Optical Core Networks Management protocols

Place for logos of authors’ institutions Optical Core NetworksManagement protocols Barbara Martini, Scuola Superiore Sant’Anna, barbara.martini@cnit.it Fabio Baroncelli, Scuola Superiore Sant’Anna, fabio.baroncelli@cnit.it

Outline Basic foundations of Network Management: • Overview on Management classification • Motivation for Network Management • Management paradigm • Terminology and Basic Concept • Standardization activity • Description on the Management Information • Simple Network Management Protocol (SNMP)

Management Classification (1) Provider structure (processes, services, policies) Service management Applications Applications Applications Information management data data System management Workstation Host PC Printer Communication Network (hub, bridge, router, multiplexer,switch) Network management

Management Classification (2) Information & System Management LAN LAN LAN MAN MAN ISP WAN Service Management MAN • Network management: • Backbone network (WAN,MAN) • Local Area Network (LAN) LAN

The importance of Network management: use case Application Application TCP TCP IP IP LAN Eth LAN FDDI Data Server Low performance Throughput reduction User FDDI Ethernet Sinchronism loss on E3 frame ATM SDH/WDM 64kbps PDH/SDH E1 MUX PCM E3/E1 34Mbps E3

Network management: basic concept GUI LAN LAN WAN/MAN • Support for: • Remote investigation • Real-time supervision • Automatic data processing • Planning future evolution LAN LAN

Management Activity Loop Monitor status and receive event reports Interpret policy and make decisions Perform management operations

Network Management definition • Network management is a service that employs a variety of tools, applications, and devices to assist human network managers in the control and maintenance of a network. • Network management includes the deployment, integration and coordination of the hardware, software and human elements to monitor, test, poll, configure, analyze, evaluate the network resources to meet the real-time, operational performance and QoS requirements at a reasonable cost. • The combination of hardware and software used to monitor and administer a network is called Network Management System (NMS)

Management System Requirements (1) • Guarantee the availability of the newtork operation • Service maintenance (availability, response time) need to face with technological changes • Security of the services through the control of security components • Human mistake prevention and bottleneck identification/recovery • Automatic or semiautomatic reaction on operation anomalies: • Real-time configuration modification in case of error • Activation of redundant components in case of error • Dynamic reactions to changes on the network and environment: • Changes regarding applications, users, components, services or fees • Dynamic adaptation of the available transmission bandwidth according to request originated by the management system

Management System Requirements (2) • Network control: • Collection and (compressed) representation of relevant network information • Definition and maintenance of a database of network configurations • When applicable, centralization of the control over peripherals and implemented functions (central management console) • Integration of management procedures on heterogeneous environment • Improvement of network administrators work conditions: • Identify and implement gradual automation of management functions • Good integration of tools into the existing operational sequences • Progress through standardization: • transition of existing, often proprietary, solutions in a standardized environment

Functional Areas (OSI Management) • Fault Management • Configuration management • Performance management • Security management • Accounting Management

Managed Object (1) Attributes Operations Behaviour Notifications Push button receiver Warning: telephone equipment is operational but no voice is heard line represented as sees Management System Real telephone Managed Object • Control, co-ordination and monitoring of network resources take place via the manipulation from Managed Objects (MO)s • MO are an abstract representation of a network resource, both physical and logical • The boundary of a management object specifies which details are accessible to a management system and which ones are shielded (black box)

Managed Object (2) • Attributes: • describe the state/condition of managed objects • can change when the condition of the real object changes • can be manipulated by means of management operation • Operations: • make it possible to access a managed object. • the number and type of operation influence the object performance and complexity • Behaviour: • determines the semantics and interaction with the real resources • is normally defined using text in plain english • Notifications • the quantity and type of the messages, which can be generated by predefined situations by a managed object when specific situation occur

Managed Object (3) • “A managed object is the abstracted view of a resource that present its properties as seen by (and for the purpose of) management (ISO 7498-4)” • A managed object may represent a relationship between several resources. • Multiple managed objects may represent a single resources to provide different abstract view of the resource for different management purpose. • Managed objects do not necessarily correspond to objects, as one knows from object-oriented programming. • Simple variables correspond to the MOs in the Internet Management

Manager-Agent paradigm operation (get,set) notification Manager Agent MO MO Management Communication protocol int’l object MO Network Management System Managed Device Management Interface

Agent role • Implements the MOs by accessing the real resources • Receives requests from a manager, processes them and transmits appropriate responses • Dispatches notifications about important changes in the MOs • Protects MOs against unauthorised accesses using access control rules and communication authentication with the partner

Manager role • Exercises control: it controls functions hence it is the crucial instance • Starts up management operations by appropriate protocol operations for the manipulation of MOs • Receives messages from agents and passes them (for handling) to appropriate applications

Management Protocol • Implements access to distant managed objects by encoding management data that is then secure during the transfer • Several protocols can be used for the implementation of the defined services • The service primitive and the appropriate protocols operations influence considerably the efficiency and the complexity of the management system MOs Algorithm for the solution of management problem CMIP, SNMP Mngm Prot Mngm Prot OSI layer 7 Communication protocol Manager Agent

Management Information Base (MIB) MO MO MO MO MO MO MIB Management Information Base (MIB) • The collection of MOs is stored in a specific data base, called Managment Information Base (MIB) • A MIB should be known both to the agent and the manager • It represents a sort of “shared knowledge” of network resources

Management Information Structure • Structure of the management information: • Defines the rules of the description of Managed Objects • Identification and designation of MOs • Composition of MOs • Behaviour of MOs • Relations to other MOs • Possible operations and internal messages of the MOs • Definition of the datatypes, structure and syntaxt for the description of the MOs • The quantity of the descriptions of MOs in accordance with these rules defines the Management Information Base (MIB)

Network Management Architecture Network Management System NMS Manager Management Data Management Protocol Managed Network Agent Agent Agent MIB MIB MIB Managed Devices

Management Network Data Network The management network is to be considered a logically separated network from data network Management Interface Management Data Management Network

Target of the Current Developments • Implementation of integrated management systems which cover all the requirements for the management of heterogeneous networks and systems • Good expandiblity and adaptability to the local network environment • Good support during the automation of management flows and conversion of management guidelines • Protection of the management against attacks of unauthorized people • Scalability of both the size of the network and increasing demanding requests of the management systems • Open interfaces to the existing infrastructure and their integration into operational sequences.

Infrastructure for network management Management Interface Management Information Base (MIB) Network Management System MIB Agent Managed Device Manager MIB Agent Managed Device Network Management Protocol MIB Agent Managed Device Managed devices represented as a set of managed objects whose data is gathered into a MIB

Management of the Internet • "Internet" refers to a set of devices that • is logically linked together by a globally unique address space based on the Internet Protocol (IP) • is able to support communications using the Transmission Control Protocol/Internet Protocol (TCP/IP) suite • These devices contain information (like parameters and statistics) that need to be managed about their: • Configuration • Running conditions • Healthy • neighborhoods

The global Internet has thousands of networks Network Webserver Software Browser Packet Packet Router Route Router Router Packet Management of the Internet

Requirements • Measurement tools to quickly, accurately and automatically identify Internet communication problems • A common network management model for managing the TCP/IP protocols and the Internet devices as well

Why is internet management so important? • End users & network managers should be able to identify & track internet problems • End users need to verify the service level agreement (SLA) stipulated with the Internet Service Provider (ISP) • The ISP should be able to set expectations: • Deciding which links need upgrading • Deciding where to place network devices (e.g., routers) • Forecast how well an application (e.g., VoIP) will work

Why is internet management so difficult? • Internet's evolution is a composition of independently developed and deployed protocols, technologies, and core applications • The phone connection oriented model (Poisson distributions of session length etc.) does not work for Internet traffic • Internet management is not in the priority list of the vendors: • Resources/skill focus on more interesting an profitable issues • Tools lacking or inadequate • Implementations poor & not fully tested with new releases • For privacy issues, the ISPs worried about providing access to their core network making results public

LAN vs WAN • Managing the LAN • Network admin has control so: • Can read information from devices • Can passively sniff traffic (e.g., using Ethereal) • Know the routes between devices (manually for small networks, automated for large networks) • Managing the WAN • No admin control, unless you are an ISP • Can’t read information out of routers • May not be able to sniff/trace traffic due to privacy/security concerns • Don’t know route details between points

Passive vs. Active Traffic Monitoring • Active Monitoring • Injects extra artificial traffic • provides explicit control on the generation of packets for measurement scenarios • testing what you want, when you need it • Passive Monitoring • does not inject extra traffic, measures real traffic parameters using: • Probe Devices that capture/watch packets as they pass (e.g., Router, switch, sniffer) • Network device that records network status information • Generally we use both approaches, e.g. start active measurement and look at passively

Active Monitoring tools: examples • Ping = for monitoring the destination reachability • Traceroute = for tracing a path • Pingroute = Combines ping & traceroute, • Pathchar, Pipechar/abing = for path characterization • Iperf = for measuring the network throughput Ping Traceroute Source Destination

Passive Monitoring tools • Hardware probes = (e.g., Sniffer, NetScout) can be stand-alone or remotely access from a central management station • Software probes = (e.g., snoop, tcpdump) • Flow measurement = (e.g., netramet, Netflow)

The ICMP Protocol • Internet Control Message Protocol (ICMP), documented in RFC 792, is a protocol that uses IP for out-of-band messages related to network operation • Since ICMP uses IP, ICMP packet delivery is unreliable, so hosts cannot count on receiving ICMP packets for any network problem. Some of ICMP's functions are to: • Announce network errors, such as a host unreachable due to any failure. • Announce network congestion. When a router begins buffering too many packets, due to an inability to transmit them as fast as they are being received, it will generate ICMP Source Quench messages. Directed at the sender, these messages should cause the rate of packet transmission to be slowed. • Assist Troubleshooting. ICMP supports an Echo function, which just sends a packet on a round-trip between two hosts. Ping, a common network management tool, is based on this feature. Ping will transmit a series of packets, measuring average round-trip times and computing loss percentages. • Announce Timeouts. If an IP packet's TTL field drops to zero, the router discarding the packet will often generate an ICMP packet announcing this fact.

Ping • Ping is common network management tool based on ICMP: • Client sends ICMP echo request, server sends reply • Client measures average round-trip times and computes loss percentages • Client can specify the number of data bytes transmitted, can puts timestamp in data bytes and can compares timestamp with time when echo comes back

Ping (2) Router “Host Unreachable” Error Message ICMP Message IP Header “Echo” “Echo Reply”

Ping example Remote host syrup:/home$ ping -n 6 thumper.bellcore.com PING thumper.bellcore.com (128.96.41.1): 64 data bytes 72 bytes from 128.96.41.1: icmp_seq=0 ttl=240 time=641.8 ms 72 bytes from 128.96.41.1: icmp_seq=2 ttl=240 time=1072.7 ms 72 bytes from 128.96.41.1: icmp_seq=3 ttl=240 time=1447.4 ms 72 bytes from 128.96.41.1: icmp_seq=4 ttl=240 time=758.5 ms 72 bytes from 128.96.41.1: icmp_seq=5 ttl=240 time=482.1 ms --- thumper.bellcore.com ping statistics --- 6 packets transmitted, 5 packets received, 16% packet loss round-trip min/avg/max = 482.1/880.5/1447.4 ms Repeat count Summary

Traceroute • Traceroute is an ICMP utility that traces a packet from local to a remote host, showing how many hops the packet requires to reach the remote host and how long each hop takes. • If you're visiting a Web site and pages are appearing slowly, you can use traceroute to figure out where the longest delays are occurring. • TraceRoute maps network routes by sending packets with small Time-to-Live (TTL) values and watching the ICMP timeout announcements.

Traceroute example Max hops Remote host 17cottrell@flora06:~>traceroute -m 20 lhr.comsats.net.pk traceroute to lhr.comsats.net.pk (210.56.16.10), 20 hops max, 40 byte packets 1 RTR-CORE1.SLAC.Stanford.EDU (134.79.19.2) 0.642 ms 2 RTR-MSFC-DMZ.SLAC.Stanford.EDU (134.79.135.21) 0.616 ms 3 ESNET-A-GATEWAY.SLAC.Stanford.EDU (192.68.191.66) 0.716 ms 4 snv-slac.es.net (134.55.208.30) 1.377 ms 5 nyc-snv.es.net (134.55.205.22) 75.536 ms 6 nynap-nyc.es.net (134.55.208.146) 80.629 ms 7 gin-nyy-bbl.teleglobe.net (192.157.69.33) 154.742 ms 8 if-1-0-1.bb5.NewYork.Teleglobe.net (207.45.223.5) 137.403 ms 9 if-12-0-0.bb6.NewYork.Teleglobe.net (207.45.221.72) 135.850 ms 10 207.45.205.18 (207.45.205.18) 128.648 ms 11 210.56.31.94 (210.56.31.94) 762.150 ms 12 islamabad-gw2.comsats.net.pk (210.56.8.4) 751.851 ms 13 * 14 lhr.comsats.net.pk (210.56.16.10) 827.301 ms No response: Lost packet or router ignores

Pingroute • Pingroute = Ping + Traceroute • It runs traceroute, then ping each founded router n times • Pingroute helps identify the route where the problem starts to occur

Path characterization • Pathchar • sends multiple packets of varying sizes to each router along route • measures minimum response time • plot min RTT vs packet size to get bandwidth • calculate differences to get individual hop characteristics • measures for each hop: BW, queuing, delay/hop • can take a long time • Pipechar/abing • Also sends back-to-back packets and measures separation on return • Much faster • Finds bottleneck Bottleneck Min spacing At bottleneck Spacing preserved On higher speed links

Iperf Iperf measures the network throughput • Client generates & sends UDP or TCP packets • Server receives receives packets • Can select port, maximum window size, port , duration, Mbytes to send etc. • Client/server communicate packets seen etc. • Reports on throughput • Requires sever to be installed at remote site, i.e. friendly administrators or logon account and password

Iperf example 3 parallel streams Max window size TCP port 25cottrell@flora06:~>iperf -p 5008 -w 512K -P 3 -c sunstats.cern.ch ------------------------------------------------------------ Client connecting to sunstats.cern.ch, TCP port 5008 TCP window size: 512 KByte ------------------------------------------------------------ [ 6] local 134.79.16.101 port 57582 connected with 192.65.185.20 port 5008 [ 5] local 134.79.16.101 port 57581 connected with 192.65.185.20 port 5008 [ 4] local 134.79.16.101 port 57580 connected with 192.65.185.20 port 5008 [ ID] Interval Transfer Bandwidth [ 4] 0.0-10.3 sec 19.6 MBytes 15.3 Mbits/sec [ 5] 0.0-10.3 sec 19.6 MBytes 15.3 Mbits/sec [ 6] 0.0-10.3 sec 19.7 MBytes 15.3 Mbits/sec Total throughput =3*15.3Mbits/s = 45.9Mbits/s Remote host

Questions • OK the monitoring of the traffic but… how about the management of the network devices?

The fundamental of internet management • Internet Architecture Board (IAB) released RFC 1052 entitled "IAB Recommendations for the Development of Internet Network Management Standards" in April 1988. • This RFC explains that the network management must : • Be as large as possible. • Have the wider diversity of implementation as possible. • Have the wider diversity of administration/management as possible. • Cover as many protocol layer as possible.

The SNMP • The Simple Network Management Protocol (SNMP) is an application layer protocol that facilitates the exchange of management information between network devices. • SNMP is part of the Transmission Control Protocol/Internet Protocol (TCP/IP) suite. • Nowadays SNMP is not limited to TCP/IP devices • SNMP enables network administrators to manage network performance, find and solve network problems, and plan for network growth.

SNMP RFCs The following RFCs are the first documents dealing with SNMP published in 1988 : • RFC 1065 - Structure and Identification of Management Information for TCP/IP-based internets • RFC 1066 - Management Information Base for Network Management of TCP/IP-based internets • RFC 1067 - A Simple Network Management Protocol (SNMP)

SNMP nodes • An SNMP nodes is a device of an SNMP managed network. There are different types of SNMP nodes: • Managed nodes = Typically runs an agent process that services requests from a management node • Management nodes = Typically a workstation running some network management & monitoring software • Not manageablenodes = A node may not support SNMP, but may be manageable by SNMP through a proxy agent running on another machine Nodes can be both managed nodes and a management node at the same time

SNMP Components • SNMP agent is a software that runs on network nodes (host, router, printer, or others) and that maintains information in a database about its configuration and current state • Management Information Bases (MIBs) is the database of the managed information • An SNMP manager is an application program that contacts an SNMP agent to query or modify the database at the agent. • SNMP protocol is the application layer protocol used by SNMP agents and managers to send and receive data.

SNMP Components MIB MIB MIB

Optical Core Networks Management protocols