RANGER GAMEZ

CompTIA Network+ (N10-009) · chapter 13 of 29

Week 13: Listening to the network

In this chapter Objectives 3.2

  1. SNMP
  2. Flow data, packet capture, port mirroring
  3. Practice questions
  4. Chapter recap

Objective 3.2

SNMP

How SNMP works

Simple Network Management Protocol (SNMP) lets a manager (the monitoring server, NMS) read and sometimes set values on agents (switches, routers, printers, UPS). The manager polls agents on UDP 161. Agents send unrequested alerts called traps to the manager on UDP 162.

An SNMP manager, the network monitoring server, on the left; a switch and a router, both running SNMP agents, on the right. The manager polls the switch with a request on UDP port 161 and the agent replies with values from its MIB. When something happens on the router, such as a link going down, its agent sends an unrequested trap to the manager on UDP port 162 right away.
Manager polls agents on UDP 161; agents send traps to the manager on UDP 162.

Exam tip Polling = manager asks (161). Trap = agent shouts (162). A trap arrives the moment a link goes down; polling notices at the next poll.

MIBs and OIDs

The management information base (MIB) is the database of values an agent can report, like interface counters, CPU, temperature. Each value has an object identifier (OID), a dotted number such as 1.3.6.1.2.1.2.2.1.10 (ifInOctets). Vendors publish MIB files so your NMS knows what each OID means.

Versions, community strings, authentication

SNMPv2c uses community strings as simple shared passwords, sent in clear text. Defaults like 'public' and 'private' must be changed. SNMPv3 adds real authentication (users and hashing) and encryption, so it is the secure choice.

snmp-server group NOC v3 priv
snmp-server user nms1 NOC v3
  auth sha <key> priv aes 128 <key>
snmp-server host 10.1.9.10 version 3
  priv nms1

Exam tip Exam favorite: need SNMP with authentication and encryption? SNMPv3. v2c community strings travel unencrypted.

Objective 3.2

Flow data, packet capture, port mirroring

Flow data

Flow data (NetFlow, IPFIX, sFlow) summarizes conversations: source and destination IP, ports, protocol, bytes, times. It does not keep the payload. Great for 'who is using all the bandwidth?' and spotting unusual talkers, with far less storage than full captures.

Exam tip Flow = metadata about conversations. Capture = every bit of the packets.

Packet capture

Packet capture records full packets, headers and payload, with a protocol analyzer like Wireshark or tcpdump. It answers the deepest questions (why is this TLS handshake failing?) but produces huge files, so capture on purpose, with filters, for a limited time.

Port mirroring

A switch only sends a frame out the port toward its destination, so a laptop on another port sees nothing. Port mirroring (Cisco calls it SPAN) copies traffic from one or more ports or VLANs to a monitor port where your analyzer or IDS listens.

monitor session 1 source
  interface Gi1/0/5 both
monitor session 1 destination
  interface Gi1/0/48
A switch with traffic flowing between port 5 and the uplink. Port mirroring, called SPAN on Cisco switches, copies every frame from port 5 to port 48, where a laptop running a protocol analyzer or an IDS listens. Without mirroring, port 48 would only see its own traffic.
Port mirroring (SPAN) copies a port's traffic to a monitor port.

Exam tip A mirror port can drop copies when busy. A hardware network tap copies every bit; that tool shows up in 5.5.

Check yourself 1Maya needs to see which internal hosts sent the most data to the internet last week, without storing full packets. Which method fits?

  1. Port mirroring
  2. Packet capture
  3. SNMP traps
  4. Flow data
Show the answer

Answer: D. Flow data

Flow records list who talked to whom and how many bytes, without payload, so they are ideal for top-talker reports.

Practice questions

Answer in your head, then open the answer. Ranger's Packet Trail has 483 questions like these for Network+, with mock exams.

Question 1A monitoring server polls switches for interface statistics using SNMP. Which port do the switches' SNMP agents listen on for these requests?

  1. UDP 162
  2. UDP 514
  3. TCP 161
  4. UDP 161
Show the answer

Answer: D. UDP 161

SNMP managers send Get/Set requests to agents on UDP 161. Agents send unsolicited traps to the manager on UDP 162.

Question 2A core switch should alert the monitoring server immediately when a link goes down rather than waiting for the next poll. Which SNMP feature does this?

  1. Community string
  2. Get request
  3. MIB
  4. Trap
Show the answer

Answer: D. Trap

A trap is an unsolicited message the agent sends to the manager (UDP 162) when an event occurs. Get requests are polls started by the manager.

Question 3An auditor flags that the network uses SNMPv2c with the community string "public". Which change BEST fixes the finding?

  1. Change the community string to a longer one
  2. Migrate to SNMPv3 with auth and encryption
  3. Use SNMPv1 read-only communities
  4. Move SNMP from UDP 161 to UDP 162
Show the answer

Answer: B. Migrate to SNMPv3 with auth and encryption

SNMPv3 adds per-user authentication and encryption. v1 and v2c send community strings in cleartext, so a longer string can still be sniffed.

Question 4In SNMP, what is the MIB?

  1. A database of objects (OIDs) the agent exposes
  2. The agent software that runs on each managed device
  3. The password used by SNMPv2c
  4. An alert sent from an agent to the manager
Show the answer

Answer: A. A database of objects (OIDs) the agent exposes

The Management Information Base defines the objects, each with an OID, that an agent exposes, such as interface counters or CPU load.

Question 5A manager wants to know which internal hosts sent the most traffic to the internet last week and to which destinations, without storing packet contents. Which method fits BEST?

  1. SNMP interface polling
  2. Flow data such as NetFlow or IPFIX
  3. Full packet capture
  4. Syslog aggregation
Show the answer

Answer: B. Flow data such as NetFlow or IPFIX

Flow records summarize conversations (source, destination, ports, bytes, time) without payloads, ideal for top-talker reports. Packet capture keeps full contents and is far larger.

Practice it in Ranger's Packet TrailThe same lessons as a story, with drills, hands-on labs and mock exams. Free, in your browser.
Play free

CompTIA, A+, Network+, Security+ and Linux+ are trademarks of CompTIA, Inc. Ranger Gamez is not affiliated with or endorsed by CompTIA. The practice questions are written to the published exam objectives; they are not real exam questions.