Previous Table of Contents Next


3.9. Accessing a MIB

This section gives an example of an SNMP management console retrieving values for MIB objects from a remote SNMP agent. In this case, the manager is a Sun Microsystems’ SunNet Manager, and the agent is located in a Proteon’s p4100+ router. Both devices connect to an Ethernet backbone. A Network General Corp. Sniffer protocol analyzer captured the data shown in Trace 3.9.

Readers unfamiliar with the Sniffer Analyzer will find a short explanation of the functions of a protocol analyzer helpful. A protocol analyzer captures, then decodes, frames of data as they are transmitted on the LAN or WAN. These frames are numbered sequentially and stored in the same order. The analyzer can display these frames several ways; it can show all of the protocol layers, or just one. The example in this section shows only the highest layer, SNMP. The analyzer also lets you choose the amount of detail included. The minimum detail is a single summary line, and the maximum is the hexadecimal representation of the bits received on the wire. This example uses an English-language detail of the SNMP constructs. A second detail shows the ASN.1 constructs and the hexadecimal decode of the actual data. With that background, I’ll summarize what we have been studying.

This exchange between the manager and the agent (see Trace 3.9a) involves two frames of information. Frame 109 contains an SNMP GetRequest PDU (protocol data unit, the core of the SNMP message) and Frame 110 contains a GetResponse PDU. (Chapter 4 examines the PDUs in depth.)

The manager sends the GetRequest to the agent asking for the values of the objects within the system subtree, OID {1.3.6.1.2.1.1}. The PDU requests information about all seven of the objects: sysDescr, sysObjectID, sysUpTime, sysContact, SysName, sysLocation, and sysServices. On the trace, you can see two coding elements for each of these objects. First, the manager requests the sysUpTime object to determine whether the agent within the router has restarted (warm or cold boot). Second, the manager asks for the values of each individual object in order (review Figure 3-2). This trace also illustrates the use of the SEQUENCE type encoding of VarBinds discussed in Section 2.5.3.5. Each object is encoded with an OBJECT IDENTIFIER type, for example {1.3.6.1.2.1.1.2.0}. The Object Value field is encoded with a NULL type because the manager does not know this information.

Frame 110 gives the agent’s GetResponse. The response returns each object and its associated value in the order that Frame 109 requested. The sysDescr provides a textual description of the device (Portable I80386 C Gateway …). The sysObjectID has a value of {1.3.6.1.4.1.1.1.1.41}. From the prefix {1.3.6.1.4.1}, you know that this is a private enterprise subtree. The next digit (.1) is the enterprise code for Proteon, Inc. (see RFC 1700, page 134, or Appendix F).

The sysUpTime object has a value of 263,621,778 hundredths of a second, which translates to roughly 30 days because the router’s network management system was restarted. Two of the objects, sysContact {system 4} and sysLocation {system 6} appear not to have a value. In reality, they have a value of a zero-length string, but the network manager entered no values for those objects in the router’s configuration file. The sysName is the domain name of the node (boulder.org). Finally, the sysServices {system 7} is a calculated sum that indicates the services this node performs. In this case, the value is 72, indicating a host offering application services (see RFC 1213, page 15).

See Trace 3.9b for a quick review of the ASN.1-encoding discussed in Chapter 2. This data shows the details of Frame 110, but with the Sniffer’s ASN.1 decoding option activated. You can trace each ASN.1 element, identifying the Type-Length-Value encodings as well as the hexadecimal display of those values. As a reference point, the first SNMP encoding (SEQUENCE [of], Length=235) appears in bold type with the characters 30 81 EB. Reviewing Chapter 2, we know that the Type field = 30H (the SEQUENCE OF type, see Figure 2-10). The Length field is the Long Definite form, with one subsequent octet (see Figure 2-5) having a value of 81 EBH. (Hexadecimal values of X are dummy characters to maintain the confidentiality of the trace.)

Trace 3.9a. Browsing the system subtree (SNMP protocol decode)

  Sniffer Network Analyzer data 10-Nov at 10:42:04 file ASAN_SYS.ENC Pg 1
  ------------------------------ Frame 109 ------------------------------
  SNMP: ----- Simple Network Management Protocol -----
  SNMP:
  SNMP: Version = 0
  SNMP: Community = boulder
  SNMP: Command = Get request
  SNMP: Request ID = 0
  SNMP: Error status = 0 (No error)
  SNMP: Error index = 0
  SNMP:
  SNMP: Object = {1.3.6.1.2.1.1.3.0} (sysUpTime.0)
  SNMP: Value = NULL
  SNMP:
  SNMP: Object = {1.3.6.1.2.1.1.1.0} (sysDescr.0)
  SNMP: Value = NULL
  SNMP:
  SNMP: Object = {1.3.6.1.2.1.1.2.0} (sysObjectID.0)
  SNMP: Value = NULL
  SNMP:
  SNMP: Object = {1.3.6.1.2.1.1.3.0} (sysUpTime.0)
  SNMP: Value = NULL
  SNMP:
  SNMP: Object = {1.3.6.1.2.1.1.4.0} (system.4.0)
  SNMP: Value = NULL
  SNMP:
  SNMP: Object = {1.3.6.1.2.1.1.5.0} (system.5.0)
  SNMP: Value = NULL
  SNMP:
  SNMP: Object = {1.3.6.1.2.1.1.6.0} (system 6.0)
  SNMP: Value = NULL
  SNMP:
  SNMP: Object = {1.3.6.1.2.1.1.7.0} (system 7.0)
  SNMP: Value = NULL
  SNMP:
  ------------------------------- Frame 110 -----------------------------
  SNMP: ----- Simple Network Management Protocol -----
  SNMP:
  SNMP: Version = 0
  SNMP: Community = boulder
  SNMP: Command = Get response
  SNMP: Request ID = 0
  SNMP: Error status = 0 (No error)
  SNMP: Error index = 0
  SNMP:
  SNMP: Object = {1.3.6.1.2.1.1.3.0] (sysUpTime.0)
  SNMP: Value = 263621778 hundredths of a second
  SNMP:
  SNMP: Object = {1.3.6.1.2.1.1.1.0} (sysDescr.0)
  SNMP: Value = Portable I80386 C Gateway BOULDER.ORG S/N XXX V12.0
  SNMP:
  SNMP: Object = {1.3.6.1.2.1.1.2.0} (sysObjectID.0)
  SNMP: Value = {1.3.6.1.4.1.1.1.1.41}
  SNMP:
  SNMP: Object = {1.3.6.1.2.1.1.3.0} (sysUpTime.0)
  SNMP: Value = 263621778 hundredths of a second
  SNMP:
  SNMP: Object = {1.3.6.1.2.1.1.4.0} (system.4.0)
  SNMP: Value =
  SNMP:
  SNMP: Object = {1.3.6.1.2.1.1.5.0} (system.5.0)
  SNMP: Value = BOULDER.ORG
  SNMP:
  SNMP: Object = {1.3.6.1.2.1.1.6.0} (system.6.0)
  SNMP: Value =
  SNMP:
  SNMP: Object = {1.3.6.1.2.1.1.7.0} (system.7.0)
  SNMP: Value = 72
  SNMP:


Previous Table of Contents Next