
the nib now the other thing we want to
do is we're going to look at the system
so again this is fairly highly commented
a bunch of different options notice we
have the fifth location unknown and this
contact I want to put on low system
location
VM running on butter's which is my
machine
desk the open in this group 227 is dr6
prose kalana 2 3 1 2 USA
North America first now I know that
sounds ridiculous and it is the earth
that especially is a little ridiculous I
could put you know Milky Way galaxy
universe but the reason why I put so
much information in my system location
is that open and a mess can use this to
group devices together a lot of people
do not leverage the power of having
certain location they'll have this
unknown or default put in a very very
good system location so the reason is if
I wanted to see all of the devices in
North Carolina I could do a search for
assistant location like NC or we're
system location like USA or North
America so I can make categories and
things in my GUI based solely on what's
in the system location and if there's an
address in system location we can also
use that to actually geo tag it we can
actually put it on a map in the right
location if you have an address in your
system location file so I strongly
recommend you to do this some agents
they limit it to like 64 characters
I don't know wise the device is where
you have to go and configure them
through a GUI but for the most part I
try to be as specific as possible and
then I'll make the system contact me hey
thanks so the next thing if you go down
through the file there's a bunch of you
checks you can deal with some logs you
can monitor executables which we'll talk
about here we want to do a disk check so
if I let me quit out of this for a
second if I do a DF - H notice I have a
slash root slash boot and a slash home
yeah those look interesting so I'm going
to go here and I'm going to add
disk well
this disc /b and this /home what these
directives will do is say start there's
a table there's a disc table in Minister
P and this will let me gather disk
utilization there's other things you can
set up here you can do load average
checks we're going to talk about extend
etc and at the very bottom so I'm going
to go to the end here and I'm going to
add another one that says trap sink 127
thought of the other that one that's
localhost
so trapping 127 other about 1 all that's
going to do is just going to send traps
to lowboys now this is where you would
put the IP address of your open MS
machine so this is a VM I'm going to
happen to know that open in a message
running on localhost this is this is
going to be fired
let me jump right the slides make sure I
didn't forget anything
so so I'm going to save that and we'll
do system control restart PD so that
should restart gas to P P now let me
bring back up ok that so here is my open
MS web console I'm going to go to my
node
and so here is my local host node again
this is running on on this system here
what I was looking for I guess I didn't
get so if I go to my event so if I go to
my events you'll see I got a cold start
trap I want to talk about traps in the
next exercise but basically when I
restarted my net SNP agent I got a cold
start trap because I had added that trap
sync now notice it's not associated with
any node because it came from 172 21 123
and we don't know where that is because
if I go to my node the only interface I
happen to have online oh right now so
close but I can leave scan well not can
tree scan yet so by default open an MS
uses public as a community name and so
if we go here I can do an FTP walk so if
I do that the P block does version to
see that see public localhost boom
you'll see I just get the system tree
this is all the stuff in the system
branch and this system uptime that I'm
telling you about notice it's in time
ticks so we've had 370 1211 hundredths
of a second since I started this system
so it's been up for an hour now if I
redo this with my why are you so nosy
why are you so nosy boom I get a whole
bunch on the stuff and the big kicker is
I want the IP at our table so if I type
in IP at our table you can see here
that's where that 172 dot xx dot one dot
123 is located so as you see we have two
interfaces index 1 our index ones I've
got index 1 is one 27001 and the x2 is 1
for the 2.20 dot one dot 123 so how I
get that in dokkan m/s well I have to do
two things first of all I'll go to the
admin GUI here and
figure SNP community names by IP address
so I'm going to type in I can do a range
here but I'm going to 172 I'm going to
look ones 127 0.1 timeout up with three
three thousand seconds retries one you
don't want to either make your timeouts
longer or you retries in the war you
don't really want to do both and then on
the community string I'm going to put
why are you so nosy
again capital y capital u capital v why
are you so nosy mail save down so that
now just associates if I type in 127 0 0
1 and do a lookup you'll see that it's
why are you so nosy right there that
gives me the communities now if I go to
my node I can you scan and what should
happen everything went well what should
happen is we should discover SNP data on
this machine and so shouldn't take too
long didn't so you can see we have wow
look post name of this is local oh this
local domain haven't changed it there's
a system object ID remember that 8 o 72
Thuy 210 tells me hey this is a Linux
box um here is my location again VM
butter starts and SP open an MS group
blah blah blah blah that's exactly what
I put in I've got my contact name and
then there's the system description as
you can see now we have extra interfaces
there's the ipv6 interface for this
particular box and here's the ipv4
interface for this particular box
cool huh kind of neat I will say if I
click viewing topology so can I be able
to bring it there we go so I'm bringing
up the you view and topology and you can
see we have our closed node notice that
the icon has a little tux on it that is
because we mapped the name so go back
that's because we Matt
this object ID about 1.3 X 6.1 that 4.18
o-72 trees at 2.10 to linux box huh okay
so going back to the slides so what we
did was we edited Eskom PDF file to
allow for access to anything to blow dot
one for the why're you so knows the
community name restarted a demon we
tested the access notice if we use
public we only get a small subsection of
the mid we use why are you so nosy which
includes that IP at our table
then we rescan as we updated the
community name in open MS and then we re
scanned and we got information again
remember we went in and we set the
community name here we discovered STP
we've got all these extra devices now
notice there is a file and opt open an
MS Etsy call FTP config file go back
here so I go to ops open in this Fe
clear that show you guys so we're in
optimism expect see if I look at the SNP
config that XML you'll see that we added
a specific entry for one 2700 that one
using the why're you so nosy community
means no magic no magic mobile NMS it is
magical but it's not magic and so that
just shows what we did to the GUI I
could have edited it through here and we
started opening a mess but again it's
lot easier to do through the GUI and so
that gives us that information
now another wonderful thing about open
an MS is I can click on resource graphs
now and there is all of this information
now coming from SNP including our space
utilization now it will take five
minutes for this to come up so you'll
see that there's Nan's right now but you
didn't have to do anything to get this
information so basically what happened
is when opening a mess started is it
came up it ran it it came up it ran it
discovered this particular object ID and
then it automatically looked in this
configure
and started collecting data so if you're
very new to open in ms go in set your
community names if SMP is enabled and
it's public you should be able to
discover these devices and it should
start collecting interesting information
out of the box and we're going to
discuss that more in detail anyway so
that's it for this lesson
I hope you found it useful so again what
we did is we we reviewed SMP remember
the two things or MIBs or code books
that talked about how what information
is available from an agent and how its
organized SNMP is a protocol that allows
you to get that information from a
manager an agent can send information
asynchronously to a manager via trap and
finally we installed the net skp agent
did some basic configuration again a
love den SP we're going to use it in a
number of future lessons and until then
I hope you folks have found this useful
please feel free to leave feedback in
the comments and we'll see you next time