SNMP v1, v2c, and v3

The book pictured at left spends more time on SNMP v1 and v2c than it does on SNMP v3. For example, it provides packet captures for v1 and v2c but not v3.

SNMP v1 is everywhere, but we should use SNMP v3 where possible.

I thought it would be helpful to show all three formats in one place.

Here is my snmpd.conf for SNMP v1 and v2c.

###########################################################################
#
# snmpd.conf
#
#   - created by the snmpconf configuration program
#
###########################################################################
# SECTION: Access Control Setup
#
#   This section defines who is allowed to talk to your running
#   snmp agent.

# rwuser: a SNMPv3 read-write user
#   arguments:  user [noauth|auth|priv] [restriction_oid]

rocommunity     read
rwcommunity     write

This is the syntax for a SNMP v1 snmpget.

orr:/home/richard$ snmpget -v 1 -c read 127.0.0.1 sysLocation.0
SNMPv2-MIB::sysLocation.0 = STRING: somewhere

Here is the SNMP v1 get.

Simple Network Management Protocol
    version: version-1 (0)
    community: read
    data: get-request (0)
        get-request
            request-id: 623181039
            error-status: noError (0)
            error-index: 0
            variable-bindings: 1 item
                Item
                    name: 1.3.6.1.2.1.1.6.0 (SNMPv2-MIB::sysLocation.0)
                    valueType: unSpecified (1)
                        unSpecified

0000  02 00 00 00 45 00 00 45 8f d7 00 00 40 11 ec ce   ....E..E....@...
0010  7f 00 00 01 7f 00 00 01 c7 4c 00 a1 00 31 d6 36   .........L...1.6
0020  30 27 02 01 00 04 04 72 65 61 64 a0 1c 02 04 25   0'.....read....%
0030  24 fc ef 02 01 00 02 01 00 30 0e 30 0c 06 08 2b   $........0.0...+
0040  06 01 02 01 01 06 00 05 00                        .........

Here is the SNMP v1 response.

Simple Network Management Protocol
    version: version-1 (0)
    community: read
    data: get-response (2)
        get-response
            request-id: 623181039
            error-status: noError (0)
            error-index: 0
            variable-bindings: 1 item
                Item
                    name: 1.3.6.1.2.1.1.6.0 (SNMPv2-MIB::sysLocation.0)
                    valueType: value (0)
                        value: simple (4294967295)
                            simple: string-value (1)
                                Value: STRING: somewhere

0000  02 00 00 00 45 00 00 4e 8f d8 00 00 40 11 ec c4   ....E..N....@...
0010  7f 00 00 01 7f 00 00 01 00 a1 c7 4c 00 3a 01 f8   ...........L.:..
0020  30 30 02 01 00 04 04 72 65 61 64 a2 25 02 04 25   00.....read.%..%
0030  24 fc ef 02 01 00 02 01 00 30 17 30 15 06 08 2b   $........0.0...+
0040  06 01 02 01 01 06 00 04 09 73 6f 6d 65 77 68 65   .........somewhe
0050  72 65                                             re

This is the syntax for a SNMP v2c snmpget.

orr:/home/richard$ snmpget -v 2c -c read 127.0.0.1 sysLocation.0
SNMPv2-MIB::sysLocation.0 = STRING: somewhere

Here is the SNMP v2c get.

Simple Network Management Protocol
    version: v2c (1)
    community: read
    data: get-request (0)
        get-request
            request-id: 1664713700
            error-status: noError (0)
            error-index: 0
            variable-bindings: 1 item
                Item
                    name: 1.3.6.1.2.1.1.6.0 (SNMPv2-MIB::sysLocation.0)
                    valueType: unSpecified (1)
                        unSpecified

0000  02 00 00 00 45 00 00 45 8f f5 00 00 40 11 ec b0   ....E..E....@...
0010  7f 00 00 01 7f 00 00 01 d6 21 00 a1 00 31 bc 9c   .........!...1..
0020  30 27 02 01 01 04 04 72 65 61 64 a0 1c 02 04 63   0'.....read....c
0030  39 83 e4 02 01 00 02 01 00 30 0e 30 0c 06 08 2b   9........0.0...+
0040  06 01 02 01 01 06 00 05 00                        .........

Here is the SNMP v2c response.

Simple Network Management Protocol
    version: v2c (1)
    community: read
    data: get-response (2)
        get-response
            request-id: 1664713700
            error-status: noError (0)
            error-index: 0
            variable-bindings: 1 item
                Item
                    name: 1.3.6.1.2.1.1.6.0 (SNMPv2-MIB::sysLocation.0)
                    valueType: value (0)
                        value: simple (4294967295)
                            simple: string-value (1)
                                Value: STRING: somewhere

0000  02 00 00 00 45 00 00 4e 8f f6 00 00 40 11 ec a6   ....E..N....@...
0010  7f 00 00 01 7f 00 00 01 00 a1 d6 21 00 3a e8 5d   ...........!.:.]
0020  30 30 02 01 01 04 04 72 65 61 64 a2 25 02 04 63   00.....read.%..c
0030  39 83 e4 02 01 00 02 01 00 30 17 30 15 06 08 2b   9........0.0...+
0040  06 01 02 01 01 06 00 04 09 73 6f 6d 65 77 68 65   .........somewhe
0050  72 65                                             re

To use SNMP v3, use a snmpd.conf like this. Notice the lack of community strings.

rwuser  richard priv 
createUser      richard MD5 bejtlichpass DES bejtlichpass

This is the syntax for a SNMP v3 snmpget.

orr:/home/richard$ snmpget -v 3 -u richard -l authPriv -a MD5 -A bejtlichpass -x DES
 -X bejtlichpass 127.0.0.1 sysLocation.0
SNMPv2-MIB::sysLocation.0 = STRING: somewhere

Here is the SNMP v3 get.

Simple Network Management Protocol
    msgVersion: snmpv3 (3)
    msgGlobalData
        msgID: 235115949
        msgMaxSize: 65507
        msgFlags: 07
        .... .1.. = Reportable: Set
        .... ..1. = Encrypted: Set
        .... ...1 = Authenticated: Set
        msgSecurityModel: USM (3)
    msgAuthoritativeEngineID: 80001F88800F7E06630CC1F644
    1... .... = Engine ID Conformance: RFC3411 (SNMPv3)
    Engine Enterprise ID: net-snmp (8072)
    Engine ID Format: Reserved/Enterprise-specific (128): Net-SNMP Random
    Engine ID Data: 0F7E0663
    Engine ID Data: Creation Time: Aug 31, 2006 06:59:24
    msgAuthoritativeEngineBoots: 25
    msgAuthoritativeEngineTime: 438
    msgUserName: richard
    msgAuthenticationParameters: B0183A673DD87ED37B9FB3C0
    msgPrivacyParameters: 0000000189C95C79
    msgData: encryptedPDU (1)
        encryptedPDU: 3C7F7013664F1C206DC92100AE9E2B3BC360C9839862AB8F...

0000  02 00 00 00 45 00 00 aa 8e 26 00 00 40 11 ee 1a   ....E....&..@...
0010  7f 00 00 01 7f 00 00 01 ef 46 00 a1 00 96 29 52   .........F....)R
0020  30 81 8b 02 01 03 30 11 02 04 0e 03 95 ad 02 03   0.....0.........
0030  00 ff e3 04 01 07 02 01 03 04 39 30 37 04 0d 80   ..........907...
0040  00 1f 88 80 0f 7e 06 63 0c c1 f6 44 02 01 19 02   .....~.c...D....
0050  02 01 b6 04 07 72 69 63 68 61 72 64 04 0c b0 18   .....richard....
0060  3a 67 3d d8 7e d3 7b 9f b3 c0 04 08 00 00 00 01   :g=.~.{.........
0070  89 c9 5c 79 04 38 3c 7f 70 13 66 4f 1c 20 6d c9   ..\y.8<.p.fO. m.
0080  21 00 ae 9e 2b 3b c3 60 c9 83 98 62 ab 8f eb be   !...+;.`...b....
0090  26 f1 d6 72 6a 5a 3a 6e ff 07 c7 dd d3 f2 b0 d4   &..rjZ:n........
00a0  f2 24 52 dc c2 ef 48 b8 c8 43 34 90 d2 98         .$R...H..C4...

Here is the SNMP v3 response.

Simple Network Management Protocol
    msgVersion: snmpv3 (3)
    msgGlobalData
        msgID: 235115949
        msgMaxSize: 65507
        msgFlags: 03
        .... .0.. = Reportable: Not set
        .... ..1. = Encrypted: Set
        .... ...1 = Authenticated: Set
        msgSecurityModel: USM (3)
    msgAuthoritativeEngineID: 80001F88800F7E06630CC1F644
    1... .... = Engine ID Conformance: RFC3411 (SNMPv3)
    Engine Enterprise ID: net-snmp (8072)
    Engine ID Format: Reserved/Enterprise-specific (128): Net-SNMP Random
    Engine ID Data: 0F7E0663
    Engine ID Data: Creation Time: Aug 31, 2006 06:59:24
    msgAuthoritativeEngineBoots: 25
    msgAuthoritativeEngineTime: 438
    msgUserName: richard
    msgAuthenticationParameters: A554DADDF26EE2EC976BA9DD
    msgPrivacyParameters: 0000001911E1CD8C
    msgData: encryptedPDU (1)
        encryptedPDU: A5CB2056AB68B85CB9AB999FB6080A3536DC086F3DF20DEC...

0000  02 00 00 00 45 00 00 b2 8e 27 00 00 40 11 ee 11   ....E....'..@...
0010  7f 00 00 01 7f 00 00 01 00 a1 ef 46 00 9e f2 fd   ...........F....
0020  30 81 93 02 01 03 30 11 02 04 0e 03 95 ad 02 03   0.....0.........
0030  00 ff e3 04 01 03 02 01 03 04 39 30 37 04 0d 80   ..........907...
0040  00 1f 88 80 0f 7e 06 63 0c c1 f6 44 02 01 19 02   .....~.c...D....
0050  02 01 b6 04 07 72 69 63 68 61 72 64 04 0c a5 54   .....richard...T
0060  da dd f2 6e e2 ec 97 6b a9 dd 04 08 00 00 00 19   ...n...k........
0070  11 e1 cd 8c 04 40 a5 cb 20 56 ab 68 b8 5c b9 ab   .....@.. V.h.\..
0080  99 9f b6 08 0a 35 36 dc 08 6f 3d f2 0d ec eb b3   .....56..o=.....
0090  1b 19 08 d1 cd 86 72 5e 2a 77 67 ee df f5 90 79   ......r^*wg....y
00a0  5f a0 27 db df 30 06 95 af 67 9b a9 16 8e 65 0e   _.'..0...g....e.
00b0  3a 2d 75 69 d8 64                                 :-ui.d

As you can see, this last example is encrypted. This is the best way to deploy SNMP v3. However, you can disable the encryption by using this snmpd.conf.

rwuser  richard auth 
createUser      richard MD5 bejtlichpass

You can run the following to generate an unencrypted SNMP v3 get.

orr:/home/richard$ snmpget -v 3 -u richard -l authNoPriv -a MD5
 -A bejtlichpass 127.0.0.1 sysLocation.0
SNMPv2-MIB::sysLocation.0 = STRING: somewhere

Here is the unencrypted SNMP v3 get.

Simple Network Management Protocol
    msgVersion: snmpv3 (3)
    msgGlobalData
        msgID: 1246784484
        msgMaxSize: 65507
        msgFlags: 05
        .... .1.. = Reportable: Set
        .... ..0. = Encrypted: Not set
        .... ...1 = Authenticated: Set
        msgSecurityModel: USM (3)
    msgAuthoritativeEngineID: 80001F88800F7E06630CC1F644
    1... .... = Engine ID Conformance: RFC3411 (SNMPv3)
    Engine Enterprise ID: net-snmp (8072)
    Engine ID Format: Reserved/Enterprise-specific (128): Net-SNMP Random
    Engine ID Data: 0F7E0663
    Engine ID Data: Creation Time: Aug 31, 2006 06:59:24
    msgAuthoritativeEngineBoots: 27
    msgAuthoritativeEngineTime: 31
    msgUserName: richard
    msgAuthenticationParameters: 210D87D7EF2AADAD95DF201C
    msgData: plaintext (0)
        plaintext
            contextEngineID: 80001F88800F7E06630CC1F644
            data: get-request (0)
                get-request
                    request-id: 1827121577
                    error-status: noError (0)
                    error-index: 0
                    variable-bindings: 1 item
                        Item
                            name: 1.3.6.1.2.1.1.6.0 (SNMPv2-MIB::sysLocation.0)
                            valueType: unSpecified (1)
                                unSpecified

0000  02 00 00 00 45 00 00 97 90 2f 00 00 40 11 ec 24   ....E..../..@..$
0010  7f 00 00 01 7f 00 00 01 fe c4 00 a1 00 83 a9 65   ...............e
0020  30 79 02 01 03 30 11 02 04 4a 50 6b e4 02 03 00   0y...0...JPk....
0030  ff e3 04 01 05 02 01 03 04 30 30 2e 04 0d 80 00   .........00.....
0040  1f 88 80 0f 7e 06 63 0c c1 f6 44 02 01 1b 02 01   ....~.c...D.....
0050  1f 04 07 72 69 63 68 61 72 64 04 0c 21 0d 87 d7   ...richard..!...
0060  ef 2a ad ad 95 df 20 1c 04 00 30 2f 04 0d 80 00   .*.... ...0/....
0070  1f 88 80 0f 7e 06 63 0c c1 f6 44 04 00 a0 1c 02   ....~.c...D.....
0080  04 6c e7 a9 a9 02 01 00 02 01 00 30 0e 30 0c 06   .l.........0.0..
0090  08 2b 06 01 02 01 01 06 00 05 00                  .+.........

Here is the unencrypted SNMP v3 response.

Simple Network Management Protocol
    msgVersion: snmpv3 (3)
    msgGlobalData
        msgID: 1246784484
        msgMaxSize: 65507
        msgFlags: 01
        .... .0.. = Reportable: Not set
        .... ..0. = Encrypted: Not set
        .... ...1 = Authenticated: Set
        msgSecurityModel: USM (3)
    msgAuthoritativeEngineID: 80001F88800F7E06630CC1F644
    1... .... = Engine ID Conformance: RFC3411 (SNMPv3)
    Engine Enterprise ID: net-snmp (8072)
    Engine ID Format: Reserved/Enterprise-specific (128): Net-SNMP Random
    Engine ID Data: 0F7E0663
    Engine ID Data: Creation Time: Aug 31, 2006 06:59:24
    msgAuthoritativeEngineBoots: 27
    msgAuthoritativeEngineTime: 31
    msgUserName: richard
    msgAuthenticationParameters: 539C1C59C5B2C9B47BE3112A
    msgData: plaintext (0)
        plaintext
            contextEngineID: 80001F88800F7E06630CC1F644
            data: get-response (2)
                get-response
                    request-id: 1827121577
                    error-status: noError (0)
                    error-index: 0
                    variable-bindings: 1 item
                        Item
                            name: 1.3.6.1.2.1.1.6.0 (SNMPv2-MIB::sysLocation.0)
                            valueType: value (0)
                                value: simple (4294967295)
                                    simple: string-value (1)
                                        Value: STRING: somewhere

0000  02 00 00 00 45 00 00 a1 90 30 00 00 40 11 ec 19   ....E....0..@...
0010  7f 00 00 01 7f 00 00 01 00 a1 fe c4 00 8d cf 61   ...............a
0020  30 81 82 02 01 03 30 11 02 04 4a 50 6b e4 02 03   0.....0...JPk...
0030  00 ff e3 04 01 01 02 01 03 04 30 30 2e 04 0d 80   ..........00....
0040  00 1f 88 80 0f 7e 06 63 0c c1 f6 44 02 01 1b 02   .....~.c...D....
0050  01 1f 04 07 72 69 63 68 61 72 64 04 0c 53 9c 1c   ....richard..S..
0060  59 c5 b2 c9 b4 7b e3 11 2a 04 00 30 38 04 0d 80   Y....{..*..08...
0070  00 1f 88 80 0f 7e 06 63 0c c1 f6 44 04 00 a2 25   .....~.c...D...%
0080  02 04 6c e7 a9 a9 02 01 00 02 01 00 30 17 30 15   ..l.........0.0.
0090  06 08 2b 06 01 02 01 01 06 00 04 09 73 6f 6d 65   ..+.........some
00a0  77 68 65 72 65                                    where

SNMP is cool. The biggest problem for SNMP v3 seems to be user and key management.