The use of SNMP and other network management tools in UNINETT. Arne Øslebø March 4, 2014

Transcription

1 The use of SNMP and other network management tools in UNINETT Arne Øslebø March 4,

2 UNINETTs network

3 GEANT 3

4 4

5 What is monitored? Link status Are all connections up? General statistics Bps, pps, error counters SNMP traps SNMP get/getnext SNMP get/getnext/getbulk >200 routers/switches and >14000 interfaces Detailed traffic statistics Top X protocols, port numbers, IP addresses etc. Netflow from routers QoS measurements Passive/active monitoring probes 5

6 Monitoring applications 6

7 Key software Net-snmp ritz/zino Geographical and schematic maps of the network NAV Link status monitor with ticket handling Maps Popular free SNMP package (GPL) Network Administration Visualized Primarily used by colleges and universities perfsonar NC Tool for distributed correlation and visualization of monitoring data 7

8 Why develop our own software? Commercial software solve wrong problems Centralized and focuses on intranets Weak handling of historical data Few statistical functions Developing our own software gives us tailored solutions Open source All software we develop are released as open source Use already available open source code and modify it A lot of development done by students 8

9 Ritz/Zino Link status monitor with ticket handling Zino is the backend that collects information Ritz is the frontend implemented in TCL Configuration files specifies which routers/switches 9 should be monitored All other information is collected through SNMP Monitors link status using SNMP traps and SNMP get Monitors connection status to routers Collects basic traffic statistics Monitors software versions Support for ticket handling Web based read only interface also available

10 Ritz screenshot 10

11 Zino SNMP usage SNMP v2c Access lists on routers IF-MIB iftable IfXTable RFC2737 BGP4-MIB IfAlias, ifinmulticastpkts etc. Entity MIB ifadminstatus, ifoperstatus IfInOctets, ifinucastpkts etc. RFC4273 BGP monitoring Vendor specific MIBs JUNIPER-ALARM-MIB CISCO-ENVMON-MIB 11

12 Maps 12

13 Link names Statistics must follow link names, not ports on routers Links can move Different port on same router To a new router Naming policy BaneTele xxxxx, teknobyen-tynset, tynset-gw ifalias 13

14 NAV Network Administration Visualized Clearly report most important errors Fix most important errors first Inform end users Traffic planning Network management system Open source GPL Development started in 1999 at NTNU Now developed by UNINETT in cooperation with 14 NTNU and others > lines of code, PostgreSQL database (94 tables) Detect bottlenecks early Reactive investigation Abuse cases trace PC

15 NAV architecture IP device info network explorer Traffic map cricket report generator machine tracker / blocker delay / loss tabular reports NAVdb status monitor RRD service monitor threshold monitor jabber www external systems event and alert engine SMS 15

16 NAV autodetecting topology Physical topology ARP CAM CDP Vlan topologi trunks STP 16 Trace equipment Block equipment

17 NAV device info 17

18 NAVdb seed data Seed data getdevicedata (Edit database tool) NAVdb snmp Device seed data rom ip-addresse org B21 : : hifm C11 : : hifm D12 : : hifm kategory snmp community : GSW : xxx : yyy : SW : xxx : yyy : WLAN : xxx : yyy Manual register of key information (seed data) 18

19 NAV SNMP usage Many MIBs are used, both standardized and vendor specific BRIDGE-MIB, CISCO-C2900-MIB, CISCO-CDP-MIB, CISCO-ENTITY-ASSET-MIB, CISCO-ENVMON-MIB, CISCO-ES-STACK-MIB, CISCO-FLASH-MIB, CISCO-HSRP-MIB, CISCO-IETF-IP-MIB, CISCO-MEMORY-POOL-MIB, CISCO-STACK-MIB, CISCO-VLAN-MEMBERSHIP-MIB, CISCO-VTP-MIB, ENTITY-MIB, ESSWITCH.MIB, HP-MIB, IF-MIB, IP-MIB, IPV6-MIB, MAU-MIB, OLD-CISCO-CHASSIS-MIB, OLD-CISCO-CPU-MIB, OLD-CISCO-INTERFACES-MIB, OSPF-MIB, RFC1213, RFC1213-MIB, SECURITY-MIB, SNMPv2-MIB 19

20 DDoS attack 20

21 NetFlow Cisco technology from 1996 Used for: IETF IPFIX definition: A set of IP packets passing an observation point in a network during a certain time interval. All packets belonging to a particular flow have a set of common properties. Flow Key analyzing network usage, security monitoring, billing etc. Tells you who talks to who, at what time and how much data was transfered. Set of properties that are used for defining a flow Flow record Measured properties of a flow 21

22 NetFlow v5/v9 Flow key: Source IP address Destination IP address Source port Destination port Layer 3 protocol type Type of service Input interface Expiration: Flow record Source and destination IP address Next hop router's IP address Input and output interface index 22 Packets and bytes in the flow sysuptime at start and end of flow TCP/UDP source and destination port number Type of service TCP flags IP protocol Source and destination AS number Source and destination address prefix mask bits Inactive timer - 15 seconds Active timer minutes Full cache RST or FIN TCP flag v9 supports configurable flow records but is most commonly used as v5 with IPv6 support.

23 Our NetFlow setup 34 routers 439 interfaces 1/100 sampling rate on most routers ~25Gb of compressed raw Netflow data every day 23 ~ 1.8 billion flows per day million flows per hour Anycast Database >1TB database size >800 millions entries in a single table

24 IPFIX IP Flow Information Export IETF standardized version of Netflow v9 RFC 5101, RFC 5102 Evolved into a very generic protocol Can export most types of structured data Log files Network statistics Sends templates that describes the flow record 24

25 IPFIX export from router with IPv6->IPv4 NAT support Flow record: sourceipv6address sourcetransportport postnatdestinationipv6address postnatsourceipv4address destinationipv4address postnaptsourcetransportport destinationtransportport postnaptdestinationtransportport observationtimemilliseconds ingressvrfid protocolidentifier natevent 25

26 Active/passive measurement probes 26

27 Measurement probes applications Multicast Beacon Appflow 27 Mping NDT

28 Combined network and system management Most NREN and ISP now deliver not only the network connection but also services TV Phone (SIP) FEIDE Storage Network and system management needs to be combined Especially important in high availability services Redundant servers and network connections Anycast 28

29 PerfSONAR NC 29 perfsonar NC perfsonar NC

30 Visual analytics 30

31 Summary UNINETT has a large and dynamic network Network management is important for providing a stable network SNMP is used for all basic management Link status Counters Other protocols are also used IPFIX and Netconf Moving towards multi domain monitoring and better integration between network and system monitoring 31