Java SNMP API FAQ

iReasoning SNMP API is a high-performance, cross-platform Java library for building network management applications. It fully supports SNMPv1, SNMPv2c, and SNMPv3. The library was designed from the ground up for all supported SNMP versions, without legacy code limited to a particular protocol version. Its code is optimized to maximize performance and minimize overhead.

Advantages include:

• Ease of use. Examples such as snmpgetnext.java and snmpwalk.java demonstrate how straightforward it is to implement SNMPv1, SNMPv2c, and SNMPv3 operations.
• High performance, with code optimized to minimize overhead.
• The first Java SNMP product to support both DES and strong 128-bit AES encryption.
• Support for SNMPv1, SNMPv2c, and SNMPv3.
• Conformance to the EJB specification when used as described below.
• A robust SMIv1 and SMIv2 MIB parser.
• Support for both UDP and TCP transports.

The Oulu University Secure Programming Group (OUSPG) discovered vulnerabilities in SNMP implementations from many vendors. Problems in decoding and processing SNMP messages could permit unauthorized privileged access, denial-of-service attacks, or unstable behavior. The findings are summarized in the CERT SNMP vulnerabilities advisory.

• VU#107186 — Multiple vulnerabilities in SNMPv1 trap handling.

  SNMP agents send traps to managers to report warnings, errors, or other state changes. Managers must decode and process those messages correctly. OUSPG found vulnerabilities in the way many managers handled malformed SNMPv1 traps. iReasoning SNMP API passed all 24,100 tests in the OUSPG test suite, so we concluded that this advisory did not affect the library.

• VU#854306 — Multiple vulnerabilities in SNMPv1 request handling.

  This advisory concerns how agents decode requests sent by managers. It does not apply to iReasoning SNMP API because this manager library does not provide agent functionality and does not accept SNMP request messages.

When asynchronous mode is not used, the library does not create a thread, and the EJB specification permits client-side sockets. The library therefore conforms to the EJB specification in synchronous mode.

The asyncSend method in SnmpSession creates a thread, so it should not be used in an Enterprise JavaBean. Some competing SNMP libraries create threads regardless of the selected mode and therefore generally do not conform to this EJB requirement.

Start with a basic understanding of SNMP and Java. The Java SNMP API User Guide provides an introduction and usage examples. Next, explore the examples shipped with the product. They demonstrate SNMP GET, GET-NEXT, walk, and other common operations and are also available through the JavaDoc.

Most examples require an SNMP agent. If you do not already have one for testing, Windows users can run snmpd.exe to start a test agent that listens on port 161.

No. Use iReasoning SNMP Agent Builder to build an SNMP agent.

iReasoning SNMP API supports SNMPv1, SNMPv2c, and SNMPv3. If you purchase only an iReasoning SNMPv2 license, SNMPv3 support is not included.

The library fully supports SNMPv3, including VACM and the USM security model with HMAC-MD5, HMAC-SHA, CBC-DES, CFB128-AES-128, CFB128-AES-192, and CFB128-AES-256. It has passed interoperability tests with other SNMPv3 products and has been used by other implementers as a de facto reference implementation.

The Advanced Encryption Standard (AES) is a U.S. Federal Information Processing Standard for protecting sensitive, unclassified information. NIST expected AES to be widely adopted by public- and private-sector organizations worldwide as a replacement for DES. Triple DES was expected to remain approved for some uses, while single DES was being phased out and retained only for legacy systems.

To illustrate the difference in key strength, NIST explained that even a machine capable of recovering a DES key in one second would require approximately 149 trillion years to exhaust a 128-bit AES key space. See the NIST AES overview and The AES Cipher Algorithm in the SNMP User-based Security Model for more information.

In our historical test environment, the snmptrapd.java sample handled approximately 2,700 traps per second on a 700 MHz Pentium III computer with 512 MB of memory. The receiving rate may be higher when the sender can produce traps faster. The sample consistently received every trap in that test, while some popular trap receivers did not.

On Windows, from the directory immediately above lib:

set classpath=lib\examples.jar;lib\ireasoningsnmp.jar

Start an SNMP agent. You can use snmpd.exe on Windows. Then run:

java snmpget -?
java snmpget localhost sysUpTime

The first command displays usage information. The second retrieves sysUpTime from the local agent. You can then try the other examples.

Yes. MibUtil.parseMib(String fileName) parses a MIB file and returns a data structure representing its tree. The mibparser.java sample demonstrates how to use the parser.

Yes, when used with J2SDK or JRE 1.4 or newer. The historical Networking IPv6 User Guide for J2SDK/JRE 1.4 provides more information. With JVM 1.4.2, the supported systems included Solaris 8 or newer and Linux kernel 2.1.2 or newer.

Because iReasoning SNMP API is written in Java, it can run on any operating system with a compatible Java Virtual Machine.

Load the required MIB files with MibUtil.loadMib. To load MIB-II (RFC 1213), call MibUtil.loadMib2(). After loading the necessary MIBs, use the other MibUtil methods to translate between object names and numeric OIDs. See the included examples for more information.

No. iReasoning SNMP Agent Builder is the appropriate product for agent development.

Yes. Add the following line to your application:

Logger.setLevel(Logger.NONE);

Yes. Set the com.ireasoning.configDir Java system property. For example, to use d:\config, launch the application with:

java -Dcom.ireasoning.configDir=d:\config ...

Yes. Because of Java applet security restrictions, the SNMP agent and web server must run on the same computer. See the Java applet example.