captureBufferControlIndex OBJECT-TYPE SYNTAX Integer32 (1..65535) MAX-ACCESS read-only STATUS current DESCRIPTION "The index of the bufferControlEntry with which this packet is associated." ::= { captureBufferEntry 1 } captureBufferIndex OBJECT-TYPE SYNTAX Integer32 (1..2147483647) MAX-ACCESS read-only STATUS current DESCRIPTION "An index that uniquely identifies an entry in the captureBuffer table associated with a particular bufferControlEntry. This index will start at 1 and increase by one for each new packet added with the same captureBufferControlIndex. Should this value reach 2147483647, the next packet added with the same captureBufferControlIndex shall cause this value to wrap around to 1." ::= { captureBufferEntry 2 } captureBufferPacketID OBJECT-TYPE SYNTAX Integer32 MAX-ACCESS read-only STATUS current DESCRIPTION "An index that describes the order of packets that are received on a particular interface. The packetID of a packet captured on an interface is defined to be greater than the packetID's of all packets captured previously on the same interface. As the captureBufferPacketID object has a maximum positive value of 2^31 - 1, any captureBufferPacketID object shall have the value of the associated packet's packetID mod 2^31." ::= { captureBufferEntry 3 } captureBufferPacketData OBJECT-TYPE SYNTAX OCTET STRING MAX-ACCESS read-only STATUS current DESCRIPTION "The data inside the packet, starting at the beginning of the packet plus any offset specified in the
associated bufferControlDownloadOffset, including any link level headers. The length of the data in this object is the minimum of the length of the captured packet minus the offset, the length of the associated bufferControlCaptureSliceSize minus the offset, and the associated bufferControlDownloadSliceSize. If this minimum is less than zero, this object shall have a length of zero." ::= { captureBufferEntry 4 } captureBufferPacketLength OBJECT-TYPE SYNTAX Integer32 UNITS "Octets" MAX-ACCESS read-only STATUS current DESCRIPTION "The actual length (off the wire) of the packet stored in this entry, including FCS octets." ::= { captureBufferEntry 5 } captureBufferPacketTime OBJECT-TYPE SYNTAX Integer32 UNITS "Milliseconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The number of milliseconds that had passed since this capture buffer was first turned on when this packet was captured." ::= { captureBufferEntry 6 } captureBufferPacketStatus OBJECT-TYPE SYNTAX Integer32 MAX-ACCESS read-only STATUS current DESCRIPTION "A value which indicates the error status of this packet. The value of this object is defined in the same way as filterPktStatus. The value is a sum. This sum initially takes the value zero. Then, for each error, E, that has been discovered in this packet, 2 raised to a value representing E is added to the sum. The errors defined for a packet captured off of an Ethernet interface are as follows: bit # Error 0 Packet is longer than 1518 octets
1 Packet is shorter than 64 octets 2 Packet experienced a CRC or Alignment error 3 First packet in this capture buffer after it was detected that some packets were not processed correctly. 4 Packet's order in buffer is only approximate (May only be set for packets sent from the probe) For example, an Ethernet fragment would have a value of 6 (2^1 + 2^2). As this MIB is expanded to new media types, this object will have other media-specific errors defined." ::= { captureBufferEntry 7 } -- The Event Group -- Implementation of the Event group is optional. -- Consult the MODULE-COMPLIANCE macro for the authoritative -- conformance information for this MIB. -- -- The Event group controls the generation and notification -- of events from this device. Each entry in the eventTable -- describes the parameters of the event that can be triggered. -- Each event entry is fired by an associated condition located -- elsewhere in the MIB. An event entry may also be associated -- with a function elsewhere in the MIB that will be executed -- when the event is generated. For example, a channel may -- be turned on or off by the firing of an event. -- -- Each eventEntry may optionally specify that a log entry -- be created on its behalf whenever the event occurs. -- Each entry may also specify that notification should -- occur by way of SNMP trap messages. In this case, the -- community for the trap message is given in the associated -- eventCommunity object. The enterprise and specific trap -- fields of the trap are determined by the condition that -- triggered the event. Two traps are defined: risingAlarm and -- fallingAlarm. If the eventTable is triggered by a condition -- specified elsewhere, the enterprise and specific trap fields -- must be specified for traps generated for that condition. eventTable OBJECT-TYPE SYNTAX SEQUENCE OF EventEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION
"A list of events to be generated." ::= { event 1 } eventEntry OBJECT-TYPE SYNTAX EventEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "A set of parameters that describe an event to be generated when certain conditions are met. As an example, an instance of the eventLastTimeSent object might be named eventLastTimeSent.6" INDEX { eventIndex } ::= { eventTable 1 } EventEntry ::= SEQUENCE { eventIndex Integer32, eventDescription DisplayString, eventType INTEGER, eventCommunity OCTET STRING, eventLastTimeSent TimeTicks, eventOwner OwnerString, eventStatus EntryStatus } eventIndex OBJECT-TYPE SYNTAX Integer32 (1..65535) MAX-ACCESS read-only STATUS current DESCRIPTION "An index that uniquely identifies an entry in the event table. Each such entry defines one event that is to be generated when the appropriate conditions occur." ::= { eventEntry 1 } eventDescription OBJECT-TYPE SYNTAX DisplayString (SIZE (0..127)) MAX-ACCESS read-create STATUS current DESCRIPTION "A comment describing this event entry." ::= { eventEntry 2 } eventType OBJECT-TYPE SYNTAX INTEGER { none(1), log(2),
snmptrap(3), -- send an SNMP trap logandtrap(4) } MAX-ACCESS read-create STATUS current DESCRIPTION "The type of notification that the probe will make about this event. In the case of log, an entry is made in the log table for each event. In the case of snmp-trap, an SNMP trap is sent to one or more management stations." ::= { eventEntry 3 } eventCommunity OBJECT-TYPE SYNTAX OCTET STRING (SIZE (0..127)) MAX-ACCESS read-create STATUS current DESCRIPTION "If an SNMP trap is to be sent, it will be sent to the SNMP community specified by this octet string." ::= { eventEntry 4 } eventLastTimeSent OBJECT-TYPE SYNTAX TimeTicks MAX-ACCESS read-only STATUS current DESCRIPTION "The value of sysUpTime at the time this event entry last generated an event. If this entry has not generated any events, this value will be zero." ::= { eventEntry 5 } eventOwner OBJECT-TYPE SYNTAX OwnerString MAX-ACCESS read-create STATUS current DESCRIPTION "The entity that configured this entry and is therefore using the resources assigned to it. If this object contains a string starting with 'monitor' and has associated entries in the log table, all connected management stations should retrieve those log entries, as they may have significance to all management stations connected to this device" ::= { eventEntry 6 }
eventStatus OBJECT-TYPE SYNTAX EntryStatus MAX-ACCESS read-create STATUS current DESCRIPTION "The status of this event entry. If this object is not equal to valid(1), all associated log entries shall be deleted by the agent." ::= { eventEntry 7 } -- logTable OBJECT-TYPE SYNTAX SEQUENCE OF LogEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "A list of events that have been logged." ::= { event 2 } logEntry OBJECT-TYPE SYNTAX LogEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "A set of data describing an event that has been logged. For example, an instance of the logDescription object might be named logDescription.6.47" INDEX { logEventIndex, logIndex } ::= { logTable 1 } LogEntry ::= SEQUENCE { logEventIndex Integer32, logIndex Integer32, logTime TimeTicks, logDescription DisplayString } logEventIndex OBJECT-TYPE SYNTAX Integer32 (1..65535) MAX-ACCESS read-only STATUS current DESCRIPTION "The event entry that generated this log entry. The log identified by a particular value of this index is associated with the same eventEntry as identified by the same value of eventIndex."
::= { logEntry 1 } logIndex OBJECT-TYPE SYNTAX Integer32 (1..2147483647) MAX-ACCESS read-only STATUS current DESCRIPTION "An index that uniquely identifies an entry in the log table amongst those generated by the same eventEntries. These indexes are assigned beginning with 1 and increase by one with each new log entry. The association between values of logIndex and logEntries is fixed for the lifetime of each logEntry. The agent may choose to delete the oldest instances of logEntry as required because of lack of memory. It is an implementation-specific matter as to when this deletion may occur." ::= { logEntry 2 } logTime OBJECT-TYPE SYNTAX TimeTicks MAX-ACCESS read-only STATUS current DESCRIPTION "The value of sysUpTime when this log entry was created." ::= { logEntry 3 } logDescription OBJECT-TYPE SYNTAX DisplayString (SIZE (0..255)) MAX-ACCESS read-only STATUS current DESCRIPTION "An implementation dependent description of the event that activated this log entry." ::= { logEntry 4 } -- Remote Network Monitoring Traps rmonEventsV2 OBJECT-IDENTITY STATUS current DESCRIPTION "Definition point for RMON notifications." ::= { rmon 0 } risingAlarm NOTIFICATION-TYPE OBJECTS { alarmIndex, alarmVariable, alarmSampleType, alarmValue, alarmRisingThreshold } STATUS current
DESCRIPTION "The SNMP trap that is generated when an alarm entry crosses its rising threshold and generates an event that is configured for sending SNMP traps." ::= { rmonEventsV2 1 } fallingAlarm NOTIFICATION-TYPE OBJECTS { alarmIndex, alarmVariable, alarmSampleType, alarmValue, alarmFallingThreshold } STATUS current DESCRIPTION "The SNMP trap that is generated when an alarm entry crosses its falling threshold and generates an event that is configured for sending SNMP traps." ::= { rmonEventsV2 2 } -- Conformance information rmonCompliances OBJECT IDENTIFIER ::= { rmonConformance 9 } rmonGroups OBJECT IDENTIFIER ::= { rmonConformance 10 } -- Compliance Statements rmonCompliance MODULE-COMPLIANCE STATUS current DESCRIPTION "The requirements for conformance to the RMON MIB. At least one of the groups in this module must be implemented to conform to the RMON MIB. Implementations of this MIB must also implement the system group of MIB-II [16] and the IF-MIB [17]." MODULE -- this module GROUP rmonEtherStatsGroup DESCRIPTION "The RMON Ethernet Statistics Group is optional." GROUP rmonHistoryControlGroup DESCRIPTION "The RMON History Control Group is optional." GROUP rmonEthernetHistoryGroup DESCRIPTION "The RMON Ethernet History Group is optional." GROUP rmonAlarmGroup DESCRIPTION
"The RMON Alarm Group is optional." GROUP rmonHostGroup DESCRIPTION "The RMON Host Group is mandatory when the rmonHostTopNGroup is implemented." GROUP rmonHostTopNGroup DESCRIPTION "The RMON Host Top N Group is optional." GROUP rmonMatrixGroup DESCRIPTION "The RMON Matrix Group is optional." GROUP rmonFilterGroup DESCRIPTION "The RMON Filter Group is mandatory when the rmonPacketCaptureGroup is implemented." GROUP rmonPacketCaptureGroup DESCRIPTION "The RMON Packet Capture Group is optional." GROUP rmonEventGroup DESCRIPTION "The RMON Event Group is mandatory when the rmonAlarmGroup is implemented." ::= { rmonCompliances 1 } rmonEtherStatsGroup OBJECT-GROUP OBJECTS { etherStatsIndex, etherStatsDataSource, etherStatsDropEvents, etherStatsOctets, etherStatsPkts, etherStatsBroadcastPkts, etherStatsMulticastPkts, etherStatsCRCAlignErrors, etherStatsUndersizePkts, etherStatsOversizePkts, etherStatsFragments, etherStatsJabbers, etherStatsCollisions, etherStatsPkts64Octets, etherStatsPkts65to127Octets, etherStatsPkts128to255Octets, etherStatsPkts256to511Octets, etherStatsPkts512to1023Octets, etherStatsPkts1024to1518Octets, etherStatsOwner, etherStatsStatus } STATUS current DESCRIPTION "The RMON Ethernet Statistics Group."
::= { rmonGroups 1 } rmonHistoryControlGroup OBJECT-GROUP OBJECTS { historyControlIndex, historyControlDataSource, historyControlBucketsRequested, historyControlBucketsGranted, historyControlInterval, historyControlOwner, historyControlStatus } STATUS current DESCRIPTION "The RMON History Control Group." ::= { rmonGroups 2 } rmonEthernetHistoryGroup OBJECT-GROUP OBJECTS { etherHistoryIndex, etherHistorySampleIndex, etherHistoryIntervalStart, etherHistoryDropEvents, etherHistoryOctets, etherHistoryPkts, etherHistoryBroadcastPkts, etherHistoryMulticastPkts, etherHistoryCRCAlignErrors, etherHistoryUndersizePkts, etherHistoryOversizePkts, etherHistoryFragments, etherHistoryJabbers, etherHistoryCollisions, etherHistoryUtilization } STATUS current DESCRIPTION "The RMON Ethernet History Group." ::= { rmonGroups 3 } rmonAlarmGroup OBJECT-GROUP OBJECTS { alarmIndex, alarmInterval, alarmVariable, alarmSampleType, alarmValue, alarmStartupAlarm, alarmRisingThreshold, alarmFallingThreshold, alarmRisingEventIndex, alarmFallingEventIndex, alarmOwner, alarmStatus } STATUS current DESCRIPTION "The RMON Alarm Group." ::= { rmonGroups 4 } rmonHostGroup OBJECT-GROUP OBJECTS { hostControlIndex, hostControlDataSource, hostControlTableSize, hostControlLastDeleteTime, hostControlOwner, hostControlStatus,
hostAddress, hostCreationOrder, hostIndex, hostInPkts, hostOutPkts, hostInOctets, hostOutOctets, hostOutErrors, hostOutBroadcastPkts, hostOutMulticastPkts, hostTimeAddress, hostTimeCreationOrder, hostTimeIndex, hostTimeInPkts, hostTimeOutPkts, hostTimeInOctets, hostTimeOutOctets, hostTimeOutErrors, hostTimeOutBroadcastPkts, hostTimeOutMulticastPkts } STATUS current DESCRIPTION "The RMON Host Group." ::= { rmonGroups 5 } rmonHostTopNGroup OBJECT-GROUP OBJECTS { hostTopNControlIndex, hostTopNHostIndex, hostTopNRateBase, hostTopNTimeRemaining, hostTopNDuration, hostTopNRequestedSize, hostTopNGrantedSize, hostTopNStartTime, hostTopNOwner, hostTopNStatus, hostTopNReport, hostTopNIndex, hostTopNAddress, hostTopNRate } STATUS current DESCRIPTION "The RMON Host Top 'N' Group." ::= { rmonGroups 6 } rmonMatrixGroup OBJECT-GROUP OBJECTS { matrixControlIndex, matrixControlDataSource, matrixControlTableSize, matrixControlLastDeleteTime, matrixControlOwner, matrixControlStatus, matrixSDSourceAddress, matrixSDDestAddress, matrixSDIndex, matrixSDPkts, matrixSDOctets, matrixSDErrors, matrixDSSourceAddress, matrixDSDestAddress, matrixDSIndex, matrixDSPkts, matrixDSOctets, matrixDSErrors } STATUS current DESCRIPTION "The RMON Matrix Group." ::= { rmonGroups 7 } rmonFilterGroup OBJECT-GROUP OBJECTS {
filterIndex, filterChannelIndex, filterPktDataOffset, filterPktData, filterPktDataMask, filterPktDataNotMask, filterPktStatus, filterPktStatusMask, filterPktStatusNotMask, filterOwner, filterStatus, channelIndex, channelIfIndex, channelAcceptType, channelDataControl, channelTurnOnEventIndex, channelTurnOffEventIndex, channelEventIndex, channelEventStatus, channelMatches, channelDescription, channelOwner, channelStatus } STATUS current DESCRIPTION "The RMON Filter Group." ::= { rmonGroups 8 } rmonPacketCaptureGroup OBJECT-GROUP OBJECTS { bufferControlIndex, bufferControlChannelIndex, bufferControlFullStatus, bufferControlFullAction, bufferControlCaptureSliceSize, bufferControlDownloadSliceSize, bufferControlDownloadOffset, bufferControlMaxOctetsRequested, bufferControlMaxOctetsGranted, bufferControlCapturedPackets, bufferControlTurnOnTime, bufferControlOwner, bufferControlStatus, captureBufferControlIndex, captureBufferIndex, captureBufferPacketID, captureBufferPacketData, captureBufferPacketLength, captureBufferPacketTime, captureBufferPacketStatus } STATUS current DESCRIPTION "The RMON Packet Capture Group." ::= { rmonGroups 9 } rmonEventGroup OBJECT-GROUP OBJECTS { eventIndex, eventDescription, eventType, eventCommunity, eventLastTimeSent, eventOwner, eventStatus, logEventIndex, logIndex, logTime, logDescription } STATUS current DESCRIPTION
"The RMON Event Group." ::= { rmonGroups 10 } rmonNotificationGroup NOTIFICATION-GROUP NOTIFICATIONS { risingAlarm, fallingAlarm } STATUS current DESCRIPTION "The RMON Notification Group." ::= { rmonGroups 11 } END6. Security Considerations
In order to implement this MIB, a probe must capture all packets on the locally-attached network, including packets between third parties. These packets are analyzed to collect network addresses, protocol usage information, and conversation statistics. Data of this nature may be considered sensitive in some environments. In such environments the administrator may wish to restrict SNMP access to the probe. This MIB also includes functions for returning the contents of captured packets, potentially including sensitive user data or passwords. It is recommended that SNMP access to these functions be restricted. There are a number of management objects defined in this MIB that have a MAX-ACCESS clause of read-write and/or read-create. Such objects may be considered sensitive or vulnerable in some network environments. The support for SET operations in a non-secure environment without proper protection can have a negative effect on network operations. SNMPv1 by itself is not a secure environment. Even if the network itself is secure (for example by using IPSec), even then, there is no control as to who on the secure network is allowed to access and GET/SET (read/change/create/delete) the objects in this MIB. It is recommended that the implementors consider the security features as provided by the SNMPv3 framework. Specifically, the use of the User-based Security Model RFC 2574 [12] and the View-based Access Control Model RFC 2575 [15] is recommended. It is then a customer/user responsibility to ensure that the SNMP entity giving access to an instance of this MIB, is properly configured to give access to the objects only to those principals (users) that have legitimate rights to indeed GET or SET (change/create/delete) them.
7. Acknowledgments
This document was produced by the IETF Remote Network Monitoring Working Group.8. Author's Address
Steve Waldbusser Phone: +1-650-948-6500 Fax: +1-650-745-0671 Email: waldbusser@nextbeacon.com9. References
[1] Harrington, D., Presuhn, R., and B. Wijnen, "An Architecture for Describing SNMP Management Frameworks", RFC 2571, April 1999. [2] Rose, M. and K. McCloghrie, "Structure and Identification of Management Information for TCP/IP-based Internets", STD 16, RFC 1155, May 1990. [3] Rose, M. and K. McCloghrie, "Concise MIB Definitions", STD 16, RFC 1212, March 1991. [4] Rose, M., "A Convention for Defining Traps for use with the SNMP", RFC 1215, March 1991. [5] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J., Rose, M. and S. Waldbusser, "Structure of Management Information Version 2 (SMIv2)", STD 58, RFC 2578, April 1999. [6] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J., Rose, M. and S. Waldbusser, "Textual Conventions for SMIv2", STD 58, RFC 2579, April 1999. [7] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J., Rose, M. and S. Waldbusser, "Conformance Statements for SMIv2", STD 58, RFC 2580, April 1999. [8] Case, J., Fedor, M., Schoffstall, M. and J. Davin, "Simple Network Management Protocol", STD 15, RFC 1157, May 1990. [9] Case, J., McCloghrie, K., Rose, M. and S. Waldbusser, "Introduction to Community-based SNMPv2", RFC 1901, January 1996.
[10] Case, J., McCloghrie, K., Rose, M. and S. Waldbusser, "Transport Mappings for Version 2 of the Simple Network Management Protocol (SNMPv2)", RFC 1906, January 1996. [11] Case, J., Harrington D., Presuhn R. and B. Wijnen, "Message Processing and Dispatching for the Simple Network Management Protocol (SNMP)", RFC 2572, April 1999. [12] Blumenthal, U. and B. Wijnen, "User-based Security Model (USM) for version 3 of the Simple Network Management Protocol (SNMPv3)", RFC 2574, April 1999. [13] Case, J., McCloghrie, K., Rose, M. and S. Waldbusser, "Protocol Operations for Version 2 of the Simple Network Management Protocol (SNMPv2)", RFC 1905, January 1996. [14] Levi, D., Meyer, P. and B. Stewart, "SNMPv3 Applications", RFC 2573, April 1999. [15] Wijnen, B., Presuhn, R. and K. McCloghrie, "View-based Access Control Model (VACM) for the Simple Network Management Protocol (SNMP)", RFC 2575, April 1999. [16] McCloghrie, K. and M. Rose, Editors, "Management Information Base for Network Management of TCP/IP-based internets: MIB-II", STD 17, RFC 1213, March 1991. [17] McCloghrie, K. and F. Kastenholz, "The Interfaces Group MIB using SMIv2", RFC 2233, November 1997. [18] Waldbusser, S., "Remote Network Monitoring MIB", RFC 1757, February 1995. [19] Waldbusser, S., "Token Ring Extensions to the Remote Network Monitoring MIB", RFC 1513, September 1993. [20] Waldbusser, S., "Remote Network Monitoring Management Information Base Version 2 using SMIv2", RFC 2021, January 1997. [21] Waterman, R., Lahaye, B., Romascanu, D. and S. Waldbusser, "Remote Network Monitoring MIB Extensions for Switched Networks Version 1.0", RFC 2613, June 1999. [22] Case, J., Mundy, R., Partain, D. and B. Stewart, "Introduction to Version 3 of the Internet-standard Network Management Framework", RFC 2570, April 1999.
10. Intellectual Property
The IETF takes no position regarding the validity or scope of any intellectual property or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; neither does it represent that it has made any effort to identify any such rights. Information on the IETF's procedures with respect to rights in standards-track and standards-related documentation can be found in BCP-11. Copies of claims of rights made available for publication and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementors or users of this specification can be obtained from the IETF Secretariat. The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights which may cover technology that may be required to practice this standard. Please address the information to the IETF Executive Director.
11. Full Copyright Statement
Copyright (C) The Internet Society (2000). All Rights Reserved. This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English. The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns. This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Acknowledgement Funding for the RFC Editor function is currently provided by the Internet Society.