COMP347 Unit 8 – Network Management and Network Operations
After completing this extended tutorial, you should be able to:
Management Information Bases (MIBs) and the Structure of Management Information (SMI) are the cornerstones of SNMP‑based management. They define what information is available on a device, how it is structured, and how it is identified. This tutorial provides a comprehensive exploration of these concepts, starting with the data definition language (ASN.1 and SMI), moving through the hierarchical MIB tree, and examining standard MIB modules (MIB‑II, IF‑MIB, IP‑MIB, etc.). We also cover Remote Monitoring (RMON), which augments SNMP with local data aggregation, alarms, and historical storage.
We will discuss practical aspects such as using snmpwalk and MIB browsers, and compare the MIB
approach with newer modeling languages like YANG. Case studies illustrate how MIBs are used in real‑world
monitoring and troubleshooting. Understanding MIBs is essential for anyone working with SNMP, as it enables
effective device management and performance analysis.
Management information is the data that network management systems collect from devices: interface counters, CPU load, routing tables, error statistics, and more. For a manager to understand and interpret this data, it must be defined in a standardized way. This is the purpose of MIBs and SMI.
SMI is defined in RFC 1155 (SMIv1) and RFC 2578 (SMIv2). It specifies:
Key SMI data types include:
INTEGER – 32‑bit signed integer.OCTET STRING – binary or text data.OBJECT IDENTIFIER – a dotted‑decimal name.Counter32 – non‑negative 32‑bit integer that wraps at 232−1.Gauge32 – non‑negative 32‑bit integer that may increase or decrease.TimeTicks – hundredths of seconds.IPAddress – 32‑bit IPv4 address (deprecated in SMIv2).
SMIv2 introduced Counter64 (for 64‑bit counters), Bits, and improved textual
conventions.
Example SMIv2 definition (from IF‑MIB):
ifIndex OBJECT-TYPE
SYNTAX InterfaceIndex
MAX-ACCESS read-only
STATUS current
DESCRIPTION "A unique value, greater than zero, for each interface."
::= { ifEntry 1 }
The MIB tree is a hierarchical namespace that begins at the root (unnamed) and is divided into branches. The top‑level arcs are:
iso(1) – managed by ISO.iso(1).org(3) – organizations.iso(1).org(3).dod(6) – US Department of Defense.iso(1).org(3).dod(6).internet(1) – the Internet subtree (1.3.6.1).Under internet, important branches include:
mgmt(2) – 1.3.6.1.2 – for standard MIBs (MIB‑II).private(4) – 1.3.6.1.4 – for enterprise‑specific MIBs.experimental(3) – 1.3.6.1.3 – for experimental MIBs.snmpV2(6) – 1.3.6.1.6 – for SNMPv2 MIB modules.
Each object is identified by a sequence of numbers (OID), e.g., 1.3.6.1.2.1.1.1.0 is the OID
for sysDescr.0 (system description). The trailing .0 indicates a scalar instance.
sysName.0.ifTable (1.3.6.1.2.1.2.2). Each row is
identified by an index (e.g., ifIndex). To retrieve a specific column for a particular
interface, append the index value.
Indexing: For a table, the index is a list of objects that uniquely identify a row. In IF‑MIB,
ifIndex is the index, so ifDescr.4 gives the description of interface #4.
MIB‑II (RFC 1213) is the core MIB, containing groups for:
Other important standard MIBs:
Vendors define their own MIBs under private.enterprises (1.3.6.1.4.1) to expose proprietary
parameters. Examples: Cisco (1.3.6.1.4.1.9), Juniper (1.3.6.1.4.1.2636), and many others. Enterprise MIBs
may contain device‑specific statistics, hardware health (temperature, fan speed), and advanced configuration
options.
When using a management system, it is important to load these MIB modules to translate OIDs into readable names and to access vendor‑specific information.
SMIv2 (RFC 2578) introduced several improvements over SMIv1 (RFC 1155):
Counter64 for high‑speed interfaces.BITS for bit‑field representation.SNMPv1 uses SMIv1; SNMPv2c and SNMPv3 use SMIv2. Most modern devices support SMIv2.
RMON (RFC 2819, 2021) is an extension to SNMP that provides:
The RMON MIB (1.3.6.1.2.1.16) includes the following groups:
RMON2 (RFC 2021) extends RMON to higher layers, adding:
RMON is particularly useful in switches and probes deployed at network segments.
Common SNMP command‑line tools (Net‑SNMP) include:
snmpget – retrieve a specific OID.snmpgetnext – retrieve the next OID in the tree.snmpwalk – traverse a subtree, retrieving all objects.snmptable – display a table in tabular format.snmptranslate – translate between OID and symbolic name.MIB browsers (e.g., iReasoning, MG‑SOFT, or open‑source tools) provide a graphical interface for exploring MIBs and issuing SNMP operations.
Example: To retrieve the description of all interfaces:
snmpwalk -v2c -c public 192.168.1.1 1.3.6.1.2.1.2.2.1.2
YANG (Yet Another Next Generation) is a data modelling language used with NETCONF/RESTCONF. It differs from SMI/MIB in several ways:
However, MIBs remain widely deployed, and many devices support both. Understanding MIBs is still essential for SNMP‑based management.
All answers are hidden; click Show Answer to reveal.
What does the acronym MIB stand for?
What is the role of the Structure of Management Information (SMI)?
Name three primitive data types defined in SMIv2.
What is the OID for the Internet subtree?
Which branch of the Internet subtree is used for enterprise‑specific MIBs?
What is the difference between a scalar object and a tabular object in a MIB?
In MIB‑II, which OID group provides system‑level information like sysName and sysDescr?
What is the purpose of the ifTable in MIB‑II?
How does RMON extend SNMP?
Name four RMON groups from the standard RMON MIB.
What is the function of the RMON Alarm group?
How does SMIv2 differ from SMIv1? List at least two differences.
What is the OID for the MIB‑II sysUptime object?
Explain the concept of table indexing in MIBs.
Which standard MIB replaces the interfaces group of MIB‑II with more detailed interface information?
What does the RMON History group do?
What is the purpose of the RMON Event group?
How does RMON2 extend the original RMON?
What command would you use to retrieve all objects under the MIB‑II system group?
snmpwalk -v2c -c public <host> 1.3.6.1.2.1.1What is a textual convention in SMI?
What is the difference between Counter32 and Gauge32?
Which MIB group in MIB‑II contains TCP connection tables?
Why is it necessary to load MIB files into an SNMP management tool?
What does the term “traversal” mean in SNMP context?
What is the purpose of the sysObjectID object?
How can you determine the number of network interfaces on a device using MIB‑II?
ifNumber (1.3.6.1.2.1.2.1.0) which gives the total
number of interfaces.What is the primary advantage of using RMON over frequent SNMP polling?
What does the term “BER” stand for in SNMP, and what is its function?
Which RMON group is used to identify the top bandwidth consumers over a period?
What is the main difference between the IF‑MIB and the older interfaces group in MIB‑II?
Sample solutions are hidden – click to reveal.
Using the MIB tree, find the OID for the interface description of interface #3. Specify the complete OID and explain the indexing.
ifDescr is 1.3.6.1.2.1.2.2.1.2. The table ifEntry has index ifIndex. So for interface #3, OID = 1.3.6.1.2.1.2.2.1.2.3.
You have an SNMP agent at 192.168.1.100 with community string “monitor”. Write a command to retrieve the system contact information.
snmpget -v2c -c monitor 192.168.1.100 1.3.6.1.2.1.1.4.0 (sysContact.0).
Explain the difference between ifOperStatus and ifAdminStatus. Which one would you monitor to detect an interface down?
ifAdminStatus is the desired administrative status (up/down). ifOperStatus is the actual operational status (up/down). Monitor ifOperStatus to detect actual down events.
You want to monitor incoming traffic utilisation on a 1 Gbps interface. Which counters would you poll and how would you calculate utilisation?
Use ifHCInOctets (or ifInOctets for 32‑bit). Poll twice, subtract to get bytes in interval, multiply by 8, divide by interval time and interface speed (1e9) to get percentage utilisation.
How would you use RMON to generate a trap when inbound traffic on a specific interface exceeds 80% of its bandwidth for 5 consecutive minutes?
Define an RMON Alarm with the OID for ifHCInOctets (or calculated utilisation), set rising threshold (e.g., 80% of speed), sample interval (300 seconds), and associate with an Event that sends a trap. The agent will compare samples and fire when threshold is crossed.
What is the significance of the “.0” suffix in many OIDs (e.g., sysUpTime.0)?
It indicates that the object is a scalar instance. For scalar objects, the index is always 0.
Using the IP‑MIB, which objects would you check to diagnose packet fragmentation issues?
Check ipReasmFails, ipFragFails, ipFragCreates, and ipReasmOKs. High fragmentation failures indicate MTU problems.
Describe the steps to load a custom vendor MIB into a management tool so that OIDs are displayed with names.
Obtain the MIB file (.txt or .my). Use the tool’s MIB compiler/loader (e.g., copy to the MIBs
directory and run snmptranslate -m +<MIBNAME>). Ensure dependencies are
satisfied.
What information can you obtain from the RMON Host group? Provide an example use case.
The Host group tracks traffic per MAC address – total bytes/packets sent/received. Use case: identify which hosts are generating excessive traffic in a LAN segment.
Compare the usage of Counter32 vs. Counter64. In which scenarios would you prefer Counter64?
Counter32 is 32‑bit and wraps at ~4.29e9. For high‑speed interfaces (1 Gbps and above), Counter64 is preferred to avoid frequent wrapping and to accurately measure total traffic.
You observe that ifInErrors is increasing rapidly on a router interface. What does this indicate and what further MIB objects would you check?
It indicates receive errors (e.g., CRC, framing). Check ifInDiscards, ifOutErrors, and also physical layer statistics if available (e.g., from RMON Ethernet stats).
How does RMON2 help in traffic classification beyond the original RMON?
RMON2 adds protocol directory and distribution, allowing you to see traffic by application protocol (e.g., HTTP, FTP, DNS) rather than just Ethernet frames.
Write a brief explanation of how the SNMP table indexing works with the ifTable. If you wanted to retrieve the speed of interface #5, what OID would you use?
ifSpeed is at 1.3.6.1.2.1.2.2.1.5. For interface #5, the OID is 1.3.6.1.2.1.2.2.1.5.5.
What is the purpose of the RMON Matrix group? Provide a practical example.
The Matrix group tracks conversations between pairs of hosts (by MAC addresses) – bytes/packets in each direction. Useful for identifying which pair of hosts is generating the most traffic (e.g., for capacity planning).
Explain how you could use MIB‑II to detect a routing loop or excessive ICMP redirects.
Check ipForwDatagrams for high forwarding rates, and icmpInRedirects or icmpOutRedirects. Also check ipRouteTable for inconsistent next‑hop entries.
Sample answers are hidden; use them to guide your study.
Research and write a detailed description of the MIB‑II System group. List each object, its OID, syntax, and purpose.
System group (1.3.6.1.2.1.1): sysDescr, sysObjectID, sysUpTime, sysContact, sysName, sysLocation, sysServices. Each provides system identification and operational status.
Compare the RMON History and Alarm groups. How do they work together to enable proactive monitoring?
The History group collects and stores samples over time. The Alarm group monitors a variable and triggers events when thresholds are crossed. Together, they allow detecting trends (history) and immediate anomalies (alarms).
Explain the concept of MIB modules and how they import definitions from other modules. Provide an example using IF‑MIB and SNMPv2‑SMI.
MIB modules use the IMPORTS statement to bring in definitions from other modules. IF‑MIB imports Counter32, Gauge32, etc. from SNMPv2‑SMI, and InterfaceIndex from SNMPv2‑TC. This promotes reuse.
Design an RMON configuration to monitor a network segment and alert when the total broadcast traffic exceeds 10% of the total traffic over a 5‑minute interval. What RMON groups and objects would you use?
Use RMON Statistics (etherStatsBroadcastPkts) and Alarm/Event. Define a history control to collect samples, then an alarm on the broadcast rate (calculated from samples).
Investigate the Host Resources MIB (HOST‑RESOURCES‑MIB). What information does it provide about CPU, memory, and processes? How is it useful for network management?
Provides processor load (hrProcessorLoad), memory size and usage (hrMemorySize, hrStorageUsed), and running processes (hrProcessTable). Useful for correlating network issues with device resource exhaustion.
Compare the OID naming of MIB‑II and the newer IF‑MIB. How has the IF‑MIB improved upon the original interfaces group? Provide specific object differences.
IF‑MIB (RFC 2863) added ifXTable with high‑capacity counters (ifHCInOctets), ifAlias for custom names, and ifLinkUpDownTrapEnable. It also redefines ifSpeed and ifHighSpeed.
Write a tutorial on using snmptable to display and interpret the IP routing table
(ipRouteTable) from a router. Include example output and explanation.
Command: snmptable -v2c -c public router 1.3.6.1.2.1.4.21. Output shows destination,
next‑hop, type, metric, etc. Explain fields.
Explain the concept of a “MIB walk” and describe how it can be used to discover the capabilities of an unknown device.
A MIB walk traverses the MIB subtree, retrieving all objects. By walking the system group and then looking at sysObjectID, you can identify the device type and know which MIBs to load. You can also discover supported tables.
How does SMI define the syntax for table objects? Describe the use of SEQUENCE and SEQUENCE OF in object definitions.
A table is defined as a SEQUENCE OF rows, where each row is a SEQUENCE of column objects. The definition includes each column’s syntax and index.
Research the RMON2 Protocol Directory group. How does it identify protocols, and what is its utility in traffic analysis?
The Protocol Directory lists the protocols supported by the agent, with identifiers (e.g., 1 for IP, 2 for IPX). It enables protocol‑specific traffic statistics and classification.
Describe the challenges of managing a network with devices that only support SMIv1 and others that support SMIv2. How can a management system handle both?
Management systems must support both versions, using the appropriate SNMP version. For SMIv1 devices, Counter64 is not available, so 32‑bit counters may wrap quickly. The system should use polling intervals that account for wrap‑around.
Write a critical analysis of the evolution from MIB‑based management to YANG‑based models. What are the advantages of YANG over SMI, and what are the barriers to adoption?
YANG offers richer modelling, supports configuration and state separation, and uses more modern encodings. However, SNMP/MIBs are deeply entrenched, and many devices still support SNMP. Migration requires upgrades to NETCONF/RESTCONF and retraining.
This extended tutorial has provided a comprehensive exploration of Management Information Bases (MIBs), the Structure of Management Information (SMI), and Remote Monitoring (RMON). We examined the ASN.1‑based SMI and its data types, the hierarchical OID namespace, and key standard MIBs like MIB‑II, IF‑MIB, and IP‑MIB. We also covered the enhancements of SMIv2 and the practical aspects of using SNMP tools to query and navigate MIBs.
RMON was presented as an extension that enables proactive monitoring, historical data collection, and local alarm generation, reducing the burden on management stations. Finally, we compared MIBs with the newer YANG models, highlighting the evolution of network management data modeling.
Mastery of MIBs and RMON is essential for effective network monitoring, performance analysis, and troubleshooting. The extensive quiz, exercises, and homework provided in this tutorial are designed to reinforce these concepts and prepare you for practical network management tasks.
In the next tutorial, we will focus on the SNMP protocol itself, covering message formats, operations (GET, SET, TRAP, etc.), and transport details, building directly on the MIB knowledge gained here.
COMP347 Unit 8 – Extended Tutorial 3 • TrustOpen University • Last updated: August 2026