SNMP

Simple network management protocol (SNMP) provides the ability to monitor and communicate status information between a variety of hosts.

  • Before installing SNMP, see Checklist: Implementing the SNMP service.
  • To find features that have been moved in Windows 2000, see New ways to do familiar tasks.
  • For help with specific tasks, see How To...
  • For general background information, see Concepts.
  • For tips about using SNMP, see Best Practices.
  • For problem-solving instructions, see Troubleshooting.


Checklist: Implementing the SNMP service

Step | Reference
Obtain, install, and configure SNMP management software. | The SNMP service
Gather information required to implement SNMP on your network. Requirements include contact persons (administrator), physical computer location, configured SNMP community names, and IP or IPX addresses, or computer names of SNMP management systems on your network. | Using SNMP
Install SNMP on this computer. | To install the SNMP service
Configure SNMP agent properties. | To configure agent properties
If you have an additional TCP/IP service in your network, such as a bridge or router, you should consult RFC 1213 for additional configuration information before proceeding. | SNMP standards (RFCs)
Configure trap destinations. | To configure traps
Configure SNMP security properties. | To configure security


New ways to do familiar tasks

This table lists common tasks for simple network management protocol (SNMP). The user interface for performing these tasks is different in Windows 2000 than it was in Windows NT 4.0.

If you want to | In Windows NT 4.0 use | In Windows 2000 use
Install the SNMP service. | The SNMP Service option in Windows NT TCP/IP Installation Options. | Add/Remove Programs in Control Panel. For more information, see Install the SNMP service.
Configure SNMP agent. | Control Panel, Network, Services tab. | Services in the Computer Management console. For more information, see Configure agent properties.
Configure SNMP traps. | Control Panel, Network, Services tab. | Services in the Computer Management console. For more information, see Configure traps.
Configure SNMP security. | Control Panel, Network, Services tab. | Services in the Computer Management console. For more information, see Configure security.


Best practices

The Windows 2000 SNMP Service greatly simplifies network management. To take best advantage of this:

  • Try to organize SNMP communities by functional organization, following the Windows 2000 distributed security model.
  • Take advantage of SNMP security checking by configuring authentication traps on all SNMP agents.
  • If you will be monitoring service specific components, such as dynamic host configuration protocol (DHCP) or Windows Internet Name Service (WINS), verify that these services have been successfully installed and configured.


How to...

  • Install the SNMP service
  • Configure agent properties
  • Configure traps
  • Configure security
  • Start or stop the SNMP service
  • Configure event to trap translator


Install the SNMP service

To install the SNMP service

  1. Open the Windows Components wizard.
  2. In Components, click Management and Monitoring Tools (but do not select or clear its check box), and then click Details.
  3. Select Simple Network Management Protocol check box, and click OK.
  4. Click Next.

Notes

  • To open the Windows Components wizard, click Start, point to Settings, click Control Panel, double-click Add/Remove Programs, and then click Add/Remove Windows Components.
  • Certain Windows components require configuration before thay can be used. If you installed one or more of these components, but did not configure them, when you click Add/Remove Windows Components, a list of components that need to be configured is displayed. To start the Windows Components wizard, click Components.
  • You must be logged on as an administrator or a member of the Administrators group in order to complete this procedure. If your computer is connected to a network, network policy settings might also prevent you from completing this procedure.
  • SNMP starts automatically after installation.

Related Topics


Configure agent properties

To configure agent properties

  1. Open Computer Management.
  2. In the console tree, click Services.

    Where?

    • Services and Applications
    • Services
  3. In the details pane, click SNMP Service
  4. On the Action menu, click Properties.
  5. On the Agent tab, in Contact, type the name of the user or administrator for this computer.
  6. In Location, type the physical location of the computer or the contact.
  7. Under Service, select the appropriate check boxes for this computer, and then click OK.

    To view a description of a dialog box item, right-click the item, and then click What's This?

Notes

  • To open Computer Management, click Start, point to Settings, and click Control Panel. Double-click Administrative Tools and then double-click Computer Management.
  • If you change existing SNMP settings, your changes take effect immediately. If you are configuring SNMP for the first time, you must restart SNMP before these settings take effect.

Related Topics


Configure traps

To configure traps

  1. Open Computer Management.
  2. In the console tree, click Services.

    Where?

    • Services and Applications
    • Services
  3. In the details pane, click SNMP Service
  4. On the Action menu, click Properties.
  5. On the Traps tab, under Community name, type the case-sensitive community name to which this computer will send trap messages, and then click Add to list.
  6. In Trap destinations, click Add.
  7. In Host name, IP or IPX address, type information for the host, and click Add.
  8. Repeat steps 5 through 7 until you have added all the communities and trap destinations you want.

Notes

  • To open Computer Management, click Start, point to Settings, and click Control Panel. Double-click Administrative Tools and then double-click Computer Management.
  • If you change existing SNMP settings, your changes take effect immediately. The SNMP service does not need to be restarted for your settings to take effect.

Related Topics


Configure security

To configure security

  1. Open Computer Management.
  2. In the console tree, click Services.

    Where?

    • Services and Applications
    • Services
  3. In the details pane, click SNMP Service
  4. On the Action menu, click Properties.
  5. On the Security tab, select Send authentication trap if you want a trap message sent whenever authentication fails.
  6. Under Accepted community names, click Add.
  7. Under Community Rights, select a permission level for this host to process SNMP requests from the selected community.

    To view a description of a dialog box item, right-click the item, and then click What's This?

  8. In Community Name, type a case-sensitive community name, and then click Add.
  9. In SNMP Service Properties, specify whether or not to accept SNMP packets from a host:
    • To accept SNMP requests from any host on the network, regardless of identity, click Accept SNMP packets from any host.
    • To limit acceptance of SNMP packets, click Accept SNMP packets from these hosts, click Add, type the appropriate host name, IP or IPX address, and then click Add again.

Important

  • If you remove all the community names, including the default name Public, SNMP does not respond to any community names presented.

Notes

  • To open Computer Management, click Start, point to Settings, and click Control Panel. Double-click Administrative Tools, and then double-click Computer Management.
  • You can add additional community and host names as necessary.
  • You can make changes to an entry by clicking the entry, and then clicking Edit. You can delete a selected entry by clicking Remove.
  • If you change existing SNMP settings, your changes take effect immediately. The SNMP service does not need to be restarted for your settings to take effect.

Related Topics


Start or stop the SNMP service

To start or stop the SNMP service

  1. Open Computer Management.
  2. In the console tree, click Services.

    Where?

    • Services and Applications
    • Services
  3. In the details pane, click SNMP Service
  4. On the Action menu, click Start, Stop, or Restart.

Notes

  • To open Computer Management, click Start, point to Settings, and click Control Panel. Double-click Administrative Tools and then double-click Computer Management.
  • If you add new extensions to SNMP, you do not need to restart the SNMP service for your changes to take effect.

Related Topics


Configure event to trap translator

To configure event to trap translator

  1. Open Command Prompt.
  2. At the Command Prompt, type evntcmd /? for syntax and options for using the Evntcmd command prompt tool.

Note

  • To open Command Prompt, click Start, point to Programs, point to Accessories, and then click Command Prompt.

Related Topics


Concepts

This section covers:

  • SNMP Overview
  • Understanding SNMP
  • Using SNMP
  • Resources


SNMP overview

  • SNMP defined
  • The SNMP service


SNMP defined

The Simple Network Management Protocol (SNMP) is a network management standard widely used in TCP/IP networks and, more recently, in Internet Packet Exchange (IPX) networks.

SNMP Model

SNMP provides a method of managing network hosts such as workstation or server computers, routers, bridges, and hubs from a centrally-located computer running network management software. SNMP performs management services by using a distributed architecture of management systems and agents.

Because network management is critical for both auditing and resource management, SNMP can be used to:

  • Configure remote devices. Configuration information can be sent to each networked host from the management system.
  • Monitor network performance. You can track the speed of processing and network throughput, and collect information about the success of data transmissions.
  • Detect network faults or inappropriate access. You can configure trigger alarms on network devices when certain events occur. When an alarm is triggered, the device forwards an event message to the management system. Common types of alarms include a device being shut down and restarted, a link failure being detected on a router, and inappropriate access.
  • Audit network usage. You can monitor both overall network usage to identify user or group access, and types of usage for network devices and services. You can use this information to generate direct billing of accounts or to justify both current network costs and planned expenditures.


The SNMP service

The simple network management protocol (SNMP) service supports computers running TCP/IP and IPX protocols. It is an optional service that can be installed after the TCP/IP protocol has been successfully configured.

The SNMP service provides an SNMP agent that allows remote, centralized management of computers running:

  • Windows 2000 Server
  • Windows 2000 Professional
  • Windows 2000-based WINS
  • Windows 2000-based DHCP
  • Windows 2000-based Internet Information Services
  • LAN Manager

To access the information that the SNMP agent service provides, you need at least one SNMP management system software application. The SNMP Service supports but does not currently include SNMP management software. SNMP management software must be running on the host which acts as the management system. For more information about SNMP management software and applications, see the Windows 2000 Resource Kit.


Understanding SNMP

  • SNMP management systems and agents
  • How SNMP works
  • SNMP messages


SNMP management systems and agents

Using SNMP requires two components:

Management Systems and Agents
  • An SNMP management system.

    The management system, also called management console, sends information and update requests to an SNMP agent. Any computer running SNMP management software is an SNMP management system. The management software application does not need to run on the same host as the SNMP agent.

    The SNMP management system requests information from a managed computer, called an SNMP agent, such as the amount of hard disk space available or the number of active sessions. The management system can also initiate a change to an agent's configuration. However, this is rare because most clients have read-only access.

  • An SNMP agent.

    • The SNMP agent responds to management system requests for information. Any computer running SNMP agent software is an SNMP agent. The Windows 2000 SNMP Service, which is agent software, responds to information requests from one or multiple management systems. The SNMP Service can be configured to determine which statistics are tracked and which management systems are authorized to request information.

    In general, agents do not originate messages, but only respond to them. A trap message is the only agent-initiated SNMP communication. A trap is an alarm-triggering event on an agent, such as a system reboot or illegal access, which provides enhanced security.

    Management hosts and agents belong to an SNMP community, which is a collection of hosts grouped together for administrative purposes. Defining communities provides security by allowing only management systems and agents within the same community to communicate.


How SNMP works

Both agents and management systems use SNMP messages to inspect and communicate host information. SNMP messages are sent using the User Datagram Protocol (UDP). The Internet Protocol (IP) is used to route the messages between the management system and host.

The information that the management system requests is contained in a management information base (MIB). The MIB is a database that contains various types of information about a networked computer, such as the version of network software running on that computer and the available hard drive space.

The following example illustrates how an SNMP agent responds to a management system request for information:

The SNMP Model
  1. The management system (Host A), sends an SNMP datagram to the agent (Host B), using the agent's host name, IP address, or IPX address.
  2. The SNMP agent receives the datagram and verifies the community name to which the management system belongs. If it is a valid community name, the agent retrieves the data requested from the appropriate SNMP subagent. If the community name is incorrect, the agent sends an "authentication failure" trap to its trap destinations (Hosts C and D).
  3. The SNMP agent returns the datagram to the management system with the requested information.

For more information on SNMP message types or the MIB, see the Windows 2000 Resource Kit.


SNMP messages

When simple network management protocol (SNMP) management programs send requests to a network device, the agent software on that device receives the requests and retrieves information from MIBs. The agent then sends the requested information back to the initiating SNMP management program. To perform these tasks, the agent uses the following messages:

SNMP Message | Description
Get | The basic SNMP request message. Sent by an SNMP management system, it requests information about a single MIB entry on an SNMP agent. For example, the amount of free drive space.
Get-next | An extended type of request message that can be used to browse the entire tree of management objects. When processing a Get-next request for a particular object, the agent returns the identity and value of the object which logically follows the object from the request. The Get-next request is useful for dynamic tables, such as an internal IP route table.
Set | If write access is permitted, this message can be used to send and assign an updated MIB value to the agent.
Getbulk | Requests that the data transferred by the host agent be as large as possible within given restraints of message size. This minimizes the number of protocol exchanges required to retrieve a large amount of management information. The maximum message size should not be larger than the path maximum transmission unit (MTU), the largest frame size allowed for a single frame on your network, or fragmentation can occur.
Trap | An unsolicited message sent by an SNMP agent to an SNMP management system when the agent detects that a certain type of event has occurred locally on the managed host. The SNMP management console that receives a trap message is known as a trap destination. For example, a trap message might be sent on a system restart event.


Using SNMP

  • Defining communities
  • Agent properties
  • Trap properties
  • SNMP security properties
  • SNMP service properties


Defining communities

You can assign groups of hosts to simple network management protocol (SNMP) communities for limited security checking of agents and management systems or for administrative purposes. Communities are identified by community names that you assign. A host can belong to multiple communities at the same time, but an agent does not accept a request from a management system outside its list of acceptable community names.

Define communities logically to take advantage of the basic authentication service provided by SNMP. In the following example, there are two communities: Public and Public 2.

Communities
  • Agent 1 can send traps and other messages to Manager 2 because they are both members of the Public 2 community.
  • Agents 2-4 can send traps and messages to Manager 1 because they are all members, by default, of the Public 1 community.

Community names are managed by configuring SNMP security properties.

Note

  • There is no relationship between community names and domain or workgroup names. Community names represent a shared password for groups of network hosts, and should be selected and changed as you would change any password. Deciding which hosts belong to the same community is generally determined by physical proximity.


Agent properties

The simple network management protocol (SNMP) agent provides the related management system with information on activities that occur at the Internet Protocol (IP) network layer.

The SNMP service sends agent information in response to an SNMP request or in an SNMP trap message.

You can configure the following agent properties by using the Agent tab on the SNMP Service Properties dialog box:

Agent Service | Select if this computer:
Physical | Manages physical devices, such as a hard disk partition.
Applications | Uses any applications that send data using the TCP/IP protocol suite. This service should always be enabled.
Datalink and Subnet | Manages a bridge.
Internet | Is an IP gateway (router).
End-to-end | Is an IP host. This service should always be enabled.

You can also configure agent properties such as:

  • The name of the person to contact, such as the network administrator.

  • The location of the contact person.

For more information on how to configure SNMP agent properties, see To configure agent properties.


Trap properties

Simple network management protocol (SNMP) traps can be used for limited security checking. When configured for an agent, the SNMP service generates trap messages any time specific events occur. These messages are sent to a trap destination. For example, an agent can be configured to initiate an authentication trap if a request for information is sent by an unrecognized management system. Trap messages can also be generated for events such as host system startup or shutdown.

Trap destinations consist of the computer name or the IP or IPX address of the management system. The trap destination must be a network-enabled host that is running SNMP management software. Trap destinations can be configured by a user, but the events (such as a system reboot) that generate a trap message are internally defined by the SNMP agent.

You can configure trap destinations by using the Traps tab in SNMP Service Properties.

For more information on how to configure SNMP traps, see To configure traps.


SNMP security properties

Simple network management protocol (SNMP) provides security through the use of community names and authentication traps. You can restrict SNMP communications for the agent, allowing it to communicate with only a specific list of other SNMP management systems.

You can configure SNMP security in SNMP Service Properties on the Security tab.

The following options can be configured to enable SNMP security:

  • Accepted community names. The service requires at least one default community name. Public is the common community name that is universally accepted in all SNMP implementations. You can add multiple community names, and delete or change the default community name. The community names configured here are used in trap destinations. If an SNMP request is received from a community which is not on this list, it will generate an authentication trap.

    • Caution

    • If you remove all the community names including the default name Public, SNMP will not respond to any community names presented.
  • Rights. A permission level can be selected, determining how the SNMP agent processes requests from a selected community. For example, you can configure the permission level to block the SNMP agent from processing any requests from a specific community.
  • Accept SNMP packets from any host. In this context, the source host and list of acceptable hosts are the source SNMP management system and the list of acceptable management systems. No SNMP packets are rejected on the basis of the name or address of the source host or the list of acceptable hosts. This option is checked by default.
  • Accept SNMP packets from these hosts. In this context, the list of acceptable hosts means the acceptable SNMP management systems. When selected, only SNMP packets received from the hosts in this list are accepted. Otherwise, the SNMP message is rejected and an authentication trap sent. This selection provides greater security than using a community name, which might contain many hosts.
  • Send authentication trap. Authentication is the process of verifying that a host name or address is valid. When the SNMP agent receives a request that does not contain the correct community name or is not sent from a member of the acceptable host list, the agent sends an authentication trap message to one or more trap destinations (management systems), indicating the failure of authentication. This option is checked by default.

For more information on how to configure SNMP security, see To configure security.


SNMP service properties

You can use the General, Log On, and Recovery tabs in SNMP Service Properties to configure how the SNMP service starts, logs on to the system, and recovers from an abnormal program termination of the service or operating system.

For information on changing these properties, see Services.


Resources

  • The SNMP standard
  • SNMP standards (RFCs)
  • Updated technical information


The SNMP standard

To meet the challenges of designing an effective network management platform for heterogeneous TCP/IP-based networks, simple network management protocol (SNMP) was defined in 1988 and approved by the Internet Activities Board (IAB) as an Internet standard in 1990.

Windows 2000 implements SNMP versions 1 and 2C. These versions are based on industry standards that define how network management information is structured, stored, and communicated between agents and management systems for TCP/IP-based networks.

The SNMP standard includes the following RFC-compliant constructs:

  • The Management Information Base II (MIB II) as defined in RFC 1213 is a set of manageable objects representing various types of information about TCP/IP components in your network, such as the network interfaces list, routing table, and TCP connections table. The Windows 2000 SNMP service supports the Host Resources MIB (RFC 1514), LAN Manager MIB II, DHCP MIB, WINS MIB, and Internet Information Services MIB. Others might develop their own MIBs for use with the Windows 2000 SNMP service. For detailed information about MIB objects, see the Windows 2000 Resource Kit.
  • The Structure for Management Information (SMI) is a separate Internet RFC (RFC 1902) that describes the object syntax for specifying how MIB data is referenced and stored.
  • Simple Network Management Protocol (SNMP) as defined in RFC 1157 is a standard defining how communication occurs between SNMP-capable devices and which types of messages are allowed.


SNMP standards (RFCs)

Requests for Comments (RFCs) are an evolving series of reports, proposals for protocols, and protocol standards used by the Internet community. Simple Network Management Protocol (SNMP) specifications are defined in RFCs published by the Internet Engineering Task Force (IETF) and other working groups.

The following RFCs specify the core SNMP standards:

RFC | Description
1155 | Structure and Identification of Management Information for TCP/IP-based Internets
1157 | Simple Network Management Protocol
1213 | Management Information Base for Network Management of TCP/IP-based internets: MIB-II

For more information on RFCs or how to obtain them, see TCP/IP standards (RFCs).

Notes

  • To read the most current RFCs related to SNMP, see the Active IETF Working Groups Web site (http://www.ietf.org/html.charters/wg-dir.html#Operations_and_Management_Area)


Additional information from Product Support Services

Updated technical information

Microsoft Product Support Services provides additional information about SNMP. See Updated technical information.


Troubleshooting

Troubleshooting SNMP

What problem are you having?

My SNMP client is not functioning.

Cause: An unknown network or SNMP problem.

Solution: SNMP error handling is integrated with Event Viewer. Use Event Viewer if you suspect there is a problem with the SNMP service. You can configure a View filter to display only SNMP messages.

See also: Using Event Viewer.

My SNMP management system keeps timing out while querying the WINS server.

Cause: The SNMP time-out period is too short.

Solution: Increase the SNMP time-out period on the SNMP management system.

An Error 3 occurs when I reboot a computer configured with an IPX address as a trap destination.

Cause: This occurs when the IPX address has been entered incorrectly, using a comma or hyphen to separate a network number from a Media Access Control (MAC) address. For example, other SNMP management software might accept an address like: 00008022,0002C0-F7AABD. However, the Windows 2000 SNMP service does not recognize an address with a comma or hyphen between the network number and MAC address.

Solution: The address used for an IPX trap destination must follow the 8.12 format for the network number and MAC address. For example, this format is valid, where xxxxxxxx is the network number and yyyyyyyyyyyy is the MAC address:

xxxxxxxx.yyyyyyyyyyyy