RFC 2263
SNMPv3 Applications
RFC 2263: SNMPv3 Applications 🎀
- Network Working Group, Request for Comments: 2263 💅
- Authors: D. Levi (SNMP Research, Inc.), P. Meyer (Secure Computing Corporation), B. Stewart (Cisco Systems) ✨
- Category: Standards Track 🦋
- Date: January 1998 🌸
- Obsoletes / Updates: this copy's header doesn't list anything it obsoletes or updates 🧚
Status of this Memo 📜
okay so this doc is an Internet standards track protocol for the Internet community, and it's asking for discussion and suggestions for improvements 🫶 For the current standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited 💖
Copyright Notice ©️
Copyright (C) The Internet Society (1997). All Rights Reserved. 💜
Abstract 🌈
okay the abstract is giving "here's the whole cast" ✨ This memo describes five types of SNMP applications that use an SNMP engine as described in [RFC2261]. The five are Command Generators, Command Responders, Notification Originators, Notification Receivers, and Proxy Forwarders 👑
It also defines MIB modules for specifying targets of management operations, for notification filtering, and for proxy forwarding 🔥
Table of Contents 🍓
1 Overview ..................................................... 2
1.1 Command Generator Applications ............................. 3
1.2 Command Responder Applications ............................. 3
1.3 Notification Originator Applications ....................... 3
1.4 Notification Receiver Applications ......................... 3
1.5 Proxy Forwarder Applications ............................... 3
2 Management Targets ........................................... 5
3 Elements Of Procedure ........................................ 6
3.1 Command Generator Applications ............................. 6
3.2 Command Responder Applications ............................. 8
3.3 Notification Originator Applications ....................... 13
3.4 Notification Receiver Applications ......................... 16
3.5 Proxy Forwarder Applications ............................... 18
3.5.1 Request Forwarding ....................................... 19
3.5.1.1 Processing an Incoming Request ......................... 19
3.5.1.2 Processing an Incoming Response ........................ 22
3.5.1.3 Processing an Incoming Report Indication ............... 23
3.5.2 Notification Forwarding .................................. 24
4 The Structure of the MIB Modules ............................. 27
4.1 The Management Target MIB Module ........................... 27
4.1.1 Tag Lists ................................................ 28
4.1.2 Definitions .............................................. 28
4.2 The Notification MIB Module ................................ 41
4.2.1 Definitions .............................................. 42
4.3 The Proxy MIB Module ....................................... 53
4.3.1 Definitions .............................................. 53
5 Identification of Management Targets in Notification
Originators ............................................... 59
6 Notification Filtering ....................................... 60
7 Management Target Translation in Proxy Forwarder
Applications .............................................. 61
7.1 Management Target Translation for Request Forwarding ....... 61
7.2 Management Target Translation for Notification Forwarding
........................................................... 62
8 Intellectual Property ........................................ 63
9 Acknowledgments .............................................. 64
10 Security Considerations ..................................... 65
11 References .................................................. 65
12 Editors' Address ............................................ 67
A. Trap Configuration Example .................................. 68
B. Full Copyright Statement .................................... 701. Overview 🦋
okay so this section covers five types of SNMP applications 💅
- Applications that start SNMP
Get,GetNext,GetBulk, and/orSetrequests, called 'command generators.' 🎀 - Applications that respond to SNMP
Get,GetNext,GetBulk, and/orSetrequests, called 'command responders.' ✨ - Applications that generate notifications, called 'notification originators.' 🔥
- Applications that receive notifications, called 'notification receivers.' 🫶
- Applications that forward SNMP
Get,GetNext,GetBulk, and/orSetrequests or notifications, called 'proxy forwarder.' 🧚
Also, there are no restrictions on which types of applications can be paired with a particular SNMP engine 💖 For example, one SNMP engine can totally be associated with both command generator and command responder applications 👑
1.1. Command Generator Applications 🌸
A command generator application starts SNMP Get, GetNext, GetBulk, and/or Set requests, and it also processes the response to any request it generated 💅
1.2. Command Responder Applications 🎀
A command responder application receives SNMP Get, GetNext, GetBulk, and/or Set requests that are meant for the local system. You can tell because the contextEngineID in the received request is equal to that of the local engine the request came in through ✨ The command responder application performs the right protocol operation, using access control, and generates a response message to send back to the request's originator 🦋
1.3. Notification Originator Applications 🔥
A notification originator application conceptually watches a system for particular events or conditions, and it generates Trap and/or Inform messages based on those events or conditions 🫶 A notification originator needs a mechanism for figuring out where to send messages, and which SNMP version and security parameters to use when sending them 🧚 This document provides a mechanism and MIB module for exactly that 💜
1.4. Notification Receiver Applications 🌈
A notification receiver application listens for notification messages, and it generates response messages when a message containing an Inform PDU is received ⭐
1.5. Proxy Forwarder Applications 👑
A proxy forwarder application forwards SNMP messages 💅 Implementing a proxy forwarder application is optional 🎀 The sections describing proxy (4.5, 5.3, and 8) may be skipped for implementations that don't include a proxy forwarder application ✨
The word "proxy" has historically been used super loosely, with lots of different meanings 🙈 Those meanings include (among others):
(1) forwarding SNMP requests to other SNMP entities without caring what managed object types are being accessed. For example, forwarding an SNMP request from one transport domain to another, or translating SNMP requests of one version into SNMP requests of another version 🌸
(2) translating SNMP requests into operations of some non-SNMP management protocol 🦋
(3) supporting aggregated managed objects, where the value of one managed object instance depends on the values of multiple other (remote) items of management information 🔥
Each of these scenarios can be advantageous. For example, aggregating management information can seriously cut the bandwidth needed for large-scale management activities 💖 But using a single term to cover all those different scenarios causes confusion 😭
To avoid that confusion, this document uses "proxy" with a much more tightly defined meaning 🎀 Here, "proxy" refers to a proxy forwarder application that forwards SNMP requests, notifications, and responses without caring what managed objects are contained within them ✨ This definition is most closely related to the first definition above 🧚 Also, in the SNMP architecture [RFC2261], a proxy forwarder is actually an application, and it doesn't have to be tied to what people usually think of as an SNMP agent 🌈
Here's the simple difference between a traditional SNMP agent and a proxy forwarder application 👑
- A proxy forwarder application forwards requests and/or notifications to other SNMP engines according to the context, regardless of the specific managed object types being accessed. It forwards the response to those previously forwarded messages back to the SNMP engine the original message came from 💅
- By contrast, the command responder application that's part of what people usually think of as an SNMP agent processes SNMP requests according to the (names of the) individual managed object types and instances being accessed. It is not a proxy forwarder application from this document's perspective 🙈
So when a proxy forwarder application forwards a request or notification for a particular contextEngineID / contextName pair, the info on how to forward is specifically tied to that context. The proxy forwarder also doesn't need a detailed definition of a MIB view, since it forwards requests regardless of the managed object types 🎀
A command responder application, on the other hand, must have the detailed definition of the MIB view. Even if it needs to issue requests to other entities, via SNMP or otherwise, that need depends on the individual managed object instances being accessed, not just on the context 🦋
Also, it's a design goal of a proxy forwarder application to act as an intermediary between the endpoints of a transaction 💖 Specifically, when forwarding Inform requests, the associated response gets forwarded once it's received from the target the Inform request was forwarded to, rather than generating a response right away when the Inform request comes in ✨
2. Management Targets 🧚
Some types of applications (notification generators and proxy forwarders especially) need a mechanism for figuring out where and how to send generated messages 🫶 This document provides that mechanism and a MIB module for it 💜 The set of information that describes where and how to send a message is called a 'Management Target,' and it has two kinds of information 🔥
- Destination information, made up of a transport domain and a transport address. This is also called a transport endpoint 🌸
- SNMP parameters, made up of message processing model, security model, security level, and security name information 👑
The SNMP-TARGET-MIB module described later in this document has one table for each of these types of information 🌈 There can be a many-to-many relationship between these two types of information in the MIB 💅 That means one transport endpoint can be paired with multiple sets of SNMP parameters, and one set of SNMP parameters can be paired with multiple transport endpoints 🎀
3. Elements Of Procedure ✨
okay so this part is the actual step-by-step for what each kind of app does when it's sending a message or getting one back 💅 Each section below walks through the procedure that application type follows when it builds a message to transmit or processes one it received. Everyone talks to the Dispatcher through the abstract service interfaces defined in [RFC2261] 🫶
3.1. Command Generator Applications
A command generator starts an SNMP request by calling the Dispatcher with this abstract service interface 🎀
statusInformation = -- sendPduHandle if success
-- errorIndication if failure
sendPdu(
IN transportDomain -- transport domain to be used
IN transportAddress -- destination network address
IN messageProcessingModel -- typically, SNMP version
IN securityModel -- Security Model to use
IN securityName -- on behalf of this principal
IN securityLevel -- Level of Security requested
IN contextEngineID -- data from/at this entity
IN contextName -- data from/in this context
IN pduVersion -- the version of the PDU
IN PDU -- SNMP Protocol Data Unit
IN expectResponse -- TRUE or FALSE
)Here's what each argument means 🧚
- transportDomain is the transport domain of the destination of the message.
- transportAddress is the address of the destination of the message.
- messageProcessingModel tells the Dispatcher which Message Processing Model the application wants to use.
- securityModel is the security model the application wants to use.
- securityName is the security model independent name for the principal the application wants the message generated on behalf of.
- securityLevel is the security level the application wants to use.
- contextEngineID is provided by the command generator if it wants to explicitly specify the location of the management information it's requesting.
- contextName is provided by the command generator if it wants to explicitly specify the local context name for the management information it's requesting.
- pduVersion indicates the version of the PDU to be sent.
- PDU is a value the command generator builds, containing the management operation it wants to perform.
- expectResponse indicates that a response is expected.
The result of the sendPdu interface tells you whether the PDU was successfully sent 📬 If it was, the returned value is a sendPduHandle. The command generator should store the sendPduHandle so it can match a response back to the original request 🔥
The Dispatcher is responsible for delivering the response to a particular request to the correct command generator application 👑 The abstract service interface used for that is:
processResponsePdu( -- process Response PDU
IN messageProcessingModel -- typically, SNMP version
IN securityModel -- Security Model in use
IN securityName -- on behalf of this principal
IN securityLevel -- Level of Security
IN contextEngineID -- data from/at this SNMP entity
IN contextName -- data from/in this context
IN pduVersion -- the version of the PDU
IN PDU -- SNMP Protocol Data Unit
IN statusInformation -- success or errorIndication
IN sendPduHandle -- handle from sendPDU
)Where:
- messageProcessingModel is the value from the received response.
- securityModel is the value from the received response.
- securityName is the value from the received response.
- securityLevel is the value from the received response.
- contextEngineID is the value from the received response.
- contextName is the value from the received response.
- pduVersion indicates the version of the PDU in the received response.
- PDU is the value from the received response.
- statusInformation indicates success or failure in receiving the response.
- sendPduHandle is the value returned by the sendPdu call that generated the original request this is a response to.
Here's the procedure when a command generator gets a message 🦋
- If the received values of messageProcessingModel, securityModel, securityName, contextEngineID, contextName, and pduVersion aren't all equal to the values used in the original request, the response gets discarded 🙈
- The operation type, request-id, error-status, error-index, and variable-bindings are extracted from the PDU and saved. If the request-id isn't equal to the value used in the original request, the response gets discarded 💀
- At this point it's up to the application to decide what to do ✨ The specific action is implementation dependent. If the statusInformation says the request failed, an appropriate action might be to try transmitting the request again, or to let the person operating the application know a failure happened 🌸
3.2. Command Responder Applications
A command responder application has to hook itself up to an SNMP engine before it can process messages 🔌 The abstract service interface used for this is:
statusInformation = -- success or errorIndication
registerContextEngineID(
IN contextEngineID -- take responsibility for this one
IN pduType -- the pduType(s) to be registered
)Where:
- statusInformation indicates success or failure of the registration attempt.
- contextEngineID is equal to the snmpEngineID of the SNMP engine the command responder is registering with.
- pduType indicates a Get, GetNext, GetBulk, or Set pdu.
Heads up 🚨 if another command responder application is already registered with an SNMP engine, any further attempts to register with the same contextEngineID and pduType get denied. That means separate command responder applications could register separately for the various pdu types. However, in practice that's undesirable, and only a single command responder application should be registered with an SNMP engine at any given time 🙅♀️
A command responder application can disassociate from an SNMP engine using this abstract service interface:
unregisterContextEngineID(
IN contextEngineID -- give up responsibility for this one
IN pduType -- the pduType(s) to be unregistered
)Where:
- contextEngineID is equal to the snmpEngineID of the SNMP engine the command responder is cancelling the registration with.
- pduType indicates a Get, GetNext, GetBulk, or Set pdu.
Once the command responder has registered with the SNMP engine, it waits to receive SNMP messages 👀 The abstract service interface used for receiving them is:
processPdu( -- process Request/Notification PDU
IN messageProcessingModel -- typically, SNMP version
IN securityModel -- Security Model in use
IN securityName -- on behalf of this principal
IN securityLevel -- Level of Security
IN contextEngineID -- data from/at this SNMP entity
IN contextName -- data from/in this context
IN pduVersion -- the version of the PDU
IN PDU -- SNMP Protocol Data Unit
IN maxSizeResponseScopedPDU -- maximum size of the Response PDU
IN stateReference -- reference to state information
) -- needed when sending a responseWhere:
- messageProcessingModel indicates which Message Processing Model received and processed the message.
- securityModel is the value from the received message.
- securityName is the value from the received message.
- securityLevel is the value from the received message.
- contextEngineID is the value from the received message.
- contextName is the value from the received message.
- pduVersion indicates the version of the PDU in the received message.
- PDU is the value from the received message.
- maxSizeResponseScopedPDU is the maximum allowable size of a ScopedPDU containing a Response PDU (based on the maximum message size the originator of the message can accept).
- stateReference is a value that references cached information about each received request message. This value must be returned to the Dispatcher in order to generate a response 🫶
Here's the procedure when a message is received 🎀
- The operation type is determined from the ASN.1 tag value associated with the PDU parameter. The operation type should always be one of the types previously registered by the application.
- The request-id is extracted from the PDU and saved.
- If the SNMPv2 operation type is GetBulk, the non-repeaters and max-repetitions values are extracted from the PDU and saved.
- The variable-bindings are extracted from the PDU and saved.
(5) Okay bestie, this is where the actual management operation happens 💅✨ The SNMPv2 operation type gets performed against the relevant MIB view inside the context named by the contextName, following the procedures in [RFC1905] 🦋. The relevant MIB view is decided by the securityLevel, securityModel, contextName, securityName, and SNMPv2 operation type. To check whether a particular object instance is inside that view, you call this abstract service interface:
statusInformation = -- success or errorIndication
isAccessAllowed(
IN securityModel -- Security Model in use
IN securityName -- principal who wants to access
IN securityLevel -- Level of Security
IN viewType -- read, write, or notify view
IN contextName -- context containing variableName
IN variableName -- OID for the managed object
)Where:
- The securityModel is the value from the received message. 🔥
- The securityName is the value from the received message. 🔥
- The securityLevel is the value from the received message. 🔥
- The viewType tells you whether the PDU type is a read or a write operation. 👀
- The contextName is the value from the received message. 🔥
- The variableName is the object instance of the variable whose access rights are being checked. 🧚
Normally, the result of the management operation is a new PDU value, and processing carries on to step (6) below. 🌸 However, at any time during the processing of the management operation:
- If the isAccessAllowed ASI returns a noSuchView, noAccessEntry, or noGroupName error, processing of the management operation is halted. A PDU value is constructed from the values in the originally received PDU, but with error_status replaced by an authorizationError code and error_index set to 0, and control passes to step (6) below. 🙈
- If the isAccessAllowed ASI returns an otherError, processing of the management operation is halted. A different PDU value is constructed from the values in the originally received PDU, but with error_status replaced by a genError code, and control passes to step (6) below. 💀
- If the isAccessAllowed ASI returns a noSuchContext error, processing of the management operation is halted, no result PDU is generated, the snmpUnknownContexts counter is incremented, and control passes to step (6) below. 😭
- If the context named by the contextName parameter is unavailable, processing of the management operation is halted, no result PDU is generated, the snmpUnavailableContexts counter is incremented, and control passes to step (6) below. 😭
(6) The Dispatcher gets called to generate a response or report message 🎀. The abstract service interface looks like this:
returnResponsePdu(
IN messageProcessingModel -- typically, SNMP version
IN securityModel -- Security Model in use
IN securityName -- on behalf of this principal
IN securityLevel -- same as on incoming request
IN contextEngineID -- data from/at this SNMP entity
IN contextName -- data from/in this context
IN pduVersion -- the version of the PDU
IN PDU -- SNMP Protocol Data Unit
IN maxSizeResponseScopedPDU -- maximum size of the Response PDU
IN stateReference -- reference to state information
-- as presented with the request
IN statusInformation -- success or errorIndication
) -- error counter OID/value if errorWhere:
- The messageProcessingModel is the value from the processPdu call. 🍓
- The securityModel is the value from the processPdu call. 🍓
- The securityName is the value from the processPdu call. 🍓
- The securityLevel is the value from the processPdu call. 🍓
- The contextEngineID is the value from the processPdu call. 🍓
- The contextName is the value from the processPdu call. 🍓
- The pduVersion says which version of the PDU gets returned. If no result PDU was generated, the pduVersion is an undefined value. 🤷♀️
- The PDU is the result generated in step (5) above. If no result PDU was generated, the PDU is an undefined value. 🤷♀️
- The maxSizeResponseScopedPDU is a local value saying the largest ScopedPDU the application can accept. 💜
- The stateReference is the value from the processPdu call. 🍓
- The statusInformation either says no error occurred and a response should be generated, or says an error occurred along with the OID and counter value of the appropriate error counter object. 🫶
Note that a command responder application should always call the returnResponsePdu abstract service interface, even when there's an error like a resource allocation error. 🚨 In that case, the PDU value passed to returnResponsePdu should contain appropriate values for errorStatus and errorIndex. 🫶
3.3. Notification Originator Applications
A notification originator application generates SNMP notification messages ✨. A notification message may, for example, contain an SNMPv2-Trap PDU or an Inform PDU. However, a particular implementation is not required to be capable of generating both types of messages. 🦋
Notification originator applications need a way to identify the management targets that notifications should go to 🎯. The particular mechanism is implementation dependent. However, if an implementation makes the configuration of management targets SNMP manageable, it MUST use the SNMP-TARGET-MIB module described in this document. 🔥
When a notification originator wants to generate a notification, it must first figure out which context holds the information to be conveyed in the notification, i.e., it must determine the contextEngineID and contextName 🧠. It must then determine the set of management targets the notification should be sent to. The application must also determine, for each management target, whether the notification message should contain an SNMPv2-Trap PDU or an Inform PDU, and if it's going to contain an Inform PDU, the number of retries and the retransmission algorithm. 💅
The mechanism a notification originator uses to determine this information is implementation dependent. Once the application has worked this out, the following procedure runs for each management target:
(1) Any appropriate filtering mechanisms are applied to determine whether the notification should be sent to the management target. If those filtering mechanisms say the notification should not be sent, processing moves on to the next management target. Otherwise, 🙃
(2) The appropriate set of variable-bindings is retrieved from local MIB instrumentation within the relevant MIB view. The relevant MIB view is determined by the securityLevel, securityModel, contextName, and securityName of the management target. To check whether a particular object instance is in the relevant MIB view, the isAccessAllowed abstract service interface is used, the same way as described in the preceding section. If the statusInformation returned by isAccessAllowed does not indicate accessAllowed, the notification is not sent to the management target. 🙅♀️
(3) A PDU is constructed using a locally unique request-id value, an operation type of SNMPv2-Trap or Inform, an error-status and error-index value of 0, and the variable-bindings supplied previously in step (2). 🎀
(4) If the notification contains an SNMPv2-Trap PDU, the Dispatcher is called using the following abstract service interface:
statusInformation = -- sendPduHandle if success
-- errorIndication if failure
sendPdu(
IN transportDomain -- transport domain to be used
IN transportAddress -- destination network address
IN messageProcessingModel -- typically, SNMP version
IN securityModel -- Security Model to use
IN securityName -- on behalf of this principal
IN securityLevel -- Level of Security requested
IN contextEngineID -- data from/at this entity
IN contextName -- data from/in this context
IN pduVersion -- the version of the PDU
IN PDU -- SNMP Protocol Data Unit
IN expectResponse -- TRUE or FALSE
)Where:
- The transportDomain is that of the management target. 🌈
- The transportAddress is that of the management target. 🌈
- The messageProcessingModel is that of the management target. 🌈
- The securityModel is that of the management target. 🌈
- The securityName is that of the management target. 🌈
- The securityLevel is that of the management target. 🌈
- The contextEngineID is the value originally determined for the notification. 🧚
- The contextName is the value originally determined for the notification. 🧚
- The pduVersion is the version of the PDU to be sent. 🧚
- The PDU is the value constructed in step (3) above. 🧚
- The expectResponse argument indicates that no response is expected. 🙈
Otherwise,
(5) If the notification contains an Inform PDU, then:
a) The Dispatcher is called using the sendPdu abstract service interface as described in step (4) above, except that the expectResponse argument indicates that a response is expected. 📣
b) The application caches information about the management target. 🗂️
c) If a response is received within an appropriate time interval from the transport endpoint of the management target, the notification is considered acknowledged and the cached information is deleted. Otherwise, 🥳
d) If a response is not received within an appropriate time period, or if a report indication is received, information about the management target is retrieved from the cache, and steps a) through d) are repeated. The number of times these steps are repeated is equal to the previously determined retry count. If this retry count is exceeded, the acknowledgement of the notification is considered to have failed, and processing of the notification for this management target is halted. 😤
Responses to Inform PDU notifications will be received via the processResponsePDU abstract service interface. 📬
3.4. Notification Receiver Applications 📬
Notification receiver applications are the ones that catch SNMP Notification messages coming from the Dispatcher, so they're basically the main character of the notification world 💅. Before they can receive anything, they have to register with the Dispatcher using the registerContextEngineID abstract service interface. The parameters are:
- The
contextEngineIDis an undefined 'wildcard' value. Notifications get delivered to a registered receiver no matter whatcontextEngineIDis in the notification message. It's giving open invite 🫶 - The
pduTypetells the Dispatcher which kinds of notifications the app wants, likeSNMPv2-TrapPDUs orInformPDUs.
Once the receiver is registered, messages come in through the processPdu abstract service interface. The parameters are:
- The
messageProcessingModelsays which Message Processing Model received and processed the message. - The
securityModelis the value from the received message. - The
securityNameis the value from the received message. - The
securityLevelis the value from the received message. - The
contextEngineIDis the value from the received message. - The
contextNameis the value from the received message. - The
pduVersionshows the version of the PDU in the received message. - The
PDUis the value from the received message. - The
maxSizeResponseScopedPDUis the biggest a ScopedPDU containing a Response PDU is allowed to be. This is based on the maximum message size that the message's originator can accept 📏 - If the message contains an
SNMPv2-TrapPDU, thestateReferenceis undefined and unused. Otherwise, thestateReferenceis a value that references cached info about the notification. This value must be returned to the Dispatcher so a response can be generated 🔑
When an SNMPv2-Trap PDU shows up at a notification receiver application, the app first pulls the SNMP operation type, request-id, error-status, error-index, and variable-bindings out of the PDU. After that, what happens next depends on the implementation. It's a choose-your-own-adventure moment 🧚
When an Inform PDU is received, the notification receiver application follows this procedure:
- The SNMPv2 operation type,
request-id,error-status,error-index, andvariable-bindingsare extracted from the PDU. - A Response PDU is constructed using the extracted
request-idandvariable-bindings, witherror-statusanderror-indexboth set to0. Clean and tidy ✨ - The Dispatcher is called to generate a response message using the
returnResponsePduabstract service interface. The parameters are:- The
messageProcessingModelis the value from theprocessPducall. - The
securityModelis the value from theprocessPducall. - The
securityNameis the value from theprocessPducall. - The
securityLevelis the value from theprocessPducall. - The
contextEngineIDis the value from theprocessPducall. - The
contextNameis the value from theprocessPducall. - The
pduVersionshows the version of the PDU to be returned. - The
PDUis the result generated in step (2) above. - The
maxSizeResponseScopedPDUis a local value showing the biggest ScopedPDU the application can accept. - The
stateReferenceis the value from theprocessPducall. - The
statusInformationsays no error happened and a response should be generated 🎉
- The
3.5. Proxy Forwarder Applications 🎀
A proxy forwarder application handles forwarding SNMP messages. There are four basic types of messages it might need to forward. They get grouped by the PDU type inside the message, or by whether the message has a report indication in it 🦋 The four basic types are:
- Messages with PDU types generated by a command generator application, like Get, GetNext, GetBulk, and Set PDU types. These are about requesting or changing info that lives inside a particular context.
- Messages with PDU types generated by a notification originator application, like SNMPv2-Trap and Inform PDU types. These are about notifications concerning info that lives inside a particular context.
- Messages containing a Response PDU type. Response PDUs only ever get forwarded because a previously forwarded message got a response 🔁
- Messages containing a report indication. Report indications only ever get forwarded because a report indication came back for a previously forwarded message.
For the first type, the proxy forwarder's job is to deliver a request for management info to an SNMP engine that's "closer" or "downstream in the path" to the engine that has access to that info. It also delivers the response with the info back to the SNMP engine the request came from 🧭 The context information in a request is what decides which SNMP engine has access to the requested info, and that decides where and how the request gets forwarded.
For the second type, the proxy forwarder's job is to figure out which SNMP engines should get notifications about management info from a particular location. The context information in a notification message says where the info in the notification applies. That's what decides which SNMP engines should hear about it 📣
For the third type, the proxy forwarder figures out which previously forwarded request or notification (if there is one) the response matches, and forwards the response back to whoever started that request or notification.
For the fourth type, the proxy forwarder figures out which previously forwarded request or notification (if there is one) the report indication matches, and forwards the report indication back to whoever started that request or notification.
When forwarding messages, a proxy forwarder application has to translate incoming management target info into outgoing management target info. How that translation works is up to the implementation. Usually it's driven by a preconfigured translation table 🗂️ If a proxy forwarder application makes the contents of that table SNMP manageable, it MUST use the SNMP-PROXY-MIB module defined in this document. No skipping this one, bestie 🚫
3.5.1. Request Forwarding
Request forwarding has two phases. First, the incoming request gets passed through the proxy application. Then, the resulting response gets passed back. These two phases are described in the next two sections 🫶
3.5.1.1. Processing an Incoming Request
A proxy forwarder application that wants to forward request messages has to register with the Dispatcher first, using the registerContextEngineID abstract service interface. The proxy forwarder must register each contextEngineID it wants to forward messages for, and it has to register for each pduType too. Heads up: when the proxy forwarder's configuration changes, the particular contextEngineID values it forwards for can change too. The proxy forwarder should call the registerContextEngineID and unregisterContextEngineID abstract service interfaces as needed so they match its current configuration 🔄
A proxy forwarder application should never try to register a contextEngineID value equal to the snmpEngineID of the SNMP engine the proxy forwarder is attached to. Don't do it, periodt 🙅♀️
Once the proxy forwarder has registered for the right contextEngineID values, it can start processing messages. Here's the procedure it follows ✨
- A message is received using the
processPduabstract service interface. The incoming management target info received from theprocessPduinterface gets translated into outgoing management target info. This translation may vary for different values ofcontextEngineIDand/orcontextName. The translation should result in a single management target 🎯 - If appropriate outgoing management target info can't be found, the proxy forwarder increments the
snmpProxyDropscounter [RFC1907], and then calls the Dispatcher using thereturnResponsePduabstract service interface. The parameters are:- The
messageProcessingModelis the value from theprocessPducall. - The
securityModelis the value from theprocessPducall. - The
securityNameis the value from theprocessPducall. - The
securityLevelis the value from theprocessPducall. - The
contextEngineIDis the value from theprocessPducall. - The
contextNameis the value from theprocessPducall. - The
pduVersionis the value from theprocessPducall. - The
PDUis an undefined value. - The
maxSizeResponseScopedPDUis a local value showing the biggest ScopedPDU the application can accept. - The
stateReferenceis the value from theprocessPducall. - The
statusInformationsays an error happened and includes the OID and value of thesnmpProxyDropsobject 🚨
- The
Processing of the message stops at this point. Otherwise,
- A new PDU is constructed. A unique value of
request-idshould be used in the new PDU, because this value is what lets a later response message get matched up with this request 🔑 The rest of the new PDU is identical to the received PDU, unless the incoming SNMP version is SNMPv2 or SNMPv3 and the outgoing SNMP version is SNMPv1. In that case, the proxy forwarder must apply the translation rules documented in [RFC1908] 🔧 - The proxy forwarder calls the Dispatcher to generate the forwarded message, using the
sendPduabstract service interface. The parameters are:- The
transportDomainis that of the outgoing management target. - The
transportAddressis that of the outgoing management target. - The
messageProcessingModelis that of the outgoing management target. - The
securityModelis that of the outgoing management target. - The
securityNameis that of the outgoing management target. - The
securityLevelis that of the outgoing management target. - The
contextEngineIDis the value originally received. - The
contextNameis the value originally received. - The
pduVersionis the version of the PDU to be sent. - The
PDUis the value constructed in step (3) above. - The
expectResponseargument shows that a response is expected. If thesendPducall is unsuccessful, the proxy forwarder performs the steps described in (2) above. Otherwise:
- The
(5) okay so the proxy forwarder has to cache a bunch of stuff 🧠 so it can match the reply to the request it forwarded. that means it saves:
- the
sendPduHandlereturned from the call tosendPdu, - the
request-idfrom the received PDU, - the
contextEngineID, - the
contextName, - the
stateReference, - the incoming management target information,
- the outgoing management information,
- and any other info needed to match an incoming response to the forwarded request 🗂️✨
if it can't cache all this (maybe because it's out of resources 😭), the proxy forwarder does the steps from (2) above again. otherwise:
(6) processing of the request just pauses 🫠 until either a response to the forwarded request shows up, or an appropriate time interval runs out. if that time runs out before any response arrives, the cached info about this request gets deleted 🗑️ bye bye.
3.5.1.2. Processing an Incoming Response
a proxy forwarder follows this procedure whenever an incoming response comes in 💌
(1) the incoming response is received using the processResponsePdu interface. the proxy forwarder uses the received parameters to find an entry in its cache of pending forwarded requests. it does this by matching the received parameters against the cached values of sendPduHandle, contextEngineID, contextName, outgoing management target information, and the request-id in the received PDU (the proxy forwarder must pull out the request-id for this part 🔍). if no appropriate cache entry can be found, processing of the response is halted. otherwise:
(2) the cache info gets pulled out, and then removed from the cache 🧹
(3) a brand new Response PDU is constructed, using the request-id value from the original forwarded request (the one pulled from the cache). all the other values are identical to the ones in the received Response PDU 💖
(4) if the incoming SNMP version is SNMPv1 and the outgoing SNMP version is SNMPv2 or SNMPv3, the proxy forwarder must apply the translation rules documented in [RFC1908] 🔄
(5) the proxy forwarder calls the Dispatcher using the returnResponsePdu abstract service interface. the parameters are:
messageProcessingModel: the Message Processing Model that the original incoming message was processed by 🎀securityModel: the one from the original incoming management target, pulled from the cachesecurityName: the one from the original incoming management target, pulled from the cachesecurityLevel: the one from the original incoming management target, pulled from the cachecontextEngineID: the value pulled from the cachecontextName: the value pulled from the cachepduVersion: the version of the PDU to be returnedPDU: the (possibly translated) Response PDUmaxSizeResponseScopedPDU: a local value for the maximum size of a ScopedPDU the application can acceptstateReference: the value pulled from the cachestatusInformation: says no error happened and that a Response PDU message should be generated ✅
3.5.1.3. Processing an Incoming Report Indication
a proxy forwarder follows this procedure when an incoming report indication shows up 👀
(1) the incoming report indication is received using the processResponsePdu interface. the proxy forwarder uses the received parameters to find an entry in its cache of pending forwarded requests. it does this by matching the received parameters against the cached value of sendPduHandle. if no appropriate cache entry can be found, processing of the report indication is halted. otherwise:
(2) the cache info gets pulled out, and then removed from the cache 🧹
(3) if the original incoming management target information indicates SNMPv1, processing of the report indication is halted 🛑
(4) the proxy forwarder calls the Dispatcher using the returnResponsePdu abstract service interface. the parameters are:
messageProcessingModel: the Message Processing Model that the original incoming message was processed by 🎀securityModel: the one from the original incoming management target, pulled from the cachesecurityName: the one from the original incoming management target, pulled from the cachesecurityLevel: the one from the original incoming management target, pulled from the cachecontextEngineID: the value pulled from the cachecontextName: the value pulled from the cachepduVersion: the version of the PDU to be returnedPDU: unused 🙈maxSizeResponseScopedPDU: a local value for the maximum size of a ScopedPDU the application can acceptstateReference: the value pulled from the cachestatusInformation: contains thecontextEngineID,contextName, counter OID, and counter value received in the report indication 📊
3.5.2. Notification Forwarding
a proxy forwarder gets notifications the same way a notification receiver application does, using the processPdu abstract service interface 📨 when a notification comes in, it follows this procedure:
(1) the incoming management target information received from the processPdu interface gets translated into outgoing management target information. heads up, this translation can change depending on the values of contextEngineId and/or contextName 👀 and it might end up with multiple management targets 🎯
(2) if no appropriate outgoing management target information can be found and the notification was a Trap, processing of the notification is halted 🛑. if no appropriate outgoing management target information can be found and the notification was an Inform, the proxy forwarder increments the snmpProxyDrops object, and calls the Dispatcher using the returnResponsePdu abstract service interface.
the parameters are:
messageProcessingModel: the received valuesecurityModel: the received valuesecurityName: the received valuesecurityLevel: the received valuecontextEngineID: the received valuecontextName: the received valuepduVersion: the received valuePDU: an undefined and unused value 🫥maxSizeResponseScopedPDU: a local value for the maximum size of a ScopedPDU the application can acceptstateReference: the received valuestatusInformation: says an error happened and that a Report message should be generated ⚠️
processing of the message stops right there 🛑 otherwise,
(3) the proxy forwarder generates a notification using the procedures in the preceding section on Notification Originators, with these exceptions:
- the
contextEngineIDandcontextNamevalues from the original received notification are used - the outgoing management targets determined earlier are used
- no filtering mechanisms are applied 🚫
- the variable-bindings from the original received notification are used, instead of grabbing variable-bindings from local MIB instrumentation. and no access-control is applied to these variable-bindings 🔓
- if, for any of the outgoing management targets, the incoming SNMP version is SNMPv1 and the outgoing SNMP version is SNMPv2 or SNMPv3, the proxy forwarder must apply the translation rules documented in [RFC1908] 🔄
- if, for any of the outgoing management targets, the incoming SNMP version is SNMPv2 or SNMPv3 and the outgoing SNMP version is SNMPv1, that outgoing management target is not used when generating the forwarded notifications 🙅
(4) if the original received notification contains an SNMPv2-Trap PDU, processing of the notification is now completed 🎉. otherwise, the original received notification must contain an Inform PDU, and processing continues.
(5) if the forwarded notifications included any Inform PDUs, processing continues when the procedures in the section for Notification Originators decide either that:
- none of the generated notifications containing Inform PDUs have been successfully acknowledged within the longest of the time intervals, in which case processing of the original notification is halted 😔, or,
- at least one of the generated notifications containing Inform PDUs is successfully acknowledged, in which case a response to the original received notification containing an Inform PDU is generated as described in the following steps 💅
(6) a Response PDU is constructed, using the values of request-id and variable-bindings from the original received Inform PDU, and error-status and error-index values of 0 🧁
(7) the Dispatcher is called using the returnResponsePdu abstract service interface. the parameters are:
messageProcessingModel: the originally received valuesecurityModel: the originally received valuesecurityName: the originally received valuesecurityLevel: the originally received valuecontextEngineID: the originally received valuecontextName: the originally received valuepduVersion: the version of the PDU constructed in step (6) abovePDU: the value constructed in step (6) abovemaxSizeResponseScopedPDU: a local value for the maximum size of a ScopedPDU the application can acceptstateReference: the originally received valuestatusInformation: says no error happened and that a Response PDU message should be generated 🌸
4. The Structure of the MIB Modules
okay now we get to the MIB modules 🧚 there are three separate ones described in this document: the management target MIB, the notification MIB, and the proxy MIB. the next sections explain how these three are structured 🎀
the way particular types of applications use these MIBs is covered later in the document:
- the management target MIB and the notification MIB in notification originator applications are described in section 6 🔔
- the notification MIB for filtering notifications in notification originator applications is described in section 7 🧹
- the management target MIB and the proxy MIB in proxy forwarding applications are described in section 8 🔁
4.1. The Management Target MIB Module
okay so the SNMP-TARGET-MIB module is where you define your management targets 🎯 it's got two tables plus the conformance and compliance statements 💅
the first table is the snmpTargetAddrTable 🦋 it holds transport domains and addresses, and it has an object called snmpTargetAddrTagList that lets you group entries together ✨
the second table is the snmpTargetParamsTable 🌸 this one stores the SNMP version and security info to use when sending messages to particular transport domains and addresses 🔐
4.1.1. Tag Lists
this part is so cute 🎀 snmpTargetAddrTagList is how you group entries in the snmpTargetAddrTable. its value is a list of tag values, and those tag values are used to pick which target addresses get used for a particular operation 💖
a tag value (which can also show up in MIB objects other than snmpTargetAddrTagList) is an arbitrary string of octets, but it may not contain a delimiter character 🙅 the delimiter characters are:
- An ASCII space character (
0x20). - An ASCII TAB character (
0x09). - An ASCII carriage return (CR) character (
0x0D). - An ASCII line feed (LF) character (
0x0B).
also, a tag value may not have a zero length 💀 generally, a particular MIB object will contain either:
- a single tag value, in which case the value of the MIB object may not contain a delimiter character, or:
- a list of tag values, separated by single delimiter characters.
for a list of tag values, those rules add up to a few restrictions on the value of the MIB object:
- There cannot be a leading or trailing delimiter character.
- There cannot be multiple adjacent delimiter characters.
4.1.2. Definitions
here's the whole MIB module, no edits 🙈 main character energy 👑
SNMP-TARGET-MIB DEFINITIONS ::= BEGIN
IMPORTS
TEXTUAL-CONVENTION,
MODULE-IDENTITY,
OBJECT-TYPE,
snmpModules,
Integer32
FROM SNMPv2-SMI
TDomain,
TAddress,
TimeInterval,
RowStatus,
StorageType,
TestAndIncr
FROM SNMPv2-TC
SnmpSecurityModel,
SnmpMessageProcessingModel,
SnmpSecurityLevel,
SnmpAdminString
FROM SNMP-FRAMEWORK-MIB
OBJECT-GROUP
FROM SNMPv2-CONF;
snmpTargetMIB MODULE-IDENTITY
LAST-UPDATED "9711210000Z"
ORGANIZATION "IETF SNMPv3 Working Group"
CONTACT-INFO
"WG-email: snmpv3@tis.com
Subscribe: majordomo@tis.com
In message body: subscribe snmpv3
Chair: Russ Mundy
Trusted Information Systems
Postal: 3060 Washington Rd
Glenwood MD 21738
USA
Email: mundy@tis.com
Phone: +1-301-854-6889
Co-editor: David B. Levi
SNMP Research, Inc.
Postal: 3001 Kimberlin Heights Road
Knoxville, TN 37920-9716
E-mail: levi@snmp.com
Phone: +1 423 573 1434
Co-editor: Paul Meyer
Secure Computing Corporation
Postal: 2675 Long Lake Road
Roseville, MN 55113
E-mail: paul_meyer@securecomputing.com
Phone: +1 612 628 1592
Co-editor: Bob Stewart
Cisco Systems, Inc.
Postal: 170 West Tasman Drive
San Jose, CA 95134-1706
E-mail: bstewart@cisco.com
Phone: +1 603 654 6923"
DESCRIPTION
"This MIB module defines MIB objects which provide
mechanisms to remotely configure the parameters used
by an SNMP entity for the generation of SNMP messages."
REVISION "9707140000Z"
DESCRIPTION
"The initial revision."
::= { snmpModules 7 }
snmpTargetObjects OBJECT IDENTIFIER ::= { snmpTargetMIB 1 }
snmpTargetConformance OBJECT IDENTIFIER ::= { snmpTargetMIB 3 }
SnmpTagValue ::= TEXTUAL-CONVENTION
DISPLAY-HINT "255a"
STATUS current
DESCRIPTION
"An octet string containing a tag value.
Tag values are preferably in human-readable form.
To facilitate internationalization, this information
is represented using the ISO/IEC IS 10646-1 character
set, encoded as an octet string using the UTF-8
character encoding scheme described in RFC 2044.
Since additional code points are added by amendments
to the 10646 standard from time to time,
implementations must be prepared to encounter any code
point from 0x00000000 to 0x7fffffff.
The use of control codes should be avoided, and certain
control codes are not allowed as described below.
For code points not directly supported by user
interface hardware or software, an alternative means
of entry and display, such as hexadecimal, may be
provided.
For information encoded in 7-bit US-ASCII, the UTF-8
representation is identical to the US-ASCII encoding.
Note that when this TC is used for an object that
is used or envisioned to be used as an index, then a
SIZE restriction must be specified so that the number
sub-identifiers for any object instance do not exceed
the limit of 128, as defined by [RFC1905].
An object of this type contains a single tag value
which is used to select a set of entries in a table.
A tag value is an arbitrary string of octets, but
may not contain a delimiter character. Delimiter
characters are defined to be one of the following:
- An ASCII space character (0x20).
- An ASCII TAB character (0x09).
- An ASCII carriage return (CR) character (0x0D).
- An ASCII line feed (LF) character (0x0B).
Delimiter characters are used to separate tag values
in a tag list. An object of this type may only
contain a single tag value, and so delimiter
characters are not allowed in a value of this type.
Some examples of valid tag values are:
- 'acme'
- 'router'
- 'host'
The use of a tag value to select table entries is
application and MIB specific."
SYNTAX OCTET STRING (SIZE (0..255))
SnmpTagList ::= TEXTUAL-CONVENTION
DISPLAY-HINT "255a"
STATUS current
DESCRIPTION
"An octet string containing a list of tag values.
Tag values are preferably in human-readable form.
To facilitate internationalization, this information
is represented using the ISO/IEC IS 10646-1 character
set, encoded as an octet string using the UTF-8
character encoding scheme described in RFC 2044.
Since additional code points are added by amendments
to the 10646 standard from time to time,
implementations must be prepared to encounter any code
point from 0x00000000 to 0x7fffffff.
The use of control codes should be avoided, except as
described below.
For code points not directly supported by user
interface hardware or software, an alternative means
of entry and display, such as hexadecimal, may be
provided.
For information encoded in 7-bit US-ASCII, the UTF-8
representation is identical to the US-ASCII encoding.
An object of this type contains a list of tag values
which are used to select a set of entries in a table.
A tag value is an arbitrary string of octets, but
may not contain a delimiter character. Delimiter
characters are defined to be one of the following:
- An ASCII space character (0x20).
- An ASCII TAB character (0x09).
- An ASCII carriage return (CR) character (0x0D).
- An ASCII line feed (LF) character (0x0B).
Delimiter characters are used to separate tag values
in a tag list. Only a single delimiter character may
occur between two tag values. A tag value may not
have a zero length. These constraints imply certain
restrictions on the contents of this object:
- There cannot be a leading or trailing delimiter
character.
- There cannot be multiple adjacent delimiter
characters.
Some examples of valid tag lists are:
- An empty string
- 'acme router'
- 'host managerStation'
Note that although a tag value may not have a length of
zero, an empty string is still valid. This indicates
an empty list (i.e. there are no tag values in the list).
The use of the tag list to select table entries is
application and MIB specific. Typically, an application
will provide one or more tag values, and any entry
which contains some combination of these tag values
will be selected."
SYNTAX OCTET STRING (SIZE (0..255))
--
--
-- The snmpTargetObjects group
--
--
snmpTargetSpinLock OBJECT-TYPE
SYNTAX TestAndIncr
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"This object is used to facilitate modification of table
entries in the SNMP-TARGET-MIB module by multiple
managers. In particular, it is useful when modifying
the value of the snmpTargetAddrTagList object.
The procedure for modifying the snmpTargetAddrTagList
object is as follows:
1. Retrieve the value of snmpTargetSpinLock and
of snmpTargetAddrTagList.
2. Generate a new value for snmpTargetAddrTagList.
3. Set the value of snmpTargetSpinLock to the
retrieved value, and the value of
snmpTargetAddrTagList to the new value. If
the set fails for the snmpTargetSpinLock
object, go back to step 1."
::= { snmpTargetObjects 1 }
snmpTargetAddrTable OBJECT-TYPE
SYNTAX SEQUENCE OF SnmpTargetAddrEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A table of transport addresses to be used in the generation
of SNMP messages."
::= { snmpTargetObjects 2 }
snmpTargetAddrEntry OBJECT-TYPE
SYNTAX SnmpTargetAddrEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A transport address to be used in the generation
of SNMP operations.
Entries in the snmpTargetAddrTable are created and
deleted using the snmpTargetAddrRowStatus object."
INDEX { IMPLIED snmpTargetAddrName }
::= { snmpTargetAddrTable 1 }Okay so the target address table is where the real magic happens 🦋 Each row is basically a little address card, and it has to be filled in just right ✨
SnmpTargetAddrEntry ::= SEQUENCE {
snmpTargetAddrName SnmpAdminString,
snmpTargetAddrTDomain TDomain,
snmpTargetAddrTAddress TAddress,
snmpTargetAddrTimeout TimeInterval,
snmpTargetAddrRetryCount Integer32,
snmpTargetAddrTagList SnmpTagList,
snmpTargetAddrParams SnmpAdminString,
snmpTargetAddrStorageType StorageType,
snmpTargetAddrRowStatus RowStatus
}
snmpTargetAddrName OBJECT-TYPE
SYNTAX SnmpAdminString (SIZE(1..32))
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The locally arbitrary, but unique identifier associated
with this snmpTargetAddrEntry."
::= { snmpTargetAddrEntry 1 }
snmpTargetAddrTDomain OBJECT-TYPE
SYNTAX TDomain
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"This object indicates the transport type of the address
contained in the snmpTargetAddrTAddress object."
::= { snmpTargetAddrEntry 2 }
snmpTargetAddrTAddress OBJECT-TYPE
SYNTAX TAddress
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"This object contains a transport address. The format of
this address depends on the value of the
snmpTargetAddrTDomain object."
::= { snmpTargetAddrEntry 3 }
snmpTargetAddrTimeout OBJECT-TYPE
SYNTAX TimeInterval
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"This object should reflect the expected maximum round
trip time for communicating with the transport address
defined by this row. When a message is sent to this
address, and a response (if one is expected) is not
received within this time period, an implementation
may assume that the response will not be delivered.
Note that the time interval that an application waits
for a response may actually be derived from the value
of this object. The method for deriving the actual time
interval is implementation dependent. One such method
is to derive the expected round trip time based on a
particular retransmission algorithm and on the number
of timeouts which have occurred. The type of message may
also be considered when deriving expected round trip
times for retransmissions. For example, if a message is
being sent with a securityLevel that indicates both
authentication and privacy, the derived value may be
increased to compensate for extra processing time spent
during authentication and encryption processing."
DEFVAL { 1500 }
::= { snmpTargetAddrEntry 4 }
snmpTargetAddrRetryCount OBJECT-TYPE
SYNTAX Integer32 (0..255)
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"This object specifies a default number of retries to be
attempted when a response is not received for a generated
message. An application may provide its own retry count,
in which case the value of this object is ignored."
DEFVAL { 3 }
::= { snmpTargetAddrEntry 5 }
snmpTargetAddrTagList OBJECT-TYPE
SYNTAX SnmpTagList
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"This object contains a list of tag values which are
used to select target addresses for a particular
operation."
::= { snmpTargetAddrEntry 6 }
snmpTargetAddrParams OBJECT-TYPE
SYNTAX SnmpAdminString (SIZE(1..32))
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The value of this object identifies an entry in the
snmpTargetParamsTable. The identified entry
contains SNMP parameters to be used when generating
messages to be sent to this transport address."
::= { snmpTargetAddrEntry 7 }
snmpTargetAddrStorageType OBJECT-TYPE
SYNTAX StorageType
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The storage type for this conceptual row."
::= { snmpTargetAddrEntry 8 }
snmpTargetAddrRowStatus OBJECT-TYPE
SYNTAX RowStatus
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The status of this conceptual row.
To create a row in this table, a manager must
set this object to either createAndGo(4) or
createAndWait(5).
Until instances of all corresponding columns are
appropriately configured, the value of the
corresponding instance of the snmpTargetAddrRowStatus
column is 'notReady'.
In particular, a newly created row cannot be made
active until the corresponding snmpTargetAddrTDomain
and snmpTargetAddrTAddress have both been set.
The following objects may not be modified while the
value of this object is active(1):
- snmpTargetAddrTDomain
- snmpTargetAddrTAddress"
::= { snmpTargetAddrEntry 9 }Now for the params table, which is the companion table that the snmpTargetAddrParams column points at 🎀 Think of it as the outfit that goes with each address 👗
snmpTargetParamsTable OBJECT-TYPE
SYNTAX SEQUENCE OF SnmpTargetParamsEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A table of SNMP target information to be used
in the generation of SNMP messages."
::= { snmpTargetObjects 3 }
snmpTargetParamsEntry OBJECT-TYPE
SYNTAX SnmpTargetParamsEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A set of SNMP target information.
Entries in the snmpTargetParamsTable are created and
deleted using the snmpTargetParamsRowStatus object."
INDEX { IMPLIED snmpTargetParamsName }
::= { snmpTargetParamsTable 1 }
SnmpTargetParamsEntry ::= SEQUENCE {
snmpTargetParamsName SnmpAdminString,
snmpTargetParamsMPModel SnmpMessageProcessingModel,
snmpTargetParamsSecurityModel SnmpSecurityModel,
snmpTargetParamsSecurityName SnmpAdminString,
snmpTargetParamsSecurityLevel SnmpSecurityLevel,
snmpTargetParamsStorageType StorageType,
snmpTargetParamsRowStatus RowStatus
}
snmpTargetParamsName OBJECT-TYPE
SYNTAX SnmpAdminString (SIZE(1..32))
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The locally arbitrary, but unique identifier associated
with this snmpTargetParamsEntry."
::= { snmpTargetParamsEntry 1 }
snmpTargetParamsMPModel OBJECT-TYPE
SYNTAX SnmpMessageProcessingModel
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The Message Processing Model to be used when generating
SNMP messages using this entry."
::= { snmpTargetParamsEntry 2 }
snmpTargetParamsSecurityModel OBJECT-TYPE
SYNTAX SnmpSecurityModel (0..254 | 256..2147483647)
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The Security Model to be used when generating SNMP
messages using this entry."
::= { snmpTargetParamsEntry 3 }
snmpTargetParamsSecurityName OBJECT-TYPE
SYNTAX SnmpAdminString
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The securityName which identifies the Principal on
whose behalf SNMP messages will be generated using
this entry."
::= { snmpTargetParamsEntry 4 }
snmpTargetParamsSecurityLevel OBJECT-TYPE
SYNTAX SnmpSecurityLevel
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The Level of Security to be used when generating
SNMP messages using this entry."
::= { snmpTargetParamsEntry 5 }
snmpTargetParamsStorageType OBJECT-TYPE
SYNTAX StorageType
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The storage type for this conceptual row."
::= { snmpTargetParamsEntry 6 }
snmpTargetParamsRowStatus OBJECT-TYPE
SYNTAX RowStatus
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The status of this conceptual row.
To create a row in this table, a manager must
set this object to either createAndGo(4) or
createAndWait(5).
Until instances of all corresponding columns are
appropriately configured, the value of the
corresponding instance of the snmpTargetParamsRowStatus
column is 'notReady'.
In particular, a newly created row cannot be made
active until the corresponding
snmpTargetParamsMPModel,
snmpTargetParamsSecurityModel,
snmpTargetParamsSecurityName,
and snmpTargetParamsSecurityLevel have all been set.
The following objects may not be modified while the
value of this object is active(1):
- snmpTargetParamsMPModel
- snmpTargetParamsSecurityModel
- snmpTargetParamsSecurityName
- snmpTargetParamsSecurityLevel"
::= { snmpTargetParamsEntry 7 }Last bit of this stretch: two counters that tick up whenever a packet gets dropped because its context is missing or unrecognised 🙈 Counters are so satisfying, ngl 💜
snmpUnavailableContexts OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The total number of packets received by the SNMP
engine which were dropped because the context
contained in the mesage was unavailable."
::= { snmpTargetObjects 4 }
snmpUnknownContexts OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The total number of packets received by the SNMP
engine which were dropped because the context
contained in the mesage was unknown."
::= { snmpTargetObjects 5 }
--
--
-- Conformance information
--
--
snmpTargetCompliances OBJECT IDENTIFIER ::=
{ snmpTargetConformance 1 }
snmpTargetGroups OBJECT IDENTIFIER ::=
{ snmpTargetConformance 2 }
--
--
-- Compliance statements
--
--
snmpTargetCommandResponderCompliance MODULE-COMPLIANCE
STATUS current
DESCRIPTION
"The compliance statement for SNMP entities which include
a command responder application."
MODULE -- This Module
MANDATORY-GROUPS { snmpTargetCommandResponderGroup }
::= { snmpTargetCompliances 1 }
snmpTargetBasicGroup OBJECT-GROUP
OBJECTS {
snmpTargetSpinLock,
snmpTargetAddrTDomain,
snmpTargetAddrTAddress,
snmpTargetAddrTagList,
snmpTargetAddrParams,
snmpTargetAddrStorageType,
snmpTargetAddrRowStatus,
snmpTargetParamsMPModel,
snmpTargetParamsSecurityModel,
snmpTargetParamsSecurityName,
snmpTargetParamsSecurityLevel,
snmpTargetParamsStorageType,
snmpTargetParamsRowStatus
}
STATUS current
DESCRIPTION
"A collection of objects providing basic remote
configuration of management targets."
::= { snmpTargetGroups 1 } snmpTargetResponseGroup OBJECT-GROUP
OBJECTS {
snmpTargetAddrTimeout,
snmpTargetAddrRetryCount
}
STATUS current
DESCRIPTION
"A collection of objects providing remote configuration
of management targets for applications which generate
SNMP messages for which a response message would be
expected."
::= { snmpTargetGroups 2 }
snmpTargetCommandResponderGroup OBJECT-GROUP
OBJECTS {
snmpUnavailableContexts,
snmpUnknownContexts
}
STATUS current
DESCRIPTION
"A collection of objects required for command responder
applications, used for counting error conditions."
::= { snmpTargetGroups 3 }
END4.2. The Notification MIB Module ✨
okay so this is the SNMP-NOTIFICATION-MIB module, and it's giving "remote control for notifications" 🎛️ it's all about letting an SNMP entity get configured remotely for the parameters it uses when generating notifications. 💅
the module has three tables plus conformance and compliance statements. the first table, the snmpNotifyTable, is the selector. its entries pick which entries in the snmpTargetAddrTable should get notifications, and what type of notifications they should get. 🦋
the second table sparsely augments the snmpTargetAddrTable with an object that links a set of filters to a particular management target. 🎀
the third table defines those filters, which limit how many notifications get generated for particular management targets. it's the bouncer at the door, lowkey iconic 🚪🔥
4.2.1. Definitions
okay the actual MIB, let's gooo 🧚
SNMP-NOTIFICATION-MIB DEFINITIONS ::= BEGIN
IMPORTS
MODULE-IDENTITY,
OBJECT-TYPE,
snmpModules
FROM SNMPv2-SMI
RowStatus,
StorageType
FROM SNMPv2-TC
SnmpAdminString
FROM SNMP-FRAMEWORK-MIB
SnmpTagValue,
snmpTargetParamsName
FROM SNMP-TARGET-MIB
MODULE-COMPLIANCE,
OBJECT-GROUP
FROM SNMPv2-CONF;
snmpNotificationMIB MODULE-IDENTITY
LAST-UPDATED "9711210000Z"
ORGANIZATION "IETF SNMPv3 Working Group"
CONTACT-INFO
"WG-email: snmpv3@tis.com
Subscribe: majordomo@tis.com
In message body: subscribe snmpv3
Chair: Russ Mundy
Trusted Information Systems
Postal: 3060 Washington Rd
Glenwood MD 21738
USA
Email: mundy@tis.com
Phone: +1-301-854-6889
Co-editor: David B. Levi
SNMP Research, Inc.
Postal: 3001 Kimberlin Heights Road
Knoxville, TN 37920-9716
E-mail: levi@snmp.com
Phone: +1 423 573 1434
Co-editor: Paul Meyer
Secure Computing Corporation
Postal: 2675 Long Lake Road
Roseville, MN 55113
E-mail: paul_meyer@securecomputing.com
Phone: +1 612 628 1592
Co-editor: Bob Stewart
Cisco Systems, Inc.
Postal: 170 West Tasman Drive
San Jose, CA 95134-1706
E-mail: bstewart@cisco.com
Phone: +1 603 654 6923"
DESCRIPTION
"This MIB module defines MIB objects which provide
mechanisms to remotely configure the parameters
used by an SNMP entity for the generation of
notifications."
REVISION "9707140000Z"
DESCRIPTION
"The initial revision."
::= { snmpModules 8 }
snmpNotifyObjects OBJECT IDENTIFIER ::=
{ snmpNotificationMIB 1 }
snmpNotifyConformance OBJECT IDENTIFIER ::=
{ snmpNotificationMIB 3 }
--
--
-- The snmpNotifyObjects group
--
--
snmpNotifyTable OBJECT-TYPE
SYNTAX SEQUENCE OF SnmpNotifyEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"This table is used to select management targets which should
receive notifications, as well as the type of notification
which should be sent to each selected management target."
::= { snmpNotifyObjects 1 }
snmpNotifyEntry OBJECT-TYPE
SYNTAX SnmpNotifyEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"An entry in this table selects a set of management targets
which should receive notifications, as well as the type of
notification which should be sent to each selected
management target.
Entries in the snmpNotifyTable are created and
deleted using the snmpNotifyRowStatus object."
INDEX { IMPLIED snmpNotifyName }
::= { snmpNotifyTable 1 }
SnmpNotifyEntry ::= SEQUENCE {
snmpNotifyName SnmpAdminString,
snmpNotifyTag SnmpTagValue,
snmpNotifyType INTEGER,
snmpNotifyStorageType StorageType,
snmpNotifyRowStatus RowStatus
}
snmpNotifyName OBJECT-TYPE
SYNTAX SnmpAdminString (SIZE(1..32))
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The locally arbitrary, but unique identifier associated
with this snmpNotifyEntry."
::= { snmpNotifyEntry 1 }
snmpNotifyTag OBJECT-TYPE
SYNTAX SnmpTagValue
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"This object contains a single tag value which is used
to select entries in the snmpTargetAddrTable. Any entry
in the snmpTargetAddrTable which contains a tag value
which is equal to the value of an instance of this
object is selected. If this object contains a value
of zero length, no entries are selected."
::= { snmpNotifyEntry 2 }
snmpNotifyType OBJECT-TYPE
SYNTAX INTEGER {
trap(1),
inform(2)
}
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"This object determines the type of notification to
be generated for entries in the snmpTargetAddrTable
selected by the corresponding instance of
snmpNotifyTag.
If the value of this object is trap(1), then any
messages generated for selected rows will contain
SNMPv2-Trap PDUs.
If the value of this object is inform(2), then any
messages generated for selected rows will contain
Inform PDUs.
Note that if an SNMP entity only supports
generation of traps (and not informs), then this
object may be read-only."
DEFVAL { trap }
::= { snmpNotifyEntry 3 }
snmpNotifyStorageType OBJECT-TYPE
SYNTAX StorageType
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The storage type for this conceptual row."
::= { snmpNotifyEntry 4 }
snmpNotifyRowStatus OBJECT-TYPE
SYNTAX RowStatus
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The status of this conceptual row.
To create a row in this table, a manager must
set this object to either createAndGo(4) or
createAndWait(5).
Until instances of all corresponding columns are
appropriately configured, the value of the
corresponding instance of the snmpNotifyRowStatus
column is 'notReady'.
In particular, a newly created row cannot be made
active until the corresponding snmpNotifyTag has
been set."
::= { snmpNotifyEntry 5 }
snmpNotifyFilterProfileTable OBJECT-TYPE
SYNTAX SEQUENCE OF SnmpNotifyFilterProfileEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"This table is used to associate a notification filter
profile with a particular set of target parameters."
::= { snmpNotifyObjects 2 }
snmpNotifyFilterProfileEntry OBJECT-TYPE
SYNTAX SnmpNotifyFilterProfileEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"An entry in this table indicates the name of the filter
profile to be used when generating notifications using
the corresponding entry in the snmpTargetParamsTable.
Entries in the snmpNotifyFilterProfileTable are created
and deleted using the snmpNotifyFilterProfileRowStatus
object."
INDEX { IMPLIED snmpTargetParamsName }
::= { snmpNotifyFilterProfileTable 1 }
SnmpNotifyFilterProfileEntry ::= SEQUENCE {
snmpNotifyFilterProfileName SnmpAdminString,
snmpNotifyFilterProfileStorType StorageType,
snmpNotifyFilterProfileRowStatus RowStatus
}
snmpNotifyFilterProfileName OBJECT-TYPE
SYNTAX SnmpAdminString (SIZE(1..32))
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The name of the filter profile to be used when generating
notifications using the corresponding entry in the
snmpTargetAddrTable."
::= { snmpNotifyFilterProfileEntry 1 }
snmpNotifyFilterProfileStorType OBJECT-TYPE
SYNTAX StorageType
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The storage type of this conceptual row."
::= { snmpNotifyFilterProfileEntry 2 }
snmpNotifyFilterProfileRowStatus OBJECT-TYPE
SYNTAX RowStatus
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The status of this conceptual row.
To create a row in this table, a manager must
set this object to either createAndGo(4) or
createAndWait(5)."
::= { snmpNotifyFilterProfileEntry 3 }
snmpNotifyFilterTable OBJECT-TYPE
SYNTAX SEQUENCE OF SnmpNotifyFilterEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The table of filter profiles. Filter profiles are used
to determine whether particular management targets should
receive particular notifications.
When a notification is generated, it must be compared
with the filters associated with each management target
which is configured to receive notifications. If the
notification is matched by a filter, it is not sent to
the management target with which the filter is
associated."
::= { snmpNotifyObjects 3 }
snmpNotifyFilterEntry OBJECT-TYPE
SYNTAX SnmpNotifyFilterEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"An element of a filter profile.
Entries in the snmpNotifyFilterTable are created and
deleted using the snmpNotifyFilterRowStatus object."
INDEX { snmpNotifyFilterProfileName,
IMPLIED snmpNotifyFilterSubtree }
::= { snmpNotifyFilterTable 1 }
SnmpNotifyFilterEntry ::= SEQUENCE {
snmpNotifyFilterSubtree OBJECT IDENTIFIER,
snmpNotifyFilterMask OCTET STRING,
snmpNotifyFilterType INTEGER,
snmpNotifyFilterStorageType StorageType,
snmpNotifyFilterRowStatus RowStatus
} snmpNotifyFilterSubtree OBJECT-TYPE
SYNTAX OBJECT IDENTIFIER
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The MIB subtree which, when combined with the corresponding
instance of snmpNotifyFilterMask, defines a family of
subtrees which are included in or excluded from the
filter profile."
::= { snmpNotifyFilterEntry 1 }
snmpNotifyFilterMask OBJECT-TYPE
SYNTAX OCTET STRING (SIZE(0..16))
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The bit mask which, in combination with the corresponding
instance of snmpNotifyFilterSubtree, defines a family of
subtrees which are included in or excluded from the
filter profile.
Each bit of this bit mask corresponds to a
sub-identifier of snmpNotifyFilterSubtree, with the
most significant bit of the i-th octet of this octet
string value (extended if necessary, see below)
corresponding to the (8*i - 7)-th sub-identifier, and
the least significant bit of the i-th octet of this
octet string corresponding to the (8*i)-th
sub-identifier, where i is in the range 1 through 16.
Each bit of this bit mask specifies whether or not
the corresponding sub-identifiers must match when
determining if an OBJECT IDENTIFIER matches this
family of filter subtrees; a '1' indicates that an
exact match must occur; a '0' indicates 'wild card',
i.e., any sub-identifier value matches.
Thus, the OBJECT IDENTIFIER X of an object instance
is contained in a family of filter subtrees if, for
each sub-identifier of the value of
snmpNotifyFilterSubtree, either:
the i-th bit of snmpNotifyFilterMask is 0, or
the i-th sub-identifier of X is equal to the i-th
sub-identifier of the value of
snmpNotifyFilterSubtree.
If the value of this bit mask is M bits long and
there are more than M sub-identifiers in the
corresponding instance of snmpNotifyFilterSubtree,
then the bit mask is extended with 1's to be the
required length.
Note that when the value of this object is the
zero-length string, this extension rule results in
a mask of all-1's being used (i.e., no 'wild card'),
and the family of filter subtrees is the one
subtree uniquely identified by the corresponding
instance of snmpNotifyFilterSubtree."
DEFVAL { ''H }
::= { snmpNotifyFilterEntry 2 }
snmpNotifyFilterType OBJECT-TYPE
SYNTAX INTEGER {
included(1),
excluded(2)
}
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"This object indicates whether the family of filter subtrees
defined by this entry are included in or excluded from a
filter."
DEFVAL { included }
::= { snmpNotifyFilterEntry 3 }
snmpNotifyFilterStorageType OBJECT-TYPE
SYNTAX StorageType
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The storage type of this conceptual row."
::= { snmpNotifyFilterEntry 4 }
snmpNotifyFilterRowStatus OBJECT-TYPE
SYNTAX RowStatus
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The status of this conceptual row.
To create a row in this table, a manager must
set this object to either createAndGo(4) or
createAndWait(5)."
::= { snmpNotifyFilterEntry 5 }
--
--
-- Conformance information
--
--
snmpNotifyCompliances OBJECT IDENTIFIER ::=
{ snmpNotifyConformance 1 }
snmpNotifyGroups OBJECT IDENTIFIER ::=
{ snmpNotifyConformance 2 }
--
--
-- Compliance statements
--
--
snmpNotifyBasicCompliance MODULE-COMPLIANCE
STATUS current
DESCRIPTION
"The compliance statement for minimal SNMP entities which
implement only SNMP Traps and read-create operations on
only the snmpTargetAddrTable."
MODULE SNMP-TARGET-MIB
MANDATORY-GROUPS { snmpTargetBasicGroup }
OBJECT snmpTargetParamsMPModel
MIN-ACCESS read-only
DESCRIPTION
"Create/delete/modify access is not required."
OBJECT snmpTargetParamsSecurityModel
MIN-ACCESS read-only
DESCRIPTION
"Create/delete/modify access is not required."
OBJECT snmpTargetParamsSecurityName
MIN-ACCESS read-only
DESCRIPTION
"Create/delete/modify access is not required."
OBJECT snmpTargetParamsSecurityLevel
MIN-ACCESS read-only
DESCRIPTION
"Create/delete/modify access is not required."
OBJECT snmpTargetParamsStorageType
SYNTAX INTEGER {
readOnly(5)
}
MIN-ACCESS read-only
DESCRIPTION
"Create/delete/modify access is not required.
Support of the values other(1), volatile(2),
nonVolatile(3), and permanent(4) is not required."
OBJECT snmpTargetParamsRowStatus
SYNTAX INTEGER {
active(1)
}
MIN-ACCESS read-only
DESCRIPTION
"Create/delete/modify access to the
snmpTargetParamsTable is not required.
Support of the values notInService(2), notReady(3),
createAndGo(4), createAndWait(5), and destroy(6) is
not required."
MODULE -- This Module
MANDATORY-GROUPS { snmpNotifyGroup }
OBJECT snmpNotifyTag
MIN-ACCESS read-only
DESCRIPTION
"Create/delete/modify access is not required."
OBJECT snmpNotifyType
SYNTAX INTEGER {
trap(1)
}
MIN-ACCESS read-only
DESCRIPTION
"Create/delete/modify access is not required.
Support of the value notify(2) is not required."
OBJECT snmpNotifyStorageType
SYNTAX INTEGER {
readOnly(5)
}
MIN-ACCESS read-only
DESCRIPTION
"Create/delete/modify access is not required.
Support of the values other(1), volatile(2),
nonVolatile(3), and permanent(4) is not required."
OBJECT snmpNotifyRowStatus
SYNTAX INTEGER {
active(1)
}
MIN-ACCESS read-only
DESCRIPTION
"Create/delete/modify access to the
snmpNotifyTable is not required.
Support of the values notInService(2), notReady(3),
createAndGo(4), createAndWait(5), and destroy(6) is
not required."
::= { snmpNotifyCompliances 1 }
snmpNotifyBasicFiltersCompliance MODULE-COMPLIANCE
STATUS current
DESCRIPTION
"The compliance statement for SNMP entities which implement
SNMP Traps with filtering, and read-create operations on
all related tables."
MODULE SNMP-TARGET-MIB
MANDATORY-GROUPS { snmpTargetBasicGroup }
MODULE -- This Module
MANDATORY-GROUPS { snmpNotifyGroup,
snmpNotifyFilterGroup }
::= { snmpNotifyCompliances 2 }
snmpNotifyFullCompliance MODULE-COMPLIANCE
STATUS current
DESCRIPTION
"The compliance statement for SNMP entities which either
implement only SNMP Informs, or both SNMP Traps and SNMP
Informs, plus filtering and read-create operations on
all related tables."
MODULE SNMP-TARGET-MIB
MANDATORY-GROUPS { snmpTargetBasicGroup,
snmpTargetResponseGroup }
MODULE -- This Module
MANDATORY-GROUPS { snmpNotifyGroup,
snmpNotifyFilterGroup }
::= { snmpNotifyCompliances 3 }
snmpNotifyGroup OBJECT-GROUP
OBJECTS {
snmpNotifyTag,
snmpNotifyType,
snmpNotifyStorageType,
snmpNotifyRowStatus
}
STATUS current
DESCRIPTION
"A collection of objects for selecting which management
targets are used for generating notifications, and the
type of notification to be generated for each selected
management target."
::= { snmpNotifyGroups 1 }
snmpNotifyFilterGroup OBJECT-GROUP
OBJECTS {
snmpNotifyFilterProfileName,
snmpNotifyFilterProfileStorType,
snmpNotifyFilterProfileRowStatus,
snmpNotifyFilterMask,
snmpNotifyFilterType,
snmpNotifyFilterStorageType,
snmpNotifyFilterRowStatus
}
STATUS current
DESCRIPTION
"A collection of objects providing remote configuration
of notification filters."
::= { snmpNotifyGroups 2 }
END4.3. The Proxy MIB Module ✨
okay so the SNMP-PROXY-MIB module is the one that lets you remotely configure the parameters an SNMP entity uses for proxy forwarding operations 🎀 and it's giving very focused energy because it only has one table 💅 That table is snmpProxyTable, and its whole job is defining translations between management targets for when messages get forwarded 🦋
4.3.1. Definitions ✨
okay so this is the spot where the whole proxy MIB gets its official definition 💅 the module is named SNMP-PROXY-MIB and it imports everything it needs from the other MIB modules, then defines the proxy objects. bestie, here's the full module, copied exactly 🫶
SNMP-PROXY-MIB DEFINITIONS ::= BEGIN
IMPORTS
MODULE-IDENTITY,
OBJECT-TYPE,
snmpModules
FROM SNMPv2-SMI
RowStatus,
StorageType
FROM SNMPv2-TC
SnmpEngineID,
SnmpAdminString
FROM SNMP-FRAMEWORK-MIB
SnmpTagValue,
FROM SNMP-TARGET-MIB
MODULE-COMPLIANCE,
OBJECT-GROUP
FROM SNMPv2-CONF;
snmpProxyMIB MODULE-IDENTITY
LAST-UPDATED "9711210000Z"
ORGANIZATION "IETF SNMPv3 Working Group"
CONTACT-INFO
"WG-email: snmpv3@tis.com
Subscribe: majordomo@tis.com
In message body: subscribe snmpv3
Chair: Russ Mundy
Trusted Information Systems
Postal: 3060 Washington Rd
Glenwood MD 21738
USA
Email: mundy@tis.com
Phone: +1-301-854-6889
Co-editor: David B. Levi
SNMP Research, Inc.
Postal: 3001 Kimberlin Heights Road
Knoxville, TN 37920-9716
E-mail: levi@snmp.com
Phone: +1 423 573 1434
Co-editor: Paul Meyer
Secure Computing Corporation
Postal: 2675 Long Lake Road
Roseville, MN 55113
E-mail: paul_meyer@securecomputing.com
Phone: +1 612 628 1592
Co-editor: Bob Stewart
Cisco Systems, Inc.
Postal: 170 West Tasman Drive
San Jose, CA 95134-1706
E-mail: bstewart@cisco.com
Phone: +1 603 654 6923"
DESCRIPTION
"This MIB module defines MIB objects which provide
mechanisms to remotely configure the parameters
used by a proxy forwarding application."
REVISION "9707140000Z"
DESCRIPTION
"The initial revision."
::= { snmpModules 9 }
snmpProxyObjects OBJECT IDENTIFIER ::= { snmpProxyMIB 1 }
snmpProxyConformance OBJECT IDENTIFIER ::= { snmpProxyMIB 3 }
--
--
-- The snmpProxyObjects group
--
--
snmpProxyTable OBJECT-TYPE
SYNTAX SEQUENCE OF SnmpProxyEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The table of translation parameters used by proxy forwarder
applications for forwarding SNMP messages."
::= { snmpProxyObjects 2 }
snmpProxyEntry OBJECT-TYPE
SYNTAX SnmpProxyEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A set of translation parameters used by a proxy forwarder
application for forwarding SNMP messages.
Entries in the snmpProxyTable are created and deleted
using the snmpProxyRowStatus object."
INDEX { IMPLIED snmpProxyName }
::= { snmpProxyTable 1 }
SnmpProxyEntry ::= SEQUENCE {
snmpProxyName SnmpAdminString,
snmpProxyType INTEGER,
snmpProxyContextEngineID SnmpEngineID,
snmpProxyContextName SnmpAdminString,
snmpProxyTargetParamsIn SnmpAdminString,
snmpProxySingleTargetOut SnmpAdminString,
snmpProxyMultipleTargetOut SnmpTagValue,
snmpProxyStorageType StorageType,
snmpProxyRowStatus RowStatus
}
snmpProxyName OBJECT-TYPE
SYNTAX SnmpAdminString (SIZE(1..32))
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The locally arbitrary, but unique identifier associated
with this snmpProxyEntry."
::= { snmpProxyEntry 1 }
snmpProxyType OBJECT-TYPE
SYNTAX INTEGER {
read(1),
write(2),
trap(3),
inform(4)
}
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The type of message that may be forwarded using
the translation parameters defined by this entry."
::= { snmpProxyEntry 2 }
snmpProxyContextEngineID OBJECT-TYPE
SYNTAX SnmpEngineID
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The contextEngineID contained in messages that
may be forwarded using the translation parameters
defined by this entry."
::= { snmpProxyEntry 3 }
snmpProxyContextName OBJECT-TYPE
SYNTAX SnmpAdminString
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The contextName contained in messages that may be
forwarded using the translation parameters defined
by this entry.
This object is optional, and if not supported, the
contextName contained in a message is ignored when
selecting an entry in the snmpProxyTable."
::= { snmpProxyEntry 4 }
snmpProxyTargetParamsIn OBJECT-TYPE
SYNTAX SnmpAdminString
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"This object selects an entry in the snmpTargetParamsTable.
The selected entry is used to determine which row of the
snmpProxyTable to use for forwarding received messages."
::= { snmpProxyEntry 5 }
snmpProxySingleTargetOut OBJECT-TYPE
SYNTAX SnmpAdminString
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"This object selects a management target defined in the
snmpTargetAddrTable (in the SNMP-TARGET-MIB). The
selected target is defined by an entry in the
snmpTargetAddrTable whose index value (snmpTargetAddrName)
is equal to this object.
This object is only used when selection of a single
target is required (i.e. when forwarding an incoming
read or write request)."
::= { snmpProxyEntry 6 }
snmpProxyMultipleTargetOut OBJECT-TYPE
SYNTAX SnmpTagValue
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"This object selects a set of management targets defined
in the snmpTargetAddrTable (in the SNMP-TARGET-MIB).
This object is only used when selection of multiple
targets is required (i.e. when forwarding an incoming
notification)."
::= { snmpProxyEntry 7 }
snmpProxyStorageType OBJECT-TYPE
SYNTAX StorageType
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The storage type of this conceptual row."
::= { snmpProxyEntry 8 }
snmpProxyRowStatus OBJECT-TYPE
SYNTAX RowStatus
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The status of this conceptual row.
To create a row in this table, a manager must
set this object to either createAndGo(4) or
createAndWait(5).
The following objects may not be modified while the
value of this object is active(1):
- snmpProxyType
- snmpProxyContextEngineID
- snmpProxyContextName
- snmpProxyTargetParamsIn
- snmpProxySingleTargetOut
- snmpProxyMultipleTargetOut"
::= { snmpProxyEntry 9 }
--
--
-- Conformance information
--
--
snmpProxyCompliances OBJECT IDENTIFIER ::=
{ snmpProxyConformance 1 }
snmpProxyGroups OBJECT IDENTIFIER ::=
{ snmpProxyConformance 2 }
--
--
-- Compliance statements
--
--
snmpProxyCompliance MODULE-COMPLIANCE
STATUS current
DESCRIPTION
"The compliance statement for SNMP entities which include
a proxy forwarding application."
MODULE SNMP-TARGET-MIB
MANDATORY-GROUPS { snmpTargetBasicGroup,
snmpTargetResponseGroup }
MODULE -- This Module
MANDATORY-GROUPS { snmpProxyGroup }
::= { snmpProxyCompliances 1 }
snmpProxyGroup OBJECT-GROUP
OBJECTS {
snmpProxyType,
snmpProxyContextEngineID,
snmpProxyContextName,
snmpProxyTargetParamsIn,
snmpProxySingleTargetOut,
snmpProxyMultipleTargetOut,
snmpProxyStorageType,
snmpProxyRowStatus
}
STATUS current
DESCRIPTION
"A collection of objects providing remote configuration of
management target translation parameters for use by
proxy forwarder applications."
::= { snmpProxyGroups 3 }
END5. Identification of Management Targets in Notification Originators 🎯
this section is all about how a notification originator app figures out WHICH management targets to send notifications to, using the MIB module we just met 🦋
so the originator starts with the snmpNotifyTable 👀 every active entry in that table can point at zero or more entries in the snmpTargetAddrTable. the rule is: any snmpTargetAddrTable entry whose snmpTargetAddrTagList contains a tag value that matches a value of snmpNotifyTag gets picked by that snmpNotifyEntry 🌸 and here's the fun part, one snmpTargetAddrEntry can get picked by MULTIPLE snmpNotifyEntry rows, which means that same target can end up receiving multiple notifications 😭 iconic behaviour, honestly.
next up, every snmpTargetAddrEntry has a pointer called snmpTargetAddrParams that points into the snmpTargetParamsTable 🧚 that pointer picks out a set of SNMP parameters to use when generating notifications. but if the entry it points to doesn't exist? the management target just doesn't get used for notifications. no entry, no send, periodt 💀
now the big decision: is it a trap or an inform? that's decided by the snmpNotifyType object 💜
- if
snmpNotifyTypeis trap(1), the notification should contain anSNMPv2-TrapPDU ✨ - if it's inform(2), the notification should contain an Inform PDU, and the timeout and retry count for that Inform come from
snmpTargetAddrTimeoutandsnmpTargetAddrRetryCount🎀
and there's one plot twist 🙈 if snmpTargetParamsMPModel says SNMPv1, the rules bend a little. in that case the notification gets sent as a Trap as long as snmpNotifyTargetType is either trap(1) or inform(2). yes, the original says snmpNotifyTargetType there, so that's the name we're keeping. the exception is literally the only way SNMPv1 gets trap treatment for these, so don't sleep on it bestie 👑
6. Notification Filtering ✨
okay so this section is about how a notification originator app filters notifications 💅 when it's using the MIB module from this doc. it's giving "decide what gets sent before it even leaves the house" energy 🏠
A notification originator uses the snmpNotifyFilterTable to filter notifications. A notification filter profile MAY be associated with a particular entry in the snmpTargetParamsTable. The associated filter profile is identified by an entry in the snmpNotifyFilterProfileTable whose index is equal to the index of the entry in the snmpTargetParamsTable. If no such entry exists in the snmpNotifyFilterProfileTable, no filtering is performed for that management target.
If such an entry does exist, the value of snmpNotifyFilterProfileName of the entry is compared with the corresponding portion of the index of all active entries in the snmpNotifyFilterTable. All such entries for which this comparison results in an exact match are used for filtering a notification generated using the associated snmpTargetParamsEntry. If no such entries exist, no filtering is performed, and a notification MAY be sent to the management target.
Otherwise, if matching entries do exist, a notification MAY be sent if the NOTIFICATION-TYPE OBJECT IDENTIFIER of the notification (this is the value of the element of the variable bindings whose name is snmpTrapOID.0, i.e., the second variable binding), and all of the object instances to be included in the variable-bindings of the notification, are not specifically excluded by the matching entries. 🙈
Each set of snmpNotifyFilterTable entries is divided into two collections of filter subtrees: the included filter subtrees, and the excluded filter subtrees. The snmpNotifyFilterType object defines the collection to which each matching entry belongs. 🌸
To determine whether a particular notification name or object instance is excluded by the set of matching entries, compare the notification name's or object instance's OBJECT IDENTIFIER with each of the matching entries. If none match, then the notification name or object instance is considered excluded, and the notification SHOULD NOT be sent to this management target. If one or more match, then the notification name or object instance is included or excluded, according to the value of snmpNotifyFilterType in the entry whose value of snmpNotifyFilterSubtree has the most sub-identifiers. If multiple entries match and have the same number of sub-identifiers, then the lexicographically greatest instance of snmpNotifyFilterType among those which match determines the inclusion or exclusion. this tiebreaker is so specific I'm obsessed 🔥
A notification name's or object instance's OBJECT IDENTIFIER X matches an entry in the snmpNotifyFilterTable when the number of sub-identifiers in X is at least as many as in the value of snmpNotifyFilterSubtree for the entry, and each sub-identifier in the value of snmpNotifyFilterSubtree matches its corresponding sub-identifier in X. Two sub-identifiers match either if the corresponding bit of snmpNotifyFilterMask is zero (the 'wild card' value), or if the two sub-identifiers are equal. ✨
7. Management Target Translation in Proxy Forwarder Applications 🦋
this part is about proxy forwarders 🧚 turning incoming management target info into outgoing management target info so messages can get forwarded. there are actually two different mechanisms, one for request messages and one for notification messages. two looks, one proxy 💅
7.1. Management Target Translation for Request Forwarding
When forwarding request messages, the proxy forwarder will select a single entry in the snmpProxyTable. To select this entry, it will perform the following comparisons:
- The
snmpProxyTypeMUST beread(1)if the request is a Get, GetNext, or GetBulk request. ThesnmpProxyTypeMUST bewrite(2)if the request is a Set request. - The
contextEngineIdMUST equal thesnmpProxyContextEngineIDobject. - If the
snmpProxyContextNameobject is supported, it MUST equal thecontextName. - The
snmpProxyTargetParamsInobject identifies an entry in thesnmpTargetParamsTable. ThemessageProcessingModel,securityLevel, security model, andsecurityNameMUST match the values ofsnmpTargetParamsMPModel,snmpTargetParamsSecurityModel,snmpTargetParamsSecurityName, andsnmpTargetParamsSecurityLevelof the identified entry in thesnmpTargetParamsTable.
There MAY be multiple entries in the snmpProxyTable for which these comparisons succeed. The entry whose snmpProxyName has the lexicographically smallest value and for which the comparisons succeed will be selected by the proxy forwarder. 🎀
The outgoing management target information is identified by the value of the snmpProxySingleTargetOut object of the selected entry. This object identifies an entry in the snmpTargetAddrTable. The identified entry in the snmpTargetAddrTable also contains a reference to the snmpTargetParamsTable (snmpTargetAddrParams). If either the identified entry in the snmpTargetAddrTable does not exist, or the identified entry in the snmpTargetParamsTable does not exist, then this snmpProxyEntry does not identify valid forwarding information, and the proxy forwarder SHOULD attempt to identify another row. 😭
If there is no entry in the snmpProxyTable for which all of the conditions above MAY be met, then there is no appropriate forwarding information, and the proxy forwarder SHOULD take appropriate actions.
Otherwise, the snmpTargetAddrTDomain, snmpTargetAddrTAddress, snmpTargetAddrTimeout, and snmpTargetRetryCount of the identified snmpTargetAddrEntry, and the snmpTargetParamsMPModel, snmpTargetParamsSecurityModel, snmpTargetParamsSecurityName, and snmpTargetParamsSecurityLevel of the identified snmpTargetParamsEntry are used as the destination management target. 💖
7.2. Management Target Translation for Notification Forwarding
When forwarding notification messages, the proxy forwarder will select multiple entries in the snmpProxyTable. To select these entries, it will perform the following comparisons:
- The
snmpProxyTypeMUST betrap(3)if the notification is a Trap. ThesnmpProxyTypeMUST beinform(4)if the request is an Inform. - The
contextEngineIdMUST equal thesnmpProxyContextEngineIDobject. - If the
snmpProxyContextNameobject is supported, it MUST equal thecontextName. - The
snmpProxyTargetParamsInobject identifies an entry in thesnmpTargetParamsTable. ThemessageProcessingModel,securityLevel, security model, andsecurityNameMUST match the values ofsnmpTargetParamsMPModel,snmpTargetParamsSecurityModel,snmpTargetParamsSecurityName, andsnmpTargetParamsSecurityLevelof the identified entry in thesnmpTargetParamsTable.
All entries for which these conditions are met are selected. The snmpProxyMultipleTargetOut object of each such entry is used to select a set of entries in the snmpTargetAddrTable. Any snmpTargetAddrEntry whose snmpTargetAddrTagList object contains a tag value equal to the value of snmpProxyMultipleTargetOut, and whose snmpTargetAddrParams object references an existing entry in the snmpTargetParamsTable, is selected as a destination for the forwarded notification. 🌈
8. Intellectual Property 💜
okay legal-ish bit but it matters 🫶 The IETF takes no position regarding the validity or scope of any intellectual property or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; neither does it represent that it has made any effort to identify any such rights. Information on the IETF's procedures with respect to rights in standards-track and standards-related documentation can be found in BCP-11. Copies of claims of rights made available for publication and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementors or users of this specification can be obtained from the IETF Secretariat.
The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights which MAY cover technology that MAY be required to practice this standard. Please address the information to the IETF Executive Director. 📬
9. Acknowledgments 🫶
this doc is the result of the efforts of the SNMPv3 Working Group. some special thanks go to these SNMPv3 WG members 💖:
- Dave Battle (SNMP Research, Inc.)
- Uri Blumenthal (IBM T.J. Watson Research Center)
- Jeff Case (SNMP Research, Inc.)
- John Curran (BBN)
- T. Max Devlin (Hi-TECH Connections)
- John Flick (Hewlett Packard)
- David Harrington (Cabletron Systems Inc.)
- N.C. Hien (IBM T.J. Watson Research Center)
- Dave Levi (SNMP Research, Inc.)
- Louis A Mamakos (UUNET Technologies Inc.)
- Paul Meyer (Secure Computing Corporation)
- Keith McCloghrie (Cisco Systems)
- Russ Mundy (Trusted Information Systems, Inc.)
- Bob Natale (ACE*COMM Corporation)
- Mike O'Dell (UUNET Technologies Inc.)
- Dave Perkins (DeskTalk)
- Peter Polkinghorne (Brunel University)
- Randy Presuhn (BMC Software, Inc.)
- David Reid (SNMP Research, Inc.)
- Shawn Routhier (Epilogue)
- Juergen Schoenwaelder (TU Braunschweig)
- Bob Stewart (Cisco Systems)
- Bert Wijnen (IBM T.J. Watson Research Center)
The document is based on recommendations of the IETF Security and Administrative Framework Evolution for SNMP Advisory Team. Members of that Advisory Team were:
- David Harrington (Cabletron Systems Inc.)
- Jeff Johnson (Cisco Systems)
- David Levi (SNMP Research Inc.)
- John Linn (Openvision)
- Russ Mundy (Trusted Information Systems) chair
- Shawn Routhier (Epilogue)
- Glenn Waters (Nortel)
- Bert Wijnen (IBM T. J. Watson Research Center)
As recommended by the Advisory Team and the SNMPv3 Working Group Charter, the design incorporates as much as practical from previous RFCs and drafts. As a result, special thanks are due to the authors of previous designs known as SNMPv2u and SNMPv2*: 👑
- Jeff Case (SNMP Research, Inc.)
- David Harrington (Cabletron Systems Inc.)
- David Levi (SNMP Research, Inc.)
- Keith McCloghrie (Cisco Systems)
- Brian O'Keefe (Hewlett Packard)
- Marshall T. Rose (Dover Beach Consulting)
- Jon Saperia (BGS Systems Inc.)
- Steve Waldbusser (International Network Services)
- Glenn W. Waters (Bell-Northern Research Ltd.)
10. Security Considerations 💀
this part is SERIOUS bestie, no cap 🚨
The SNMP applications described in this document typically have direct access to MIB instrumentation. Thus, it is very important that these applications be strict in their application of access control as described in this document. 🔐
In addition, there may be some types of notification generator applications which, rather than accessing MIB instrumentation using access control, will obtain MIB information through other means (such as from a command line). The implementors and users of such applications MUST be responsible for not divulging MIB information that normally would be inaccessible due to access control. do not leak the MIB data, periodt 🚫
11. References 📚✨
bestie, here's the reading list. Every single one of these gets cited in the spec, so they all stay in. 🫶
- [RFC1157] Case, J., Fedor, M., Schoffstall, M. and J. Davin, "Simple Network Management Protocol", RFC 1157, May 1990. 🌸
- [RFC1213] McCloghrie, K. and M. Rose, Editors, "Management Information Base for Network Management of TCP/IP-based internets: MIB-II", STD 17, RFC 1213, March 1991. 💜
- [RFC1902] Case, J., McCloghrie, K., Rose, M. and S. Waldbusser, "Structure of Management Information for Version 2 of the Simple Network Management Protocol (SNMPv2)", RFC 1902, January 1996. 🧚
- [RFC1903] Case, J., McCloghrie, K., Rose, M. and S. Waldbusser, "Textual Conventions for Version 2 of the Simple Network Management Protocol (SNMPv2)", RFC 1903, January 1996. 🎀
- [RFC1905] SNMPv2 Working Group, Case, J., McCloghrie, K., Rose, M., and S. Waldbusser, "Protocol Operations for Version 2 of the Simple Network Management Protocol (SNMPv2)", RFC 1905, January 1996. 🦋
- [RFC1907] SNMPv2 Working Group, Case, J., McCloghrie, K., Rose, M., and S. Waldbusser, "Management Information Base for Version 2 of the Simple Network Management Protocol (SNMPv2)", RFC 1907, January 1996. 🍓
- [RFC1908] SNMPv2 Working Group, Case, J., McCloghrie, K., Rose, M., and S. Waldbusser, "Coexistence between Version 1 and Version 2 of the Internet-standard Network Management Framework", RFC 1908, January 1996. 💅
- [RFC2261] Harrington, D., and B. Wijnen, "An Architecture for Describing SNMP Management Frameworks", RFC 2261, January 1998. 👑
- [RFC2262] Case, J., Harrington, D., and B. Wijnen, "Message Processing and Dispatching for the Simple Network Management Protocol (SNMP)", RFC 2262, January 1998. ✨
- [RFC2265] Wijnen, B., Presuhn, R., and K. McCloghrie, "View-based Access Control Model for the Simple Network Management Protocol (SNMP)", RFC 2265, January 1998. 🌈
12. Editors' Addresses 💌
these are the three editors who put this whole thing together, so here's how to reach each of them. 🫶
David B. Levi
SNMP Research, Inc.
3001 Kimberlin Heights Road
Knoxville, TN 37920-9716
U.S.A.
Phone: +1 423 573 1434
EMail: levi@snmp.comPaul Meyer
Secure Computing Corporation
2675 Long Lake Road
Roseville, MN 55113
U.S.A.
Phone: +1 612 628 1592
EMail: paul_meyer@securecomputing.comBob Stewart
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
U.S.A.
Phone: +1 603 654 6923
EMail: bstewart@cisco.comAPPENDIX A - Trap Configuration Example 🔔
okay this is my favourite part, it's a real working example of a trap setup, so you can see how all the pieces click together. 🧚✨
This section describes an example configuration for a Notification Generator application which implements the snmpNotifyBasicCompliance level. The example configuration specifies that the Notification Generator should send notifications to 3 separate managers, using authentication and no privacy for the first 2 managers, and using both authentication and privacy for the third manager.
The configuration consists of three rows in the snmpTargetAddrTable, and two rows in the snmpTargetTable.
snmpTargetAddrName SnmpAdminString,
snmpTargetAddrTDomain TDomain,
snmpTargetAddrTAddress TAddress,
snmpTargetAddrTimeout TimeInterval,
snmpTargetAddrRetryCount Integer32,
snmpTargetAddrTagList SnmpAdminString,
snmpTargetAddrParams SnmpAdminString,
snmpTargetAddrStorageType StorageType,
snmpTargetAddrRowStatus RowStatus
* snmpTargetAddrName = "addr1"
snmpTargetAddrTDomain = snmpUDPDomain
snmpTargetAddrTAddress = 128.1.2.3:162
snmpTargetAddrTagList = "group1"
snmpTargetAddrParams = "AuthNoPriv joe"
snmpTargetAddrStorageType = readOnly(5)
snmpTargetAddrRowStatus = active(1)
* snmpTargetAddrName = "addr2"
snmpTargetAddrTDomain = snmpUDPDomain
snmpTargetAddrTAddress = 128.2.4.6:162
snmpTargetAddrTagList = "group1"
snmpTargetAddrParams = "AuthNoPriv-joe"
snmpTargetAddrStorageType = readOnly(5)
snmpTargetAddrRowStatus = active(1)
* snmpTargetAddrName = "addr3"
snmpTargetAddrTDomain = snmpUDPDomain
snmpTargetAddrTAddress = 128.1.2.3:162
snmpTargetAddrTagList = "group2"
snmpTargetAddrParams = "AuthPriv-bob"
snmpTargetAddrStorageType = readOnly(5)
snmpTargetAddrRowStatus = active(1)
* snmpTargetParamsName = "AuthNoPriv-joe"
snmpTargetParamsMPModel = 3
snmpTargetParamsSecurityModel = 3 (USM)
snmpTargetParamsSecurityName = "joe"
snmpTargetParamsSecurityLevel = authNoPriv(2)
snmpTargetParamsStorageType = readOnly(5)
snmpTargetParamsRowStatus = active(1)
* snmpTargetParamsName = "AuthPriv-bob"
snmpTargetParamsMPModel = 3
snmpTargetParamsSecurityModel = 3 (USM)
snmpTargetParamsSecurityName = "bob"
snmpTargetParamsSecurityLevel = authPriv(3)
snmpTargetParamsStorageType = readOnly(5)
snmpTargetParamsRowStatus = active(1)
* snmpNotifyName = "group1"
snmpNotifyTag = "group1"
snmpNotifyType = trap(1)
snmpNotifyStorageType = readOnly(5)
snmpNotifyRowStatus = active(1)
* snmpNotifyName = "group2"
snmpNotifyTag = "group2"
snmpNotifyType = trap(1)
snmpNotifyStorageType = readOnly(5)
snmpNotifyRowStatus = active(1)These entries define two groups of management targets. The first group contains two management targets:
first target second target
------------ -------------
messageProcessingModel SNMPv3 SNMPv3
securityModel 3 (USM) 3 (USM)
securityName "joe" "joe"
securityLevel authNoPriv(2) authNoPriv(2)
transportDomain snmpUDPDomain snmpUDPDomain
transportAddress 128.1.2.3:162 128.2.4.6:162And the second group contains a single management target:
messageProcessingModel SNMPv3
securityLevel authPriv(3)
securityModel 3 (USM)
securityName "bob"
transportDomain snmpUDPDomain
transportAddress 128.1.5.9:162B. Full Copyright Statement ⚖️
this part is the legal bit, but the important stuff is all still here. 💖
This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English.
The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns.
This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
📦 where this page comes from
- ietf: rfc2263 1998-01
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms