As per Relevance of the word associated, we have this rfc below:
Network Working Group S.
Request for Comments: 1271 Carnegie Mellon
November 1991
Remote Network Monitoring Management Information
Status of this
This memo is an extension to the SNMP MIB. This RFC specifies an
standards track protocol for the Internet community, and
discussion and suggestions for improvements. Please refer to
current edition of the "IAB Official Protocol Standards" for
standardization state and status of this protocol. Distribution
this memo is unlimited
Table of
1. Abstract .............................................. 2
2. The Network Management Framework....................... 2
3. Objects ............................................... 2
3.1 Format of Definitions ................................ 3
4. Overview .............................................. 3
4.1 Remote Network Management Goals ...................... 3
4.2 Textual Conventions .................................. 5
4.3 Structure of MIB ..................................... 5
4.3.1 The Statistics Group ............................... 6
4.3.2 The History Group .................................. 6
4.3.3 The Alarm Group .................................... 6
4.3.4 The Host Group ..................................... 6
4.3.5 The HostTopN Group ................................. 6
4.3.6 The Matrix Group ................................... 7
4.3.7 The Filter Group ................................... 7
4.3.8 The Packet Capture Group ........................... 7
4.3.9 The Event Group .................................... 7
5. Control of Remote Network Monitoring Devices .......... 7
5.1 Resource Sharing Among Multiple Management Stations .. 8
5.2 Row Addition Among Multiple Management Stations ...... 9
6. Definitions ........................................... 10
7. Acknowledgments ....................................... 80
8. References ............................................ 80
Security Considerations................................... 81
Author's Address.......................................... 81
Remote Network Monitoring Working Group [Page 1]
RFC 1271 Remote Network Monitoring MIB November 1991
1.
This memo defines a portion of the Management Information Base (MIB
for use with network management protocols in TCP/IP-based internets
In particular, it defines objects for managing remote
monitoring devices
2. The Network Management
The Internet-standard Network Management Framework consists of
components. They are
RFC 1155 which defines the SMI, the mechanisms used for
and naming objects for the purpose of management. RFC 1212
defines a more concise description mechanism, which is
consistent with the SMI
RFC 1156 which defines MIB-I, the core set of managed objects
the Internet suite of protocols. RFC 1213, defines MIB-II,
evolution of MIB-I based on implementation experience and
operational requirements
RFC 1157 which defines the SNMP, the protocol used for
access to managed objects
The Framework permits new objects to be defined for the purpose
experimentation and evaluation
3.
Managed objects are accessed via a virtual information store,
the Management Information Base or MIB. Objects in the MIB
defined using the subset of Abstract Syntax Notation One (ASN.1) [7]
defined in the SMI. In particular, each object has a name, a syntax
and an encoding. The name is an object identifier,
administratively assigned name, which specifies an object type.
object type together with an object instance serves to
identify a specific instantiation of the object. For
convenience, we often use a textual string, termed the
DESCRIPTOR, to also refer to the object type
The syntax of an object type defines the abstract data
corresponding to that object type. The ASN.1 language is used
this purpose. However, the SMI [3] purposely restricts the ASN.1
constructs which may be used. These restrictions are explicitly
for simplicity
The encoding of an object type is simply how that object
Remote Network Monitoring Working Group [Page 2]
RFC 1271 Remote Network Monitoring MIB November 1991
is represented using the object type's syntax.
tied to the notion of an object type's syntax and encoding
how the object type is represented when being transmitted
the network
The SMI specifies the use of the basic encoding rules of ASN.1 [8],
subject to the additional requirements imposed by the SNMP
3.1. Format of
Section 6 contains the specification of all object
contained in this MIB module. The object types are
using the conventions defined in the SMI, as amended by
extensions specified in [9,10].
4.
Remote network monitoring devices are instruments that exist for
purpose of managing a network. Often these remote probes
stand-alone devices and devote significant internal resources for
sole purpose of managing a network. An organization may employ
of these devices, one per network segment, to manage its internet.
addition, these devices may be used for a network management
provider to access a client network, often geographically remote
While many of the objects in this document are suitable for
management of any type of network, there are some which are
to managing Ethernet networks. The design of this MIB allows
objects to be defined for other network types. It is intended
future versions of this document will define extensions for
network types such as Token Ring and FDDI
4.1. Remote Network Management
o Offline
There are sometimes conditions when a
station will not be in constant contact with
remote monitoring devices. This is sometimes
design in an attempt to lower communications
(especially when communicating over a WAN
dialup link), or by accident as network
affect the communications between the
station and the probe
For this reason, this MIB allows a probe to
configured to perform diagnostics and to
statistics continuously, even when communication
the management station may not be possible
Remote Network Monitoring Working Group [Page 3]
RFC 1271 Remote Network Monitoring MIB November 1991
efficient. The probe may then attempt to
the management station when an exceptional
occurs. Thus, even in circumstances
communication between management station and probe
not continuous, fault, performance, and
information may be continuously accumulated
communicated to the management station
and efficiently
o Preemptive
Given the resources available on the monitor,
is potentially helpful for it continuously to
diagnostics and to log network performance.
monitor is always available at the onset of
failure. It can notify the management station of
failure and can store historical
information about the failure. This
information can be played back by the
station in an attempt to perform further
into the cause of the problem
o Problem Detection and
The monitor can be configured to
conditions, most notably error conditions,
continuously to check for them. When one of
conditions occurs, the event may be logged,
management stations may be notified in a number
ways
o Value Added
Because a remote monitoring device represents
network resource dedicated exclusively to
management functions, and because it is
directly on the monitored portion of the network,
remote network monitoring device has the
to add significant value to the data it collects
For instance, by highlighting those hosts on
network that generate the most traffic or errors,
probe can give the management station precisely
information it needs to solve a class of problems
o Multiple
An organization may have multiple management
for different units of the organization, for
functions (e.g. engineering and operations), and in
attempt to provide disaster recovery.
environments with multiple management stations
common, the remote network monitoring device has
Remote Network Monitoring Working Group [Page 4]
RFC 1271 Remote Network Monitoring MIB November 1991
deal with more than own management station
potentially using its resources concurrently
4.2. Textual
Two new data types are introduced as a textual convention in this
document. These textual conventions enhance the readability of
specification and can ease comparison with other specifications
appropriate. It should be noted that the introduction of the
textual conventions has no effect on either the syntax nor
semantics of any managed objects. The use of these is merely
artifact of the explanatory method used. Objects defined in terms
one of these methods are always encoded by means of the rules
define the primitive type. Hence, no changes to the SMI or the
are necessary to accommodate these textual conventions which
adopted merely for the convenience of readers and writers in
of the elusive goal of clear, concise, and unambiguous MIB documents
The new data types are: OwnerString and EntryStatus
4.3. Structure of
The objects are arranged into the following groups
-
-
-
-
-
-
-
- packet
-
These groups are the basic unit of conformance. If a
monitoring device implements a group, then it must implement
objects in that group. For example, a managed agent that
the host group must implement the hostControlTable, the hostTable
the hostTimeTable
Remote Network Monitoring Working Group [Page 5]
RFC 1271 Remote Network Monitoring MIB November 1991
All groups in this MIB are optional. Implementations of this
must also implement the system and interfaces group of MIB-II [6].
MIB-II may also mandate the implementation of additional groups
These groups are defined to provide a means of assigning
identifiers, and to provide a method for managed agents to know
objects they must implement
4.3.1. The Statistics
The statistics group contains statistics measured by the probe
each monitored interface on this device. This group
consists of the etherStatsTable but in the future will contain
for other media types including Token Ring and FDDI
4.3.2. The History
The history group records periodic statistical samples from a
and stores them for later retrieval. This group currently
of the historyControlTable and the etherHistoryTable. In
versions of the MIB, this group may contain tables for other
types including Token Ring and FDDI
4.3.3. The Alarm
The alarm group periodically takes statistical samples from
in the probe and compares them to previously configured thresholds
If the monitored variable crosses a threshold, an event is generated
A hysteresis mechanism is implemented to limit the generation
alarms. This group consists of the alarmTable and requires
implementation of the event group
4.3.4. The Host
The host group contains statistics associated with each
discovered on the network. This group discovers hosts on the
by keeping a list of source and destination MAC Addresses seen
good packets promiscuously received from the network. This
consists of the hostControlTable, the hostTable, and
hostTimeTable
4.3.5. The HostTopN
The hostTopN group is used to prepare reports that describe the
that top a list ordered by one of their statistics. The
statistics are samples of one of their base statistics over
interval specified by the management station. Thus, these
are rate based. The management station also selects how many
Remote Network Monitoring Working Group [Page 6]
RFC 1271 Remote Network Monitoring MIB November 1991
hosts are reported. This group consists of the
and the hostTopNTable, and requires the implementation of the
group
4.3.6. The Matrix
The matrix group stores statistics for conversations between sets
two addresses. As the device detects a new conversation, it
a new entry in its tables. This group consists of
matrixControlTable, the matrixSDTable and the matrixDSTable
4.3.7. The Filter
The filter group allows packets to be matched by a filter equation
These matched packets form a data stream that may be captured or
generate events. This group consists of the filterTable and
channelTable
4.3.8. The Packet Capture
The Packet Capture group allows packets to be captured after
flow through a channel. This group consists of
bufferControlTable and the captureBufferTable, and requires
implementation of the filter group
4.3.9. The Event
The event group controls the generation and notification of
from this device. This group consists of the eventTable and
logTable
5. Control of Remote Network Monitoring
Due to the complex nature of the available functions in
devices, the functions often need user configuration. In many cases
the function requires parameters to be set up for a data
operation. The operation can proceed only after these parameters
fully set up
Many functional groups in this MIB have one or more tables in
to set up control parameters, and one or more data tables in which
place the results of the operation. The control tables are
read-write in nature, while the data tables are typically read-only
Because the parameters in the control table often describe
data in the data table, many of the parameters can be modified
when the control entry is invalid. Thus, the method for
these parameters is to invalidate the control entry, causing
deletion and the deletion of any associated data entries, and
Remote Network Monitoring Working Group [Page 7]
RFC 1271 Remote Network Monitoring MIB November 1991
create a new control entry with the proper parameters. Deleting
control entry also gives a convenient method for reclaiming
resources used by the associated data
Some objects in this MIB provide a mechanism to execute an action
the remote monitoring device. These objects may execute an action
a result of a change in the state of the object. For those
in this MIB, a request to set an object to the same value as
currently holds would thus cause no action to occur
To facilitate control by multiple managers, resources have to
shared among the managers. These resources are typically the
and computation resources that a function requires
5.1. Resource Sharing Among Multiple Management
When multiple management stations wish to use functions that
for a finite amount of resources on a device, a method to
this sharing of resources is required. Potential conflicts include
o Two management stations wish to simultaneously
resources that together would exceed the capability
the device
o A management station uses a significant amount
resources for a long period of time
o A management station uses resources and then crashes
forgetting to free the resources so others
use them
A mechanism is provided for each management station
function in this MIB to avoid these conflicts and to help
them when they occur. Each function has a label identifying
initiator (owner) of the function. This label is set by
initiator to provide for the following possibilities
o A management station may recognize resources it
and no longer needs
o A network operator can find the management station
owns the resource and negotiate for it to be freed
o A network operator may decide to unilaterally
resources another network operator has reserved
o Upon initialization, a management station may
resources it had reserved in the past. With
Remote Network Monitoring Working Group [Page 8]
RFC 1271 Remote Network Monitoring MIB November 1991
information it may free the resources if it no
needs them
Management stations and probes should support any format of the
string dictated by the local policy of the organization. It
suggested that this name contain one or more of the following:
address, management station name, network manager's name, location
or phone number. This information will help users to share
resources more effectively
There is often default functionality that the device wishes to
up. The resources associated with this functionality are then
by the device itself. In this case, the device will set the
owner object to a string starting with 'monitor'.
modification of the monitor-owned configuration by network
stations is discouraged. In fact, a network management
should only modify these objects under the direction of
administrator of the probe, often the network administrator
When a network management station wishes to utilize a function in
monitor, it is encouraged to first scan the control table of
function to find an instance with similar parameters to share.
is especially true for those instances owned by the monitor,
can be assumed to change infrequently. If a management
decides to share an instance owned by another management station,
should understand that the management station that owns the
may indiscriminately modify or delete it
5.2. Row Addition Among Multiple Management
The addition of new rows is achieved using the method described
[9]. In this MIB, rows are often added to a table in order
configure a function. This configuration usually involves
that control the operation of the function. The agent must
these parameters to make sure they are appropriate given
defined in this MIB as well as any implementation
restrictions such as lack of resources. The agent implementor may
confused as to when to check these parameters and when to signal
the management station that the parameters are invalid. There
two opportunities
o When the management station sets each parameter object
o When the management station sets the entry status
to valid
If the latter is chosen, it would be unclear to the
station which of the several parameters was invalid and caused
Remote Network Monitoring Working Group [Page 9]
RFC 1271 Remote Network Monitoring MIB November 1991
badValue error to be emitted. Thus, wherever possible,
implementor should choose the former as it will provide
information to the management station
A problem can arise when multiple management stations attempt to
configuration information simultaneously using SNMP. When
involves the addition of a new conceptual row in the same
table, the managers may collide, attempting to create the same entry
To guard against these collisions, each such control entry contains
status object with special semantics that help to arbitrate among
managers. If an attempt is made with the row addition mechanism
create such a status object and that object already exists, an
is returned. When more than one manager simultaneously attempts
create the same conceptual row, only the first will succeed.
others will receive an error
6.
RFC1271-MIB DEFINITIONS ::=
Counter FROM RFC1155-
DisplayString FROM RFC1158-
mib-2 FROM RFC1213-
OBJECT-TYPE FROM RFC-1212;
-- This MIB module uses the extended OBJECT-TYPE macro
-- defined in [9].
-- Remote Network Monitoring
rmon OBJECT IDENTIFIER ::= { mib-2 16 }
-- textual
OwnerString ::=
-- This data type is used to model an
-- assigned name of the owner of a resource.
-- information is taken from the NVT ASCII character set
-- It is suggested that this name contain one or
-- of the following
-- IP address, management station name, network manager'
-- name, location, or phone number
-- In some cases the agent itself will be the owner
-- an entry. In these cases, this string shall be
-- to a string starting with 'monitor'.
Remote Network Monitoring Working Group [Page 10]
RFC 1271 Remote Network Monitoring MIB November 1991
--
-- SNMP access control is articulated entirely in terms
-- the contents of MIB views; access to a particular
-- object instance depends only upon its presence
-- absence in a particular MIB view and never upon
-- value or the value of related object instances. Thus
-- objects of this type afford resolution of
-- contention only among cooperating managers;
-- realize no access control function with
-- to uncooperative parties
--
-- By convention, objects with this syntax are
-- as
--
-- SIZE (0..127)
EntryStatus ::=
{ valid(1),
createRequest(2),
underCreation(3),
invalid(4)
}
-- The status of a table entry
--
-- Setting this object to the value invalid(4) has
-- effect of invalidating the corresponding entry
-- That is, it effectively disassociates the
-- identified with said entry
-- It is an implementation-specific matter as to
-- the agent removes an invalidated entry from the table
-- Accordingly, management stations must be prepared
-- receive tabular information from agents that
-- to entries currently not in use.
-- interpretation of such entries requires
-- of the relevant EntryStatus object
--
-- An existing instance of this object cannot be set
-- createRequest(2). This object may only be set
-- createRequest(2) when this instance is created.
-- this object is created, the agent may wish to
-- supplemental object instances to complete a
-- row in this table. Immediately after completing
-- create operation, the agent must set this object
-- underCreation(3).
--
-- Entries shall exist in the underCreation(3) state
Remote Network Monitoring Working Group [Page 11]
RFC 1271 Remote Network Monitoring MIB November 1991
-- the management station is finished configuring
-- entry and sets this object to valid(1) or aborts
-- setting this object to invalid(4). If the
-- determines that an entry has been in
-- underCreation(3) state for an abnormally long time
-- it may decide that the management station
-- crashed. If the agent makes this decision
-- it may set this object to invalid(4) to reclaim
-- entry. A prudent agent will understand that
-- management station may need to wait for human
-- and will allow for that possibility in
-- determination of this abnormally long period
statistics OBJECT IDENTIFIER ::= { rmon 1 }
history OBJECT IDENTIFIER ::= { rmon 2 }
alarm OBJECT IDENTIFIER ::= { rmon 3 }
hosts OBJECT IDENTIFIER ::= { rmon 4 }
hostTopN OBJECT IDENTIFIER ::= { rmon 5 }
matrix OBJECT IDENTIFIER ::= { rmon 6 }
filter OBJECT IDENTIFIER ::= { rmon 7 }
capture OBJECT IDENTIFIER ::= { rmon 8 }
event OBJECT IDENTIFIER ::= { rmon 9 }
-- The Statistics
--
-- Implementation of the Statistics group is optional
--
-- The statistics group contains statistics measured by
-- probe for each monitored interface on this device.
-- statistics take the form of free running counters
-- start from zero when a valid entry is created
--
-- This group currently has statistics defined only
-- Ethernet interfaces. Each etherStatsEntry
-- statistics for one Ethernet interface. The probe
-- create one etherStats entry for each monitored
-- interface on the device
etherStatsTable OBJECT-
SYNTAX SEQUENCE OF
ACCESS not-
STATUS
"A list of Ethernet statistics entries."
::= { statistics 1 }
Remote Network Monitoring Working Group [Page 12]
RFC 1271 Remote Network Monitoring MIB November 1991
etherStatsEntry OBJECT-
SYNTAX
ACCESS not-
STATUS
"A collection of statistics kept for a
Ethernet interface."
INDEX { etherStatsIndex }
::= { etherStatsTable 1 }
EtherStatsEntry ::= SEQUENCE {
etherStatsIndex INTEGER (1..65535),
etherStatsDataSource OBJECT IDENTIFIER
etherStatsDropEvents Counter
etherStatsOctets Counter
etherStatsPkts Counter
etherStatsBroadcastPkts Counter
etherStatsMulticastPkts Counter
etherStatsCRCAlignErrors Counter
etherStatsUndersizePkts Counter
etherStatsOversizePkts Counter
etherStatsFragments Counter
etherStatsJabbers Counter
etherStatsCollisions Counter
etherStatsPkts64Octets Counter
etherStatsPkts65to127Octets Counter
etherStatsPkts128to255Octets Counter
etherStatsPkts256to511Octets Counter
etherStatsPkts512to1023Octets Counter
etherStatsPkts1024to1518Octets Counter
etherStatsOwner OwnerString
etherStatsStatus
}
etherStatsIndex OBJECT-
SYNTAX INTEGER (1..65535)
ACCESS read-
STATUS
"The value of this object uniquely identifies
etherStats entry."
::= { etherStatsEntry 1 }
etherStatsDataSource OBJECT-
SYNTAX OBJECT
ACCESS read-
STATUS
Remote Network Monitoring Working Group [Page 13]
RFC 1271 Remote Network Monitoring MIB November 1991
"This object identifies the source of the data
this etherStats entry is configured to analyze.
source can be any ethernet interface on this device
In order to identify a particular interface,
object shall identify the instance of the
object, defined in [4,6], for the desired interface
For example, if an entry were to receive data
interface #1, this object would be set to ifIndex.1.
The statistics in this group reflect all
on the local network segment attached to
identified interface
This object may not be modified if the
etherStatsStatus object is equal to valid(1)."
::= { etherStatsEntry 2 }
etherStatsDropEvents OBJECT-
SYNTAX
ACCESS read-
STATUS
"The total number of events in which
were dropped by the probe due to lack of resources
Note that this number is not necessarily the number
packets dropped; it is just the number of times
condition has been detected."
::= { etherStatsEntry 3 }
etherStatsOctets OBJECT-
SYNTAX
ACCESS read-
STATUS
"The total number of octets of data (
those in bad packets) received on
network (excluding framing bits but
FCS octets)."
::= { etherStatsEntry 4 }
etherStatsPkts OBJECT-
SYNTAX
ACCESS read-
STATUS
"The total number of packets (including error packets
received."
::= { etherStatsEntry 5 }
Remote Network Monitoring Working Group [Page 14]
RFC 1271 Remote Network Monitoring MIB November 1991
etherStatsBroadcastPkts OBJECT-
SYNTAX
ACCESS read-
STATUS
"The total number of good packets received that
directed to the broadcast address."
::= { etherStatsEntry 6 }
etherStatsMulticastPkts OBJECT-
SYNTAX
ACCESS read-
STATUS
"The total number of good packets received that
directed to a multicast address. Note that
number does not include packets directed to
broadcast address."
::= { etherStatsEntry 7 }
etherStatsCRCAlignErrors OBJECT-
SYNTAX
ACCESS read-
STATUS
"The total number of packets received
had a length (excluding framing bits,
including FCS octets) of between 64 and 1518
octets, inclusive, but were not an integral
of octets in length or had a bad Frame
Sequence (FCS)."
::= { etherStatsEntry 8 }
etherStatsUndersizePkts OBJECT-
SYNTAX
ACCESS read-
STATUS
"The total number of packets received that
less than 64 octets long (excluding framing bits
but including FCS octets) and were otherwise
formed."
::= { etherStatsEntry 9 }
etherStatsOversizePkts OBJECT-
SYNTAX
ACCESS read-
STATUS
Remote Network Monitoring Working Group [Page 15]
RFC 1271 Remote Network Monitoring MIB November 1991
"The total number of packets received that
longer than 1518 octets (excluding framing bits
but including FCS octets) and were
well formed."
::= { etherStatsEntry 10 }
etherStatsFragments OBJECT-
SYNTAX
ACCESS read-
STATUS
"The total number of packets received that were not
integral number of octets in length or that had a
Frame Check Sequence (FCS), and were less than 64
octets in length (excluding framing bits
including FCS octets)."
::= { etherStatsEntry 11 }
etherStatsJabbers OBJECT-
SYNTAX
ACCESS read-
STATUS
"The total number of packets received that
longer than 1518 octets (excluding framing bits
but including FCS octets), and were not
integral number of octets in length or
a bad Frame Check Sequence (FCS)."
::= { etherStatsEntry 12 }
etherStatsCollisions OBJECT-
SYNTAX
ACCESS read-
STATUS
"The best estimate of the total number of
on this Ethernet segment."
::= { etherStatsEntry 13 }
etherStatsPkts64Octets OBJECT-
SYNTAX
ACCESS read-
STATUS
"The total number of packets (including
packets) received that were 64 octets in
(excluding framing bits but including FCS octets)."
Remote Network Monitoring Working Group [Page 16]
RFC 1271 Remote Network Monitoring MIB November 1991
::= { etherStatsEntry 14 }
etherStatsPkts65to127Octets OBJECT-
SYNTAX
ACCESS read-
STATUS
"The total number of packets (including
packets) received that were
65 and 127 octets in length
(excluding framing bits but including FCS octets)."
::= { etherStatsEntry 15 }
etherStatsPkts128to255Octets OBJECT-
SYNTAX
ACCESS read-
STATUS
"The total number of packets (including
packets) received that were
128 and 255 octets in length
(excluding framing bits but including FCS octets)."
::= { etherStatsEntry 16 }
etherStatsPkts256to511Octets OBJECT-
SYNTAX
ACCESS read-
STATUS
"The total number of packets (including
packets) received that were
256 and 511 octets in length
(excluding framing bits but including FCS octets)."
::= { etherStatsEntry 17 }
etherStatsPkts512to1023Octets OBJECT-
SYNTAX
ACCESS read-
STATUS
"The total number of packets (including
packets) received that were
512 and 1023 octets in length
(excluding framing bits but including FCS octets)."
::= { etherStatsEntry 18 }
Remote Network Monitoring Working Group [Page 17]
RFC 1271 Remote Network Monitoring MIB November 1991
etherStatsPkts1024to1518Octets OBJECT-
SYNTAX
ACCESS read-
STATUS
"The total number of packets (including
packets) received that were
1024 and 1518 octets in length
(excluding framing bits but including FCS octets)."
::= { etherStatsEntry 19 }
etherStatsOwner OBJECT-
SYNTAX
ACCESS read-
STATUS
"The entity that configured this entry and
therefore using the resources assigned to it."
::= { etherStatsEntry 20 }
etherStatsStatus OBJECT-
SYNTAX
ACCESS read-
STATUS
"The status of this etherStats entry."
::= { etherStatsEntry 21 }
-- The History
-- Implementation of the History group is optional
--
-- The history group records periodic statistical samples
-- a network and stores them for later retrieval.
-- historyControl table stores configuration entries that
-- define an interface, polling period, and other parameters
-- Once samples are taken, their data is stored in an
-- in a media-specific table. Each such entry defines
-- sample, and is associated with the historyControlEntry
-- caused the sample to be taken. Currently the only media
-- specific table defined is the etherHistoryTable,
-- Ethernet networks
--
-- If the probe keeps track of the time of day, it
-- start the first sample of the history at a time such
-- when the next hour of the day begins, a sample
-- started at that instant. This tends to make
Remote Network Monitoring Working Group [Page 18]
RFC 1271 Remote Network Monitoring MIB November 1991
-- user-friendly reports, and enables comparison of
-- from different probes that have relatively accurate
-- of day
--
-- The monitor is encouraged to add two history control
-- per monitored interface upon initialization that
-- a short term and a long term polling period.
-- parameters are 30 seconds for the short term
-- period and 30 minutes for the long term period
historyControlTable OBJECT-
SYNTAX SEQUENCE OF
ACCESS not-
STATUS
"A list of history control entries."
::= { history 1 }
historyControlEntry OBJECT-
SYNTAX
ACCESS not-
STATUS
"A list of parameters that set up a
sampling of statistics."
INDEX { historyControlIndex }
::= { historyControlTable 1 }
HistoryControlEntry ::= SEQUENCE {
historyControlIndex INTEGER (1..65535),
historyControlDataSource OBJECT IDENTIFIER
historyControlBucketsRequested INTEGER (1..65535),
historyControlBucketsGranted INTEGER (1..65535),
historyControlInterval INTEGER (1..3600),
historyControlOwner OwnerString
historyControlStatus
}
historyControlIndex OBJECT-
SYNTAX INTEGER (1..65535)
ACCESS read-
STATUS
"An index that uniquely identifies an entry in
historyControl table. Each such entry defines
set of samples at a particular interval for
interface on the device."
::= { historyControlEntry 1 }
Remote Network Monitoring Working Group [Page 19]
RFC 1271 Remote Network Monitoring MIB November 1991
historyControlDataSource OBJECT-
SYNTAX OBJECT
ACCESS read-
STATUS
"This object identifies the source of the data
which historical data was collected
placed in a media-specific table on behalf of
historyControlEntry. This source can be
interface on this device. In order to
a particular interface, this object shall
the instance of the ifIndex object,
in [4,6], for the desired interface. For example
if an entry were to receive data from interface #1,
this object would be set to ifIndex.1.
The statistics in this group reflect all
on the local network segment attached to
identified interface
This object may not be modified if the
historyControlStatus object is equal to valid(1)."
::= { historyControlEntry 2 }
historyControlBucketsRequested OBJECT-
SYNTAX INTEGER (1..65535)
ACCESS read-
STATUS
"The requested number of discrete time
over which data is to be saved in the part of
media-specific table associated with
historyControl entry
When this object is created or modified, the
should set historyControlBucketsGranted as closely
this object as is possible for the particular
implementation and available resources."
DEFVAL { 50 }
::= { historyControlEntry 3 }
historyControlBucketsGranted OBJECT-
SYNTAX INTEGER (1..65535)
ACCESS read-
STATUS
"The number of discrete sampling
over which data shall be saved in the part
Remote Network Monitoring Working Group [Page 20]
RFC 1271 Remote Network Monitoring MIB November 1991
the media-specific table associated with
historyControl entry
When the associated
object is created or modified, the
should set this object as closely to the
value as is possible for the
probe implementation and available resources.
probe must not lower this value except as a
of a modification to the
historyControlBucketsRequested object
There will be times when the actual number
buckets associated with this entry is less
the value of this object. In this case, at
end of each sampling interval, a new bucket
be added to the media-specific table
When the number of buckets reaches the value
this object and a new bucket is to be added to
media-specific table, the oldest bucket
with this historyControlEntry shall be deleted
the agent so that the new bucket can be added
When the value of this object changes to a value
than the current value, entries are
from the media-specific table associated with
historyControlEntry. Enough of the oldest of
entries shall be deleted by the agent so that
number remains less than or equal to the new value
this object
When the value of this object changes to a
greater than the current value, the number
associated media-specific entries may be
to grow."
::= { historyControlEntry 4 }
historyControlInterval OBJECT-
SYNTAX INTEGER (1..3600)
ACCESS read-
STATUS
"The interval in seconds over which the data
sampled for each bucket in the part of
media-specific table associated with
historyControl entry. This interval
be set to any number of seconds between 1
Remote Network Monitoring Working Group [Page 21]
RFC 1271 Remote Network Monitoring MIB November 1991
3600 (1 hour).
Because the counters in a bucket may overflow at
maximum value with no indication, a prudent
will take into account the possibility of
in any of the associated counters. It is
to consider the minimum time in which any
could overflow on a particular media type and
the historyControlInterval object to a value
than this interval. This is typically
important for the 'octets' counter in
media-specific table. For example, on an
network, the etherHistoryOctets counter could
in about one hour at the Ethernet's
utilization
This object may not be modified if the
historyControlStatus object is equal to valid(1)."
DEFVAL { 1800 }
::= { historyControlEntry 5 }
historyControlOwner OBJECT-
SYNTAX
ACCESS read-
STATUS
"The entity that configured this entry and is
using the resources assigned to it."
::= { historyControlEntry 6 }
historyControlStatus OBJECT-
SYNTAX
ACCESS read-
STATUS
"The status of this historyControl entry
Each instance of the media-specific table
with this historyControlEntry will be deleted by
agent if this historyControlEntry is not equal
valid(1)."
::= { historyControlEntry 7 }
-- Ether History
etherHistoryTable OBJECT-
SYNTAX SEQUENCE OF
Remote Network Monitoring Working Group [Page 22]
RFC 1271 Remote Network Monitoring MIB November 1991
ACCESS not-
STATUS
"A list of Ethernet history entries."
::= { history 2 }
etherHistoryEntry OBJECT-
SYNTAX
ACCESS not-
STATUS
"An historical sample of Ethernet statistics on
particular Ethernet interface. This sample
associated with the historyControlEntry which
up the parameters for a regular collection of
samples."
INDEX { etherHistoryIndex , etherHistorySampleIndex }
::= { etherHistoryTable 1 }
EtherHistoryEntry ::= SEQUENCE {
etherHistoryIndex INTEGER (1..65535),
etherHistorySampleIndex INTEGER
etherHistoryIntervalStart TimeTicks
etherHistoryDropEvents Counter
etherHistoryOctets Counter
etherHistoryPkts Counter
etherHistoryBroadcastPkts Counter
etherHistoryMulticastPkts Counter
etherHistoryCRCAlignErrors Counter
etherHistoryUndersizePkts Counter
etherHistoryOversizePkts Counter
etherHistoryFragments Counter
etherHistoryJabbers Counter
etherHistoryCollisions Counter
etherHistoryUtilization INTEGER (0..10000)
}
etherHistoryIndex OBJECT-
SYNTAX INTEGER (1..65535)
ACCESS read-
STATUS
"The history of which this entry is a part.
history identified by a particular value of
index is the same history as
by the same value of historyControlIndex."
::= { etherHistoryEntry 1 }
Remote Network Monitoring Working Group [Page 23]
RFC 1271 Remote Network Monitoring MIB November 1991
etherHistorySampleIndex OBJECT-
SYNTAX
ACCESS read-
STATUS
"An index that uniquely identifies the
sample this entry represents among all
associated with the same historyControlEntry
This index starts at 1 and increases by
as each new sample is taken."
::= { etherHistoryEntry 2 }
etherHistoryIntervalStart OBJECT-
SYNTAX
ACCESS read-
STATUS
"The value of sysUpTime at the start of the
over which this sample was measured. If the
keeps track of the time of day, it should
the first sample of the history at a time such
when the next hour of the day begins, a sample
started at that instant. Note that following
rule may require the probe to delay collecting
first sample of the history, as each sample must
of the same interval. Also note that the sample
is currently being collected is not accessible in
table until the end of its interval."
::= { etherHistoryEntry 3 }
etherHistoryDropEvents OBJECT-
SYNTAX
ACCESS read-
STATUS
"The total number of events in which
were dropped by the probe due to lack of
during this interval. Note that this number is
necessarily the number of packets dropped, it is
the number of times this condition has been detected."
::= { etherHistoryEntry 4 }
etherHistoryOctets OBJECT-
SYNTAX
ACCESS read-
STATUS
"The total number of octets of data (
Remote Network Monitoring Working Group [Page 24]
RFC 1271 Remote Network Monitoring MIB November 1991
those in bad packets) received on
network (excluding framing bits but
FCS octets)."
::= { etherHistoryEntry 5 }
etherHistoryPkts OBJECT-
SYNTAX
ACCESS read-
STATUS
"The number of packets (including error packets
received during this sampling interval."
::= { etherHistoryEntry 6 }
etherHistoryBroadcastPkts OBJECT-
SYNTAX
ACCESS read-
STATUS
"The number of good packets received during
sampling interval that were directed to
broadcast address."
::= { etherHistoryEntry 7 }
etherHistoryMulticastPkts OBJECT-
SYNTAX
ACCESS read-
STATUS
"The number of good packets received during
sampling interval that were directed to
multicast address. Note that this number does
include packets addressed to the broadcast address."
::= { etherHistoryEntry 8 }
etherHistoryCRCAlignErrors OBJECT-
SYNTAX
ACCESS read-
STATUS
"The number of packets received during
sampling interval that had a length (
framing bits but including FCS octets)
64 and 1518 octets, inclusive, but were not
integral number of octets in length or had
bad Frame Check Sequence (FCS)."
::= { etherHistoryEntry 9 }
Remote Network Monitoring Working Group [Page 25]
RFC 1271 Remote Network Monitoring MIB November 1991
etherHistoryUndersizePkts OBJECT-
SYNTAX
ACCESS read-
STATUS
"The number of packets received during
interval that were less than 64 octets
(excluding framing bits but including
octets) and were otherwise well formed."
::= { etherHistoryEntry 10 }
etherHistoryOversizePkts OBJECT-
SYNTAX
ACCESS read-
STATUS
"The number of packets received during
interval that were longer than 1518
(excluding framing bits but including
octets) but were otherwise well formed."
::= { etherHistoryEntry 11 }
etherHistoryFragments OBJECT-
SYNTAX
ACCESS read-
STATUS
"The total number of packets received during
sampling interval that were not an
number of octets in length or
had a bad Frame Check Sequence (FCS),
were less than 64 octets in length (
framing bits but including FCS octets)."
::= { etherHistoryEntry 12 }
etherHistoryJabbers OBJECT-
SYNTAX
ACCESS read-
STATUS
"The number of packets received during
interval that were longer than 1518
(excluding framing bits but including FCS octets),
and were not an integral number of octets
length or had a bad Frame Check Sequence (FCS)."
::= { etherHistoryEntry 13 }
Remote Network Monitoring Working Group [Page 26]
RFC 1271 Remote Network Monitoring MIB November 1991
etherHistoryCollisions OBJECT-
SYNTAX
ACCESS read-
STATUS
"The best estimate of the total number of
on this Ethernet segment during this interval."
::= { etherHistoryEntry 14 }
etherHistoryUtilization OBJECT-
SYNTAX INTEGER (0..10000)
ACCESS read-
STATUS
"The best estimate of the mean physical
network utilization on this interface during
interval, in hundredths of a percent."
::= { etherHistoryEntry 15 }
-- The Alarm
-- Implementation of the Alarm group is optional
--
-- The Alarm Group requires the implementation of the
-- group
--
-- The Alarm group periodically takes statistical samples
-- variables in the probe and compares them to
-- that have been configured. The alarm table
-- configuration entries that each define a variable
-- polling period, and threshold parameters. If a sample
-- found to cross the threshold values, an event
-- generated. Only variables that resolve to an ASN.1
-- primitive type of INTEGER (INTEGER, Counter
-- Gauge, or TimeTicks) may be monitored in this way
--
-- This function has a hysteresis mechanism to limit
-- generation of events. This mechanism generates one
-- as a threshold is crossed in the appropriate direction
-- No more events are generated for that threshold until
-- opposite threshold is crossed
--
-- In the case of a sampling a deltaValue, a probe
-- implement this mechanism with more precision if it
-- a delta sample twice per period, each time comparing
-- sum of the latest two samples to the threshold.
-- allows the detection of threshold
Remote Network Monitoring Working Group [Page 27]
RFC 1271 Remote Network Monitoring MIB November 1991
-- that span the sampling boundary. Note that this does
-- require any special configuration of the threshold value
-- It is suggested that probes implement this more
-- algorithm
alarmTable OBJECT-
SYNTAX SEQUENCE OF
ACCESS not-
STATUS
"A list of alarm entries."
::= { alarm 1 }
alarmEntry OBJECT-
SYNTAX
ACCESS not-
STATUS
"A list of parameters that set up a periodic
for alarm conditions."
INDEX { alarmIndex }
::= { alarmTable 1 }
AlarmEntry ::= SEQUENCE {
alarmIndex INTEGER (1..65535),
alarmInterval INTEGER
alarmVariable OBJECT IDENTIFIER
alarmSampleType INTEGER
alarmValue INTEGER
alarmStartupAlarm INTEGER
alarmRisingThreshold INTEGER
alarmFallingThreshold INTEGER
alarmRisingEventIndex INTEGER (1..65535),
alarmFallingEventIndex INTEGER (1..65535),
alarmOwner OwnerString
alarmStatus
}
alarmIndex OBJECT-
SYNTAX INTEGER (1..65535)
ACCESS read-
STATUS
"An index that uniquely identifies an entry in
alarm table. Each such entry defines
diagnostic sample at a particular
for an object on the device."
::= { alarmEntry 1 }
Remote Network Monitoring Working Group [Page 28]
RFC 1271 Remote Network Monitoring MIB November 1991
alarmInterval OBJECT-
SYNTAX
ACCESS read-
STATUS
"The interval in seconds over which the data
sampled and compared with the rising and
thresholds. When setting this variable,
should be given to ensure that the variable
monitored will not exceed 2^31 - 1 and
over the alarmValue object during the interval
This object may not be modified if the
alarmStatus object is equal to valid(1)."
::= { alarmEntry 2 }
alarmVariable OBJECT-
SYNTAX OBJECT
ACCESS read-
STATUS
"The object identifier of the particular variable
be sampled. Only variables that resolve to an ASN.1
primitive type of INTEGER (INTEGER, Counter, Gauge
or TimeTicks) may be sampled
Because SNMP access control is articulated
in terms of the contents of MIB views, no
control mechanism exists that can restrict the value
this object to identify only those objects that
in a particular MIB view. Because there is thus
acceptable means of restricting the read access
could be obtained through the alarm mechanism,
probe must only grant write access to this object
those views that have read access to all objects
the probe
During a set operation, if the supplied
name is not available in the selected MIB view,
badValue error must be returned. If at any
the variable name of an established alarmEntry
no longer available in the selected MIB view,
probe must change the status of this
to invalid(4).
This object may not be modified if the
alarmStatus object is equal to valid(1)."
::= { alarmEntry 3 }
Remote Network Monitoring Working Group [Page 29]
RFC 1271 Remote Network Monitoring MIB November 1991
alarmSampleType OBJECT-
SYNTAX INTEGER {
absoluteValue(1),
deltaValue(2)
}
ACCESS read-
STATUS
"The method of sampling the selected variable
calculating the value to be compared against
thresholds. If the value of this object
absoluteValue(1), the value of the selected
will be compared directly with the thresholds at
end of the sampling interval. If the value of
object is deltaValue(2), the value of the
variable at the last sample will be subtracted
the current value, and the difference compared
the thresholds
This object may not be modified if the
alarmStatus object is equal to valid(1)."
::= { alarmEntry 4 }
alarmValue OBJECT-
SYNTAX
ACCESS read-
STATUS
"The value of the statistic during the last
period. The value during the current sampling
is not made available until the period is completed."
::= { alarmEntry 5 }
alarmStartupAlarm OBJECT-
SYNTAX INTEGER {
risingAlarm(1),
fallingAlarm(2),
risingOrFallingAlarm(3)
}
ACCESS read-
STATUS
"The alarm that may be sent when this entry is
set to valid. If the first sample after this
becomes valid is greater than or equal to
risingThreshold and alarmStartupAlarm is equal
risingAlarm(1) or risingOrFallingAlarm(3), then
single rising alarm will be generated. If the
Remote Network Monitoring Working Group [Page 30]
RFC 1271 Remote Network Monitoring MIB November 1991
sample after this entry becomes valid is less
or equal to the fallingThreshold
alarmStartupAlarm is equal to fallingAlarm(2)
risingOrFallingAlarm(3), then a single
alarm will be generated
This object may not be modified if the
alarmStatus object is equal to valid(1)."
::= { alarmEntry 6 }
alarmRisingThreshold OBJECT-
SYNTAX
ACCESS read-
STATUS
"A threshold for the sampled statistic. When
current sampled value is greater than or equal
this threshold, and the value at the last
interval was less than this threshold, a
event will be generated
A single event will also be generated if the
sample after this entry becomes valid is
than or equal to this threshold and the
alarmStartupAlarm is equal to risingAlarm(1)
risingOrFallingAlarm(3).
After a rising event is generated, another such
will not be generated until the sampled
falls below this threshold and reaches
alarmFallingThreshold
This object may not be modified if the
alarmStatus object is equal to valid(1)."
::= { alarmEntry 7 }
alarmFallingThreshold OBJECT-
SYNTAX
ACCESS read-
STATUS
"A threshold for the sampled statistic. When
current sampled value is less than or equal
this threshold, and the value at the last
interval was greater than this threshold, a
event will be generated
A single event will also be generated if the
sample after this entry becomes valid is less than
equal to this threshold and the
Remote Network Monitoring Working Group [Page 31]
RFC 1271 Remote Network Monitoring MIB November 1991
alarmStartupAlarm is equal to fallingAlarm(2)
risingOrFallingAlarm(3).
After a falling event is generated, another such
will not be generated until the sampled
rises above this threshold and reaches
alarmRisingThreshold
This object may not be modified if the
alarmStatus object is equal to valid(1)."
::= { alarmEntry 8 }
alarmRisingEventIndex OBJECT-
SYNTAX INTEGER (0..65535)
ACCESS read-
STATUS
"The index of the eventEntry that
used when a rising threshold is crossed.
eventEntry identified by a particular value
this index is the same as identified by the same
of the eventIndex object. If there is
corresponding entry in the eventTable,
no association exists. In particular, if this
is zero, no associated event will be generated,
zero is not a valid event index
This object may not be modified if the
alarmStatus object is equal to valid(1)."
::= { alarmEntry 9 }
alarmFallingEventIndex OBJECT-
SYNTAX INTEGER (0..65535)
ACCESS read-
STATUS
"The index of the eventEntry that
used when a falling threshold is crossed.
eventEntry identified by a particular value
this index is the same as identified by the same
of the eventIndex object. If there is
corresponding entry in the eventTable,
no association exists. In particular, if this
is zero, no associated event will be generated,
zero is not a valid event index
This object may not be modified if the
alarmStatus object is equal to valid(1)."
Remote Network Monitoring Working Group [Page 32]
RFC 1271 Remote Network Monitoring MIB November 1991
::= { alarmEntry 10 }
alarmOwner OBJECT-
SYNTAX
ACCESS read-
STATUS
"The entity that configured this entry and
therefore using the resources assigned to it."
::= { alarmEntry 11 }
alarmStatus OBJECT-
SYNTAX
ACCESS read-
STATUS
"The status of this alarm entry."
::= { alarmEntry 12 }
-- The Host
-- Implementation of the Host group is optional
--
-- The host group discovers new hosts on the network
-- keeping a list of source and destination MAC Addresses
-- in good packets. For each of these addresses, the
-- group keeps a set of statistics. The
-- controls which interfaces this function is performed on
-- and contains some information about the process.
-- behalf of each hostControlEntry, data is collected on
-- interface and placed both the hostTable and
-- hostTimeTable. If the monitoring device finds
-- short of resources, it may delete entries as needed.
-- is suggested that the device delete the least
-- used entries first
-- The hostTable contains entries for each
-- discovered on a particular interface. Each
-- contains statistical data about that host. This
-- is indexed by the MAC address of the host,
-- which a random access may be achieved
-- The hostTimeTable contains data in the same format as
-- hostTable, and must contain the same set of hosts, but
-- indexed using hostTimeCreationOrder rather than hostAddress
-- The hostTimeCreationOrder is an integer which
-- the relative order in which a particular entry
Remote Network Monitoring Working Group [Page 33]
RFC 1271 Remote Network Monitoring MIB November 1991
-- discovered and thus inserted into the table. As
-- order, and thus index, is among those entries
-- in the table, the index for a particular entry may
-- if an (earlier) entry is deleted. Thus the
-- between hostTimeCreationOrder and hostTimeEntry may
-- broken at any time
-- The hostTimeTable has two important uses. The first is
-- fast download of this potentially large table. Because
-- index of this table runs from 1 to the size of the table
-- inclusive, its values are predictable. This allows
-- efficient packing of variables into SNMP PDU's and
-- a table transfer to have multiple packets outstanding
-- These benefits increase transfer rates tremendously
-- The second use of the hostTimeTable is the
-- discovery by the management station of new entries
-- to the table. After the management station
-- downloaded the entire table, it knows that new
-- will be added immediately after the end of the
-- table. It can thus detect new entries
-- and retrieve them easily
-- Because the association between hostTimeCreationOrder
-- hostTimeEntry may be broken at any time, the
-- station must monitor the related
-- object. When the management station thus detects a deletion
-- it must assume that any such associations have been broken
-- and invalidate any it has stored locally. This
-- restarting any download of the hostTimeTable that may
-- been in progress, as well as rediscovering the end of
-- hostTimeTable so that it may detect new entries. If
-- management station does not detect the broken association
-- it may continue to refer to a particular host by
-- creationOrder while unwittingly retrieving the
-- associated with another host entirely. If this
-- while downloading the host table, the management
-- may fail to download all of the entries in the table
hostControlTable OBJECT-
SYNTAX SEQUENCE OF
ACCESS not-
STATUS
"A list of host table control entries."
::= { hosts 1 }
Remote Network Monitoring Working Group [Page 34]