Content

| 7.3 |  | Troubleshooting TCP/IP Application Layer Protocols |
| 7.3.7 |  | Network management and time protocols |

NTP
Logging time is very important in determining when a problem started. Most network problems can be narrowed down to a configuration change or modifications to the network topology. A synchronized time enables correlation of syslog and Cisco IOS debug output to specific events. While the primary goal of problem resolution is to fix the problem, it is also quite helpful to know when the problem originated so that the problem can be resolved and avoided in the future.

The Network Time Protocol (NTP) synchronizes timekeeping among a set of distributed time servers and clients. This synchronization allows events to be correlated when system logs are created and other time-specific events occur. For timestamps to be of use, it is a good idea for all the routers and switches in the network to derive time from a common network time source.

Configuring time services on routers requires exec and configuration commands. To configure the time zone properties on the router, the configuration commands clock timezone and clock summer-time are used. The commands ntp server ip-addr and ntp source interface define the NTP server(s) and the source IP address of the NTP requests.

The internal clock of the router is set using the EXEC command clock set. To view NTP peer status information, use the show ntp associations and show ntp status commands.

SNMP
Simple Network Management Protocol (SNMP) is an application-layer protocol that facilitates the exchange of management information between network devices. It is part of the Transmission Control Protocol/Internet Protocol (TCP/IP) protocol suite.

Although troubleshooting is necessary to recover from problems, the ultimate goal of the network administrator is to avoid problems. That is also the goal of network management software. The network management software used on TCP/IP networks is based on the Simple Network Management Protocol (SNMP).

SNMP is a client/server protocol. In SNMP terminology, it is described as a manager/agent protocol. The agent (the server) runs on the device being managed, which is called the Managed Network Entity. The agent monitors the status of the device and reports that status to the manager.

The manager (the client) runs on the Network Management Station (NMS). The NMS collects information from all of the different devices that are being managed, consolidates it, and presents it to the network administrator. This design places all of the data manipulation tools and most of the human interaction on the NMS. Concentrating the bulk of the work on the manager means that the agent software is small and easy to implement. This is why most TCP/IP network equipment comes with an SNMP management agent.

SNMP is a request/response protocol. UDP port 161 is its well-known port. SNMP uses UDP as its transport protocol because it has no need for the overhead of TCP. Reliability is not required because each request generates a response. If the SNMP application does not receive a response, it simply re-issues the request. Sequencing is not needed because each request and each response travels as a single datagram.

The NMS periodically requests the status of each managed device (GetRequest) and each agent responds with the status of its device (GetResponse). Making periodic requests is called polling. Polling reduces the burden on the agent because the NMS decides when polls are needed, and the agent simply responds. Polling also reduces the burden on the network because the polls originate from a single system at a predictable rate. The shortcoming of polling is that it does not allow for real-time updates. If a problem occurs on a managed device, the manager does not find out until the agent is polled. To handle this, SNMP uses a modified polling system called trap-directed polling.

A trap is an interrupt signaled by a predefined event. When a trap event occurs, the SNMP agent does not wait for the manager to poll. Instead it immediately sends information to the manager. Traps allow the agent to inform the manager of unusual events while allowing the manager to maintain control of polling. SNMP traps are sent on UDP port 162. The manager sends polls on port 161 and listens for traps on port 162.

The commands in Figure display information about network management applications. A troubleshooter uses the information from these commands to isolate problems at the application layer that are related to the SNMP and NTP protocols.

Figure lists commands which make configuration changes that troubleshooters can use to correct problems with network management protocols at the application layer.