I´m taking a network management class and the main topic is SNMP. Although my teacher is good at explaining the theoretical part of SNMP ( V1,V2,V3, RMON, MIBS etc.) he is not good at explaining the practical things like how can I use the information I just gathered or how would I use SNMP to detect congestion or unusual traffic on the network. Any information on this would be appreciated.
3 Answers
I frequently use SNMP in combination with rrdtool to provide overview graphs letting me know about the traffic flowing through routers on my network and cpu / memory usage of servers. A common command-line tool is 'snmpget' which will grab and output a specific piece of data provided by an SNMP enabled device.
For instance, to get the octets transferred through my Cisco router I use:
snmpget -v 1 -c public $router_ip_address IF-MIB::ifOutOctets.3 | egrep -o "[0-9]+$"
and then pipe the output into rrdtool. In consumer grade devices I've frequently ran into supposed support for SNMP that doesn't actually exist (the chip may be there, but its not actually written into the firmware) - so that's definitely something to watch out for. For instance, the Netgear router that was in place before this Cisco one 'supported' SNMP, but didn't actually output any data.
For figuring out what data is available for a given device, you can use the snmpwalk command or check the MIBs. I've found, however, that checking the MIBs is mostly useless as most devices I've encountered tend to use their own custom MIBs (or don't advertise which ones they support). An example of the snmpwalk command is; snmpwalk -c public $device_ip_address
If you're curious about my rrdtool graphing here's an example of the portion of my script (that runs every five minutes) to graph my router traffic.
function plot_router {
if [ ! -e $DATA_DIRECTORY/router.rrd ]; then
rrdtool create $DATA_DIRECTORY/router.rrd --start now \
DS:bytes_in:COUNTER:600:U:U \
DS:bytes_out:COUNTER:600:U:U \
RRA:AVERAGE:0.5:1:600 \
RRA:AVERAGE:0.5:6:700 \
RRA:AVERAGE:0.5:24:775 \
RRA:AVERAGE:0.5:288:797 \
RRA:MAX:0.5:1:600 \
RRA:MAX:0.5:6:700 \
RRA:MAX:0.5:24:775 \
RRA:MAX:0.5:288:797
fi
bytes_in=`snmpget -v 1 -c public $router_ip IF-MIB::ifInOctets.3 | egrep -o "[0-9]+$"`
bytes_out=`snmpget -v 1 -c public $router_ip IF-MIB::ifOutOctets.3 | egrep -o "[0-9]+$"`
rrdtool update $DATA_DIRECTORY/router.rrd \
N:$bytes_in:$bytes_out
# The actual graphing...
for (( i=0;i<$SEGMENTS_COUNT;i++)); do
SEGMENT=${SEGMENTS[${i}]}
FILENAME="$OUTPUT_DIRECTORY/router_$SEGMENT.png"
rrdtool graph $FILENAME -s e-$SEGMENT -e now -h $HEIGHT -w $WIDTH --title "(`date`) Router"\
--rigid \
--slope-mode \
DEF:bytes_out=$DATA_DIRECTORY/router.rrd:bytes_out:AVERAGE \
CDEF:inverted=0,bytes_out,- \
AREA:inverted$fg_color1:"Bytes Out (Upload)" \
DEF:bytes_in=$DATA_DIRECTORY/router.rrd:bytes_in:AVERAGE AREA:bytes_in$fg_color2:"Bytes In (Download)" \
CDEF:error=bytes_in,UN,INF,0,IF \
AREA:error$fg_color_error:"Errors" \
GPRINT:bytes_in:AVERAGE:"Avg Bytes In\: %3.0lf" \
GPRINT:inverted:AVERAGE:"Avg Bytes Out\: %3.0lf" >> /dev/null
done
}
Note the bit about the script running every five minutes. For the life of me, in all my years of using rrdtool, I've never taken the time to figure out the right 'tunings' for the RRAs for anything but a five minute interval. If you get the tunings wrong, you'll end up with completely empty graphs and an utter sense of bafflement. So, from my experience, just use five minute intervals (run your insertion script every five minutes from cron) unless you want to spend some time figuring out the correct RRAs for something else.
I also wanted to point out that, while rrdtool is an amazing tool for Linux systems, it is also available on OSX (it might be available for Windows through Cygwin). Its an easy install through fink - just make sure to add the "unstable/main" and "unstable/crypto" trees to your /sw/etc/fink.conf file and "fink install rrdtool" your way to bliss.
I hope that this sheds some light on some practical uses of SNMP.
-
-
This is good. Thank you and I hope you don´t mind me using your script as an inspiration for my own.– StulliDec 7, 2009 at 13:02
-
Thanks guys. :) Stulli; I most certainly don't mind. I had a heckuva time figuring this stuff out for myself when I first delved into it a few years ago. Dec 8, 2009 at 0:59
SNMP is primarily used for performance monitoring. With this in mind, you can use SNMP to detect unusual network traffic if by that you mean "unusually busy". Just read the proper metric every x minutes, plot the values in something like rrdtool and check the graphs. You could also read the value every now and then and trigger some alarm (send an email, SMS or something similar if the value is too high).
That said, configuring SNMP will always require some degree of investing time and money. It's not a fire and forget solution, but it is very flexible and powerful.
SNMP is used for quite a bit more than just monitoring and measuring network traffic. SNMP can and is used to monitor interface status, CPU and memory usage, hardware status on network and server equipment, etc. In my environment SNMP is the lynchpin of monitoring every piece of hardware running, from servers to switches to firewalls, etc.