How to effectively use a MIB Browser

Are you just beginning to learn the ropes as a network administrator ? Learn how you can effectively use a MIB Browser to retrieve and set configuration data in routers, switches, and servers.

What is a MIB Browser ?
Working with MIB Modules and enterprise MIBs
How to select and read the MIB objects that are most interesting to you ?

What is a MIB Browser ?

A MIB Browser is a tool that allows you to pull out data from SNMP enabled devices such as routers, switches, and servers. In addition to pulling out data, a MIB Browser may also perform the following functions.

Retrieve and display MIB data in a human readable form
Allow you to make it smarter by compiling in more MIB definitions
Set MIB variables, create, modify or delete conceptual table rows
Basic alarm ( trap ) management
View the text file in a graphical manner usually featuring a MIB tree
Support all versions of SNMP including SNMPv3 security

What is a MIB Walker ?
Nowadays, the term MIB Walker and MIB Browser mean the same thing. Originally, the term "MIB Walk" referred to the ability to dump all or a section of the MIB tree via the snmpwalk command.

Types of MIB Browsers

A MIB Browser can be as simple as a text based snmpwalk commandor as sophisticated as Unbrowse SNMP that uses a spreadsheet like view. In some cases the command line may actually be a better choice, such as when you are feeding the data to some other tool or when you are running in a very resource constrained hardware. Some alternate views of the same MIB data are shown in the table below:

Text based The simplest MIB Browser is the snmpwalk command. It talks to the agent and dumps the MIB data in a easy to understand text console. It is a must have tool, you never know when you might need it. You can download the snmpwalk and other related utilities such as (snmpset, snmpget, snmptable) from the Net-SNMP website. http://www.net-snmp.org
Simple GUI Many commercial products present the MIB data to you in a nice list control. This allows you to see a more structured form of the MIB data.
Spreadsheet like Some products like Unbrowse SNMP present MIB data in a spreadsheet like interface. These products combine the raw MIB data along with the knowledge of MIB definitions to present conceptual SNMP rows as real spreadsheet rows. These tools also allow you to add rows, delete rows, or modify cells. You can then commit all your changes in a single button click.

MIB Modules and MIB Browsers

A MIB Module is just a file that contains definitions of related MIB objects. The IF-MIB module for example defines the ifxTable, ifStack table and 50 other objects. These modules are defined by experts in that area and are distributed in a plain text file in a so-called SMI format. The file itself is quite hard to read and comprehend.

The MIB Browser comes to the rescue here. It can understand the SMI file either natively or by compiling it into an intermediate format. It can then show the MIB in a graphical format that is easier to comprehend and navigate. Some example are shown in the table below.

Plain MIB File A plain MIB file looks like the image on the right. Some of these plain MIB files run into thousands of lines and are notoriously hard to read and comprehend. These files are written in standard format called the SMI format. The SMI format (officially called SMIv2 is defined in RFC2578
Graphical format Most MIB Browsers have the capability to transform the plain text file into a graphical display. The goal is to employ elements like bitmaps, lists, and fonts to present the MIB definitions in the most intuitive way possible. See the screenshot on the right for an example of Unbrowse SNMP.

Dealing with MIB Modules

While working with SNMP, one of the key considerations is whether the MIB Browser has sufficient knowledge of the MIBs. The unit of definition of a MIB is a module. To effectively manage a particular agent, you must tell the MIB browser about as many objects implemented by the agent as possible. This means loading the MIB Browser with as many enterprise (private) MIBs as you can lay your hands on.

Modules implemented by the router (agent)

A single MIB module defines a related group of SNMP objects. An agent can choose not to implement a module at all or to implement only a subset of objects from a module. An agent typically implements objects from a large number of modules. Within each module it may not support all objects.
For example the Cisco Catalyst 4000 series switch implement MIB objects from 100+ different MIB modules as shown here.

How to find out what modules are implemented by the agent ?

You may ask, "Well, how do I know what MIB modules I need to manage my router model XXX ?".

There are several options.

Just ask your router vendor for a list of modules implemented by model XXX. Some vendors like Cisco and Juniper make it easy by publishing this information on their websites. Most will tell you the names of modules and may even provide you with MIB files you can compile yourself.
Use a discovery tool to check the sysORTable. The sysORTable is basically a set of pointers to agent capabilities (or) to modules implemented. Some tools like Unbrowse SNMP allow you to check the sysORTable via a tool. Note that this method may not work in many agents or may be inaccurate due to faulty implementations. In those cases, you can use a brute force method - which is the most accurate.
Use a brute force discovery tool. The idea is to dump the entire MIB database and then check each OID for a match against the MIB browsers knowledge base of MIBs. Any unresolved OIDs can be dumped to the screen. You can then hunt for these unknown OIDs in an online MIB database such as mibdepot.

What does loading MIBs mean ?

The MIB browser is only as smart as the number of MIB definitions it knows. If you have not "told" the MIB Browser about a particular group of objects, the MIB browser is ignorant of that object. Loading MIBs refers to the process of telling a MIB Browser to read in some information from selected modules which are about to be used. It is like saying, "Get ready, I am going to be using these modules X,Y,Z anytime now".

Some MIB Browsers need you to explicitly load MIBs after you start, even if you have already "told it" about the existance of those MIBs via the act of compiling those modules. This form of loading means that the loaded MIBs will be read in to memory. Unbrowse SNMP does not require you to take any explicit action of loading.

How to use a MIB Browser with real world agents

Routers, switches, storage networks, and servers implement thousands of objects from several dozen modules. Some objects may not even be publicly documented. What is the right way to effectively use a MIB Browser in such a situation ?

Get your hands on as many enterprise MIBs as you can for that particular vendor. If you are dealing with Cisco or Juniper, you are in luck because all their MIBs are publicly available. If you are dealing with other vendors you can visit a MIB database such as MIB Depot (http://www.mibdepot.com)
Compile those MIBs into your MIB Browser. It would help a lot if your MIB Browser has various leniency levels because not all enterprise MIBs are clean nor do they follow the mib file naming conventions. Unbrowse SNMP allows you to compile almost anything you throw at it and does not expect any file name convention.
You rarely want to pull the entire MIB database from the router, this is potentially huge amount of data. So, you must first figure out what you are interested in and locate the MIB objects that can provide you that information.
Create a view of the MIB objects you are interested in. Unbrowse allows you to drag and drop all kinds of MIB objects into a "walk view".
If you are dealing with large tables such as accounting tables, ATM Virtual Circuit tables, or MPLS LSP related tables, you really do not want all the rows back. Sometimes, the number of rows in those table can exceed tens of thousands. So your MIB Browser must also allow you to specify a subset of rows to retrieve. With Unbrowse you can select a number of ranges of rows to retrieve.
Your MIB Browser must allow you to save all the above information that you carefully put together, so that you do not have to go through this process again. Unbrowse SNMP allows you to save this information, the next time will be as easy as pressing a "Walk" button.

Get a MIB Browser and learning

If you want to learn more about MIB Browsers and SNMP, the best way it to download a MIB Browser and start playing with it.

Try Unbrowse SNMP now !

Happy browsing !

Glossary

MIB	Management Information Base You can consider it to be the "router database" for purposes of MIB browsing.
SNMP	Simple Network Management Protocol
SMI	Structure of Management Information Dictates the format of the MIB file (the plain text file)
Agent	Typically a router, switch, server or other network elements which are SNMP capable.