U2.5 SNMPv1

U2.5 SNMPv1

1. general

   • ISO 7498-2
     • network mgt protocols provide
       • configuration management
       • accounting
       • event logging
     • defines network mgt security in general
   • SNMP RFCs
     • RFC 1155-1157
     • RFC 1441-1448
     • RFC 2570-2576

2. architectural model

   • SNMP protocol entities
     • U2.5 SNMPv1 - architectural model
     • at least one management station
       • acts as management role
     • a number of network elements
       • acts as agent role
   • all entities have a management information base (MIB)
     • SNMP access MIB on top of UDP and IP
       • U2.5 SNMPv1 - SNMPv1 protocol stack
       • connectionless!!
       • ports
         • 161
           • for requests (GET, SET)
         • 162
           • for traps

3. 3 operations

   • GET
     • enables mgt station to retrieve object values from managed entity
   • SET
     • enables the management station to set object values in managed entity
   • TRAP
     • enables a managed entity to notify the management station of significant events
   • implemented with "protocol data units" (PDUs)
     • 3 parts to a PDU message
       • version
       • community
       • SNMP operation

4. security services provided

   • authentication service
     • Assure the destination device that the SNMP PDU does come from the source from which it claims to be
   • access control service
     • Limit the SNMP operations that a device can request according to device's identity

5. security mechanisms

   • authentication mechanism
     • community name
       • All PDUs from mgt station must contain the community name
   • access mode mechanism
     • community profile
       • Each device stores a community profile that specifies which MIB values and how those values can be access by an entity bearing the associated community name.

6. threats

   • primary
     • data modification
     • masquerade
   • secondary
     • message stream modification
     • eavesdropping

7. vulnerabilities

   • no integrity protection
   • no timeliness guarantee
   • no replay protection
   • weath authentication mechanism
   • no confidentiality protection