Introduction to Network Administration - Module 37

                                                    Module Overview    

  

37.1 Workstations and Servers   

37.1.1 Workstations 

37.1.2 Servers 

37.1.3 Client-server relationship 

37.1.4 Introduction to NOS 

37.1.5 Microsoft NT, 2000, and .NET 

37.1.6 UNIX, Sun, HP, and LINUX 

37.1.7 Apple 

37.1.8 Concept of service on servers 

37.2 Network Management   

37.2.1 Introduction to network management 

37.2.2 OSI and network management model 

37.2.3 SNMP and CMIP standards 

37.2.4 SNMP operation 

37.2.5 Structure of management information and MIBs 

37.2.6 SNMP protocol 

37.2.7 Configuring SNMP 

37.2.8 RMON 

37.2.9 Syslog

Case Study: WANs

  Overview

 

 

The first PCs were designed as standalone desktop systems. The operating system (OS) software allowed one user at a time to access files and system resources. The user had physical access to the PC. As PC-based computer networks gained popularity in the workplace, software companies developed specialized network operating systems (NOS). Developers designed NOS to provide file security, user privileges, and resource sharing among multiple users. The explosive growth of the Internet compelled developers to build the NOS of today around Internet-related technologies and services like the World Wide Web (WWW).

Network connectivity is now essential to the desktop computing. The distinction between modern desktop operating systems, now loaded with networking features and services, and their NOS counterparts has blurred. Now, most popular operating systems, such as Microsoft Windows 2000 and Linux, are found on high-powered network servers and on the desktops of end users.

Knowledge of different operating systems will ensure that the correct operating system is selected to offer all  the necessary services. UNIX, Linux, Mac OS X, and several Windows operating systems will be introduced.

Effective management of LANs and WANs is the key element to maintaining a productive environment in the networking world. As more services become available to more users, the performance of networks suffer. Network administrators, through constant monitoring, must recognize and be able to rectify problems before they become noticeable to the end users.

Various tools and protocols are available to monitor the network on a local and remote basis. A comprehensive understanding of these tools is critical to effective network management.

Students completing this module should be able to:

• Identify several potential tasks performed by a workstation
• Identify several potential functions of a server
• Describe the roles of equipment in a client/server environment
• Describe the differences between a NOS and a desktop operating system
• List several Windows operating systems and their features
• List several alternatives to the Windows operating systems and their features
• Identify network management tools
• Identify the driving forces behind network management
• Describe the OSI and network management model
• Describe simple network management protocol (SNMP) and common management information protocol (CMIP)
• Describe how management software gathers information and records problems 

  37.1  Workstations and Servers  

  37.1.1  Workstations  

 

A workstation is a client computer that is used to run applications and is connected to a server from which it obtains data shared with other computers. A server is a computer that runs a NOS. A workstation uses special software, such as a network shell program to perform the following tasks:

• Intercepts user data and application commands
• Decides if the command is for the local operating system or for the NOS.
• Directs the command to the local operating system or to the network interface card (NIC) for processing and transmission onto the network
• Delivers transmissions from the network to the application running on the workstation

Some Windows operating systems may be installed on workstations and servers. The NT/2000/XP versions of Windows software provide network server capability. Windows 9x and ME versions only provide workstation support.

UNIX or Linux can serve as a desktop operating system but are usually found on high-end computers. These workstations are employed in engineering and scientific applications, which require dedicated high-performance computers. Some of the specific applications that are frequently run on UNIX workstations are included in the following list:

• Computer-aided design (CAD)
• Electronic circuit design
• Weather data analysis
• Computer graphics animation
• Telecommunications equipment management

Most current desktop operating systems include networking capabilities and support multi-user access. For this reason, it is becoming more common to classify computers and operating systems based on the types of applications the computer runs. This classification is based on the role or function that the computer plays, such as workstation or server. Typical desktop or low-end workstation applications might include word processing, spreadsheets, and financial management. On high-end workstations,  the applications might include graphical design or equipment management and others as listed above.

A diskless workstation is a special class of computer designed to run on a network. As the name implies, it has no disk drives but does have a monitor, keyboard, memory, booting instructions in ROM, and a network interface card. The software that is used to establish a network connection is loaded from the bootable ROM chip located on the NIC.

Because a diskless workstation does not have any disk drives, it is not possible to upload data from the workstation or download anything to it. A diskless workstation cannot pass a virus onto the network, nor can it be used to take data from the network by copying this information to a disk drive. As a result, diskless workstations offer greater security than ordinary workstations. For this reason, such workstations are used in networks where security is paramount.

Laptops can also serve as workstations on a LAN and can be connected through a docking station, external LAN adapter, or a Personal Computer Memory Card International Association (PCMCIA) card. A docking station is an add-on device that turns a laptop into a desktop.

  37.1  Workstations and Servers  

  37.1.2  Servers 

  

In a network operating system environment, many client systems access and share the resources of one or more servers.  Desktop client systems are equipped with their own memory and peripheral devices, such as a keyboard, monitor, and a disk drive. Server systems must be equipped to support multiple concurrent users and multiple tasks as clients make demands on the server for remote resources.

NOSs have additional network management tools and features that are designed to support access by large numbers of simultaneous users. On all but the smallest networks, NOSs are installed on powerful servers. Many users, known as clients, share these servers. Servers usually have high-capacity, high-speed disk drives, large amounts of RAM, high-speed NICs, and in some cases, multiple CPUs. These servers are typically configured to use the Internet family of protocols, TCP/IP, and offer one or more TCP/IP services.

Servers running NOSs are also used to authenticate users and provide access to shared resources. These servers are designed to handle requests from many clients simultaneously. Before a client can access the server resources, the client must be identified and be authorized to use the resource. Identification and authorization is achieved by assigning each client an account name and password. The account name and password are then verified by an authentication service to permit or deny access to the network. By centralizing user accounts, security, and access control, server-based networks simplify the work of network administration.

Servers are typically larger systems than workstations and have additional memory to support multiple tasks that are active or resident in memory at the same time. Additional disk space is also required on servers to hold shared files and to function as an extension to the internal memory on the system. Also, servers typically require extra expansion slots on their system boards to connect shared devices, such as printers and multiple network interfaces.

Another feature of systems capable of acting as servers is the processing power. Ordinarily, computers have a single CPU, which executes the instructions that make up a given task or process. In order to work efficiently and deliver fast responses to client requests, a NOS server requires a powerful CPU to execute its tasks or programs. Single processor systems with one CPU can meet the needs of most servers if the CPU has the necessary speed. To achieve higher execution speeds, some systems are equipped with more than one processor. Such systems are called multiprocessor systems. Multiprocessor systems are capable of executing multiple tasks in parallel by assigning each task to a different processor. The aggregate amount of work that the server can perform in a given time is greatly enhanced in multiprocessor systems.

Since servers function as central repositories of resources that are vital to the operation of client systems, these servers must be efficient and robust. The term robust indicates that the server systems are able to function effectively under heavy loads. It also means the systems are able to survive the failure of one or more processes or components without experiencing a general system failure. This objective is met by building redundancy into server systems. Redundancy is the inclusion of additional hardware components that can take over if other components fail. Redundancy is a feature of fault tolerant systems that are designed to survive failures and can be repaired without interruption while the systems are up and running. Because a NOS depends on the continuous operation of its server, the extra hardware components justify the additional expense.

Server applications and functions include web services using Hypertext Transfer Protocol (HTTP), File Transfer Protocol (FTP), and Domain Name System (DNS). Standard e-mail protocols supported by network servers include Simple Mail Transfer Protocol (SMTP), Post Office Protocol 3 (POP3), and Internet Messaging Access Protocol (IMAP). File sharing protocols include Sun Microsystems Network File System (NFS) and Microsoft Server Message Block (SMB).

Network servers frequently provide print services. A server may also provide Dynamic Host Configuration Protocol (DHCP), which automatically allocates IP addresses to client workstations. In addition to running services for the clients on the network, servers can be set to act as a basic firewall for the network. This is accomplished using proxy or Network Address Translation (NAT), both of which hide internal private network addresses from the Internet.

One server running a NOS may work well when serving only a handful of clients. But most organizations must deploy several servers in order to achieve acceptable performance. A typical design separates services so one server is responsible for e-mail, another server is responsible for file sharing, and another is responsible for FTP.

The concentration of network resources, such as files, printers, and applications on servers, also makes the data generated easier to back up and maintain. Rather than have these resources distributed on individual machines, network resources can be located on specialized, dedicated servers for easy access and back up.

  37.1  Workstations and Servers  

  37.1.3  Client-server relationship   

 

The client-server computing model distributes processing over multiple computers. Distributed processing enables access to remote systems for the purpose of sharing information and network resources. In a client-server environment, the client and server share or distribute processing responsibilities. Most network operating systems are designed around the client-server model to provide network services to users. A computer on a network can be referred to as a host, workstation, client, or server. A computer running TCP/IP, whether it is a workstation or a server, is considered a host computer.

Definitions of other commonly used terms are:

• Local host - The machine on which the user currently is working.
• Remote host - A system that is being accessed by a user from another system.
• Server - Provides resources to one or more clients by means of a network.
• Client - A machine that uses the services from one or more servers on a network.

An example of a client-server relationship is a FTP session. FTP is a universal method of transferring a file from one computer to another.  For the client to transfer a file to or from the server, the server must be running the FTP daemon or service. In this case, the client requests the file to be transferred. The server provides the services necessary to receive or send the file.

The Internet is also a good example of a distributed processing client-server computing relationship. The client or front end typically handles user presentation functions, such as screen formatting, input forms, and data editing. This is done with a browser, such as Netscape or Internet Explorer. Web browsers send requests to web servers. When the browser requests data from the server, the server responds, and the browser program receives a reply from the web server. The browser then displays the HTTP data that was received. The server or back end handles the client's requests for Web pages and provides HTTP or WWW services.

Another example of a client-server relationship is a database server and a data entry or query client in a LAN. The client or front end might be running an application written in the C or Java language, and the server or back end could be running Oracle or other database management software. In this case, the client would handle formatting and presentation tasks for the user. The server would provide database storage and data retrieval services for the user.

In a typical file server environment, the client might have to retrieve large portions of the database files to process the files locally. This retrieval of the database files can cause excess network traffic. With the client-server model, the client presents a request to the server, and the server database engine might process 100,000 records and pass only a few back to the client to satisfy the request. Servers are typically much more powerful than client computers and are better suited to processing large amounts of data. With client-server computing, the large database is stored, and the processing takes place on the server. The client has to deal only with creating the query. A relatively small amount of data or results might be passed across the network. This satisfies the client query and results in less usage of network bandwidth. The graphic shows an example of client-server computing. Note that the workstation and server normally would be connected to the LAN by a hub or switch.

The distribution of functions in client-server networks brings substantial advantages, but also incurs some costs. Although the aggregation of resources on server systems brings greater security, simpler access, and coordinated control, the server introduces a single point of failure into the network. Without an operational server, the network cannot function at all. Additionally, servers require trained, expert staff to administer and maintain them, which increases the expense of running the network. Server systems require additional hardware and specialized software that adds substantially to the cost.

  37.1  Workstations and Servers  

  37.1.4  Introduction to NOS  

 

A computer OS is the software foundation on which computer applications and services run on a workstation. Similarly, a NOS enables communication between multiple devices and the sharing of resources across a network. A NOS operates on UNIX, Microsoft Windows NT, or Windows 2000 network servers.

Common functions of an OS on a workstation include controlling the computer hardware, executing programs and providing a user interface. The OS performs these functions for a single user. Multiple users can share the machine but they cannot log on at the same time. In contrast, a NOS distributes functions over a number of networked computers. A NOS depends on the services of the native OS in each individual computer. The NOS then adds functions that allow access to shared resources by a number of users concurrently.

Workstations function as clients in a NOS environment. When a workstation becomes a client in a NOS environment, additional specialized software enables the local user to access non-local or remote resources, as if these resources were a part of the local system. The NOS enhances the reach of the client workstation by making remote services available as extensions of the local operating system.

A system capable of operating as a NOS server must be able to support multiple users concurrently. The network administrator creates an account for each user, allowing the user to logon and connect to the server system. The user account on the server enables the server to authenticate that user and allocate the resources that the user is allowed to access. Systems that provide this capability are called multi-user systems.

A NOS server is a multitasking system, capable of executing multiple tasks or processes at the same time. The NOS scheduling software allocates internal processor time, memory, and other elements of the system to different tasks in a way that allows them to share the system resources. Each user on the multi-user system is supported by a separate task or process internally on the server. These internal tasks are created dynamically as users connect to the system and are deleted when users disconnect.

The main features to consider when selecting a NOS are performance, management and monitoring tools, security, scalability, and robustness or fault tolerance. The following section briefly defines each of these features.

Performance

A NOS must perform well at reading and writing files across the network between clients and servers. It must be able to maintain fast performance under heavy loads, when many clients are making requests. Consistent performance under heavy demand is an important standard for a NOS.

Management and monitoring

The management interface on the NOS server provides the tools for server monitoring, client administration, file, print, and disk storage management. The management interface provides tools for the installation of new services and the configuration of those services. Additionally, servers require regular monitoring and adjustment.

Security

A NOS must protect the shared resources under its control. Security includes authenticating user access to services to prevent unauthorized access to the network resources. Security also performs encryption to protect information as it travels between clients and servers.

Scalability

Scalability is the ability of a NOS to grow without degradation in performance. The NOS must be capable of sustaining performance as new users join the network and new servers are added to support them.

Robustness/fault tolerance

A measure of robustness is the ability to deliver services consistently under heavy load and to sustain its services if components or processes fail. Using redundant disk devices and balancing the workload across multiple servers can improve NOS robustness.

   37.1  Workstations and Servers 

   37.1.5  Microsoft NT, 2000, and .NET 

  

Since the release of Windows 1.0 in November 1985, Microsoft has produced many versions of Windows operating systems with improvements and changes to support a variety of users and purposes. Figure  summarizes the current Windows OS.

NT 4 was designed to provide an environment for mission critical business that would be more stable than the Microsoft consumer operating systems. It is available for both desktop (NT 4.0 Workstation) and server (NT 4.0 Server). An advantage of NT over previous Microsoft OSs is that DOS and older Windows programs can be executed in virtual machines (VMs). Program failures are isolated and do not require a system restart. 

Windows NT provides a domain structure to control user and client access to server resources. It is administered through the User Manager for Domains application on the domain controller. Each NT domain requires a single primary domain controller which holds the Security Accounts Management Database (SAM) and may have one or more backup domain controllers, each of which contains a read-only copy of the SAM. When a user attempts to logon, the account information is sent to the SAM database. If the information for that account is stored in the database, the user will be authenticated to the domain and have access to the workstation and network resources.

Based on the NT kernel, the more recent Windows 2000 has both desktop and server versions. Windows 2000 supports “plug-and-play” technology, permitting installation of new devices without the need to restart the system. Windows 2000 also includes a file encryption system for securing data on the hard disk.

Windows 2000 enables objects, such as users and resources, to be placed into container objects called organizational units (OUs). Administrative authority over each OU can be delegated to a user or group. This feature allows more specific control than is possible with Windows NT 4.0.

Windows 2000 Professional is not designed to be a full NOS. It does not provide a domain controller, DNS server, DHCP server, or render any of the services that can be deployed with Windows 2000 Server. The primary purpose of Windows 2000 Professional is to be part of a domain as a client-side operating system. The type of hardware that can be installed on the system is limited. Windows 2000 Professional can provide limited server capabilities for small networks and peer-to-peer networks. It can be a file server, a print server, an FTP server, and a web server, but will only support up to ten simultaneous connections.

Windows 2000 Server adds to the features of Windows 2000 Professional many new server-specific functions. It can also operate as a file, print, web and application server. The Active Directory Services feature of Windows 2000 Server serves as the centralized point of management of users, groups, security services, and network resources. It includes the multipurpose capabilities required for workgroups and branch offices as well as for departmental deployments of file and print servers, application servers, web servers, and communication servers.

Windows 2000 Server is intended for use in small-to-medium sized enterprise environments. It provides integrated connectivity with Novell NetWare, UNIX, and AppleTalk systems. It can also be configured as a communications server to provide dialup networking services for mobile users. Windows 2000 Advanced Server provides the additional hardware and software support needed for enterprise and extremely large networks.

Microsoft has developed Windows .NET server with the ability to provide a secure and reliable system to run enterprise-level web and FTP sites to compete with the Linux, UNIX and Novell’s One NET. The Windows .NET Server provides XML Web Services to companies which run medium to high volume web traffic.

 

  37.1  Workstations and Servers 

  37.1.6  UNIX, Sun, HP, and LINUX 

  

 Origins of UNIX

UNIX is the name of a group of operating systems that trace their origins back to 1969 at Bell Labs. Since its inception, UNIX was designed to support multiple users and multitasking. UNIX was also one of the first operating systems to include support for Internet networking protocols. The history of UNIX, which now spans over 30 years, is complicated because many companies and organizations have contributed to its development.

UNIX was first written in assembly language, a primitive set of instructions that control the internal instructions of a computer. However, UNIX could only run on a specific type of computer. In 1971, Dennis Ritchie created the C language. In 1973, Ritchie along with fellow Bell Labs programmer Ken Thompson rewrote the UNIX system programs in C language. Because C is a higher-level language, UNIX could be moved or ported to another computer with far less programming effort. The decision to develop this portable operating system proved to be the key to the success of UNIX. During the 1970s, UNIX evolved through the development work of programmers at Bell Labs and several universities, notably the University of California, at Berkeley.  -

When UNIX first started to be marketed commercially in the 1980s, it was used to run powerful network servers, not desktop computers. Today, there are dozens of different versions of UNIX, including the following:

• Hewlett Packard UNIX (HP-UX)
• Berkeley Software Design, Inc. (BSD UNIX), which has produced derivatives such as FreeBSD
• Santa Cruz Operation (SCO) UNIX
• Sun Solaris
• IBM UNIX (AIX)

UNIX, in its various forms, continues to advance its position as the reliable, secure OS of choice for mission-critical applications that are crucial to the operation of a business or other organization. UNIX is also tightly integrated with TCP/IP. TCP/IP basically grew out of UNIX because of the need for LAN and WAN communications.

The Sun Microsystems Solaris Operating Environment and its core OS, SunOS, is a high-performance, versatile, 64-bit implementation of UNIX. Solaris runs on a wide variety of computers, from Intel-based personal computers to powerful mainframes and supercomputers. Solaris is currently the most widely used version of UNIX in the world for large networks and Internet websites. Sun is also the developer of the "Write Once, Run Anywhere" Java technology.

Despite the popularity of Microsoft Windows on corporate LANs, much of the Internet runs on powerful UNIX systems. Although UNIX is usually associated with expensive hardware and is not user friendly, recent developments, including the creation of Linux, have changed that image.

Origins of Linux

In 1991, a Finnish student named Linus Torvalds began work on an operating system for an Intel 80386-based computer. Torvalds became frustrated with the state of desktop operating systems, such as DOS, and the expense and licensing issues associated with commercial UNIX. Torvalds set out to develop an operating system that was UNIX-like in its operation but used software code that was open and completely free of charge to all users.

Torvald's work led to a worldwide collaborative effort to develop Linux, an open source operating system that looks and feels like UNIX. By the late 1990s, Linux had become a viable alternative to UNIX on servers and Windows on the desktop. The popularity of Linux on desktop PCs has also contributed to interest in using UNIX distributions, such as FreeBSD and Sun Solaris on the desktop. Versions of Linux can now run on almost any 32-bit processor, including the Intel 80386, Motorola 68000, Alpha, and PowerPC chips.

As with UNIX, there are numerous versions of Linux. Some are free downloads from the web, and others are commercially distributed. The following are a few of the most popular versions of Linux:

• Red Hat Linux – distributed by Red Hat Software
• OpenLinux – distributed by Caldera
• Corel Linux
• Slackware
• Debian GNU/Linux
• SuSE Linux

Linux is one of the most powerful and reliable operating systems in the world today. Because of this, Linux has already made inroads as a platform for power users and in the enterprise server arena. Linux is less often deployed as a corporate desktop operating system. Although graphical user interfaces (GUIs) are available to make Linux user-friendly, most beginning users find Linux more difficult to use than Mac OS or Windows. Currently, many companies, such as Red Hat, SuSE, Corel, and Caldera, are striving to make Linux a viable operating system for the desktop.  -

Application support must be considered when Linux is implemented on a desktop system. The number of business productivity applications is limited when compared to Windows. However, some vendors provide Windows emulation software, such as WABI and WINE, which enables many Windows applications to run on Linux. Additionally, companies such as Corel are making Linux versions of their office suites and other popular software packages.

Networking with Linux

Recent distributions of Linux have networking components built in for connecting to a LAN, establishing a dialup connection to the Internet, or other remote network. In fact, TCP/IP is integrated into the Linux kernel instead of being implemented as a separate subsystem.

Some advantages of Linux as a desktop operating system and network client include the following:

• It is a true 32-bit operating system.
• It supports preemptive multitasking and virtual memory.
• The code is open source and thus available for anyone to enhance and improve.
•  

  6.1  Workstations and Servers 

  6.1.7  Apple   

 

Apple Macintosh computers were designed for easy networking in a peer-to-peer, workgroup situation. Network interfaces are included as part of the hardware and networking components are built into the Macintosh operating system. Ethernet and Token Ring network adapters are available for the Macintosh.

The Macintosh, or Mac, is popular in many educational institutions and corporate graphics departments. Macs can be connected to one another in workgroups and can access AppleShare file servers. Macs can also be connected to PC LANs that include Microsoft, NetWare, or UNIX servers.

Mac OS X (10)

The Macintosh operating system, Mac OS X, is sometimes referred to as Apple System 10.

Some of the features of Mac OS X are in the GUI called Aqua. The Aqua GUI resembles a cross between Microsoft Windows XP and Linux X-windows GUI. Mac OS X is designed to provide features for the home computer, such as Internet browsing, video and photo editing, and games, while still providing features that offer powerful and customizable tools that IT professionals need in an operating system.

The Mac OS X is fully compatible with older versions of the Mac operating systems. Mac OS X provides a new feature that allows for AppleTalk and Windows connectivity. The Mac OS X core operating system is called Darwin. Darwin is a UNIX-based, powerful system that provides stability and performance. These enhancements provide Mac OS X with support for protected memory, preemptive multitasking, advanced memory management, and symmetric multiprocessing. This makes Mac OS X a formidable competitor amongst operating systems.

  37.1  Workstations and Servers 

  37.1.8  Concept of service on servers 

NOSs are designed to provide network processes to clients. Network services include the WWW, file sharing, mail exchange, directory services, remote management, and print services. Remote management is a powerful service that allows administrators to configure networked systems that are miles apart. It is important to understand that these network processes are referred to as services in Windows 2000 and daemons in UNIX and Linux. Network processes all provide the same functions, but the way processes are loaded and interact with the NOS are different in each operating system.

Depending on the NOS, some of these key network processes may be enabled during a default installation. Most popular network processes rely on the TCP/IP suite of protocols. Because TCP/IP is an open, well-known set of protocols, TCP/IP-based services are vulnerable to unauthorized scans and malicious attacks. Denial of service (DoS) attacks, computer viruses, and fast-spreading Internet worms have forced NOS designers to reconsider which network services are started automatically.

Recent versions of popular NOSs, such as Windows and Red Hat Linux, restrict the number of network services that are on by default. When deploying a NOS, key network services will need to be enabled manually.

When a user decides to print in a networked printing environment, the job is sent to the appropriate queue for the selected printer. Print queues stack the incoming print jobs and services them using a first-in, first-out (FIFO) order. When a job is added to the queue, it is placed at the end of the waiting list and printed last. The printing wait time can sometimes be long, depending on the size of the print jobs at the head of the queue. A network print service will provide system administrators with the necessary tools to manage the large number of print jobs being routed throughout the network. This includes the ability to prioritize, pause, and even delete print jobs that are waiting to be printed.

File sharing

The ability to share files over a network is an important network service. There are many file sharing protocols and applications in use today. Within a corporate or home network, files are typically shared using Windows File Sharing or the NFS protocol. In such environments, an end user may not even know if a given file is on a local hard disk or on a remote server. Windows File Sharing and NFS allow users to easily move, create, and delete files in remote directories.

FTP

Many organizations make files available to remote employees, to customers, and to the general public using FTP. FTP services are made available to the public in conjunction with web services. For example, a user may browse a website, read about a software update on a web page, and then download the update using FTP. Smaller companies may use a single server to provide FTP and HTTP services, while larger companies may choose to use dedicated FTP servers.

Although FTP clients must logon, many FTP servers are configured to allow anonymous access. When users access a server anonymously, they do not need to have a user account on the system. The FTP protocol also allows users to upload, rename, and delete files, so administrators must be careful to configure an FTP server to control levels of access.

FTP is a session-oriented protocol. Clients must open an application layer session with the server, authenticate, and then perform an action, such as download or upload. If the client session is inactive for a certain length of time, the server disconnects the client. This inactive length of time is called an idle timeout. The length of an FTP idle timeout varies depending on the software.

Web services

The World Wide Web is now the most visible network service. In less than a decade, the World Wide Web has become a global network of information, commerce, education, and entertainment. Millions of companies, organizations, and individuals maintain websites on the Internet. Websites are collections of web pages stored on a server or group of servers.

The World Wide Web is based on a client/server model. Clients attempt to establish TCP sessions with web servers. Once a session is established, a client can request data from the server. HTTP typically governs client requests and server transfers. Web client software includes GUI web browsers, such as Netscape Navigator and Internet Explorer.

Web pages are hosted on computers running web service software. The two most common web server software packages are Microsoft Internet Information Services (IIS) and Apache Web Server. Microsoft IIS runs on a Windows platform and Apache Web Server runs on UNIX and Linux platforms. A Web service software package is available for virtually all operating systems currently in production.

DNS

The DNS protocol translates an Internet name, such as www.cisco.com, into an IP address. Many applications rely on the directory services provided by DNS to do this work. Web browsers, e-mail programs, and file transfer programs all use the names of remote systems. The DNS protocol allows these clients to make requests to DNS servers in the network for the translation of names to IP addresses. Applications can then use the addresses to send their messages. Without this directory lookup service, the Internet would be almost impossible to use.

DHCP

The purpose of DHCP is to enable individual computers on an IP network to learn their TCP/IP configurations from the DHCP server or servers. DHCP servers have no information about the individual computers until information is requested. The overall purpose of this is to reduce the work necessary to administer a large IP network. The most significant piece of information distributed in this manner is the IP address that identifies the host on the network. DHCP also allows for recovery and the ability to automatically renew network IP addresses through a leasing mechanism. This mechanism allocates an IP address for a specific time period, releases it, and then assigns a new IP address. DHCP allows all this to be done by a DHCP server which saves the system administrator considerable amount of time.

  37.2  Network Management 

  37.2.1  Introduction to network management 

 

As a network evolves and grows, it becomes a more critical and indispensable resource to the organization.  As more network resources are available to users, the network becomes more complex, and maintaining the network becomes more complicated. Loss of network resources and poor performance are results of increased complexity and are not acceptable to the users.  The network administrator must actively manage the network, diagnose problems, prevent situations from occurring, and provide the best performance of the network for the users. At some point, networks become too large to manage without automated network management tools.

Network Management includes the following duties:

• Monitoring network availability
• Improving automation
• Monitoring response time
• Providing security features
• Rerouting traffic
• Restoring capabilities
• Registering users

The driving forces behind network management are shown in Figure  and explained below:

• Controlling corporate assets – If network resources are not effectively controlled, they will not provide the results that management requires.
• Controlling complexity – With massive growth in the number of network components, users, interfaces, protocols, and vendors, loss of control of the network and its resources threatens management.
• Improved service – Users expect the same or improved service as the network grows and the resources become more distributed.
• Balancing various needs – Users must be provided with various applications at a given level of support, with specific requirements in the areas of performance, availability, and security.
• Reducing downtime – Ensure high availability of resources by proper redundant design.
• Controlling costs – Monitor and control resource utilization so that user needs can be satisfied at a reasonable cost.  

Some basic network management terms are introduced in Figure .

  37.2  Network Management 

  37.2.2  OSI and network management model 

  

The International Standards Organization (ISO) created a committee to produce a model for network management, under the direction of the OSI group.

This model has four parts:

• Organization
• Information
• Communication
• Functional

This is a view of network management from the top-down, divided into four submodels and recognized by the OSI standard.

The Organization model  describes the components of network management such as a manager, agent, and so on, and their relationships. The arrangement of these components leads to different types of architecture, which will be discussed later.

The Information model is concerned with structure and storage of network management information.  This information is stored in a database, called a management information base (MIB). The ISO defined the structure of management information (SMI) to define the syntax and semantics of management information stored in the MIB. MIBs and SMI will be covered in more depth later.

The Communication model deals with how the management data is communicated between the agent and manager process.  It is concerned with the transport protocol, the application protocol, and commands and responses between peers.

The Functional model addresses the network management applications that reside upon the network management station (NMS).  The OSI network management model categorizes five areas of function, sometimes referred to as the FCAPS model:

• Fault
• Configuration
• Accounting
• Performance
• Security

This network management model has gained broad acceptance by vendors as a useful way of describing the requirements for any network management system.

  37.2  Network Management 

  37.2.3  SNMP and CMIP standards 

To allow for interoperability of management across many different network platforms, network management standards are required so that vendors can implement and adhere to these standards. Two main standards have emerged:

• Simple Network Management Protocol – IETF community
• Common Management Information Protocol – Telecommunications community

SNMP actually refers to a set of standards for network management, including a protocol, a database structure specification, and a set of data objects. SNMP was adopted as the standard for TCP/IP internets in 1989 and became very popular. An upgrade, known as SNMP version 2c (SNMPv2c) was adopted in 1993. SNMPv2c provides support for centralized and distributed network management strategies, and included improvements in the structure of management information (SMI), protocol operations, management architecture, and security. This was designed to run on OSI based networks as well as TCP/IP based networks. Since then SNMPv3 has been released. To solve the security shortcomings of SNMPv1 and SNMPv2c, SNMPv3 provides secure access to MIBs by authenticating and encrypting packets over the network. The CMIP is an OSI network management protocol that was created and standardized by the ISO for the monitoring and control of heterogeneous networks.

  37.2  Network Management 

  37.2.4  SNMP operation 

 

SNMP is an application layer protocol designed to facilitate the exchange of management information between network devices. By using SNMP to access management information data, such as packets per second sent on an interface or number of open TCP connections, network administrators can more easily manage network performance to find and solve network problems.

Today, SNMP is the most popular protocol for managing diverse commercial, university, and research internetworks.

Standardization activity continues even as vendors develop and release state-of-the-art SNMP-based management applications. SNMP is a simple protocol, yet its feature set is sufficiently powerful to handle the difficult problems involved with the management of heterogeneous networks.

The organizational model for SNMP based network management includes four elements:

• Management station
• Management agent
• Management information base
• Network management protocol

The NMS is usually a standalone workstation, but it may be implemented over several systems. It includes a collection of software called the network management application (NMA). The NMA includes a user interface to allow authorized network managers to manage the network. It responds to user commands issued throughout the network. The management agents are network-management software modules that reside in key network devices, such as other hosts, routers, bridges and hubs. They respond to requests for information and requests for actions from the NMS, such as polling, and may provide the NMS with important but unsolicited information, such as traps. All the management information of a particular agent is stored in the management information base on that agent. An agent might keep track of the following:

• Number and state of its virtual circuits
• Number of certain kinds of error messages received
• Number of bytes and packets in and out of the device
• Maximum output queue length, for routers and other internetworking devices
• Broadcast messages sent and received
• Network interfaces going down and coming up

The NMS performs a monitoring function by retrieving the values from the MIB. The NMS can cause an action to take place at an agent. The communication between the manager and the agent is carried out by an application layer network management protocol. SNMP uses User Datagram Protocol (UDP) and communicates over ports 161 and 162. It is based on an exchange of messages. There are three common message types:

• Get - Enables the management station to retrieve the value of MIB objects from the agent.
• Set - Enables the management station to set the value of MIB objects at the agent.
• Trap - Enables the agent to notify the management station of significant events.

This model is referred to as a two-tier model.  However, it assumes that all network elements are manageable by SNMP. This is not always the case, as some devices have a proprietary management interface. In these cases, a three-tiered model is required.  A network manager who wants to obtain information or control this proprietary node communicates with a proxy agent. The proxy agent then translates the manager’s SNMP request into a form appropriate to the target system and uses whatever proprietary management protocol is appropriate to communicate with the target system. Responses from the target to the proxy are translated into SNMP messages and communicated back to the manager.

Network management applications often offload some network management functionality to a remote monitor (RMON) probe. The RMON probe gathers management information locally, and then the network manager periodically retrieves a summary of this data.

The NMS is an ordinary workstation, running a typical operating system.  It has a large amount of RAM, to hold all the management applications running at the same time. The manager runs a typical network protocol stack, such as TCP/IP. The network management applications rely on the host operating system, and on the communication architecture. Examples of network management applications are Ciscoworks2000, HP Openview, and IBM NetView.

As discussed before, the manager may be a standalone, centralized workstation sending out queries to all agents, no matter where they are located.  In a distributed network, a decentralized architecture is more appropriate, with local NMS at each site. These distributed NMS can act in a client-server architecture, in which one NMS acts as a master server, and the others are clients. The clients send their data to the master server for centralized storage.  An alternative is that all distributed NMSs have equal responsibility, each with their own manager databases, so the management information is distributed over the peer NMSs. 

  37.2  Network Management  

  37.2.5  Structure of management information and MIBs    

 

A MIB is used to store the structured information representing network elements and their attributes. The structure itself is defined in a standard called the SMI, which defines the data types that can be used to store an object, how those objects are named, and how they are encoded for transmission over a network.

MIBs are highly structured depositories for information about a device. Many standard MIBs exist, but more MIBs that are proprietary exist to uniquely manage different vendor’s devices. The original SMI MIB was categorized into eight different groups, totaling 114 managed objects. More groups were added to define MIB-II, which now replaces MIB-I.

All managed objects in the SNMP environment are arranged in a hierarchical or tree structure. The leaf objects of the tree, which are the elements that appear at the bottom of the diagram, are the actual managed objects. Each managed object represents some resource, activity or related information that is to be managed. A unique object identifier, which is a number in dot notation, identifies each managed object. Each object identifier is described using abstract syntax notation (ASN.1).

SNMP uses these object identifiers to identify the MIB variables to retrieve or modify. Objects that are in the public domain are described in MIBs introduced in Request for Comments (RFCs). They are readily accessible at: http://www.ietf.org

All vendors are encouraged to make their MIB definitions known. Once an assigned enterprise value has been given, the vendor is responsible for creating and maintaining sub-trees.

  37.2  Network Management 

   37.2.6  SNMP protocol 

  

The agent is a software function embedded in most networked devices, such as routers, switches, managed hubs, printers, and servers.  It is responsible for processing SNMP requests from the manager. It is also responsible for the execution of routines that maintain variables as defined in the various supported MIBs.

Interaction between the manager and the agent is facilitated by the SNMP. The term simple comes from the restricted number of message types that are part of the initial protocol specification. The strategy was designed to make it easier for developers to build management capabilities into network devices. The initial protocol specification is referred to as SNMPv1 (version 1).

There are three types of SNMP messages issued on behalf of an NMS. They are GetRequest, GetNextRequest and SetRequest.  All three messages are acknowledged by the agent in the form of a GetResponse message. An agent may issue a Trap message in response to an event that affects the MIB and the underlying resources.

The development of SNMPv2c addressed limitations in SNMPv1. The most noticeable enhancements were the introduction of the GetBulkRequest message type and the addition of 64-bit counters to the MIB. Retrieving information with GetRequest and GetNextRequest was an inefficient method of collecting information. Only one variable at a time could be solicited with SNMPv1. The GetBulkRequest addresses this weakness by receiving more information with a single request. Secondly, the 64-bit counters addressed the issue of counters rolling over too quickly, especially with higher speed links like Gigabit Ethernet.

The management entity is also referred to as the manager or NMS.  It is responsible for soliciting information from the agent. The solicitations are based on very specific requests. The manager processes the retrieved information in a number of ways. The retrieved information can be logged for later analysis, displayed using a graphing utility, or compared with preconfigured values to test if a particular condition has been met.

Not all manager functions are based on data retrieval. There is also the ability to issue changes of a value in the managed device. This feature enables an administrator to configure a managed device using SNMP.

The interaction between the manager and the managed device does introduce traffic to the network. Caution should be taken when introducing managers on to the network. Aggressive monitoring strategies can negatively affect network performance. Bandwidth utilizations will go up, which may be an issue for WAN environments. Also, monitoring has a performance impact on the devices being monitored, since they are required to process the manager requests. This processing should not take precedence over production services.

A general rule is that a minimum amount of information should be polled as infrequently as possible. Determine which devices and links are most critical and what type of data is required.

SNMP uses user datagram protocol (UDP) as a transport protocol. Since UDP is connectionless and unreliable, it is possible for SNMP to lose messages. SNMP itself has no provision for guarantee of delivery, so it is up to the application using SNMP to cope with lost messages.

Each SNMP message contains a cleartext string, called a community string. The community string is used like a password to restrict access to managed devices.  SNMPv3 has addressed the security concerns raised by transmitting the community string in cleartext.

An example of what the SNMPv2c message looks like is illustrated in Figure . A detailed presentation of the protocol can be found in the Internet standard RFC1905.

The fact that the community string is cleartext is no surprise to anyone who has studied the Internet Protocol (IP) protocol suite. All fields specified in the protocol suite are cleartext, except for security authentication and encryption specifications.

The community string was essentially a security placeholder until the SNMPv2 working group could ratify security mechanisms. The efforts were referred to the SNMPv3 working group. All SNMP-based management applications need to be configured to use the appropriate community strings. Some organizations frequently change the community string values to reduce the risk of malicious activity from the unauthorized use of the SNMP service.

In spite of the weakness associated with community-based authentication, management strategies are still based on SNMPv1. Cisco devices do support SNMPv3 message types and the increased security capabilities, but most management software applications do not support SNMPv3.

SNMPv3 supports the concurrent existence of multiple security models.

  37.2  Network Management  

  37.2.7  Configuring SNMP    

 

In order to have the NMS communicate with networked devices, the devices must have SNMP enabled and the SNMP community strings configured. These devices are configured using the command line syntax described in the following paragraphs.

More than one read-only string is supported. The default on most systems for this community string is public. It is not advisable to use the default value in an enterprise network. To set the read-only community string used by the agent, use the following command:

Router(config)#snmp-server community string ro

• String – Community string that acts like a password and permits access to the SNMP protocol
• ro – (Optional) Specifies read-only access. Authorized management stations are only able to retrieve MIB objects.

More than one read-write string is supported. All SNMP objects are available for write access. The default on most systems for this community string is private. It is not advisable to use this value in an enterprise network. To set the read-write community string used by the agent, use the following command:

Router(config)#snmp-server community string rw

• rw – (Optional) Specifies read-write access. Authorized management stations are able to both retrieve and modify MIB objects

There are several strings that can be used to specify location of the managed device and the main system contact for the device.

Router(config)#snmp-server location text

Router(config)#snmp-server contact text

• text – String that describes the system location information

These values are stored in the MIB objects sysLocation and sysContact .

   37.2  Network Management 

   37.2.8  RMON 

  

RMON is a major step forward in Internetwork management. It defines a remote monitoring MIB that supplements MIB-II and provides the network manager with vital information about the network. The remarkable feature of RMON is that while it is simply a specification of a MIB, with no changes in the underlying SNMP protocol, it provides a significant expansion in SNMP functionality.

With MIB-II, the network manager can obtain information that is purely local to individual devices.  Consider a LAN with a number of devices on it, each with an SNMP agent. An SNMP manager can learn of the amount of traffic into and out of each device, but with MIB-II it cannot easily learn about the traffic on the LAN as a whole.

Network management in an internetworked environment typically requires one monitor per subnetwork.

The RMON standard originally designated as IETF RFC 1271, now RFC 1757, was designed to provide proactive monitoring and diagnostics for distributed LAN-based networks. Monitoring devices, called agents or probes, on critical network segments allow for user-defined alarms to be created and a wealth of vital statistics to be gathered by analyzing every frame on a segment.

The RMON standard divides monitoring functions into nine groups to support Ethernet topologies and adds a tenth group in RFC 1513 for Token Ring-unique parameters. The RMON standard was crafted to be deployed as a distributed computing architecture, where the agents and probes communicate with a central management station, a client, using SNMP. These agents have defined SNMP MIB structures for all nine or ten Ethernet or Token Ring RMON groups, allowing interoperability between vendors of RMON-based diagnostic tools. The RMON groups are defined as:

• Statistics group - Maintains utilization and error statistics for the subnetwork or segment being monitored. Examples are bandwidth utilization, broadcast, multicast, CRC alignment, fragments, and so on.
• History group - Holds periodic statistical samples from the statistics group and stores them for later retrieval. Examples are utilization, error count, and packet count.
• Alarm group - Allows the administrator to set a sampling interval and threshold for any item recorded by the agent. Examples are absolute or relative values and rising or falling thresholds.
• Host group - Defines the measurement of various types of traffic to and from hosts attached to the network. Examples are packets sent or received, bytes sent or received, errors, and broadcast and multicast packets.
• Host TopN group - Provides a report of TopN hosts based on host group statistics.
• Traffic matrix group - Stores errors and utilization statistics for pairs of communicating nodes of the network. Examples are errors, bytes, and packets.
• Filter group - A filter engine that generates a packet stream from frames that match the pattern specified by the user.
• Packet capture group - Defines how packets that match filter criteria are buffered internally.
• Event group - Allows the logging of events, also called generated traps, to the manager, together with time and date. Examples are customized reports based upon the type of alarm. 

   37.2  Network Management 

   37.2.9  Syslog 

  

The Cisco syslog logging utility is based on the UNIX syslog utility. System events are usually logged to the system console unless disabled. The syslog utility is a mechanism for applications, processes, and the operating system of Cisco devices to report activity and error conditions. The syslog protocol is used to allow Cisco devices to issue these unsolicited messages to a network management station.

Every syslog message logged is associated with a timestamp, a facility, a severity, and a textual log message. These messages are sometimes the only means of gaining insight into some device misbehaviors.

Severity level indicates the critical nature of the error message.  There are eight levels of severity, 0-7, with level 0 (zero) being the most critical, and level 7 the least critical. The levels are as follows:

0  Emergencies

1  Alerts

2  Critical

3  Errors

4  Warnings

5  Notifications

6  Informational

7  Debugging

The facility and severity level fields are used for processing the messages. Level 0 (zero) to level 7 are facility types provided for custom log message processing. The Cisco IOS defaults to severity level 6.This setting is configurable.

In order to have the NMS receive and record system messages from a device, the device must have syslog configured.  Below is a review of the command line syntax on how to configure these devices.

To enable logging to all supported destinations:

Router(config)#logging on

To send log messages to a syslog server host, such as CiscoWorks2000:

Router(config)#logging hostname | ip address

To set logging severity level to level 6, informational:

Router(config)#logging trap informational

To include timestamp with syslog message:

Router(config)#service timestamps log datetime

  Summary

 

 

An understanding of the following key points should have been achieved:

• The functions of a workstation and a server
• The roles of various equipment in a client/server environment
• The development of Networking Operating Systems (NOS)
• An overview of the various Windows platforms
• An overview of some of the alternatives to Windows operating systems
• Reasons for network management
• The layers of OSI and network management model
• The type and application of network management tools
• The role that SNMP and CMIP play in network monitoring
• How management software gathers information and records problems
• How to gather reports on network performance