Intermediate

Reading and interacting with SNMP

servers
In this section, you will learn about the SNMP protocol and examine Python
libraries for dealing with SNMP packets.
The SNMP
The Simple Network Management Protocol (SNMP) is an application layer
protocol that facilitates the exchange of management information between
network devices. This protocol is part of the set of TCP/IP protocols and allows
administrators to manage performance, find and solve problems, and plan the
future growth of the network.

SNMP is used to monitor and control the status of devices connected to the
internet, especially routers, although it can be used in any type of host that
allows the snmpd process to be executed. SNMP operates at the application level
using the TCP/IP transport protocol, so it ignores the specific aspects of the
hardware on which it operates. The management is carried out at the IP level, so
you can control devices that are connected in any network that's accessible from
the internet, and not only those located in the local network itself.

For the SNMP protocol, the network is a set of basic elements. The fundamental
elements of a network that employs SNMP are as follows:

Managed devices: In each one, an agent is executed

Administrator (manager): The device from which the network is
administered
Management Information Base, MIB: A namespace organized
hierarchically in the form of a tree, containing the information that can be
read and/or written

Here are the five types of SNMP messages that are exchanged between Agents
and Administrators:

Get Request: A request from the Administrator to the Agent to send the
values contained in the MIB (database)
Get Next Request: A request from the Administrator to the Agent to send
the values contained in the MIB, referring to the object
Get Response: The Agent's response to the information request that's
launched by the Administrator
Set Request: A request from the Administrator to the Agent to change the
 value contained in the MIB, referring to a specific object
Trap: A spontaneous message sent by the Agent to the Administrator, upon
detecting a predetermined condition, such as the connection/disconnection
of a station or an alarm

The SNMP protocol is composed of two elements: the agent and the manager. It
is a client-server architecture, in which the agent plays the role of the server and
the manager acts as the client.

The agent is a program that must be executed in each network node that you
want to manage or monitor. It offers an interface of all the elements that can be
configured. These elements are stored in data structures called Management
Information Base (MIB). It represents part of the server, insofar as it has the
information that you want to manage and expects commands from the client.

The manager is the software that runs in the station responsible for monitoring
the network; its task is to consult the different agents that are in the nodes of the
network and data they have been obtaining.

In essence, SNMP is a very simple protocol since all operations are performed
under the load-and-store paradigm, which allows for a reduced set of commands.
A manager can perform only two types of operations on an agent: read or write
the value of a variable in the agent's MIB. These two operations are known as
a read request (get request) and a write request (set-request). There is a
command to respond to a read request, called read-response, which is used only
by the agent.

The possibility of extending the protocol is directly related to the ability of the
MIB to store new elements. If a manufacturer wants to add a new command to a
device, such as a router, they simply add the corresponding variables to its
database (MIB).
MIB – a broad base of information
A MIB is a hierarchical database of objects and their values, stored in an SNMP
agent.

Generally, the objects of the MIB are referenced by an identifier. For example,
the internet object is referred to by 1.3.6.1, or iso-ccitt.identified-
organization.dod.internet.

Through the MIB, you have access to the information for management, which is
contained in the internal memory of the device in question. MIB is a complete
and well-defined database, with a tree structure, and is suitable for handling
various groups of objects, with unique identifiers for each object.

The SNMP architecture operates with a small group of objects that are defined in
detail in the RFC 1066 Management information base for network management
over TCP/IP.

The 8 groups of objects that are usually handled by MIB, which define a total of
114 objects (recently, with the introduction of MIB-II, are defined up to a total of
185 objects), are as follows:

System: Includes the identity of the vendor and the time since the last
reinitialization of the management system
Interfaces: Single or multiple interfaces, local or remote
ATT (Address Translation Table): Contains the address of the network
and the equivalences with the physical addresses
IP (Internet Protocol): Provides the route tables, and keeps statistics on
the received IP datagrams
ICMP (Internet Communication Management Protocol): Counts the
number of received ICMP messages and errors
TCP (Transmission Control Protocol): Provides information about TCP
connections and retransmissions
UDP (User Datagram Protocol): Counts the number of UDP datagrams
sent, received, and delivered
EGP (Exterior Gateway Protocol): Collects information on the number of
 EGP messages that are received and generated

SNMP is a client/server-based network protocol. The server daemon provides

the requested information to the clients. If you are working with a Debian-based
distribution, you can install snmp in your local machine with the apt-get install
snmp command. This will provide some snmp commands. In your machine, if

SNMP has been installed and configured properly, you can use the snmpwalk utility
command to query the basic system information by using the following syntax:
# snmpwalk -v2c -c public localhost

Here is the output of the execution of the snmpwalk command, where we can see
information being returned by the SNMP agent:
iso.3.6.1.2.1.1.1.0 = STRING: "Linux debian6box 2.6.32-5-686 #1 SMP
Tue Jan 15 15:00:01 UTC 2019 i686"
iso.3.6.1.2.1.1.2.0 = OID: iso.3.6.1.4.1.8072.3.2.10
iso.3.6.1.2.1.1.3.0 = Timeticks: (88855240) 10 days, 6:49:12.40
iso.3.6.1.2.1.1.4.0 = STRING: "Me <[email protected]>"
iso.3.6.1.2.1.1.5.0 = STRING: "debian6box"
iso.3.6.1.2.1.1.6.0 = STRING: "Sitting on the Dock of the Bay"

The output of the preceding command will show the MIB number and its values.
For example, the iso.3.6.1.2.1.1.1.0 MIB number shows that it's a string type
value, such as Linux debian6box 2.6.32-5-686 #1 SMP Tue Jan 15 15:00:01 UTC 2019 i686.
Introduction to pysnmp
PySNMP is a cross-platform, pure Python SNMP engine implementation (https:/
/github.com/etingof/pysnmp) that abstracts a lot of SNMP details for developers, and

supports both Python 2 and Python 3.

You can install the pysnmp module by using the pip command:
$ pip install pysnmp

ASN.1 (https://asn1js.org) is a standard and notation that describes rules and

structures to represent, encode, transmit, and decode data in telecommunication
and computer networking. PySNMP also requires the PyASN1 package.
PyASN1 (https://github.com/etingof/pyasn1) conveniently provides a Python
wrapper around ASN.

This module provides a useful wrapper for the snmp commands. Let's learn how
to create an snmpwalk command. To begin, import a command generator:
from pysnmp.entity.rfc3413.oneliner import cmdgen
cmd_generator = cmdgen.CommandGenerator()

Then, define the necessary default values for the connection, assuming that the
snmpd daemon has been running on port 161 in public SNMP simulator at
demo.snmplabs.com and that the community string has been set to public:
SNMP_HOST = 'demo.snmplabs.com'
SNMP_PORT = 161
SNMP_COMMUNITY = 'public'

We can perform SNMP using the getCmd() method. The result is unpacked into
various variables. The output of this command consists of a four-value tuple. Out
of those, three are related to the errors that are returned by the command
generator, and the fourth one (varBinds) is related to the actual variables that bind
the returned data and contains the query result:
error_notify, error_status, error_index, var_binds =
cmd_generator.getCmd(
cmdgen.CommunityData(SNMP_COMMUNITY),
cmdgen.UdpTransportTarget((SNMP_HOST, SNMP_PORT)),
cmdgen.MibVariable('SNMPv2-MIB', 'sysDescr', 0),
 lookupNames=True, lookupValues=True

You can see that cmdgen takes the following parameters:

CommunityData(): Sets the community string as public.

UdpTransportTarget(): This is the host target, where the snmp agent is running.
This is specified in a pair of the hostname and the UDP port.
MibVariable: This is a tuple of values that includes the MIB version number
and the MIB target string (which is sysDescr; this refers to the description of
the system).

The output of this command consists of a four-value tuple. Out of those, three
are related to the errors returned by the command generator, and the fourth is
related to the actual variables that bind the returned data. The following example
shows how the preceding method can be used to fetch the SNMP host
description string from a running SNMP daemon.

You can find the following code in the snmp_get_information.py file:

#!/usr/bin/env python3

from pysnmp.hlapi import *

import sys

def get_info_snmp(host, oid):

for (errorIndication,errorStatus,errorIndex,varBinds) in nextCmd(SnmpEngine(),
CommunityData('public'),UdpTransportTarget((host, 161)),ContextData(), ObjectType(ObjectIdentity(o

if errorIndication:
print(errorIndication, file=sys.stderr)
break
elif errorStatus:
print('%s at %s' % (errorStatus.prettyPrint(),errorIndex and varBinds[int(errorIndex) - 1][0] or '
break
else:
for varBind in varBinds:
print('%s = %s' % varBind)

get_info_snmp('demo.snmplabs.com', '1.3.6.1.2.1.1.9.1.2')
Polling information from the SNMP
agent
An interesting tool to check for connections with SNMP servers and obtain the
value of the SNMP variable is snmp-get, which is available for both Windows and
Unix environments: https://snmpsoft.com/shell-tools/snmp-get/.

Other tools, such as snmpwalk (available at https://snmpsoft.com/shell-tools/snmp-walk/),

allow us to obtain information about SNMP servers.

This is the syntax you can use to request information about a specific host:
snmpwalk -c:community -v:2c -r:host -os:[oid]

In the following screenshot, we can see the usage for the snmpwalk command:
At http://snmplabs.com/snmpsim/public-snmp-agent-simulator.html#examples, you can see
some examples of executing the snmpalk command using the SNMP simulation
service at demo.snmplabs.com.