SNMP

NMS — Network Management System

SNMP — Simple Network Management Protocol

Protocol to exchange network device statistics

SNMP Agent

Lives on network equipment
Collecting and stores information in a MIB
Does not store history

MIB — Management Information Base

On-device SNMP database
The schema for the database
How the SNMP agent stores information

ITU — International Telecommunication Union

UN agency responsible for international telecommunications

OID Tree

An ITU, X.660 standardized tree

OID — Object identifier

Node on an OID tree

IETF MIB

A standard MIB, defined by the IETF
Not popular

Vendor MIB

Contrast to the IETF MIB
Vendors can create their own MIBs, attached to the Global OID tree

What is stored in MIBs

Device Statistics

Uptime, packets sent, packets received, packets dropped
Memory used, CPU used, temperature, fan-speed

Using SNMP to track CPU time

On the device, I run a normal command, and look at the outputs:

switch # show processes cpu | i util
CPU utilization for five seconds: 20%/0%; one minute: 21%; five minutes: 20%

I want to figure out how to get the switch to report the first value “20” for “CPU used in the last 5 seconds.”

What MIB does a C3560CX support?
I find the formal specification for the MIB somewhere on the vendor website: CISCO-PROCESS-MIB (109)
Looking at the OID tree first I identify a possible leaf
- cpmCPUTotal1minRev via 1.3.6.1.4.1.9.9.109.1.1.1.1.7
Looking at the MIB itself, I make sure it’s a supported OID
- I search for cpmCPUTotal1minRev

I find this…

cpmCPUTotal1minRev OBJECT-TYPE
    SYNTAX          Gauge32 (0..100)
    UNITS           "percent"
    MAX-ACCESS      read-only
    STATUS          current
    DESCRIPTION
        "The overall CPU busy percentage in the last 1 minute
        period. This object deprecates the object cpmCPUTotal1min

        and increases the value range to (0..100)."

    ::= { cpmCPUTotalEntry 7 }

This is the OID leaf I’m going to query:

.1.3.6.1.4.1.9.9.109.1.1.1.1.7

written out it looks like this…

iso.org.dod.internet.private.enterprise.cisco.ciscoMgmt.ciscoProcessMIB.cpmCPU.cpmCPUTotalObjects.cpmCPUTotalTable.cpmCPUTotalEntry.cpmCPUTotal1minRev

… “how much CPU did this Cisco device use in the last 1 minute?”

OIDREF shows the SNMP world OID tree.

graph TD
    dot["."]
    dot --> iso["iso (1)"]
    iso --> mem["mem (2)"]
    iso --> org["org (3)"]
    org --> dod["dod (6)"]
    dod --> internet["internet (1)"]
    internet --> mgmt["mgmt (2)"]
    internet --> private["private (4)"]
    mgmt --> mib["mib (1)"]
    private --> enterprise["enterprise (1)"]
    mib --> ip["IP (4)"]
    mib --> tcp["TCP (6)"]
    mib --> udp["UDP (7)"]
    mib --> snmp["SNMP (11)"]
    enterprise --> cisco["cisco (9)"]
    cisco --> ciscoMgmt["ciscoMgmt (9)"]
    cisco --> ciscoExperiment["ciscoExperiment (10)"]
    cisco --> ciscoAdmin["ciscoAdmin (12)"]
    ciscoMgmt --> ciscoIpMIB["ciscoIpMIB (101)"]
    ciscoMgmt --> ciscoProcessMIB["ciscoProcessMIB (109) CISCO-PROCESS-MIB"]
    ciscoMgmt --> ciscoMemoryPoolMIB["ciscoMemoryPoolMIB (48)"]
    ciscoProcessMIB --> cpmCPU["cpmCPU (1)"]
    cpmCPU --> cpmCPUTotalObjects["cpmCPUTotalObjects (1)"]
    cpmCPUTotalObjects --> cpmCPUTotalTable["cpmCPUTotalTable (1)"]
    cpmCPUTotalTable --> cpmCPUTotalEntry["cpmCPUTotalEntry (1)"]
    cpmCPUTotalEntry --> cpmCPUTotal1minRev["cpmCPUTotal1minRev (7)"]
    style mem                   fill:#ddd,color:#aaa,stroke:#ccc
    style mgmt                  fill:#ddd,color:#aaa,stroke:#ccc
    style mib                   fill:#ddd,color:#aaa,stroke:#ccc
    style ip                    fill:#ddd,color:#aaa,stroke:#ccc
    style tcp                   fill:#ddd,color:#aaa,stroke:#ccc
    style udp                   fill:#ddd,color:#aaa,stroke:#ccc
    style snmp                  fill:#ddd,color:#aaa,stroke:#ccc
    style ciscoExperiment       fill:#ddd,color:#aaa,stroke:#ccc
    style ciscoAdmin            fill:#ddd,color:#aaa,stroke:#ccc
    style ciscoIpMIB            fill:#ddd,color:#aaa,stroke:#ccc
    style ciscoMemoryPoolMIB    fill:#ddd,color:#aaa,stroke:#ccc
    style ciscoProcessMIB fill:#1a4a6b,color:#fff,stroke:#1a4a6b

Configs

SNMP v2

snmp-server community SSG_PROMETHEUS ro

SNMPv3

snmp-server group SSG_PROMETHEUS v3 priv
snmp-server user ciscosnmp SSG_PROMETHEUS v3 auth sha auth-password-goes-here priv aes 128 encryption-password-goes-here

Verify

These are performed on a linux host. This is apt install snmp on Debian.

SNMPv2

snmpwalk -v2c -c <community> <host> 1.3.6.1.4.1.9.9.109.1.1.1.1.7

SNMPv3

snmpwalk -v3 -l authPriv -u <user> -a SHA -A  <auth-password> -x AES -X <encryption-password> <host> 1.3.6.1.4.1.9.9.109.1.1.1.1.7

ariadne@tesseract:~$ snmpwalk -v3 -l authPriv -u ciscosnmp -a SHA -A <removed> -x AES -X <removed> <host> 1.3.6.1.4.1.9.9.109.1.1.1.1.7
iso.3.6.1.4.1.9.9.109.1.1.1.1.7.1 = Gauge32: 20

Trap severity

snmp-server enable traps syslog
logging snmp-trap emergencies
logging snmp-trap alerts
logging snmp-trap critical

Is SNMP to configure devices

Nope. See RFC 3535.

SNMP works reasonably well for device monitoring. The stateless nature of SNMP is useful for statistical and status polling.

Refereces

Cisco - Consider SNMP

How to find the MIB for Cisco Devices - GitHub

Keyboard shortcuts