7/31/2019 Application Layer Protocol and Functionality
1/76
Application Layer Protocol and
functionality
7/31/2019 Application Layer Protocol and Functionality
2/76
WHAT IS LDAP
LDAP IS LIGHT WEIGHT
SUFFICIENT STRAIGHT FORWARD
EASY TO IMPLEMENT AS AGAINST X.500 DAPWHICH IS HEAVY WEIGHT
7/31/2019 Application Layer Protocol and Functionality
3/76
LDAP
DIRECTORY BECAUSE DATA IS ORGANISED IN
THE FORM OF TREE MUCH LIKE UNIX FILE
SYSTEM
USES SIMPLIFIED SET OF ENCODING
RUNS DIRECTLY ABOVE TCP/IP
USES STRING TO REPRESENT DATA
7/31/2019 Application Layer Protocol and Functionality
4/76
LDAP
LDAP SECURITY MODEL : DEFINES HOW
INFORMATION CAN BE PROTECTED FROM
UNAUTHORISED ACCESS
7/31/2019 Application Layer Protocol and Functionality
5/76
LDAP
LDAP API
THERE ARE SEVERAL LDAP API
APPLICATION PROGRAMMING INTERFACE
OLDEST ONES WRITTEN IN C
NOW A DAYS LDAP API S ARE AVAILABLE IN
OTHER PROGRAMMING LANGUAGES LIKE
PERL JAVA
7/31/2019 Application Layer Protocol and Functionality
6/76
HOW LDAP WORKS
LDAP DIRECTORY SERVICE IS BASED ON
CLIENT SERVER MODEL
LDAP IS A MESSAGE ORIENTED PROTOCOL
CLIENT CONSTRUCTS AN LDAP MESSAGE
CONTAINING A REQUEST AND SENDS IT TOTHE SERVER
7/31/2019 Application Layer Protocol and Functionality
7/76
HOW LDAP WORKS
SERVER PROCESSES THE REQUEST AND
SENDS IT BACK TO THE CLIENT IN THE FORM
OF LDAP MESSAGE
7/31/2019 Application Layer Protocol and Functionality
8/76
LDAP BACKENDS
THE BASIC DAEMON PROCESS THAT RUNS
ON THE LDAP SERVER CALLED SLAPD
COMES WITH THREE DIFFERENT BACKEND
DATABASES
WE ASSUME THAT IN OUR CASE WE USE
LDBM THE MOST USED ONE
7/31/2019 Application Layer Protocol and Functionality
9/76
HOW LDAP WORKS
LDAP DATABASE WORKS BY ADDING A
COMPACT FOUR BYTE UNIQUE IDENTIFIER
INDEX FILES ARE MAINTAINED FOR
REFERRING TO DATA
7/31/2019 Application Layer Protocol and Functionality
10/76
LDAP PROTOCOL OPERATION
INTERROGATION OPERATION : SEARCH
, COMPARE ADD DELETE OPERATOIN : ADD ,
DELETE , MODIFY , MODIFY DN
AUTHENTICATION AND CONTROLOPERATION : BIND ,
UNBIND , ABANDON
7/31/2019 Application Layer Protocol and Functionality
11/76
LDAP INFORMATION MODEL
BASIC UNIT IS ENTRY ( A COLLECTION OF
INFORMATION ABOUT AN OBJECT )
AN ENTRY IS COMPOSED OF A SET OF
ATTRIIBUTES
7/31/2019 Application Layer Protocol and Functionality
12/76
Definition of MIME
MIME, stand for Multi-purpose Internet mailExtensions, is a freely available specification thatoffers a way to interchange text in languages withdifferent character sets, and multimedia e-mailamong many different computer system that use
Internet mail standards.
7/31/2019 Application Layer Protocol and Functionality
13/76
Introduction
MIME extends the format of Internet mail to allow non-US-ASCII textual messages, non-textual messages,multipart message bodies, and non-US-ASCIIinformation in message headers.
MIME provides Internet mail users with functionalitysimilar to that of MS-Mail for LAN-based internal mail.MS-Mail and MIME allow the attachment of files andother objects, as does MIME. Unfortunately,
Microsofts method of handling these attachments isundertaken through a proprietary format and MS-Maildoes not provide compliance with the MIME open
standard.
7/31/2019 Application Layer Protocol and Functionality
14/76
7/31/2019 Application Layer Protocol and Functionality
15/76
What exactly is MIME?
In 1992, a new standard was defined by anInternet engineering task force working group inRFC1521 & 1522 called MIME.
MIME is an extension to the Internet mail standard,known as Simple Mail Transfer Protocol (SMTP)that allows mail messages containing differenttype of multimedia information to be sent acrossthe network this includes, but is not limited to,word-processor documents, spreadsheets,programs, graphics, audio, and motion picturefiles, as well as links that enable users to retrieveinformation from remote databases from within a
mail message.
7/31/2019 Application Layer Protocol and Functionality
16/76
Cont
MIME is a specification for enhancing thecapabilities of standard Internet e-mail.
It offers a simple standardized way to representand encode a wide variety of media types oftransmission via Internet mail.
It is defines extensions to SMTP to supportbinary attachments of arbitrary format.
The designers of MIME have learned a lot fromthe old SMTP protocol and its mailers.
MIME is here to stay and it works.
7/31/2019 Application Layer Protocol and Functionality
17/76
Cont
When using the MIME standard, messages cancontain the following types:
Text message in US-ASCII
Character set other than US-ASCII
Multiple objects in a single messages
Multimedia; Image, Audio, and Video messages
Multi-front messages
Messages of unlimited length
Binary files
7/31/2019 Application Layer Protocol and Functionality
18/76
Cont
MIME is defined to be completely backwardscompatible, yet flexible and open toextensions. Therefore, it builds on the older
standard by defining additional fields for themail message header, that describes newcontent types, and a distinct organization ofthe message body.
7/31/2019 Application Layer Protocol and Functionality
19/76
How MIME works?
The developers of MIME found a clever way towork around the limitation. It packages differentdata types into a 7-bit ASCII format. that way, all
e-mail, regardless of the data it contains, appearsas standard e-mail messages to the internetsSMTP servers. The beauty of the solution lies in
the fact that SMTP didnt have to change to
handle such data.
7/31/2019 Application Layer Protocol and Functionality
20/76
Cont
Uses a new binary encoding scheme calledBASE 64
New SMTP headers describe the attached
document
User agents read the header to figure out howto interpret the message
7/31/2019 Application Layer Protocol and Functionality
21/76
MIME Specific technical definition
New MIME headers
The Content-type headers
The Application-type headers
The Content-transfer-Encoding The Content-ID &Content Description
Multipart Message
Non-ASCII text in mail messages
7/31/2019 Application Layer Protocol and Functionality
22/76
The Content-type Header
Content-type sub-type describes what formatthis part of the message is in
Text Image
Message AudioApplication Video
Multipart
The default type is simple ASCII text
MIME-Version : 1.0
Content-type:text/plain;charset=US-ascii
7/31/2019 Application Layer Protocol and Functionality
23/76
The Content-type Applications Subtypes:
Postscript
Octet-Stream-Unidentified binarydata
Many other will be added
7/31/2019 Application Layer Protocol and Functionality
24/76
The Content-transfer-Encoding
Base64 encoding algorithm is used to encodebinary data in 7bit ASCII data
Quoted-printable is for text-only messages
A few others
7bit No encoding Case insensitive
8bit No encoding
Binary No encodingX-token No encoding
Example
7/31/2019 Application Layer Protocol and Functionality
25/76
Summary
MIME has been designed to avoid problemscaused by additional restrictions imposed bysome Internet mail transport mechanisms.
The Multipart and Message content types allowmixing and hierarchical structuring of objects ofdifferent types in a single message. Furthercontent types provide a mechanism for taggingmessages or body parts as audio, image, orother kinds of data.
Finally, a number of useful content types aredefined for general use by consenting useragents, notably Text/Richtext, Message/Partial,and Message/External-Body.
7/31/2019 Application Layer Protocol and Functionality
26/76
POP
POP supports simple download-and-delete requirements foraccess to remote mailboxes (termed maildrop in the POPRFC's).
Although most POP clients have an option to leave mail onserver after download, e-mail clients using POP generally
connect, retrieve all messages, store them on the user's PC asnew messages, delete them from the server, and thendisconnect.
POP (POP1) is specified in RFC 918 (1984),
POP2 by RFC 937 (1985).
The original specification of POP3 is RFC 1081 (1988). Itscurrent specification is RFC 1939, updated with an extensionmechanism, RFC 2449 and an authentication mechanism inRFC 1734.
http://www.answers.com/topic/request-for-commentshttp://tools.ietf.org/html/rfc918http://tools.ietf.org/html/rfc937http://tools.ietf.org/html/rfc1939http://tools.ietf.org/html/rfc1081http://tools.ietf.org/html/rfc2449http://tools.ietf.org/html/rfc1939http://tools.ietf.org/html/rfc1734http://tools.ietf.org/html/rfc2449http://tools.ietf.org/html/rfc1734http://tools.ietf.org/html/rfc1734http://tools.ietf.org/html/rfc2449http://tools.ietf.org/html/rfc1939http://tools.ietf.org/html/rfc1081http://tools.ietf.org/html/rfc937http://tools.ietf.org/html/rfc918http://www.answers.com/topic/request-for-comments7/31/2019 Application Layer Protocol and Functionality
27/76
27
POP
Usually, mailboxes are kept on a dedicatedmachine.
Computer with mailboxes runs POP server.
User runs POP client on local computer. POP client can access and retrieve messages
from mailbox.
Requires authentication (password).
Local computer uses SMTP for outgoing mail.
7/31/2019 Application Layer Protocol and Functionality
28/76
28
POP
7/31/2019 Application Layer Protocol and Functionality
29/76
7/31/2019 Application Layer Protocol and Functionality
30/76
30
POP and Dialup Access
POP useful for dialup connection. Users computer not always connected.
Can download all mail at once and read off-line.
An alternative to POP:IMAP(Interactive MailAccess Protocol):
Does not copy email to users PC- email always
resides in the mail server. Useful when user uses several computers.
7/31/2019 Application Layer Protocol and Functionality
31/76
POP3
Stands for Post Office Protocol Version 3
RFC in 1993
POP3 is intended to permit a workstation todynamically access a maildrop on a server
host in a useful fashion. Usually, this means
that the POP3 protocol is used to allow a
workstation to retrieve mail that the server isholding for it.
7/31/2019 Application Layer Protocol and Functionality
32/76
POP3
Doesnt provide extensive mail operations on
the server
Normally mail is downloaded, then deleted
Deletion doesnt really occur until QUIT
Uses port 110
7/31/2019 Application Layer Protocol and Functionality
33/76
Minimal POP3 Commands
USER nameusers name
PASS stringusers password
QUIT quits, and updates the mailbox
STAT status LIST [msg]lists the mail messages (#s only)
RETR msg retrieves a mail message
DELE msg deletes a message
NOOP No operation
RSET resets the mail to its original state
7/31/2019 Application Layer Protocol and Functionality
34/76
RMON
What is RMON?
RMON is the common abbreviation for Remote Monitoring, a system defined by the IETF thatallows you to monitor the traffic of LANs or VLANs remotely.
RMON (Remote Network Monitoring) provides standard information that a networkadministrator can use to monitor, analyze, and troubleshoot a group of local area networks(LANs) from central location.
Remote Monitoring (RMON) is an extension to the SNMP MIB, and includes two versions RMON and RMON 2.
MIB - A Management Information Base (MIB) is a collection of information that is organizedhierarchically. MIBs are accessed using a network-management protocol such as SNMP. Theyare comprised of managed objects and are identified by object identifiers.
7/31/2019 Application Layer Protocol and Functionality
35/76
Goals of RMON
RMON, primary goal is to provide information
relating to network errors and utilization.
RMON data is gathered as part of ten
different monitoring groups.
7/31/2019 Application Layer Protocol and Functionality
36/76
RMON
Offline Operation:There are sometimes conditions when a management station willnot be in constant contact with its remote monitoring devices.Probes will perform diagnostics and to collect statisticscontinuously, even when communication with the managementstation may not be possible or efficient
Proactive Monitoring :Continuously run diagnostics and log network performance andnotify the management station of the failure and store historicalstatistical information about the failure.
7/31/2019 Application Layer Protocol and Functionality
37/76
RMON
Problem Detection and Reporting :The monitor can be configured to recognize conditions, mostnotably error conditions, and to continuously check for them. Whenone of these conditions occurs, the event may be logged, andmanagement stations may be notified in a number of ways.
Value Added Data :Highlighting those hosts on the network that generate the mosttraffic or errors, the probe can give the management stationprecisely the information it needs to solve a class of problems.
7/31/2019 Application Layer Protocol and Functionality
38/76
Version of RMON
RMON was originally developed to address the problem of managing LANsegments and remote sites from a Central Location.
There are two versions of RMON, RMON 1 & RMON 2:
RMON1-It defines 10 MIB groups for basic monitoring.
It allows network monitoring at MAC layer or belowRMON1 was only capable of providing information up to the MAC level,
RMON2-This is an extension of RMON 1 that focuses on higher layers of traffic above theMAC layerIt has an emphasis on IP traffic and application level trafficIt allows network management applications to monitor packets on all network
layers.RMON 2 is capable of monitoring traffic up to the application level.
7/31/2019 Application Layer Protocol and Functionality
39/76
Working of RMON
Working of the RMONSetup:FDDI Backbone network with a local Ethernet LAN, two remote LANS, one is a token ring LAN andthe other an FDDI Lan.NMS is on the the local Ethernet LAN
MonitoringEthernet Local LAN is monitored by the Ethernet probe on the LAN.The FDDI backbone is monitored by an FDDI probe via the bridge and Ethernet LAN.
Token Rink is monitored by the token ring probeThe FDDI LAN is monitored by the built in probe on the router.Both the remote LANs communicate with the NMS via the routers, the WAN and the backbonenetwork,
WorkingRMON devices monitors the local network segment & does the necessary analyses and informs theNMS only when there are exceptions or NMS requests for some info.This reduces the traffic especially on the segment in which the NMS resides, as all the monitoringtraffic would otherwise converge there.
Alarm GroupSet thresholds on a variety of items affecting network performanceWhen the thresholds are crossed, events are reported.In general, the values of thresholds are determined according to past experience
7/31/2019 Application Layer Protocol and Functionality
40/76
Advantages of RMON
It improves your efficiency -Using RMON probes allows you to remain at one workstation andcollect information from widely dispersed LAN segments or VLANs. This means that the timetaken to reach a problem site, set up equipment, and begin collecting information is largelyeliminated.
It allows you to manage your network in a more proactive manner- If they are configuredcorrectly, RMON probes deliver information before problems occur. This means that you can
take action before they affect users. It reduces the load on the network and the management workstation Traditional network
management involves a management workstation polling network devices at regular intervalsto gather statistics and identify problems or trends. As network sizes and traffic levels grow,this approach places a strain on the management workstation and also generates largeamounts of traffic. An RMON probe, however, autonomously looks at the network on behalfof the management workstation without affecting the characteristics and performance of thenetwork. The probe reports by exception, which means that it only informs the management
workstation when the network has entered an abnormal state. Increases Productivity for administrators.
Permits monitoring on a more frequent basis and hence faster fault diagnosis.
Needs no direct visibility by NMS; more reliable information
7/31/2019 Application Layer Protocol and Functionality
41/76
Disadvantages of RMON
The amount of information it provides is insufficient for networkmanagers and administrators who need to solve complex problems,often at a distance.
The mechanism employed for data retrieval to a centralmanagement console are slow and very bandwidth inefficient.
RMON values are stored in 32 bit registers which limit the countvalue to 4,294,967,295. Although a seemingly large value, this isactually quite small. In a 100 Mbps fast Ethernet network running atjust 10% loading, the counters will be reset to zero after just onehour of acitivity.
Full RMON support in hardware typically requires dedicated RISC
processor technology and this is achievable in sub -$1,000 routers,hubs etc.
i l k i
7/31/2019 Application Layer Protocol and Functionality
42/76
SNTP-Simple Network Time
Protocol Simple Network Time Protocol (SNTP) is a time-
maintenance application that you can use tosynchronize hardware in a network.
Simple Network Time Protocol (SNTP) is used to keep
device clocks synchronized. By using timestamps thatare kept synchronized, SNTP is useful for trackingprocesses and for interactions between systems.
i5/OS SNTP is based on Request for Comments (RFC)
2030. You can view RFC 2030 by searching for thenumber with the RFC index search engine located onthe RFC editor Web site.
SNTP Cli
7/31/2019 Application Layer Protocol and Functionality
43/76
SNTP Client
When Simple Network Time Protocol (SNTP) is configured as a client,the i5/OS operating system retrieves a time value from an externaltime source. You can specify from which sources (up to three) toretrieve the time value. This external time value is compared to thesystem time.
If the system time value does not match the external time source, atime adjustment begins.
The system time is adjusted until the required time value is reached.You can configure the i5/OS operating system as the SNTP client to polla Network Time Protocol (NTP) or an SNTP server to find the time.
The SNTP client updates the system clock. Most applications use thesystem clock as their time source. By updating the system clock,applications reflect the synchronized time obtained from the timeserver.
7/31/2019 Application Layer Protocol and Functionality
44/76
SNTP Server
When you configure the i5/OS operating system as an SNTP
server, your system acts as a time server for other devices.
Other SNTP clients check time by polling your SNTP server. If
a clients time values do not match the SNTP server time, a
time adjustment begins.
The clients system time is adjusted until the required time
value is reached. This is useful for maintaining time within a
network.
7/31/2019 Application Layer Protocol and Functionality
45/76
Basic tasks that fall under this category are:
What is Network Management?
Fault Management
Dealing with problems and emergencies in the network (router
stops routing, server loses power, etc.)
Performance Management
How smoothly is the network running?
Can it handle the workload it currently has?
Configuration Management
Keeping track of device settings and how they function
7/31/2019 Application Layer Protocol and Functionality
46/76
Network Management must be...
The management interface must be...
The management mechanism must be...
Standardized
Extendible
Portable
Inexpensive
Implemented as software only
7/31/2019 Application Layer Protocol and Functionality
47/76
Functional Areas of NetworkManagement
Configuration Management- inventory, configuration, provisioning
Fault Management- reactive and proactive network fault management
Performance Management- # of packets dropped, timeouts, collisions, CRC errors
Security Management- SNMP doesnt provide much here
Accounting Management- cost management and chargeback assessment
Asset Management- statistics of equipment, facility, and administration personnel
Planning Management- analysis of trends to help justify a network upgrade orbandwidth increase
SNMP & N t k M t Hi t
7/31/2019 Application Layer Protocol and Functionality
48/76
SNMP & Network Management History
1983- TCP/IP replaces ARPANET at U.S. Dept. of Defense, effective birth of Internet
First model for net management - HEMS - High-Level Entity Management System (RFCs1021,1022,1024,1076)
1987- ISO OSI proposes CMIP - Common Management Information Protocol, and CMOT(CMIP over TCP) for the actual network management protocol for use on the internet
Nov. 1987- SGMP - Simple Gateway Monitoring protocol (RFC 1028)
1989- Marshall T. Rose heads up SNMP working group to create a common network
management framework to be used by both SGMP and CMOTto allow for transition toCMOT
Aug. 1989- Internet-standard Network Management Framework defined (RFCs 1065,1066, 1067)
Apr. 1989- SNMP promoted to recommendedstatus as the de facto TCP/IP networkmanagement framework (RFC 1098)
June 1989- IAB committee decides to let SNMP and CMOT develop separately
May 1990- IAB promotes SNMP to a standard protocol with a recommended status(RFC 1157)
Mar. 1991 - format of MIBs and traps defined (RFCs 1212, 1215)
TCP/IP MIB definition revised to create SNMPv1 (RFC 1213)
7/31/2019 Application Layer Protocol and Functionality
49/76
Versions
Two major versions SNMPv1, SNMPv2
SNMPv1 is the recommended standard
SNMPv2 has become split into:
SNMPv2u - SNMPv2 with user-based security
SNMPv2* - SNMPv2 with user-based security and additional features
SNMPv2c - SNMPv2 without security
7/31/2019 Application Layer Protocol and Functionality
50/76
What is SNMP?
SNMP is a tool (protocol) that allows for remoteand local management of items on the networkincluding servers, workstations, routers, switches
and other managed devices. Comprised of agents and managers
Agent - process running on each managed node collecting information
about the device it is running on.
Manager - process running on a management workstation that requests
information about devices on the network.
7/31/2019 Application Layer Protocol and Functionality
51/76
Advantages of using SNMP
Standardized
universally supported
extendible
portable
allows distributed management access
lightweight protocol
7/31/2019 Application Layer Protocol and Functionality
52/76
Client Pull & Server Push
SNMP is a client pull model
SNMP is a server push model
The management system (client) pulls data from the agent (server).
The agent (server) pushes out a trap message to a (client) management
system
7/31/2019 Application Layer Protocol and Functionality
53/76
Ports & UDP
SNMP uses User Datagram Protocol (UDP) as the transport mechanism for SNMP
messages
UDP Port 161 - SNMP Messages
UDP Port 162 - SNMP Trap Messages
Like FTP, SNMP uses two well-known ports to operate:
Ethernet
Frame IP Packet
UDP
Datagram
SNMP Message CRC
7/31/2019 Application Layer Protocol and Functionality
54/76
SNMP network management is based on three parts:
The Three Parts of SNMP
Structure of Management Information (SMI)
Rules specifying the format used to define objects managed on
the network that the SNMP protocol accesses
Management Information Base (MIB)
A map of the hierarchical order of all managed objects and how
they are accessed
SNMP Protocol
Defines format of messages exchanged by management systemsand agents.
Specifies the Get, GetNext, Set, and Trap operations
7/31/2019 Application Layer Protocol and Functionality
55/76
NodesItems in an SNMP Network are called nodes. There are different types of nodes.
Managed nodes
Management nodes
Nodes that are not manageable by SNMP
Typically runs an agent process that services requests from a management node
Typically a workstation running some network management & monitoring software
A node may not support SNMP, but may be manageable by SNMP through a proxy agentrunning on another machine
Nodes can be both managed nodes and a management node at the same time (typically thisis the case, since you want to be able to manage the workstation that your management application is running on.)
7/31/2019 Application Layer Protocol and Functionality
56/76
Community Names
Community names are used to define where an SNMP message is destined for.
They mirror the same concept as a Windows NT or Unix domain.
Set up your agents to belong to certain communities.
Set up your management applications to monitor and receive traps from certain
community names.
7/31/2019 Application Layer Protocol and Functionality
57/76
SNMP Agents
Two basic designs of agents
Extendible Agents
Monolithic Agents
not extendible
optimized for specific hardware platform and OS
this optimization results in less overhead (memory and system resources) and
quicker execution
Open, modular design allows for adaptations to new management
data and operational requirements
7/31/2019 Application Layer Protocol and Functionality
58/76
Proxy & Gateway Agents
Proxy & Gateway Agents extend the capabilities of SNMP by allowing it to:
Manage a device that cannot support an SNMP agent
Manage a device that supports a non-SNMP management agent
Allow a non-SNMP management system to access an SNMP agent
Provide firewall-type security to other SNMP agents (UDP packet filtering)
Translate between different formats of SNMP messages (v1 and v2)
Consolidate multiple managed nodes into a single network address (also toprovide a single trap destination)
7/31/2019 Application Layer Protocol and Functionality
59/76
Four Basic Operations
Get
GetNext
Set
Trap
Retrieves the value of a MIB variable stored on the agent machine
(integer, string, or address of another MIB variable)
Retrieves the next value of the next lexical MIB variable
Changes the value of a MIB variable
An unsolicited notification sent by an agent to a management application(typically a notification of something unexpected, like an error)
Traps
7/31/2019 Application Layer Protocol and Functionality
60/76
TrapsTraps are unrequested event reports that are sent to a management system by an SNMP
agent process
When a trappable event occurs, a trap message is generated by the agent and is sent to a
trap destination (a specific, configured network address)
Many events can be configured to signal a trap, like a network cable fault, failing NIC or
Hard Drive, a General Protection Fault, or a power supply failure
Traps can also be throttled -- You can limit the number of traps sent per second from theagent
Traps have a priority associated with them -- Critical, Major, Minor, Warning, Marginal,
Informational, Normal, Unknown
Trap Receivers
7/31/2019 Application Layer Protocol and Functionality
61/76
Trap ReceiversTraps are received by a management application.
Management applications can handle the trap in a few ways:
Poll the agent that sent the trap for more information about the event, and the
status of the rest of the machine.
Log the reception of the trap.
Completely ignore the trap.
Management applications can be set up to send off an e-mail, call a voice mail and leave
a message, or send an alpha-numeric page to the network administrators pager that says:
Your PDC just Blue-Screened at 03:46AM. Have a nice day. :)
7/31/2019 Application Layer Protocol and Functionality
62/76
Languages of SNMP
Structure of Management Information (SMI)
Abstract Syntax Notation One (ASN.1)
Basic Encoding Rules (BER)
specifies the format used for defining managed objects that are
accessed via the SNMP protocol
used to define the format of SNMP messages and managed objects
(MIB modules) using an unambiguous data description format
used to encode the SNMP messages into a format suitable for
transmission across a network
S
7/31/2019 Application Layer Protocol and Functionality
63/76
SMIv1Structure of Management Information
SMIv1 is described in RFCs 1155, 1212, 1215
These RFCs describe:
How MIB modules are defined with CCITT X.208 ASN.1 data description language
The subset of the ASN.1 language that is used in MIBs
The addition of the APPLICATION data type to ASN.1, specifically for use with
SNMP MIBs
All ASN.1 constructs are serialized using the CCITT X.209 BER for transmission
across the wire
definition of the high-level structure of the Internet branch
(iso(1).org(3).dod(6).internet(1)) of the MIB naming tree
the definition and description of an SNMP managed object
7/31/2019 Application Layer Protocol and Functionality
64/76
SMIv2Structure of Management Information
SMIv2 is described in RFCs 1442, 1443, 1444
These RFCs describe:
SMIv2 is a backward compatible update to SMIv1
The only exception is the Counter64 type defined by SMIv2
Counter64 cannot be created in SMIv2
RFC 2089 defines how bilingual (SMIv1 & SMIv2) agents handle the Counter64data type
IETF requires that new and revised RFCs specify MIB modules using SMIv2
7/31/2019 Application Layer Protocol and Functionality
65/76
ASN.1Abstract Syntax Notation One
ASN.1 is nothing more than a language definition. It is similar to C/C++ and
other programming languages.
Syntax examples:
-- two dashes is a comment -- The C equivalent is written in the comment
MostSevereAlarm ::= INTEGER -- typedef MostSevereAlarm int;
circuitAlarms MostSevereAlarm ::= 3 -- MostSevereAlarm circuitAlarms = 3;
MostSevereAlarm ::= INTEGER (1..5) -- specify a valid range
ErrorCounts ::= SEQUENCE {
circuitID OCTET STRING,
erroredSeconds INTEGER,
unavailableSeconds INTEGER
} -- data structures are defined using the SEQUENCE keyword
7/31/2019 Application Layer Protocol and Functionality
66/76
BER
Basic Encoding Rules
The relationship between ASN.1 and BER parallels that of source code and machine
code.
CCITT X.209 specifies the Basic Encoding Rules
All SNMP messages are converted / serialized from ASN.1 notation into smaller,
binary data (BER)
SNMP D T
7/31/2019 Application Layer Protocol and Functionality
67/76
INTEGER -- signed 32-bit integer
OCTET STRING
OBJECT IDENTIFIER (OID)
NULL-- not actually data type, but data value
IpAddress -- OCTET STRING of size 4, in network byte order (B.E.)
Counter -- unsigned 32-bit integer (rolls over)
Gauge -- unsigned 32-bit integer (will top out and stay there)
TimeTicks -- unsigned 32-bit integer (rolls over after 497 days)Opaque -- used to create new data types not in SNMPv1
DateAndTime, DisplayString, MacAddress, PhysAddress, TimeInterval, TimeStamp,
TruthValue, VariablePointer -- textual conventions used as types
SNMP Data Types
Yellow items defined by
ASN.1
Orange items defined by
RFC 1155
7/31/2019 Application Layer Protocol and Functionality
68/76
Managed Objects & MIBs
Always defined and referenced within the context of a MIB
A typical MIB variable definition:
sysContact OBJECT-TYPE -- OBJECT-TYPE is a macro
SYNTAX DisplayString (SIZE (0..255))
ACCESS read-write -- or read-write, write-only, not-accessible
STATUS mandatory -- or optional, deprecated, obsolete
DESCRIPTION
Chris Francois
(360)650-0000
::= { system 4 }
7/31/2019 Application Layer Protocol and Functionality
69/76
Basic Message Format
Message Length
Message Version
Community String
PDU Header
PDU Body
Message Preamble
SNMP Protocol DataUnit
Message Length
Message VersionSNMP
SNMP Message Formats
7/31/2019 Application Layer Protocol and Functionality
70/76
Message Length
Message Version
Community String
PDU Type
PDU Length
Request ID
Error Status
Error Index
Length of Variable Bindings
Length of First Binding
Additional Variable Bindings
OID of First Binding
Type of First Binding
Value of First Binding
Length of Second Binding
OID of Second Binding
Type of Second Binding
Value of Second Binding
Message Version
Community String
PDU Type
PDU Length
Enterprises MIB OID
Agent IP Address
Standard Trap Type
Length of Variable Bindings
Length of First Binding
Additional Variable Bindings
OID of First Binding
Type of First Binding
Value of First Binding
Length of Second Binding
OID of Second Binding
Type of Second Binding
Value of Second Binding
Specific Trap Type
Time Stamp
PDU
Body
SNMP
Message
Preamble
PDU
Header
Commercial SNMP Applications
7/31/2019 Application Layer Protocol and Functionality
71/76
Commercial SNMP ApplicationsHere are some of the various SNMP Management products available today:
http://www.hp.com/go/openview/ HP OpenView
http://www.tivoli.com/ IBM NetView
http://www.novell.com/products/managewise/ Novell ManageWise
http://www.sun.com/solstice/ Sun MicroSystems Solstice
http://www.microsoft.com/smsmgmt/ Microsoft SMS Server
http://www.compaq.com/products/servers/management/ Compaq Insight Manger
http://www.redpt.com/ SnmpQL - ODBC Compliant
http://www.empiretech.com/ Empire Technologies
ftp://ftp.cinco.com/users/cinco/demo/ Cinco Networks NetXray
http://www.netinst.com/html/snmp.html SNMP Collector (Win9X/NT)
http://www.netinst.com/html/Observer.html Observer
http://www.gordian.com/products_technologies/snmp.html Gordians SNMP Agent
http://www.castlerock.com/ Castle Rock Computing
http://www.adventnet.com/ Advent Network Management
http://www.smplsft.com/ SimpleAgent, SimpleTester
SNMP & Windows NT 5 0
7/31/2019 Application Layer Protocol and Functionality
72/76
SNMP & Windows NT 5.0Proposed features of the Windows NT5 SNMP Service
Full bilingual support for SNMPv1 and SNMPv2c
ability to map SNMPv2c requests to SNMPv1 for processing by
extension agents
better synchronization of MIB variables
a new extension agent framework(backward compatible with originalframework, but with MS add-ons)
code-generator for creation of extension agents
MIB-II, LAN Manager 2, IP Forwarding MIB (RFC 1354), and Host Resources MIB
(RFC 1514) extension agents included
All MIB modules included with SNMP install
SMS 2.0 also has a Symantec PCAnywhere type of application integrated into it,
allowing remote-but-local management as well
RFC Description Published Current Status
7/31/2019 Application Layer Protocol and Functionality
73/76
SNMP
RFCs
RFC Description Published Current Status1065 SMIv1 Aug-88 Obsoleted by 1155
1066 SNMPv1 MIB Aug-88 Obsoleted by 1156
1067 SNMPv1 Aug-88 Obsoleted by 1098
1098 SNMPv1 Apr-89 Obsoleted by 1157
1155 SMIv1 May-90 Standard
1156 SNMPv1 MIB May-90 Historic
1157 SNMPv1 May-90 Standard1158 SNMPv1 MIB-II May-90 Obsoleted by 1213
1212 SNMPv1 MIB definitions Mar-91 Standard
1213 SNMPv1 MIB-II Mar-91 Standard
1215 SNMPv1 traps Mar-91 Informational
1351 Secure SNMP administrative model Jul-92 Proposed Standard
1352 Secure SNMP managed objects Jul-92 Proposed Standard
1353 Secure SNMP security protocols Jul-92 Proposed Standard
1441 Introduction to SNMPv2 Apr-93 Proposed Standard
1442 SMIv2 Apr-93 Obsoleted by 1902
1443 Textual conventions for SNMPv2 Apr-93 Obsoleted by 19031444 Conformance statements for SNMPv2 Apr-93 Obsoleted by 1904
1445 SNMPv2 administrative model Apr-93 Historic
1446 SNMPv2 security protocols Apr-93 Historic
1447 SNMPv2 party MIB Apr-93 Historic
1448 SNMPv2 protocol operations Apr-93 Obsoleted by 1905
1449 SNMPv2 transport mapping Apr-93 Obsoleted by 1906
1450 SNMPv2 MIB Apr-93 Obsoleted by 1907
1451 Manger-to-manger MIB Apr-93 Historic
1452 Coexistence of SNMPv1 and SNMPv2 Apr-93 Obsoleted by 1908
1901 Community-Based SNMPv2 Jan-96 Experimental1902 SMIv2 Jan-96 Draft Standard
1903 Textual conventions for SNMPv2 Jan-96 Draft Standard
1904 Conformance statements for SNMPv2 Jan-96 Draft Standard
1905 Protocol operations for SNMPv2 Jan-96 Draft Standard
1906 Transport mapping for SNMPv2 Jan-96 Draft Standard
1907 SNMPv2 MIB Jan-96 Draft Standard
1908 Coexistence of SNMPv1 and SNMPv2 Jan-96 Draft Standard
1909 Administrat ive infrastructure for SNMPv2 Feb-96 Experimental
1910 User-based security for SNMPv2 Feb-96 Experimental
7/31/2019 Application Layer Protocol and Functionality
74/76
Light Weight Presentation Protocol
Lightweight Presentation Protocol (LPP) describes an approachfor providing "stream-lined" support of OSI application services ontop of TCP/IP-based network for some constrained environments.
LPP was initially derived from a requirement to run the ISO
Common Management Information Protocol (CMIP) in TCP/IP-based network.
LPP is designed for a particular class of OSI applications, namelythose entities whose application context contains only anAssociation Control Service Element (ACSE) and a RemoteOperations Service Element (ROSE). In addition, a DirectoryServices Element (DSE) is assumed for use by the application-entity, but only in a very limited sense. LPP is not applicable toentities whose application context is more extensive (e.g.,contains a Reliable Transfer Service Element).
If one wants to implement ISO applications in a TCP/IP based network without
7/31/2019 Application Layer Protocol and Functionality
75/76
constrains, the ITOT mechanisms (specified in RFC 2126) should be used.
Protocol Structure - LPP: Lightweight Presentation Protocol The
service provider is in one of the following states:IDLE, WAIT1, WAIT2, DATA, WAIT3, or WAIT4
The possible events are:PS-user P-CONNECT.REQUESTP-CONNECT.RESPONSEP-RELEASE.REQUEST
P-RELEASE.RESPONSEP-DATA.REQUESTP-U-ABORT.REQUESTnetwork TCP closed or errored(*)receive ConnectRequest PDUreceive ConnectResponse PDU
receive ReleaseRequest PDUreceive ReleaseResponse PDUreceive UserData(*) or CL-UserData(**) (*) tcp-based service only(**) udp-based service only
PDUi i iti t d Ab t PDU
7/31/2019 Application Layer Protocol and Functionality
76/76
receive user-initiated Abort PDUreceive provider-initiated Abort PDUtimer expires(**)
The possible actions are:
PS-user P-CONNECT.INDICATIONP-CONNECT.CONFIRMATIONP-RELEASE.INDICATIONP-RELEASE.CONFIRMATIONP-DATA.INDICATIONP-U-ABORT.INDICATION
P-P-ABORT.INDICATIONnetwork open TCP(*)close TCP(*)send ConnectRequest PDUsend ConnectResponse PDUsend ReleaseRequest PDUsend ReleaseResponse PDUsend UserData(*) or CL-UserData(**) PDUsend user-initiated Abort PDUsend provider-initiated Abort PDUset timer(**)