Certopolis

CompTIA Network+ (V9)

SNMP v1, v2c and v3, traps vs informs, for Network+

SNMP is mostly polling: a manager queries agents on UDP 161, and agents send unsolicited notifications to the manager on UDP 162. A trap is never confirmed, so a lost trap is gone; an inform is answered with a Response, so the sender knows it arrived. SNMPv1 and v2c rely on a plain-text community string, while SNMPv3 adds per-user authentication and optional encryption.

Polling, ports and notifications

RFC 1157 describes SNMP's design: the monitoring center learns the network's state mainly by polling, and a limited number of unsolicited messages, called traps, guide the timing and focus of that polling.

An SNMP entity receives requests on UDP port 161. Messages that report traps should be received on UDP port 162. So the agent on a switch listens on 161, and the management station listens on 162.

RFC 1157 lists generic traps, including coldStart, linkDown, linkUp and authenticationFailure. linkDown means the agent sees a failure in one of the links in its configuration. authenticationFailure means it received a message that was not properly authenticated, such as one with the wrong community; RFC 3418 says the snmpEnableAuthenTraps object controls whether that trap is sent.

Trap or inform

RFC 3416 says there is no confirmation associated with the SNMPv2-Trap-PDU. The sender cannot tell whether a trap arrived, so it never resends one.

The InformRequest-PDU is a confirmed notification. The receiver replies with a Response-PDU carrying the same request-id. RFC 3416 still notes there is no guarantee of delivery, but the sender at least learns when an inform got through.

Example: a monitoring station sometimes misses link alerts from a switch, and a capture shows the switch never retransmits them. The switch is sending traps. Configuring informs lets it learn which notifications were acknowledged.

Community strings and SNMPv3 security levels

In SNMPv1 and SNMPv2c the only security parameter is the community string, sent in each message in plain text. RFC 1157 calls this a trivial authentication service. RFC 3584 says SNMPv1 and SNMPv2 do not provide any security and recommends SNMPv3 with its cryptographic mechanisms for authentication and privacy.

RFC 3411 defines three SNMPv3 security levels, from weakest to strongest: noAuthNoPriv (no authentication, no privacy), authNoPriv (authentication but no privacy) and authPriv (authentication and privacy).

Authentication proves a message came from the named user and was not altered. Privacy encrypts its contents. If you need to know each poll is genuine but do not care who reads the counters, authNoPriv is enough. A longer community string is still sent in clear text, so it does not fix the exposure.

Where the exam catches people

  • Believing the agent and the manager both listen on 161: agents receive requests on UDP 161, and traps are received on UDP 162.
  • Believing a trap is resent if it is lost: traps have no confirmation, so the sender never knows; use informs when delivery matters.
  • Believing a long SNMPv2c community string secures SNMP: the string travels in plain text, and RFC 3584 points to SNMPv3 instead.
  • Believing authNoPriv encrypts the data: it authenticates the message only; encryption needs authPriv.

Written from CompTIA's documentation

Try 3 questions on this

Pick an answer to see why each option is right or wrong.

  1. A team wants each SNMPv3 poll verified as unaltered and as coming from a known user, but sees no need to hide the counter values in transit. Which of the following security levels fits?

    Right. In the game that’s Renown for your Network Operations building.

    Not that one: D is right. In the game your Network Operations building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    Authentication is what verifies that a message is unaltered and came from the claimed user; privacy is encryption that hides its contents. Integrity and origin without confidentiality is authNoPriv.

    Written from www.rfc-editor.org/rfc/rfc3411.txt

  2. A monitoring station occasionally misses event notifications from a switch, and captures show the switch never resends them. Which of the following SNMP message types is the switch most likely sending?

    Right. In the game that’s Renown for your Network Operations building.

    Not that one: B is right. In the game your Network Operations building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    With no confirmation the switch has no way to know a trap was lost, so it never resends. An Inform, by contrast, is a confirmed notification answered with a Response.

    Written from www.rfc-editor.org/rfc/rfc3416.txt

  3. A company's switches accept SNMP requests from any station quoting the right community string, and a capture on the management segment shows that string in plain text. Which of the following changes removes the exposure?

    Right. In the game that’s Renown for your Network Operations building.

    Not that one: B is right. In the game your Network Operations building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    It recommends deploying SNMPv3 with 'full support for the SNMPv3 cryptographic mechanisms (for authentication and privacy)'. Only the move to SNMPv3 replaces the plaintext shared string with keyed, per-user authentication.

    Written from www.rfc-editor.org/rfc/rfc3584.txt