Network Monitoring & Management

If you are involved in development of SNMP based network management and monitoring solutions using Java technology SNMP4J API (Open Source) is good enough. But if you want commercially supported library for extensive development give a try to WebNMS SNMP API 4 by ZOHO Corp (formerly AdventNet Inc.). WebNMS SNMP API has some unique features like IPv6 and relational database support. Additionally it provides high-level bean components such as, SnmpTarget, SnmpTable, SnmpPoller, TrapReceiver for easy application development.

Key Features of WebNMS SNMP API are as follows

Multi-lingual support: Complete support for SNMPv1, SNMPv2c and SNMPv3.

SNMPv3 security: Support for HMAC-SHA-96, HMAC-MD5-96, CBC-DES, CBC-3DES, CFB-AES-128, CFB-AES-192, CFB-AES-256 bit encryption.

Robust SMIv1 and SMIv2 MIB Parser: Seamlessly parses the MIB definitions from any OEM vendor. Offers various flavors of parsing based on the MIB definitions.

MIB Loading: Option to load MIB definitions from a pre-compiled file, a Serialized file, or a Database to boost the performance.

IPv6 (Internet Protocol Version 6) support: Provides connectivity with IPv6 and IPv4 based devices.

SNMP Broadcasting: Broadcasts snmp packets across the network to auto-discover snmp devices in the network.

SNMP Beans: Provides high-level bean components such as, SnmpTarget, SnmpTable, SnmpPoller, TrapReceiver for easy application development.

Database support: Provides scalability by storing MIB definitions and SNMPv3 configuration data in any relational database such as, MySQL and Oracle.

MIB Browser: Tool for administering network and system components. Can be run as a stand-alone application or invoked from a web browser.

Command line utilities: Perform SNMP operations such as, SNMP GET, SNMP GETNEXT, SNMP SET, SNMP BULK, SNMP WALK, etc. on remote agents.

You can download trial version of WebNMS SNMP API from following link

http://www.webnms.com/snmp/download.html

There is also a free version (without support) of WebNMS SNMP API which can be downloaded from same link mentioned above but it lacks some advanced features like EJB support,MIB browser tool and some others. Get complete datasheet from here.

Take a look on these nice books on SNMP.

Title: Essentials of SNMP - 2nd Edition
Link:Essential_SNMP.zip
Format: CHM (Windows) - Zipped

If you are interested in developing SNMP applications for oracle get this one.
It is little bit older but still useful.

Title: Oracle SNMP support reference guide
Link: Oracle_SNMP.pdf
Format: PDF

You may need Adobe Acrobat reader to read this file

SNMP simulators are SNMP agents which models routers and hosts. It appears to the SNMP Network Management Applications as if it is talking to actual devices. In various conditions they are very useful and helps in saving cost and time, some of these are as follows

1) Demonstrations of network management software (NMS).
2) Development of NMS.
3) For stress/performance/scalability testing of newly developed NMS modules.
4) For training purposes etc. etc.

I use them specially when actual Cisco router is unavailable to me or want to test under development modules. Some SNMP simulators also simulates SNMP error conditions and simultaneous simulation of number of agents with different IP addresses and I recommends these types of simulators because they give you chance of scalability testing and debugging of your modules under various error conditions in a large sized simulated network.

Here are some of my favorite SNMP simulators, if you have some more then please post them here.

1) MIMIC SNMP agent simulator.

Features:
- Supports SNMP v1/v2/v3.
- Can compile any SMI-compliant MIB to extend your set of devices.
- Ships with a large number of pre-compiled MIBs, networks and devices from the leading networking companies.
- Support pre compiled MIB and
- Creates a network of up to 10,000 SNMP-manageable devices on one Intel-based PC or Sun Sparc

Links: http://www.gambitcomm.com/site/products/snmp_simulator.shtml
http://www.gambitcomm.com


2) AdventNet Simulation Toolkit

Features:
- Ability to simulate 10000+ agents simultaneously.
- Supports SNMP v1/v2/v3.
- Support for SNMPv1,v2,v3 traps and SNMP v2, v3 Informs.
- Simulation of SNMP v1,v2,v3 error conditions from UI or using scripts.

Screen shots: http://www.adventnet.com/products/simulator/images/network_designer.jpg
Link: http://www.adventnet.com/products/simulator/index.html

NetFlow and sFlow are traffic reporting mechanisms that manufactures have embedded into enterprise-level switches and routers.

This white paper which nicely describes NetFlow and sFlow technologies, their comparison with each other and their uses. Take a look when you have the time.

Format: PDF

Link: http://www.openreality.co.uk/pdf/flow_wp.pdf

In my last post some one has drop a comment about two great NetFlow tools NFDUMP and NFSEN, thanks to him for his/her suggestions.

NFDUMP is brother of tcpdump. NFDUMP reads data from log files stored by NetFlow collector daemon NFCAPD and displays flow/statistics .

NFSEN is separate project which is web based front end tool for NFDUMP.
A complete setup looks like following block diagram




NFDUMP and NFSEN are part of NfSen project

All these tools NFCAPD, NFDUMP, NFSEN are available under BSD License. And available for platform

All BSD Platforms (FreeBSD/NetBSD/OpenBSD/Apple Mac OS X)
All POSIX (Linux/BSD/UNIX-like OSes)

Screenshots and download location for NfSen project
http://sourceforge.net/projects/nfsen/

Location of NFDUMP
http://sourceforge.net/projects/nfdump/

1) What is NetFlow
2) NetFlow traffic converter
3) NetFlow collection engines and analyzers

1) What is NetFlow

NetFlow is a proprietary Cisco protocol, and all current Cisco routers and switches support this protocol. These devices record all traffic that traverses the network links and send detailed information concerning that traffic to a NetFlow collector using UDP packets.

NetFlow is the new standard for network traffic analysis; SNMP management just isn't sufficient anymore. Using NetFlow, you can see the utilization on a router—as well as the traffic that's causing the utilization.

According to Cisco a network flow is identified as a unidirectional stream of packets between a given source and destination—both are defined by a network-layer IP address and by transport-layer source and destination port numbers. Specifically, a flow is identified as the combination of the following key fields:

•Source IP address
•Destination IP address
•Source port number
•Destination port number
•Layer 3 protocol type
•Type of service (ToS)
•Input logical interface

These seven key fields define a unique flow. If a packet has one key field different from another packet, it is considered to belong to another flow. A flow might contain other accounting fields (such as the AS number in the NetFlow export Version 5 flow format) that depend on the export record version that you configure.
Version 5 and 9 are most versions of NetFlow. NetFlow v7 is used for switching information.

2) NetFlow traffic converter

NDSAD (NetUP Data Stream Accounting Daemon) by NetUP is a daemon who intercepts all traffic going in the network and exports statistics into the NetFlow v.5 format in real-time. It is compatible with any traffic accounting system which supports Netflow protocol and is freeware!
Here is NDSAD home page

http://www.netup.biz//ndsad.php

NDSAD has been tested on Linux, FreeBSD, SPARC Solaris and Win32. and available on it’s Sourceforge project page

http://www.sourceforge.net/projects/ndsad/

3) NetFlow collection engines and analyzers

To collect and analyze NetFlow stream, collection engine and a analyzer is required. Some popular freeware and commertial tools are given below

Cisco NetFlow collection engine and analyzer
Platform: HPUX, Solaris, Linux
Link: ftp://ftp.cisco.com/pub/netmgmt/netflow/

FLOWD ( Freeware collection engine )
Platform: Solaris 9, Linux FC2, Linux RH9, FreeBSD 3.5+

Link: http://www.mindrot.org/flowd.html

FlowScane ( Analyzer only )
Platform: Linux, Unix
Link: http://www.caida.org/tools/utilities/flowscan/pub/

PRTG( Freeware, Analyzer only)
Platform: Windows 98/ME/2000/XP/2003

Link: http://www.paessler.com/prtg