Network management network management Simple Keeping a network running, and knowing that it is. Precise The deployment, integration and coordination of the hardware, software and human elements to monitor, test, poll, configure, analyze, evaluate and control the network and element resources, to meet the real-time, operational performance and quality-of-service requirements at a reasonable cost. [Saydam 1996] introduced in ch. 5 — open in glossary is one server, many devices with agents inside them, and a protocol between. SNMP (Simple Network Management Protocol) Simple Network Management Protocol The Internet’s network-management protocol, typically run over UDP so that it still works when the network is under stress (§3.3, built in §5.7). introduced in ch. 3 is the old and widely used protocol that reads numbers out of devices and receives their alarms.
Words you will meet
-
Managing server managing server Simple The machine an operator uses to watch and change the network. Precise An application, typically with human network managers in the loop, running in a centralized network management station in the network operations centre. It controls the collection, processing, analysis and dispatching of network management information and commands. A network may have several. introduced in ch. 5 — open in glossary — the machine an operator uses to watch and change the network, in the network operations centre ( NOC (Network Operations Centre) Network Operations Centre The centralized station where the managing server runs, typically with human network managers in the loop. introduced in ch. 5 ).
-
Managed device managed device Simple Any piece of equipment the operator manages. Precise A piece of network equipment, including its software, that resides on a managed network: a host, router, switch, middlebox, modem, thermometer or other network-connected device. Each has many manageable components and configuration parameters for them. introduced in ch. 5 — open in glossary — anything on the network being managed: a router, a host, a modem, a thermometer.
-
Agent network management agent Simple The small program inside a device that takes orders. Precise A software process running in a managed device that communicates with the managing server, taking local actions at the device under the server's command and control. It is similar in spirit to the routing control agent of Figure 5.2. introduced in ch. 5 — open in glossary — the small program inside a managed device that takes orders.
-
SNMP snmp Simple Poll devices for numbers, and receive their alarms. Precise Simple Network Management Protocol, version 3 defined in RFC 3410. An application-layer protocol carrying network-management control and information messages between a managing server and an agent. Most commonly used request-response, to query or modify MIB object values; also used by an agent to send an unsolicited trap message. introduced in ch. 5 — open in glossary — the protocol between them, in use since the late 1980s.
-
MIB mib Simple The collection of readable values a device exposes. Precise Management Information Base: the objects holding a managed device's operational state and, to some extent, its configuration data. An object might be a counter, descriptive information, status information or protocol-specific information. Related objects are gathered into MIB modules, of which over 400 are defined in RFCs, plus many device- and vendor-specific ones. introduced in ch. 5 — open in glossary — Management Information Base: the collection of values a device exposes.
-
SMI smi Simple The language MIB objects are written in. Precise Structure of Management Information: the data description language in which MIB objects are specified, defined in RFCs 2578, 2579 and 2580. A formal definition language ensures that the syntax and semantics of network management data are well defined and unambiguous. The book notes that its name gives no hint of its function. introduced in ch. 5 — open in glossary — the language MIB objects are defined in.
-
Trap trap Simple The device speaks first, without being asked. Precise An unsolicited SNMP message from an agent to a managing server, generated asynchronously in response to an event rather than to a request. RFC 3418 defines well-known trap types including a cold or warm start, a link going up or down, the loss of a neighbour, and an authentication failure. A received trap requires no response. introduced in ch. 5 — open in glossary — an unsolicited message from an agent, reporting an event.
-
PDU (Protocol Data Unit) Protocol Data Unit The generic name for one message of a protocol. SNMPv3 defines seven PDU types. introduced in ch. 5 — the generic name for one protocol message. SNMPv3 has seven kinds.
Why this matters
Section 5.5 showed a logically centralized controller managing a network. That is new. The problem is old.
A network is hundreds or thousands of interacting pieces of hardware and software, and somebody has to keep it running. The tools for that predate SDN (Software-Defined Networking) Software-Defined Networking Separating the control plane from the data plane by computing forwarding tables in a remote controller. introduced in ch. 4 by decades and are still everywhere.
This section is the framework and the old protocol. Section 5.7.3 is the new one, and it exists because a committee wrote down in 2002 exactly what the old one could not do.
What network management is
The book quotes a definition it admits is a long run-on sentence, and it is worth reading slowly.
Network management includes the deployment, integration, and coordination of the hardware, software, and human elements to monitor, test, poll, configure, analyze, evaluate, and control the network and element resources to meet the real-time, operational performance, and Quality of Service requirements at a reasonable cost.
In plain words
Three things in that definition are easy to skim past.
“Human elements.” People are part of the system being coordinated, not outside it.
Seven verbs. Monitor, test, poll, configure, analyze, evaluate, control. Only two of them change anything; five are about finding out.
“At a reasonable cost.” Network management is an economic activity, not only a technical one.
The framework
An application running in a centralized network management station in the network operations centre. It controls the collection, processing, analysis and dispatching of network management information and commands. A network may have several of them.
Everything an operator does passes through this shape: a person, a server, a protocol, an agent, and the data the agent guards.
Read all steps as text
- 1 · the managing server, with humans in the loop — An application running in a centralized network management station in the network operations centre. It controls the collection, processing, analysis and dispatching of network management information and commands. A network may have several of them.
- 2 · the managed devices — A managed device is any piece of network equipment, including its software, on the managed network: a host, router, switch, middlebox, modem, thermometer or anything else attached. Each has many manageable components and configuration parameters for them.
- 3 · the data each device holds — Three kinds. CONFIGURATION data is what the manager explicitly set — an assigned IP address, an interface speed. OPERATIONAL data is what the device learned while running, such as its list of immediate OSPF neighbours. STATISTICS are counts updated as it operates: dropped packets on an interface, or the cooling fan speed.
- 4 · an agent inside every device — A software process running in the managed device that communicates with the managing server and takes local actions under its command and control. The book says it is similar to the routing control agent of Figure 5.2 — the same shape of idea, one section apart.
- 5 · and the protocol between them — It lets the managing server query the status of devices and act on them through their agents, and lets agents report exceptional events such as a component failure. Note carefully: the protocol does not manage the network. It provides capabilities that human network managers use to manage it. The book calls that a subtle but important distinction.
The protocol does not manage the network
The book makes a point of this and calls it subtle but important.
A network management protocol network management protocol Simple The language between the operator's machine and the devices. Precise The protocol running between the managing server and the managed devices. It lets the server query device status and take actions through the agents, and lets agents report exceptional events. It does not itself manage the network: it provides capabilities that human network managers use to manage it. introduced in ch. 5 — open in glossary provides capabilities. It lets a server ask a device a question, tell a device to change something, and lets a device report an event. That is all it does.
The managing is done by people, using those capabilities. Nothing in SNMP (Simple Network Management Protocol) Simple Network Management Protocol The Internet’s network-management protocol, typically run over UDP so that it still works when the network is under stress (§3.3, built in §5.7). introduced in ch. 3 knows what a healthy network looks like or what should be done about a failure.
Three ways operators actually work
| CLItype commands at the device | SNMP / MIBquery and set object values | NETCONF / YANGsection 5.7.3 | |
|---|---|---|---|
| What you do | |||
| Used mostly for | |||
| How many devices at a time | |||
| Where it struggles |
Cells marked ⓘ have a reason behind them — click to read it.
All three are in use today, and the book presents them in the order they appeared. Click any cell for the detail.
The middle column is this section’s subject and the right column is the next one’s. Note the row about how many devices at a time: CLI (Command Line Interface) Command Line Interface Typing commands directly at a device, on its console or over SSH. Vendor-specific, error-prone, and hard to scale — but still how much real configuration is done. introduced in ch. 5 and SNMP both manage devices individually, and that limitation is most of the reason the third column exists.
SNMP and the MIB
SNMP version 3 is an application-layer protocol that carries network-management control and information messages between a managing server and an agent acting on its behalf.
It is used in two ways.
Request-response. The server sends a request, the agent receives it, performs some action, and sends a reply. Typically the request queries or modifies MIB object values on the managed device.
Traps. An agent sends an unsolicited message to notify the server of an exceptional situation. A link interface going up or down is the book’s example. Such a situation has changed MIB object values.
| PDU type | Sender → receiver | Description |
|---|---|---|
Cells marked ⓘ have an explanation — click to read it.
Read the middle column first. Six of the seven have a fixed direction, and the exception is the one that answers everything else.
Click any box to read what that part of the message is for.
Every field, as text
- PDU type (0–3) — which of the request or response messages this is (example: 0)
- Request Id — ties a response back to its request (example: 4711)
- Error Status (0–5) — did it work (example: noError)
- Error Index — which variable went wrong
- Name — the MIB object asked about (example: ipSystemStatsInDelivers)
- Value — its value (example: 1 048 213)
- Name
- Value
- ⋯
- PDU type (4) — this one is a trap (example: 4)
- Enterprise — whose device this is
- Agent Addr — which device is reporting
- Trap Type (0–7) — which well-known event (example: linkDown)
- Specific code — a vendor’s own refinement
- Time stamp — when it happened
- Name
- Value
- ⋯
The book draws the fields as boxes without bit widths, and so does this: SNMP values are encoded with a length in front of them, so no field has a fixed size. Click any box.
The most common usage. The server asks, the agent performs some action, the agent replies.
Click any arrow to see what that message says and why it is sent.
The request Id is the only thing tying a response to its request. That one field is doing the job TCP would otherwise have done.
Read this diagram as text
- Managing server sends GetRequest · id=4711 · ipSystemStatsInDelivers to Agent, in a router. A request to retrieve one MIB object value. The MIB objects being asked about are named in the variable binding part of the PDU — the Name and Value boxes in Figure 5.21.
- Agent, in a router sends Response · id=4711 · 1 048 213 to Managing server. The agent responds with a Response PDU containing the object identifiers and their associated values. Its request Id is copied from the request, which is how the server pairs them up.
Lifelines, left to right: Managing server (server), Agent, in a router (router).
SNMP rides on an unreliable transport, and nothing repairs a loss
An SNMP PDU (Protocol Data Unit) Protocol Data Unit The generic name for one message of a protocol. SNMPv3 defines seven PDU types. introduced in ch. 5 can be carried over many transport protocols, but it is typically carried in the payload of a UDP (User Datagram Protocol) User Datagram Protocol A simple transport protocol with no reliability, no flow control and no congestion control. introduced in ch. 1 datagram. RFC (Request For Comments) Request For Comments The name of an IETF standards document. There are currently nearly 9000 of them. introduced in ch. 1 3417 calls UDP “the preferred transport mapping”.
UDP is unreliable, so there is no guarantee that a request or its response arrives. The request Id field is what makes this survivable. The server numbers its requests and the agent copies that number into its response, so the server can notice that something never came back.
What happens next is deliberately unspecified. The standard mandates no retransmission procedure, and does not even say whether to retransmit. It only requires that the managing server “needs to act responsibly in respect to the frequency and duration of retransmissions”.
Security arrived late, again
SNMP has evolved through three versions, and its designers describe SNMPv3 as “SNMPv2 with additional security and administration capabilities”.
The consequence of the earlier gap is concrete. Because there was not adequate
security, SNMP was used primarily for monitoring rather than control —
SetRequest was rarely used in SNMPv1. A protocol that can read but is not
trusted to write is half a protocol.
The book draws a general lesson here, and chapter 8 returns to it. Security turns out to be of critical concern. Its importance is realised a bit late, and it is then “added on”.
The Management Information Base
A managed device’s operational state, and to some extent its configuration data, are represented as objects gathered into a MIB mib Simple The collection of readable values a device exposes. Precise Management Information Base: the objects holding a managed device's operational state and, to some extent, its configuration data. An object might be a counter, descriptive information, status information or protocol-specific information. Related objects are gathered into MIB modules, of which over 400 are defined in RFCs, plus many device- and vendor-specific ones. introduced in ch. 5 — open in glossary for that device.
An object might be a counter. The book’s examples are the number of IP (Internet Protocol) Internet Protocol The network-layer protocol that defines the datagram format and addressing every Internet device must use. introduced in ch. 1 datagrams a router discarded because of header errors, and the number of carrier sense errors on an Ethernet interface card. It might instead be descriptive information, such as the software version running on a DNS (Domain Name System) Domain Name System Translates a human-friendly name such as www.ietf.org into a network address. introduced in ch. 1 server. It might be status information, such as whether a device is functioning correctly. Or it might be protocol-specific, such as a routing path to a destination.
Related objects are gathered into MIB modules. There are over 400 defined in RFCs, and many more device- and vendor-specific ones. RFC 4293 defines the module for IP (Internet Protocol) Internet Protocol The network-layer protocol that defines the datagram format and addressing every Internet device must use. introduced in ch. 1 and ICMP (Internet Control Message Protocol) Internet Control Message Protocol Carries error and diagnostic messages between hosts and routers. A ping is an ICMP message. Covered in §5.6. introduced in ch. 2 , RFC 4022 the one for TCP (Transmission Control Protocol) Transmission Control Protocol The Internet transport protocol that delivers data reliably and in order, with flow control and congestion control. introduced in ch. 1 , and RFC 4113 the one for UDP.
MIB objects themselves are specified in a data description language called SMI smi Simple The language MIB objects are written in. Precise Structure of Management Information: the data description language in which MIB objects are specified, defined in RFCs 2578, 2579 and 2580. A formal definition language ensures that the syntax and semantics of network management data are well defined and unambiguous. The book notes that its name gives no hint of its function. introduced in ch. 5 — open in glossary , Structure of Management Information — a name the book notes gives no hint of its function. A formal definition language is used so that the syntax and semantics of management data are unambiguous.
One real MIB object
The book says reading MIB RFCs is dry, and then says looking at one is good for
you anyway. Here is ipSystemStatsInDelivers, from RFC 4293.
ipSystemStatsInDelivers OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The total number of datagrams successfully de-
livered to IP user-protocols (including ICMP).
When tracking interface statistics, the coun-
ter of the interface to which these datagrams
were addressed is incremented. This interface
might not be the same as the input interface
for some of the datagrams.
Discontinuities in the value of this counter can
occur at re-initialization of the management
system, and at other times as indicated by the
value of ipSystemStatsDiscontinuityTime."
::= { ipSystemStatsEntry 18 }In plain words
Six lines of definition, and every one of them earns its place.
Counter32 is one of the basic data types defined in SMI. It is a 32-bit
counter, so a reader knows it wraps.
read-only says this object can never be the target of a SetRequest.
STATUS current says the definition is still in force, rather than
deprecated.
The description does two things a bare name cannot. It says what is counted — datagrams delivered to an upper-layer protocol, including ICMP — and it warns that the count can jump when the management system restarts. A counter that can jump is a counter you must not subtract naively.
::= { ipSystemStatsEntry 18 } places the object in the naming tree, so it
has a globally unique identifier and not just a name.
Everyday picture
A building with a caretaker in every room.
The caretakers do not decide anything. Each one keeps a clipboard of numbers about their own room: temperature, how many times the door opened, whether the lamp works. They answer when the office calls to ask for a figure.
If something dramatic happens, a caretaker phones the office without waiting to be asked. That call is a trap.
Where the picture stops. A caretaker would tell you what the numbers mean. An agent will not: it hands over a counter, and every judgement about whether that counter is bad news belongs to the person at the managing server.
Check yourself
Check yourself
0 of 7 answered1.The book calls one distinction about the network management protocol "subtle, but important". What is it?
2.A device reports its list of immediate OSPF neighbours. Which of the three kinds of data is that?
3.What did the Internet Architecture Board's 2002 network-management workshop conclude about SNMP and MIBs?
4.Which SNMPv3 PDU type can be sent by an agent without having been asked for anything?
5.predictA managing server sends a GetRequest with request Id 4713 over UDP, and it is lost. What does the standard require the server to do?
6.The MIB object ipSystemStatsInDelivers is declared MAX-ACCESS read-only. What follows from that?
7.Why was SetRequest rarely used in SNMPv1?
What to remember
- Five components: a managing server, managed devices, the data those devices hold, an agent inside each device, and a protocol between server and agents.
- The protocol does not manage the network. It provides capabilities; people manage.
- SNMP is used two ways: request-response to read or write MIB values, and unsolicited traps to report events. It typically rides on UDP, and the standard leaves retransmission entirely to the server’s judgement.