24	ROUTER AND NETWORK MANAGEMENT

NTP works in a hierarchy with stratum one at the top (stratum 0 is ‘undefined’). Primary reference servers are stratum one servers. When a server uses time signals from a stratum one server, it becomes a stratum two server. When a server uses time signals from a stratum two server, it becomes a stratum three server, and so on . . .

There are many stratum one servers based on a variety of Cesium clocks, GPS clocks, radio time signals, etc. Many of these offer public service so if you do not want to implement your own stratum one servers, it is possible to take service from these servers and have several stratum two servers within your network. All network devices in your network can then take service from each of these servers and their clocks will maintain accuracy as defined by stratum three. It is generally considered to be good practice to only use a public stratum one server if your server is likely to serve a fairly large set of clients and higher stratum servers (100 is considered to be a good figure). It is also considered good practice, if you are going to use a public stratum one server, to operate two or more stratum two servers to service your clients. A good rule of thumb is to operate three servers to provide service to a SP core network and their customers’ networks.

In general, the difference between service from a stratum one server and a stratum two server will be negligible, so do not use public stratum one servers unnecessarily.

3.3 LOGGING

Logging is, by definition, the acquisition and storage of large volumes of data regarding the performance of the network. The architecture of the network device defines the mechanisms by which logged information is acquired and the mechanisms and location of the storage of the resulting data. Many modern devices have large volume storage devices built in. These allow the storage of logging and accounting information locally and the transfer of that data in bulk to a central device for post-processing. Those devices with little or no local storage must send all logged information immediately to an external device for storage. This is generally done with syslog and SNMP. It is important to note that syslog and SNMP use UDP as the transport protocol. UDP is inherently unreliable so, during an outage, it can be quite difficult to ensure the delivery of vital messages. This is one of the major benefits of having significant local storage so that logging can be done locally, copied using standard mechanisms to remote servers and, in the event of the failure of standard mechanisms, the locally stored logs can be copied in bulk to the central location.

If you do not log events, it is just impossible to tell exactly what has happened on your network and when. If you offer SLAs, then the inability to identify events, which may impact your SLA, makes you liable to claims from your customers that you have not met your SLA and you have no way to prove or disprove the claim.

3.4SIMPLE NETWORK MANAGEMENT PROTOCOL (SNMP)

SNMP is a widely used set of protocols for monitoring the health of networks. SNMP is based on four major elements: (1) a network management station; (2) a network

3.4 SIMPLE NETWORK MANAGEMENT PROTOCOL (SNMP)

25

management agent; (3) a network management protocol; and (4) management information bases (MIBs).

•The network management station is the workstation to and from which SNMP messages are sent and on which the results are analysed and presented to the operator.

•The network management agent is based on the network device. It responds to requests from the network management station and sends unsolicited notifications of network alert events.

•The network management protocol is the grammar used by the network management station and the network management agent for their conversations.

•The MIB is a dictionary, which describes the objects being given values, the type and range of the values available to each object and an identifier for each of those objects. These objects are formed into a hierarchy of objects.

SNMP provides two operations: GET and SET. GET is used to retrieve information from a network element. SET is used to overwrite a value of the configuration of a network element. The ability to GET and SET values on network devices provides the operator with the ability to both monitor and configure devices remotely using SNMP. The combination of polling (GET) and traps/informs provides a comprehensive mechanism for monitoring all manner of network devices.

3.4.1SNMPv1, v2c AND v3

There are, currently, three versions of SNMP in widespread use (SNMP v2p and v2u are both obsolete). Essentially, each version provides enhancements to various aspects of the previous versions.

With the standardization of version 3 in RFC 2271 through RFC 2275, the RFCs describing version 1, the initial version, and version 2c, a version with enhanced data types and larger counters, have been made historical.

3.4.1.1 Security in SNMP

SNMP is not an inherently secure protocol. However, security is a significant issue for SNMP, given the nature of the information being passed around. The security (or otherwise) of SNMP can have an impact on the utility of this protocol in larger networks. Since SNMP provides the ability to read and write information to managed devices, it is highly desirable for the manager to be able to decide who may and may not access the information available via SNMP. Versions 1 and 2c use a community string, which is a plain text password. Since each trap and poll sent to/from a network device contains the password in plain text, it is easy to find this password and, with that password, obtain and possibly modify vital network configuration and statistical information. It is not uncommon for