Network Monitoring & Management

SNMP API for Java Developers

2011-06-01T03:25:00.000-07:00

If you are involved in development of SNMP based network management and monitoring solutions using Java technology SNMP4J API (Open Source) is good enough. But if you want commercially supported library for extensive development give a try to WebNMS SNMP API 4 by ZOHO Corp (formerly AdventNet Inc.). WebNMS SNMP API has some unique features like IPv6 and relational database support. Additionally it provides high-level bean components such as, SnmpTarget, SnmpTable, SnmpPoller, TrapReceiver for easy application development.

Key Features of WebNMS SNMP API are as follows

Multi-lingual support: Complete support for SNMPv1, SNMPv2c and SNMPv3.

SNMPv3 security: Support for HMAC-SHA-96, HMAC-MD5-96, CBC-DES, CBC-3DES, CFB-AES-128, CFB-AES-192, CFB-AES-256 bit encryption.

Robust SMIv1 and SMIv2 MIB Parser: Seamlessly parses the MIB definitions from any OEM vendor. Offers various flavors of parsing based on the MIB definitions.

MIB Loading: Option to load MIB definitions from a pre-compiled file, a Serialized file, or a Database to boost the performance.

IPv6 (Internet Protocol Version 6) support: Provides connectivity with IPv6 and IPv4 based devices.

SNMP Broadcasting: Broadcasts snmp packets across the network to auto-discover snmp devices in the network.

SNMP Beans: Provides high-level bean components such as, SnmpTarget, SnmpTable, SnmpPoller, TrapReceiver for easy application development.

Database support: Provides scalability by storing MIB definitions and SNMPv3 configuration data in any relational database such as, MySQL and Oracle.

MIB Browser: Tool for administering network and system components. Can be run as a stand-alone application or invoked from a web browser.

Command line utilities: Perform SNMP operations such as, SNMP GET, SNMP GETNEXT, SNMP SET, SNMP BULK, SNMP WALK, etc. on remote agents.

You can download trial version of WebNMS SNMP API from following link

http://www.webnms.com/snmp/download.html

There is also a free version (without support) of WebNMS SNMP API which can be downloaded from same link mentioned above but it lacks some advanced features like EJB support,MIB browser tool and some others. Get complete datasheet from here.

Whether map of your network

2009-02-03T08:21:00.000-08:00

If your network is being monitored by MRTG, you can visualize the utilization of the network links in a interesting way with Network Weathermap. The weather-map of a network is two ways colored arrows on a map representing the logical topology of the network and color of arrow indicates the utilization of network bandwidth between two points in term of “%” (see the attached image).

The Network Weathermap is perl based tool developed by Panagiotis Christias. The required data are acquired from graphs created by the MRTG package. Images produced by Network Weathermap are not just dummy one and are backed by extra DHTML and JavaScript code for web-over pop-ups.

Home page: http://netmon.grnet.gr/weathermap/

Download Link: http://netmon.grnet.gr/weathermap/dist/weathermap-1.1.1.tar.gz

Essentials of SNMP

2007-03-07T03:03:00.000-08:00

Take a look on these nice books on SNMP.

Title: Essentials of SNMP - 2nd Edition
Link:Essential_SNMP.zip
Format: CHM (Windows) - Zipped

If you are interested in developing SNMP applications for oracle get this one.
It is little bit older but still useful.

Title: Oracle SNMP support reference guide
Link: Oracle_SNMP.pdf
Format: PDF

You may need Adobe Acrobat reader to read this file

SNMP Simulators

2006-10-23T23:49:00.000-07:00

SNMP simulators are SNMP agents which models routers and hosts. It appears to the SNMP Network Management Applications as if it is talking to actual devices. In various conditions they are very useful and helps in saving cost and time, some of these are as follows

1) Demonstrations of network management software (NMS).
2) Development of NMS.
3) For stress/performance/scalability testing of newly developed NMS modules.
4) For training purposes etc. etc.

I use them specially when actual Cisco router is unavailable to me or want to test under development modules. Some SNMP simulators also simulates SNMP error conditions and simultaneous simulation of number of agents with different IP addresses and I recommends these types of simulators because they give you chance of scalability testing and debugging of your modules under various error conditions in a large sized simulated network.

Here are some of my favorite SNMP simulators, if you have some more then please post them here.

1) MIMIC SNMP agent simulator.

Features:
- Supports SNMP v1/v2/v3.
- Can compile any SMI-compliant MIB to extend your set of devices.
- Ships with a large number of pre-compiled MIBs, networks and devices from the leading networking companies.
- Support pre compiled MIB and
- Creates a network of up to 10,000 SNMP-manageable devices on one Intel-based PC or Sun Sparc

Links: http://www.gambitcomm.com/site/products/snmp_simulator.shtml
http://www.gambitcomm.com

2) AdventNet Simulation Toolkit

Features:
- Ability to simulate 10000+ agents simultaneously.
- Supports SNMP v1/v2/v3.
- Support for SNMPv1,v2,v3 traps and SNMP v2, v3 Informs.
- Simulation of SNMP v1,v2,v3 error conditions from UI or using scripts.

Screen shots: http://www.adventnet.com/products/simulator/images/network_designer.jpg
Link: http://www.adventnet.com/products/simulator/index.html

NetFlow vs. sFlow

2006-10-05T04:09:00.000-07:00

NetFlow and sFlow are traffic reporting mechanisms that manufactures have embedded into enterprise-level switches and routers.

This white paper which nicely describes NetFlow and sFlow technologies, their comparison with each other and their uses. Take a look when you have the time.

Format: PDF

Link: http://www.openreality.co.uk/pdf/flow_wp.pdf

Great NetFlow projects

2006-09-28T05:35:00.000-07:00

In my last post some one has drop a comment about two great NetFlow tools NFDUMP and NFSEN, thanks to him for his/her suggestions.

NFDUMP is brother of tcpdump. NFDUMP reads data from log files stored by NetFlow collector daemon NFCAPD and displays flow/statistics .

NFSEN is separate project which is web based front end tool for NFDUMP.
A complete setup looks like following block diagram

NFDUMP and NFSEN are part of NfSen project

All these tools NFCAPD, NFDUMP, NFSEN are available under BSD License. And available for platform

All BSD Platforms (FreeBSD/NetBSD/OpenBSD/Apple Mac OS X)
All POSIX (Linux/BSD/UNIX-like OSes)

Screenshots and download location for NfSen project
http://sourceforge.net/projects/nfsen/

Location of NFDUMP
http://sourceforge.net/projects/nfdump/

Monitor your network traffic using NetFlow enabled monitoring tools

2006-08-07T00:56:00.000-07:00

This article provides information on how to monitor your network traffic going through interface using various Cisco NetFlow based monitoring tools available freeware and commercial versions.
This image gives the rough view of whole setup

1) What is NetFlow
2) NetFlow traffic converter
3) NetFlow collection engines and analyzers

1) What is NetFlow

NetFlow is a proprietary Cisco protocol, and all current Cisco routers and switches support this protocol. These devices record all traffic that traverses the network links and send detailed information concerning that traffic to a NetFlow collector using UDP packets.

NetFlow is the new standard for network traffic analysis; SNMP management just isn't sufficient anymore. Using NetFlow, you can see the utilization on a router—as well as the traffic that's causing the utilization.

According to Cisco a network flow is identified as a unidirectional stream of packets between a given source and destination—both are defined by a network-layer IP address and by transport-layer source and destination port numbers. Specifically, a flow is identified as the combination of the following key fields:

•Source IP address
•Destination IP address
•Source port number
•Destination port number
•Layer 3 protocol type
•Type of service (ToS)
•Input logical interface

These seven key fields define a unique flow. If a packet has one key field different from another packet, it is considered to belong to another flow. A flow might contain other accounting fields (such as the AS number in the NetFlow export Version 5 flow format) that depend on the export record version that you configure.
Version 5 and 9 are most versions of NetFlow. NetFlow v7 is used for switching information.

2) NetFlow traffic converter

NDSAD (NetUP Data Stream Accounting Daemon) by NetUP is a daemon who intercepts all traffic going in the network and exports statistics into the NetFlow v.5 format in real-time. It is compatible with any traffic accounting system which supports Netflow protocol and is freeware!
Here is NDSAD home page

http://www.netup.biz//ndsad.php

NDSAD has been tested on Linux, FreeBSD, SPARC Solaris and Win32. and available on it’s Sourceforge project page

http://www.sourceforge.net/projects/ndsad/

3) NetFlow collection engines and analyzers

To collect and analyze NetFlow stream, collection engine and a analyzer is required. Some popular freeware and commertial tools are given below

Cisco NetFlow collection engine and analyzer
Platform: HPUX, Solaris, Linux
Link: ftp://ftp.cisco.com/pub/netmgmt/netflow/

FLOWD ( Freeware collection engine )
Platform: Solaris 9, Linux FC2, Linux RH9, FreeBSD 3.5+

Link: http://www.mindrot.org/flowd.html

FlowScane ( Analyzer only )
Platform: Linux, Unix
Link: http://www.caida.org/tools/utilities/flowscan/pub/

PRTG( Freeware, Analyzer only)
Platform: Windows 98/ME/2000/XP/2003

Link: http://www.paessler.com/prtg

How to get Cisco running configuration using SNMP++ 3.x and VC++ MFC

2006-08-02T23:13:00.000-07:00

The essential part of this code is SNMP++ library and TFTP server.
You can download SNMP++ form following link

http://www.agentpp.com/snmp_pp3_x/snmp_pp3_x.html

Or if you want compiled version for VC++ 6.0 send me an email

A free ware TFTP Server is here

http://tftpd32.jounin.net

//Assuming you are using MFC

//Put Snmp::socket_startup(); in your applications InitInstance

//Function parameters
//cro Read-only community
//crw Read-write community
//ciscoIP ip-address of Cisco router
//tftpServer ip-address of tftpserver
//destFile Destination file name for running configuration

//First include snmp++ header file
#include "include/snmp_pp.h"

//returns 0 if fails oterwise +ve value

int YourClass::GetConfig(CString cro, CString crw,CString ciscoIP,CString tftpServer,CString destFile)
{

int status;
Snmp* snmp = new Snmp(status,8161);

if(snmp == NULL)
{
AfxMessageBox("Snmp object creation failed !");
return(0);
}

if( status != SNMP_CLASS_SUCCESS)
{
AfxMessageBox(snmp->error_msg(status));
delete(snmp);
return(0);
}

//snmp_version
snmp_version version = version2c; // or version1

UdpAddress address(ciscoIP); // Address of your Cisco router
unsigned short port = 161; //UDP SNMP port
address.set_port(port);

//Setting Values
CTarget ctarget(address);
ctarget.set_readcommunity(cro);
ctarget.set_writecommunity(crw);
ctarget.set_retry(3);
ctarget.set_version(version);
ctarget.set_timeout(5*100);

Pdu pdu;
//pdu = new Pdu();

Vb vb;

CString oidTFTPserver;
oidTFTPserver.Format("%s%s",".1.3.6.1.4.1.9.2.1.55.",tftpServer);

vb.set_oid((Oid)oidTFTPserver);

vb.set_value(destFile);
pdu += vb;

status = snmp->set(pdu,ctarget);

if(status != SNMP_CLASS_SUCCESS)
{
CString msg_err;
AfxMessageBox(snmp->error_msg(status));
delete(snmp);
return(0);

}

return(1);

}

PRTG Traffic Grapher – A great freeware tool

2006-07-19T06:41:00.000-07:00

PRTG Traffic Grapher is an easy to use Windows software for monitoring and classifying bandwidth usage. It provides system administrators with live readings and long-term usage trends for their network devices. The most common usage is bandwidth usage monitoring, but you can also monitor many other aspects of your network like memory and CPU utilizations.

A very useful feature of PRTG that I noted is Analyzing of Cisco Netflow data streams. Visit following link to see all it’s features

http://www.paessler.com/prtg/features

PRTG uses both SNMP and packet sniffing or Netflow based monitoring. using the Packet Sniffer or Netflow based monitoring you can differentiate the traffic by protocol, IP addresses and MAC addresses

PRTG proves both freeware and commertial edittion. The freeware edition of PRTG Traffic Grapher is completely free for personal and commercial use and may be downloaded for free. You can monitore up to three sensors with it

http://download.paessler.com/download/prtg.zip

If this link dos not work follow this

http://www.paessler.com/prtg/download

If you want to monitor more then three sensors then commertial edition is required which costs $62.50

Graphs generated by PRTG are very eye catching. Visit following link to see some screen shots

http://www.paessler.com/prtg/

Monitoring network traffic using Cisco IP accounting and MAC accounting

2006-07-15T05:12:00.000-07:00

By enabling IP accounting, users can see the number of bytes and packets switched through the Cisco IOS® software on a source and destination IP address basis. Only transit IP traffic is measured and only on an outbound basis; traffic generated by the software or terminating in the software is not included in the accounting statistics.

The MAC address accounting feature provides accounting information for IP traffic based on the source and destination MAC addresses on local area network (LAN) interfaces. This feature calculates the total packet and byte counts for a LAN interface that receives or sends IP packets to or from a unique MAC address. It also records a timestamp for the last packet received or sent.

Visit following link from Cisco to know how to enable IP accounting and MAC accounting on Cisco router

http://www.cisco.com/warp/public/477/SNMP/mac_ip_snmp.shtml

Followings are third party software, which provides facility of getting IP Accounting data easily from your Cisco device using SNMP

IPAccounting (Version 1.0)
Link: http://www.dvsinfo.com/downloads/IPAccounting.zip
Price: USD 90
Special features: Resolves IP address using DNS, can export IP accounting data to different format like CSV or plain text

SNMP library for Visual C++ developer

2006-07-14T04:50:00.000-07:00

SNMP++ provides freeware development library for Visual C++ Developers.

You can download it's source code form it's home page along with documentation, here is the link

http://www.agentpp.com/snmp_pp3_x/snmp_pp3_x.html

Current version is v3.2. Download page also provides praject files for MS VC++7.0 Project Files for compilation of source code in Windows environment.

SNMP++v3.x is based on SNMP++v2.8 from HP* and extends it by support for SNMPv3 and a couple of bug fixes. SNMP++v3.x is a C++ API which supports SNMP v1, v2c, and v3.
Currently supported platforms are Linux, FreeBSD, Solaris 2.6 (or higher), HPUX 10/11, Digital Unix 3/4 (True64), Windows NT/2000, and CygWin.

If you want pre compiled API just post a message on this blog

SNMP Development for serious java developers

2006-07-08T03:33:00.000-07:00

If you are a serious java developer and want high performance, multi threaded, open source APIs for your NMS project, here are two great open source projects

SNMP4J

Description: Free Open Source multi threaded SNMP API for Java™ 2SE 1.4 or later. Its clean object oriented design is inspired by HP SNMP++, which is a well-known SNMPv1/v2c/v3 API for C++

SNMP version supported: v1, v2c ,v3

Link: http://www.snmp4j.org

Netsnmpj

Description: netsnmpj is an open source Java library that allows java code to perform SNMP v1, v2c and v3 operations using the net-snmp library. It is composed of both java and native code elements. Please read the INSTALL file for details on installation. Currently Windows, Linux and Solaris(sparc) are supported.

SNMP version supported: v1, v2c ,v3

Link: http://netsnmpj.sourceforge.net

SNMP links and FAQ

2006-07-06T23:36:00.000-07:00

SNMP (Simple Network Management Protocol)

FAQ Part 1

http://www.faqs.org/faqs/snmp-faq/part1/

FAQ Part 2

http://www.faqs.org/faqs/snmp-faq/part2/

All about SNMP (Freeware/Shareware tools)

http://www.snmplink.org/

More then MIB browser

http://www.wtcs.org/snmp4tpc/getif.htm

How to centrally monitor events using syslog

2006-06-27T04:41:00.000-07:00

1. Introduction
2. Configuring syslog on Linux and Cisco
3. How to convert windows events to Syslog
4. More information on syslog

1. Introduction

In a networking environment it is very common to see different platforms running together for example Unix, Linux, Windows servers /workstations and Cisco routers. So there is a great need of monitoring events centrally by using some mechanism, and Syslog provides this.
The syslog protocol is a very simplistic protocol: the syslog sender sends a small textual message (less than 1024 bytes) to the syslog receiver. The receiver is commonly called "syslogd", "syslog daemon" or "syslog server". Syslog messages can be sent via UDP and/or TCP. Often the data is sent in cleartext, however, an SSL wrapper such as Stunnel, sslio or sslwrap can be used to provide for a layer of encryption through SSL/TLS.
Syslog is a de facto standard for forwarding log messages in an IP network. The term "syslog" is often used for both the actual Syslog protocol, as well as the application or library sending syslog messages.
In general syslog uses UDP protocol and syslog server listens to port 514 for syslog messages.

2. Configuring syslog on Linux and Cisco

Almost all Unix platform and Cisco routers support syslog. Please read related documentation for how to configure syslog on particular platform here is link for configuring it for Linux, and Cisco routers.

On Linux platform

http://www.linuxhomenetworking.com/linux-hn/logging.htm
http://www.linuxjournal.com/article/5476

On Cisco router

http://www.cisco.com/en/US/products/sw/cscowork/ps2073/

products_tech_note09186a00800a7275.shtml#topic1

3. How to convert windows events to Syslog

As I mentioned almost all Unix and Cisco routers support syslog and you can monitor them centrally, unfortunately Windows server/workstation does not provide syslog compatibility for monitoring events by default. But you can do this by using third party converters which monitors event log as source and generates syslog message whenever some event arrives.Using syslog server you can log these syslog messages to text files for further processing.
Some freeware and commercial tools on windows platform for converting, and receiving syslog messages are listed below.

Ntsyslog

Description - A great freeware for converting windows event log to syslog
Link - http://sourceforge.net/project/showfiles.php?group_id=36242
Cost - Freeware

Winlogd

Description - Winlogd is a syslog client for Windows that allows the Event Log to talk to syslog.
Link - http://www.edoceo.com/dl/winlogd.exe
Cost - Freeware
Note - Please read configuration instruction on http://www.edoceo.com/products/winlogd.php

VPN Console

Description – Good tool having all component like event log to syslog converter, syslog server and analyzer tool
Link - http://www.dvsinfo.com/downloads/VPN_Console.zip
Cost: USD 100 - 30 day evaluation available.

Kiwi Syslog Daemon

Description – Freeware Tool for receiving syslog messages
Link: http://www.kiwitools.com/downloads/syslog/Kiwi_Syslogd_8.0.2.setup.exe
Cost: Freeware

TFTPD32

Description – Freeware Tool for receiving syslog messages. Tftpd32 includes DHCP, TFTP, SNTP and Syslog servers as well as a TFTP client.
Link: http://www.kiwitools.com/downloads/syslog/Kiwi_Syslogd_8.0.2.setup.exe
Cost: Freeware

You can find many more commercial and freeware tools for this purpose on google by using key word “event log to syslog”

4. More information on syslog

http://www.faqs.org/rfcs/rfc3164.html

http://www.monitorware.com/Common/en/Articles/syslog-described.php

http://www.informit.com/articles/article.asp?p=426638&rl=1