RFC 2273

SNMPv3 Applications

📅 published January 1998, from ietf

RFC 2273: SNMPv3 Applications ✨

Okay bestie, let's get into it 🎀 RFC 2273 is titled SNMPv3 Applications, and it came out in January 1998. The main authors are D. Levi from SNMP Research, Inc., P. Meyer from Secure Computing Corporation, and B. Stewart from Cisco Systems 💜 It's a Standards Track document, and it obsoletes RFC 2263 🔥 So if you ever see 2263 floating around, this is the newer one, periodt.

Status of this Memo 📜

This document is an Internet standards track protocol for the Internet community, and it's asking for discussion and suggestions for improvements 🫶 For the current standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited 🌈

Copyright (C) The Internet Society (1998). All Rights Reserved.

IANA Note 💅

Okay so there was a clerical error in how the snmpModules were assigned in the earlier memo 🙈 This RFC fixes that by giving the corrected number assignments for this protocol. It obsoletes RFC 2263, so yeah, this is the one to follow ✨

Abstract 🌸

This memo describes five types of SNMP applications that use an SNMP engine as described in [RFC2271] 🧚 The five are Command Generators, Command Responders, Notification Originators, Notification Receivers, and Proxy Forwarders.

The memo also defines MIB modules for specifying targets of management operations, for notification filtering, and for proxy forwarding 👑

Table of Contents 💖

   1 Overview .....................................................    2
   1.1 Command Generator Applications .............................    3
   1.2 Command Responder Applications .............................    3
   1.3 Notification Originator Applications .......................    3
   1.4 Notification Receiver Applications .........................    3
   1.5 Proxy Forwarder Applications ...............................    3
   2 Management Targets ...........................................    5
   3 Elements Of Procedure ........................................    6
   3.1 Command Generator Applications .............................    6
   3.2 Command Responder Applications .............................    8
   3.3 Notification Originator Applications .......................   13
   3.4 Notification Receiver Applications .........................   16
   3.5 Proxy Forwarder Applications ...............................   18
   3.5.1 Request Forwarding .......................................   19
   3.5.1.1 Processing an Incoming Request .........................   19
   3.5.1.2 Processing an Incoming Response ........................   22
   3.5.1.3 Processing an Incoming Report Indication ...............   23
   3.5.2 Notification Forwarding ..................................   24
   4 The Structure of the MIB Modules .............................   27
   4.1 The Management Target MIB Module ...........................   27
   4.1.1 Tag Lists ................................................   28
   4.1.2 Definitions ..............................................   28
   4.2 The Notification MIB Module ................................   41
   4.2.1 Definitions ..............................................   42
   4.3 The Proxy MIB Module .......................................   53
   4.3.1 Definitions ..............................................   53
   5 Identification of Management Targets in Notification
        Originators ...............................................   59
   6 Notification Filtering .......................................   60
   7 Management Target Translation in Proxy  Forwarder
        Applications ..............................................   61
   7.1 Management Target Translation for Request Forwarding .......   61
   7.2 Management Target Translation for Notification Forwarding
        ...........................................................   62
   8 Intellectual Property ........................................   63
   9 Acknowledgments ..............................................   64
   10 Security Considerations .....................................   65
   11 References ..................................................   65
   12 Editors' Address ............................................   67
   A. Trap Configuration Example ..................................   68
   B. Full Copyright Statement ....................................   70

1. Overview 🎀

This document describes five types of SNMP applications, and honestly each one has its own vibe 💅

1.1. Command Generator Applications ✨

Command generators are apps that start SNMP Get, GetNext, GetBulk, and/or Set requests 🔥 They also process the response to any request they generated, so they're the whole loop, iykyk.

1.2. Command Responder Applications 👑

Command responders receive SNMP Get, GetNext, GetBulk, and/or Set requests that are meant for the local system. You can tell a request is for the local system when the contextEngineID in the received request matches the local engine it came through 🦋 The command responder then does the protocol operation, using access control, and generates a response message to send back to whoever sent the request. Main character energy, literally 💖

1.3. Notification Originator Applications 🌸

A notification originator conceptually keeps an eye on a system for particular events or conditions 👀 Based on those, it generates Trap and/or Inform messages 🧚 A notification originator has to have a way to figure out where to send messages, and which SNMP version and security parameters to use when sending them. The document gives a mechanism and a MIB module for exactly this purpose 🫶

1.4. Notification Receiver Applications 🌈

Notification receivers listen for notification messages 👂 When a message containing an Inform PDU comes in, they generate response messages 💜

1.5. Proxy Forwarder Applications 🍓

A proxy forwarder application forwards SNMP messages 💅 Quick heads up: implementing a proxy forwarder is optional 🙈 The sections about proxy (4.5, 5.3, and 8) can be skipped by implementations that don't include a proxy forwarder application.

The word "proxy" has historically been used super loosely, with a bunch of different meanings 😭 Some of those meanings include (among others):

  1. forwarding SNMP requests to other SNMP entities without caring which managed object types are being accessed; for example, to forward an SNMP request from one transport domain to another, or to translate SNMP requests of one version into SNMP requests of another version;
  2. translating SNMP requests into operations of some non-SNMP management protocol; and
  3. supporting aggregated managed objects, where the value of one managed object instance depends on the values of multiple other (remote) items of management information.

Each of these can be really useful. For example, aggregating management information can significantly reduce the bandwidth requirements of large-scale management activities ✨ But using one single term to cover all of these different scenarios causes confusion 💀

So to avoid that confusion, this document uses "proxy" with a much more tightly defined meaning 🔥 Here, "proxy" refers to a proxy forwarder application that forwards SNMP requests, notifications, and responses without caring what managed objects are contained within those requests or notifications 🦋 This definition is most closely related to the first meaning above. Also, in the SNMP architecture [RFC2271], a proxy forwarder is actually an application, and it doesn't need to be tied to what people usually think of as an SNMP agent 🧚

So what's the actual difference between a traditional SNMP agent and a proxy forwarder application? It's pretty simple, bestie 💖

  • A proxy forwarder application forwards requests and/or notifications to other SNMP engines according to the context, and regardless of the specific managed object types being accessed. It then sends the response to those previously forwarded messages back to the SNMP engine the original message came from 🫶
  • The command responder application that's part of what people traditionally think of as an SNMP agent is different. It processes SNMP requests according to the (names of the) individual managed object types and instances being accessed, and it is NOT a proxy forwarder application from this document's perspective 💅

So when a proxy forwarder application forwards a request or notification for a particular contextEngineID / contextName pair, two things are true 🌸 The info on how to forward the request is specifically tied to that context, and the proxy forwarder doesn't need a detailed definition of a MIB view, because it forwards the request no matter which managed object types are involved 👑

A command responder is different 😤 It needs the detailed definition of the MIB view. And even if it needs to send requests to other entities, via SNMP or otherwise, that need depends on the individual managed object instances being accessed. So it isn't just about the context 🧚

One more thing: a design goal of a proxy forwarder application is to act as an intermediary between the endpoints of a transaction ✨ When it forwards Inform requests, the associated response gets forwarded once it's received from the target the Inform request was forwarded to. It doesn't generate a response right away when the Inform request arrives 🦋

2. Management Targets ✨

Okay so some apps (notification generators and proxy forwarders especially) need a way to figure out WHERE and HOW to send the messages they make 📬. This doc gives you a mechanism and a MIB module for exactly that 🎀. The info that says where and how to send is called a 'Management Target' 💖, and it has two kinds of info:

  • Destination information, which is a transport domain and a transport address. This is also called a transport endpoint 🦋
  • SNMP parameters, which are message processing model, security model, security level, and security name info 🔐

The SNMP-TARGET-MIB module (later in this doc) has one table for each of these kinds of info 🌸. And it's a many-to-many thing in the MIB 🧚. One transport endpoint can go with several sets of SNMP parameters, and one set of SNMP parameters can go with several transport endpoints. Iconic, honestly 💅

3. Elements Of Procedure 💜

The following sections describe the procedures each type of app follows when it's generating messages to send or processing messages it received 🫶. Apps talk to the Dispatcher through the abstract service interfaces defined in [RFC2271] ✨.

3.1. Command Generator Applications 🚀

A command generator starts an SNMP request by calling the Dispatcher with this abstract service interface:

    statusInformation =              -- sendPduHandle if success
                                     -- errorIndication if failure
      sendPdu(
      IN   transportDomain           -- transport domain to be used
      IN   transportAddress          -- destination network address
      IN   messageProcessingModel    -- typically, SNMP version
      IN   securityModel             -- Security Model to use
      IN   securityName              -- on behalf of this principal
      IN   securityLevel             -- Level of Security requested
      IN   contextEngineID           -- data from/at this entity
      IN   contextName               -- data from/in this context
      IN   pduVersion                -- the version of the PDU
      IN   PDU                       -- SNMP Protocol Data Unit
      IN   expectResponse            -- TRUE or FALSE
           )

Where:

  • The transportDomain is that of the destination of the message 🎯
  • The transportAddress is that of the destination of the message 📍
  • The messageProcessingModel indicates which Message Processing Model the application wants to use 🛠️
  • The securityModel is the security model that the application wants to use 🔐
  • The securityName is the security model independent name for the principal on whose behalf the application wants the message to be generated 🧑‍💼
  • The securityLevel is the security level that the application wants to use 🛡️
  • The contextEngineID is provided by the command generator if it wants to explicitly specify the location of the management information it's requesting 🗺️
  • The contextName is provided by the command generator if it wants to explicitly specify the local context name for the management information it's requesting 🏷️
  • The pduVersion indicates the version of the PDU to be sent 📦
  • The PDU is a value constructed by the command generator containing the management operation that the command generator wants to perform 🧁
  • The expectResponse argument indicates that a response is expected 🙏

The result of the sendPdu interface tells you whether the PDU was successfully sent 📨. If it was, the returned value will be a sendPduHandle. The command generator should store the sendPduHandle so that it can correlate a response to the original request 🔗. This is giving detective energy 🕵️‍♀️.

The Dispatcher is responsible for delivering the response to a particular request to the correct command generator application 💌. The abstract service interface used for this is:

    processResponsePdu(              -- process Response PDU
      IN   messageProcessingModel    -- typically, SNMP version
      IN   securityModel             -- Security Model in use
      IN   securityName              -- on behalf of this principal
      IN   securityLevel             -- Level of Security
      IN   contextEngineID           -- data from/at this SNMP entity
      IN   contextName               -- data from/in this context
      IN   pduVersion                -- the version of the PDU
      IN   PDU                       -- SNMP Protocol Data Unit
      IN   statusInformation         -- success or errorIndication
      IN   sendPduHandle             -- handle from sendPDU
           )

Where:

  • The messageProcessingModel is the value from the received response 📬
  • The securityModel is the value from the received response 🔐
  • The securityName is the value from the received response 🧑‍💼
  • The securityLevel is the value from the received response 🛡️
  • The contextEngineID is the value from the received response 🗺️
  • The contextName is the value from the received response 🏷️
  • The pduVersion indicates the version of the PDU in the received response 📦
  • The PDU is the value from the received response 🧁
  • The statusInformation indicates success or failure in receiving the response ✅❌
  • The sendPduHandle is the value returned by the sendPdu call that generated the original request this is a response to 🔑

The procedure when a command generator receives a message goes like this 👀:

  1. If the received values of messageProcessingModel, securityModel, securityName, contextEngineID, contextName, and pduVersion are not all equal to the values used in the original request, the response is discarded 🗑️
  2. The operation type, request-id, error-status, error-index, and variable-bindings are extracted from the PDU and saved. If the request-id is not equal to the value used in the original request, the response is discarded 🗑️
  3. At this point, it's up to the application to take an appropriate action 🫡. The specific action is implementation dependent. If the statusInformation indicates that the request failed, an appropriate action might be to attempt to transmit the request again, or to notify the person operating the application that a failure occurred 📣

3.2. Command Responder Applications 🎀

Before a command responder application can process messages, it must first associate itself with an SNMP engine 🤝. The abstract service interface used for this is:

    statusInformation =        -- success or errorIndication
      registerContextEngineID(
      IN   contextEngineID     -- take responsibility for this one
      IN   pduType             -- the pduType(s) to be registered
           )

Where:

  • The statusInformation indicates success or failure of the registration attempt 🎉
  • The contextEngineID is equal to the snmpEngineID of the SNMP engine that the command responder is registering with 🆔
  • The pduType indicates a Get, GetNext, GetBulk, or Set pdu 🧾

Note that if another command responder application is already registered with an SNMP engine, any further attempts to register with the same contextEngineID and pduType will be denied 🚫. This implies that separate command responder applications could register separately for the various pdu types. However, in practice this is undesirable, and only a single command responder application should be registered with an SNMP engine at any given time 🙅‍♀️. Main character rule: one responder per engine, bestie 👑.

A command responder application can disassociate from an SNMP engine using this abstract service interface:

    unregisterContextEngineID(
      IN   contextEngineID     -- give up responsibility for this one
      IN   pduType             -- the pduType(s) to be unregistered
           )

Where:

  • The contextEngineID is equal to the snmpEngineID of the SNMP engine that the command responder is cancelling the registration with 🆔
  • The pduType indicates a Get, GetNext, GetBulk, or Set pdu 🧾

Once the command responder has registered with the SNMP engine, it waits to receive SNMP messages 👂. The abstract service interface used for receiving messages is:

    processPdu(                     -- process Request/Notification PDU
      IN   messageProcessingModel   -- typically, SNMP version
      IN   securityModel            -- Security Model in use
      IN   securityName             -- on behalf of this principal
      IN   securityLevel            -- Level of Security
      IN   contextEngineID          -- data from/at this SNMP entity
      IN   contextName              -- data from/in this context
      IN   pduVersion               -- the version of the PDU
      IN   PDU                      -- SNMP Protocol Data Unit
      IN   maxSizeResponseScopedPDU -- maximum size of the Response PDU
      IN   stateReference           -- reference to state information
           )                        -- needed when sending a response

Where:

  • The messageProcessingModel indicates which Message Processing Model received and processed the message 📥
  • The securityModel is the value from the received message 🔐
  • The securityName is the value from the received message 🧑‍💼
  • The securityLevel is the value from the received message 🛡️
  • The contextEngineID is the value from the received message 🗺️
  • The contextName is the value from the received message 🏷️
  • The pduVersion indicates the version of the PDU in the received message 📦
  • The PDU is the value from the received message 🧁
  • The maxSizeResponseScopedPDU is the maximum allowable size of a ScopedPDU containing a Response PDU (based on the maximum message size that the originator of the message can accept) 📏
  • The stateReference is a value that references cached information about each received request message 🧠. This value must be returned to the Dispatcher in order to generate a response 🔁

The procedure when a message is received is as follows 📋.

  1. The operation type is determined from the ASN.1 tag value associated with the PDU parameter. The operation type should always be one of the types previously registered by the application 🏷️
  2. The request-id is extracted from the PDU and saved 💾
  3. If the SNMPv2 operation type is GetBulk, the non-repeaters and max-repetitions values are extracted from the PDU and saved 🧮
  4. The variable-bindings are extracted from the PDU and saved 💅

okay so we're picking up right in the middle of step (5) 💅

(5) The management operation represented by the SNMPv2 operation type is performed with respect to the relevant MIB view within the context named by the contextName, according to the procedures set forth in [RFC1905]. The relevant MIB view is determined by the securityLevel, securityModel, contextName, securityName, and SNMPv2 operation type. To determine whether a particular object instance is within the relevant MIB view, the following abstract service interface is called: 🔍

    statusInformation =      -- success or errorIndication
      isAccessAllowed(
      IN   securityModel     -- Security Model in use
      IN   securityName      -- principal who wants to access
      IN   securityLevel     -- Level of Security
      IN   viewType          -- read, write, or notify view
      IN   contextName       -- context containing variableName
      IN   variableName      -- OID for the managed object
           )

Where:

  • The securityModel is the value from the received message.
  • The securityName is the value from the received message.
  • The securityLevel is the value from the received message.
  • The viewType indicates whether the PDU type is a read or write operation.
  • The contextName is the value from the received message.
  • The variableName is the object instance of the variable for which access rights are to be checked.

Normally, the result of the management operation will be a new PDU value, and processing will continue in step (6) below. However, at any time during the processing of the management operation: ✨

  • If the isAccessAllowed ASI returns a noSuchView, noAccessEntry, or noGroupName error, processing of the management operation is halted, a PDU value is constructed using the values from the originally received PDU, but replacing the error_status with an authorizationError code, and error_index value of 0, and control is passed to step (6) below.
  • If the isAccessAllowed ASI returns an otherError, processing of the management operation is halted, a different PDU value is constructed using the values from the originally received PDU, but replacing the error_status with a genError code, and control is passed to step (6) below.
  • If the isAccessAllowed ASI returns a noSuchContext error, processing of the management operation is halted, no result PDU is generated, the snmpUnknownContexts counter is incremented, and control is passed to step (6) below.
  • If the context named by the contextName parameter is unavailable, processing of the management operation is halted, no result PDU is generated, the snmpUnavailableContexts counter is incremented, and control is passed to step (6) below.

(6) The Dispatcher is called to generate a response or report message. The abstract service interface is: 📬

returnResponsePdu(
  IN   messageProcessingModel   -- typically, SNMP version
  IN   securityModel            -- Security Model in use
  IN   securityName             -- on behalf of this principal
  IN   securityLevel            -- same as on incoming request
  IN   contextEngineID          -- data from/at this SNMP entity
  IN   contextName              -- data from/in this context
  IN   pduVersion               -- the version of the PDU
  IN   PDU                      -- SNMP Protocol Data Unit
  IN   maxSizeResponseScopedPDU -- maximum size of the Response PDU
  IN   stateReference           -- reference to state information
                                -- as presented with the request
  IN   statusInformation        -- success or errorIndication
       )                        -- error counter OID/value if error

Where:

  • The messageProcessingModel is the value from the processPdu call.
  • The securityModel is the value from the processPdu call.
  • The securityName is the value from the processPdu call.
  • The securityLevel is the value from the processPdu call.
  • The contextEngineID is the value from the processPdu call.
  • The contextName is the value from the processPdu call.
  • The pduVersion indicates the version of the PDU to be returned. If no result PDU was generated, the pduVersion is an undefined value.
  • The PDU is the result generated in step (5) above. If no result PDU was generated, the PDU is an undefined value.
  • The maxSizeResponseScopedPDU is a local value indicating the maximum size of a ScopedPDU that the application can accept.
  • The stateReference is the value from the processPdu call.
  • The statusInformation either contains an indication that no error occurred and that a response should be generated, or contains an indication that an error occurred along with the OID and counter value of the appropriate error counter object.
🎀 Note that a command responder application should always call the returnResponsePdu abstract service interface, even in the event of an error such as a resource allocation error. In the event of such an error, the PDU value passed to returnResponsePdu should contain appropriate values for errorStatus and errorIndex.

3.3. Notification Originator Applications 🦋

A notification originator application generates SNMP notification messages. A notification message may, for example, contain an SNMPv2-Trap PDU or an Inform PDU. However, a particular implementation is not required to be capable of generating both types of messages. 🌸

Notification originator applications require a mechanism for identifying the management targets to which notifications should be sent. The particular mechanism used is implementation dependent. However, if an implementation makes the configuration of management targets SNMP manageable, it MUST use the SNMP-TARGET-MIB module described in this document. 💜

When a notification originator wishes to generate a notification, it must first determine in which context the information to be conveyed in the notification exists, i.e., it must determine the contextEngineID and contextName. It must then determine the set of management targets to which the notification should be sent. The application must also determine, for each management target, whether the notification message should contain an SNMPv2-Trap PDU or Inform PDU, and if it is to contain an Inform PDU, the number of retries and retransmission algorithm. 🧚

The mechanism by which a notification originator determines this information is implementation dependent. Once the application has determined this information, the following procedure is performed for each management target: 🫶

(1) Any appropriate filtering mechanisms are applied to determine whether the notification should be sent to the management target. If such filtering mechanisms determine that the notification should not be sent, processing continues with the next management target. Otherwise,

(2) The appropriate set of variable-bindings is retrieved from local MIB instrumentation within the relevant MIB view. The relevant MIB view is determined by the securityLevel, securityModel, contextName, and securityName of the management target. To determine whether a particular object instance is within the relevant MIB view, the isAccessAllowed abstract service interface is used, in the same manner as described in the preceding section. If the statusInformation returned by isAccessAllowed does not indicate accessAllowed, the notification is not sent to the management target.

(3) A PDU is constructed using a locally unique request-id value, an operation type of SNMPv2-Trap or Inform, an error-status and error-index value of 0, and the variable-bindings supplied previously in step (2).

(4) If the notification contains an SNMPv2-Trap PDU, the Dispatcher is called using the following abstract service interface: 📣

statusInformation =              -- sendPduHandle if success
                                 -- errorIndication if failure
  sendPdu(
  IN   transportDomain           -- transport domain to be used
  IN   transportAddress          -- destination network address
  IN   messageProcessingModel    -- typically, SNMP version
  IN   securityModel             -- Security Model to use
  IN   securityName              -- on behalf of this principal
  IN   securityLevel             -- Level of Security requested
  IN   contextEngineID           -- data from/at this entity
  IN   contextName               -- data from/in this context
  IN   pduVersion                -- the version of the PDU
  IN   PDU                       -- SNMP Protocol Data Unit
  IN   expectResponse            -- TRUE or FALSE
       )

Where:

  • The transportDomain is that of the management target.
  • The transportAddress is that of the management target.
  • The messageProcessingModel is that of the management target.
  • The securityModel is that of the management target.
  • The securityName is that of the management target.
  • The securityLevel is that of the management target.
  • The contextEngineID is the value originally determined for the notification.
  • The contextName is the value originally determined for the notification.
  • The pduVersion is the version of the PDU to be sent.
  • The PDU is the value constructed in step (3) above.
  • The expectResponse argument indicates that no response is expected.

Otherwise,

(5) If the notification contains an Inform PDU, then:

  • a) The Dispatcher is called using the sendPdu abstract service interface as described in step (4) above, except that the expectResponse argument indicates that a response is expected.
  • b) The application caches information about the management target.
  • c) If a response is received within an appropriate time interval from the transport endpoint of the management target, the notification is considered acknowledged and the cached information is deleted. Otherwise,
  • d) If a response is not received within an appropriate time period, or if a report indication is received, information about the management target is retrieved from the cache, and steps a) through d) are repeated. The number of times these steps are repeated is equal to the previously determined retry count. If this retry count is exceeded, the acknowledgement of the notification is considered to have failed, and processing of the notification for this management target is halted.

🌈 Responses to Inform PDU notifications will be received via the processResponsePDU abstract service interface.

3.4. Notification Receiver Applications ✨

okay so notification receiver applications are the ones that catch SNMP Notification messages coming from the Dispatcher 📬 before any of that can happen, the notification receiver has to register with the Dispatcher using the registerContextEngineID abstract service interface. the parameters are:

  • The contextEngineID is an undefined 'wildcard' value. Notifications get delivered to a registered notification receiver regardless of the contextEngineID in the notification message 🫶
  • The pduType tells the Dispatcher what kinds of notifications the app wants (for example, SNMPv2-Trap PDUs or Inform PDUs) 🔔

once the notification receiver is registered, messages get received through the processPdu abstract service interface. the parameters are:

  • The messageProcessingModel indicates which Message Processing Model received and processed the message.
  • The securityModel is the value from the received message.
  • The securityName is the value from the received message.
  • The securityLevel is the value from the received message.
  • The contextEngineID is the value from the received message.
  • The contextName is the value from the received message.
  • The pduVersion indicates the version of the PDU in the received message.
  • The PDU is the value from the received message.
  • The maxSizeResponseScopedPDU is the maximum allowable size of a ScopedPDU containing a Response PDU (based on the maximum message size that the originator of the message can accept).
  • If the message contains an SNMPv2-Trap PDU, the stateReference is undefined and unused. Otherwise, the stateReference is a value which references cached information about the notification. this value must be returned to the Dispatcher in order to generate a response. 🧠

when an SNMPv2-Trap PDU gets delivered to a notification receiver application, it first pulls out the SNMP operation type, request-id, error-status, error-index, and variable-bindings from the PDU. after that, processing depends on the particular implementation 🤷‍♀️

when an Inform PDU is received, the notification receiver application follows this procedure:

(1) The SNMPv2 operation type, request-id, error-status, error-index, and variable-bindings are extracted from the PDU.

(2) A Response PDU is constructed using the extracted request-id and variable-bindings, with error-status and error-index both set to 0. 💅

(3) The Dispatcher is called to generate a response message using the returnResponsePdu abstract service interface. the parameters are:

  • The messageProcessingModel is the value from the processPdu call.
  • The securityModel is the value from the processPdu call.
  • The securityName is the value from the processPdu call.
  • The securityLevel is the value from the processPdu call.
  • The contextEngineID is the value from the processPdu call.
  • The contextName is the value from the processPdu call.
  • The pduVersion indicates the version of the PDU to be returned.
  • The PDU is the result generated in step (2) above.
  • The maxSizeResponseScopedPDU is a local value indicating the maximum size of a ScopedPDU that the application can accept.
  • The stateReference is the value from the processPdu call.
  • The statusInformation indicates that no error occurred and that a response should be generated.

3.5. Proxy Forwarder Applications 🦋

okay this one is giving middleman energy 😌 a proxy forwarder application deals with forwarding SNMP messages. there are four basic types of messages it might need to forward. they're grouped by the PDU type inside a message, or by whether the message has a report indication in it. the four basic types are:

  • Those containing PDU types which were generated by a command generator application (for example, Get, GetNext, GetBulk, and Set PDU types). these deal with requesting or modifying information located within a particular context.
  • Those containing PDU types which were generated by a notification originator application (for example, SNMPv2-Trap and Inform PDU types). these deal with notifications concerning information located within a particular context.
  • Those containing a Response PDU type. forwarding of Response PDUs always happens as a result of receiving a response to a previously forwarded message.
  • Those containing a report indication. forwarding of report indications always happens as a result of receiving a report indication for a previously forwarded message.

for the first type, the proxy forwarder's job is to deliver a request for management information to an SNMP engine which is "closer" or "downstream in the path" to the SNMP engine that has access to that information, and then deliver the response with the information back to the SNMP engine the request came from. the context information in a request is used to figure out which SNMP engine has access to the requested information, and that decides where and how the request gets forwarded 🗺️

for the second type, the proxy forwarder's job is to figure out which SNMP engines should receive notifications about management information from a particular location. the context information in a notification message determines the location that the information in the notification applies to. that's what's used to decide which SNMP engines should get notified about this information 🔔

for the third type, the proxy forwarder's job is to figure out which previously forwarded request or notification (if any) the response matches, and then forward the response back to the initiator of the request or notification 🔁

for the fourth type, the proxy forwarder's job is to figure out which previously forwarded request or notification (if any) the report indication matches, and then forward the report indication back to the initiator of the request or notification 🚩

when forwarding messages, a proxy forwarder application must perform a translation of incoming management target information into outgoing management target information. how this translation is performed is implementation specific. in lots of cases it's driven by a preconfigured translation table 📋 if a proxy forwarder application makes the contents of this table SNMP manageable, it MUST use the SNMP-PROXY-MIB module defined in this document.

3.5.1. Request Forwarding

there are two phases for request forwarding. first, the incoming request has to be passed through the proxy application. then, the resulting response gets passed back. these phases are described in the following two sections 🎀

3.5.1.1. Processing an Incoming Request

a proxy forwarder application that wants to forward request messages must first register with the Dispatcher using the registerContextEngineID abstract service interface. the proxy forwarder must register each contextEngineID it wants to forward messages for, as well as for each pduType. note that as the configuration of a proxy forwarder changes, the particular contextEngineID values it's forwarding for may change too. the proxy forwarder should call the registerContextEngineID and unregisterContextEngineID abstract service interfaces as needed to reflect its current configuration 🔄

a proxy forwarder application should never attempt to register a value of contextEngineID which is equal to the snmpEngineID of the SNMP engine that the proxy forwarder is associated with. 🙅‍♀️

once the proxy forwarder has registered for the appropriate contextEngineId values, it can start processing messages. the following procedure is used:

(1) A message is received using the processPdu abstract service interface. the incoming management target information received from the processPdu interface is translated into outgoing management target information. note that this translation may vary for different values of contextEngineID and/or contextName. the translation should result in a single management target. 🎯

(2) If appropriate outgoing management target information cannot be found, the proxy forwarder increments the snmpProxyDrops counter [RFC1907], and then calls the Dispatcher using the returnResponsePdu abstract service interface. the parameters are:

  • The messageProcessingModel is the value from the processPdu call.
  • The securityModel is the value from the processPdu call.
  • The securityName is the value from the processPdu call.
  • The securityLevel is the value from the processPdu call.
  • The contextEngineID is the value from the processPdu call.
  • The contextName is the value from the processPdu call.
  • The pduVersion is the value from the processPdu call.
  • The PDU is an undefined value.
  • The maxSizeResponseScopedPDU is a local value indicating the maximum size of a ScopedPDU that the application can accept.
  • The stateReference is the value from the processPdu call.
  • The statusInformation indicates that an error occurred and includes the OID and value of the snmpProxyDrops object.

processing of the message stops right there. otherwise,

(3) A new PDU is constructed. a unique value of request-id should be used in the new PDU (this value lets a later response message get correlated with this request). the rest of the new PDU is identical to the received PDU, unless the incoming SNMP version is SNMPv2 or SNMPv3 and the outgoing SNMP version is SNMPv1, in which case the proxy forwarder must apply the translation rules documented in [RFC1908]. 🔀

(4) The proxy forwarder calls the Dispatcher to generate the forwarded message, using the sendPdu abstract service interface. the parameters are:

  • The transportDomain is that of the outgoing management target.
  • The transportAddress is that of the outgoing management target.
  • The messageProcessingModel is that of the outgoing management target.
  • The securityModel is that of the outgoing management target.
  • The securityName is that of the outgoing management target.
  • The securityLevel is that of the outgoing management target.
  • The contextEngineID is the value originally received.
  • The contextName is the value originally received.
  • The pduVersion is the version of the PDU to be sent.
  • The PDU is the value constructed in step (3) above.
  • The expectResponse argument indicates that a response is expected. If the sendPdu call is unsuccessful, the proxy forwarder performs the steps described in (2) above. Otherwise:

(5) The proxy forwarder caches the following information in order to match an incoming response to the forwarded request:

  • The sendPduHandle returned from the call to sendPdu,
  • The request-id from the received PDU.
  • the contextEngineID,
  • the contextName,
  • the stateReference,
  • the incoming management target information,
  • the outgoing management information,
  • any other information needed to match an incoming response to the forwarded request.

If this information cannot be cached (possibly due to a lack of resources), the proxy forwarder performs the steps described in (2) above. Otherwise:

(6) Processing of the request stops until a response to the forwarded request is received, or until an appropriate time interval has expired. If this time interval expires before a response has been received, the cached information about this request is removed. 🕰️✨

3.5.1.2. Processing an Incoming Response 📬

okay so a proxy forwarder follows this procedure whenever an incoming response shows up 💌

(1) The incoming response is received using the processResponsePdu interface. The proxy forwarder uses the received parameters to locate an entry in its cache of pending forwarded requests. This is done by matching the received parameters with the cached values of sendPduHandle, contextEngineID, contextName, outgoing management target information, and the request-id contained in the received PDU (the proxy forwarder must extract the request-id for this purpose). If an appropriate cache entry cannot be found, processing of the response is halted. Otherwise:

(2) The cache information is extracted, and removed from the cache.

(3) A new Response PDU is constructed, using the request-id value from the original forwarded request (as extracted from the cache). All other values are identical to those in the received Response PDU.

(4) If the incoming SNMP version is SNMPv1 and the outgoing SNMP version is SNMPv2 or SNMPv3, the proxy forwarder must apply the translation rules documented in [RFC1908]. 🔁

(5) The proxy forwarder calls the Dispatcher using the returnResponsePdu abstract service interface. Parameters are:

  • The messageProcessingModel indicates the Message Processing Model by which the original incoming message was processed.
  • The securityModel is that of the original incoming management target extracted from the cache.
  • The securityName is that of the original incoming management target extracted from the cache.
  • The securityLevel is that of the original incoming management target extracted from the cache.
  • The contextEngineID is the value extracted from the cache.
  • The contextName is the value extracted from the cache.
  • The pduVersion indicates the version of the PDU to be returned.
  • The PDU is the (possibly translated) Response PDU.
  • The maxSizeResponseScopedPDU is a local value indicating the maximum size of a ScopedPDU that the application can accept.
  • The stateReference is the value extracted from the cache.
  • The statusInformation indicates that no error occurred and that a Response PDU message should be generated. 💖

3.5.1.3. Processing an Incoming Report Indication 🚨

a proxy forwarder follows this procedure when an incoming report indication arrives 🫶

(1) The incoming report indication is received using the processResponsePdu interface. The proxy forwarder uses the received parameters to locate an entry in its cache of pending forwarded requests. This is done by matching the received parameters with the cached values of sendPduHandle. If an appropriate cache entry cannot be found, processing of the report indication is halted. Otherwise:

(2) The cache information is extracted, and removed from the cache.

(3) If the original incoming management target information indicates SNMPv1, processing of the report indication is halted. 🙈

(4) The proxy forwarder calls the Dispatcher using the returnResponsePdu abstract service interface. Parameters are:

  • The messageProcessingModel indicates the Message Processing Model by which the original incoming message was processed.
  • The securityModel is that of the original incoming management target extracted from the cache.
  • The securityName is that of the original incoming management target extracted from the cache.
  • The securityLevel is that of the original incoming management target extracted from the cache.
  • The contextEngineID is the value extracted from the cache.
  • The contextName is the value extracted from the cache.
  • The pduVersion indicates the version of the PDU to be returned.
  • The PDU is unused.
  • The maxSizeResponseScopedPDU is a local value indicating the maximum size of a ScopedPDU that the application can accept.
  • The stateReference is the value extracted from the cache.
  • The statusInformation contain the contextEngineID, contextName, counter OID, and counter value received in the report indication. 🌸

3.5.2. Notification Forwarding 📣

a proxy forwarder receives notifications in the same way a notification receiver application does, using the processPdu abstract service interface. The following procedure is used when a notification is received:

(1) The incoming management target information received from the processPdu interface is translated into outgoing management target information. Note that this translation may vary for different values of contextEngineId and/or contextName. The translation may result in multiple management targets. 🎯

(2) If appropriate outgoing management target information cannot be found and the notification was a Trap, processing of the notification is halted. If appropriate outgoing management target information cannot be found and the notification was an Inform, the proxy forwarder increments the snmpProxyDrops object, and calls the Dispatcher using the returnResponsePdu abstract service interface.

The parameters are:

  • The messageProcessingModel is the received value.
  • The securityModel is the received value.
  • The securityName is the received value.
  • The securityLevel is the received value.
  • The contextEngineID is the received value.
  • The contextName is the received value.
  • The pduVersion is the received value.
  • The PDU is an undefined and unused value.
  • The maxSizeResponseScopedPDU is a local value indicating the maximum size of a ScopedPDU that the application can accept.
  • The stateReference is the received value.
  • The statusInformation indicates that an error occurred and that a Report message should be generated.

Processing of the message stops at this point. Otherwise,

(3) The proxy forwarder generates a notification using the procedures described in the preceding section on Notification Originators, with the following exceptions:

  • The contextEngineID and contextName values from the original received notification are used.
  • The outgoing management targets previously determined are used.
  • No filtering mechanisms are applied.
  • The variable-bindings from the original received notification are used, rather than retrieving variable-bindings from local MIB instrumentation. In particular, no access-control is applied to these variable-bindings.
  • If for any of the outgoing management targets, the incoming SNMP version is SNMPv1 and the outgoing SNMP version is SNMPv2 or SNMPv3, the proxy forwarder must apply the translation rules as documented in [RFC1908].
  • If for any of the outgoing management targets, the incoming SNMP version is SNMPv2 or SNMPv3, and the outgoing SNMP version is SNMPv1, this outgoing management target is not used when generating the forwarded notifications. 🧚

(4) If the original received notification contains an SNMPv2-Trap PDU, processing of the notification is now completed. Otherwise, the original received notification must contain an Inform PDU, and processing continues. 🔍

(5) If the forwarded notifications included any Inform PDUs, processing continues when the procedures described in the section for Notification Originators determine that either:

  • None of the generated notifications containing Inform PDUs have been successfully acknowledged within the longest of the time intervals, in which case processing of the original notification is halted, or,
  • At least one of the generated notifications containing Inform PDUs is successfully acknowledged, in which case a response to the original received notification containing an Inform PDU is generated as described in the following steps. 🎀

(6) A Response PDU is constructed, using the values of request-id and variable-bindings from the original received Inform PDU, and error-status and error-index values of 0.

(7) The Dispatcher is called using the returnResponsePdu abstract service interface. Parameters are:

  • The messageProcessingModel is the originally received value.
  • The securityModel is the originally received value.
  • The securityName is the originally received value.
  • The securityLevel is the originally received value.
  • The contextEngineID is the originally received value.
  • The contextName is the originally received value.
  • The pduVersion indicates the version of the PDU constructed in step (6) above.
  • The PDU is the value constructed in step (6) above.
  • The maxSizeResponseScopedPDU is a local value indicating the maximum size of a ScopedPDU that the application can accept.
  • The stateReference is the originally received value.
  • The statusInformation indicates that no error occurred and that a Response PDU message should be generated. ✅

4. The Structure of the MIB Modules ✨

there are three separate MIB modules described in this document: the management target MIB, the notification MIB, and the proxy MIB. The following sections describe the structure of these three MIB modules. 🦋

The use of these MIBs by particular types of applications is described later in this document:

  • The use of the management target MIB and the notification MIB in notification originator applications is described in section 6.
  • The use of the notification MIB for filtering notifications in notification originator applications is described in section 7.
  • The use of the management target MIB and the proxy MIB in proxy forwarding applications is described in section 8. 💜

4.1. The Management Target MIB Module ✨

okay so the SNMP-TARGET-MIB module is where we define management targets 🎯. it has two tables plus conformance/compliance statements, so it's pretty much the whole package 💅

the first table is the snmpTargetAddrTable 🗺️. it holds transport domains and addresses, and it also has an object called snmpTargetAddrTagList that gives you a way to group entries together 🧺

the second table is the snmpTargetParamsTable 🔐. this one holds the SNMP version and security info to use when sending messages to particular transport domains and addresses. no cap, the two tables work as a team 🫶

4.1.1. Tag Lists 🏷️

the snmpTargetAddrTagList object is how entries in the snmpTargetAddrTable get grouped ✨. its value is a list of tag values, and those tags are used to pick which target addresses get used for a particular operation 🎯

a tag value (which can also show up in MIB objects other than snmpTargetAddrTagList) is an arbitrary string of octets. it's giving freedom, but a tag value may not contain a delimiter character 🙅‍♀️ the delimiter characters are these four:

  • An ASCII space character (0x20).
  • An ASCII TAB character (0x09).
  • An ASCII carriage return (CR) character (0x0D).
  • An ASCII line feed (LF) character (0x0B).

on top of that, a tag value may not have a zero length 📏. generally, a particular MIB object may contain either:

  • a single tag value, in which case the value of the MIB object may not contain a delimiter character, or:
  • a MIB object may contain a list of tag values, separated by single delimiter characters.

for a list of tag values, these constraints add some rules for what the MIB object's value can look like 👑

  • There cannot be a leading or trailing delimiter character.
  • There cannot be multiple adjacent delimiter characters.

4.1.2. Definitions 📜

ok this is the actual MIB module, the full ASN.1 definition. you'll see the IMPORTS, the MODULE-IDENTITY with all the contact info, the textual conventions, and the objects 🧚

   SNMP-TARGET-MIB DEFINITIONS ::= BEGIN

   IMPORTS
       TEXTUAL-CONVENTION,
       MODULE-IDENTITY,
       OBJECT-TYPE,
       snmpModules,
       Integer32
           FROM SNMPv2-SMI

       TDomain,
       TAddress,
       TimeInterval,
       RowStatus,
       StorageType,
       TestAndIncr
           FROM SNMPv2-TC
       SnmpSecurityModel,
       SnmpMessageProcessingModel,
       SnmpSecurityLevel,
       SnmpAdminString
           FROM SNMP-FRAMEWORK-MIB

       OBJECT-GROUP
           FROM SNMPv2-CONF;

   snmpTargetMIB MODULE-IDENTITY
       LAST-UPDATED "9711210000Z"
       ORGANIZATION "IETF SNMPv3 Working Group"
       CONTACT-INFO
           "WG-email:   snmpv3@tis.com
            Subscribe:  majordomo@tis.com
                        In message body:  subscribe snmpv3

            Chair:      Russ Mundy
                        Trusted Information Systems
            Postal:     3060 Washington Rd
                        Glenwood MD 21738
                        USA
            Email:      mundy@tis.com
            Phone:      +1-301-854-6889

            Co-editor:  David B. Levi
                        SNMP Research, Inc.
            Postal:     3001 Kimberlin Heights Road
                        Knoxville, TN 37920-9716
            E-mail:     levi@snmp.com
            Phone:      +1 423 573 1434

            Co-editor:  Paul Meyer
                        Secure Computing Corporation
            Postal:     2675 Long Lake Road
                        Roseville, MN 55113
            E-mail:     paul_meyer@securecomputing.com
            Phone:      +1 612 628 1592

            Co-editor:  Bob Stewart
                        Cisco Systems, Inc.
            Postal:     170 West Tasman Drive
                        San Jose, CA 95134-1706
            E-mail:     bstewart@cisco.com
            Phone:      +1 603 654 6923"
       DESCRIPTION
           "This MIB module defines MIB objects which provide
            mechanisms to remotely configure the parameters used
            by an SNMP entity for the generation of SNMP messages."
       REVISION        "9707140000Z"
       DESCRIPTION
           "The initial revision."
       ::= { snmpModules 12 }

   snmpTargetObjects       OBJECT IDENTIFIER ::= { snmpTargetMIB 1 }
   snmpTargetConformance   OBJECT IDENTIFIER ::= { snmpTargetMIB 3 }

   SnmpTagValue ::= TEXTUAL-CONVENTION
       DISPLAY-HINT "255a"
       STATUS       current
       DESCRIPTION
           "An octet string containing a tag value.
            Tag values are preferably in human-readable form.

            To facilitate internationalization, this information
            is represented using the ISO/IEC IS 10646-1 character
            set, encoded as an octet string using the UTF-8
            character encoding scheme described in RFC 2044.

            Since additional code points are added by amendments
            to the 10646 standard from time to time,
            implementations must be prepared to encounter any code
            point from 0x00000000 to 0x7fffffff.

            The use of control codes should be avoided, and certain
            control codes are not allowed as described below.

            For code points not directly supported by user
            interface hardware or software, an alternative means
            of entry and display, such as hexadecimal, may be
            provided.

            For information encoded in 7-bit US-ASCII, the UTF-8
            representation is identical to the US-ASCII encoding.

            Note that when this TC is used for an object that
            is used or envisioned to be used as an index, then a
            SIZE restriction must be specified so that the number
            sub-identifiers for any object instance do not exceed
            the limit of 128, as defined by [RFC1905].

            An object of this type contains a single tag value
            which is used to select a set of entries in a table.
            A tag value is an arbitrary string of octets, but
            may not contain a delimiter character.  Delimiter
            characters are defined to be one of the following:

                -  An ASCII space character (0x20).

                -  An ASCII TAB character (0x09).

                -  An ASCII carriage return (CR) character (0x0D).

                -  An ASCII line feed (LF) character (0x0B).

            Delimiter characters are used to separate tag values
            in a tag list.  An object of this type may only
            contain a single tag value, and so delimiter
            characters are not allowed in a value of this type.

            Some examples of valid tag values are:

                - 'acme'

                - 'router'

                - 'host'

            The use of a tag value to select table entries is
            application and MIB specific."
       SYNTAX       OCTET STRING (SIZE (0..255))

   SnmpTagList ::= TEXTUAL-CONVENTION
       DISPLAY-HINT "255a"
       STATUS       current
       DESCRIPTION
           "An octet string containing a list of tag values.
            Tag values are preferably in human-readable form.

            To facilitate internationalization, this information
            is represented using the ISO/IEC IS 10646-1 character
            set, encoded as an octet string using the UTF-8
            character encoding scheme described in RFC 2044.

            Since additional code points are added by amendments
            to the 10646 standard from time to time,
            implementations must be prepared to encounter any code
            point from 0x00000000 to 0x7fffffff.

            The use of control codes should be avoided, except as
            described below.

            For code points not directly supported by user
            interface hardware or software, an alternative means
            of entry and display, such as hexadecimal, may be
            provided.

            For information encoded in 7-bit US-ASCII, the UTF-8
            representation is identical to the US-ASCII encoding.

            An object of this type contains a list of tag values
            which are used to select a set of entries in a table.

            A tag value is an arbitrary string of octets, but
            may not contain a delimiter character.  Delimiter
            characters are defined to be one of the following:

                -  An ASCII space character (0x20).

                -  An ASCII TAB character (0x09).

                -  An ASCII carriage return (CR) character (0x0D).

                -  An ASCII line feed (LF) character (0x0B).

            Delimiter characters are used to separate tag values
            in a tag list.  Only a single delimiter character may
            occur between two tag values.  A tag value may not
            have a zero length.  These constraints imply certain
            restrictions on the contents of this object:

                - There cannot be a leading or trailing delimiter
                  character.

                - There cannot be multiple adjacent delimiter
                  characters.

            Some examples of valid tag lists are:

                - An empty string

                - 'acme router'
                - 'host managerStation'

            Note that although a tag value may not have a length of
            zero, an empty string is still valid.  This indicates
            an empty list (i.e. there are no tag values in the list).

            The use of the tag list to select table entries is
            application and MIB specific.  Typically, an application
            will provide one or more tag values, and any entry
            which contains some combination of these tag values
            will be selected."
       SYNTAX       OCTET STRING (SIZE (0..255))

   --
   --
   -- The snmpTargetObjects group
   --
   --

   snmpTargetSpinLock OBJECT-TYPE
       SYNTAX      TestAndIncr
       MAX-ACCESS  read-write
       STATUS      current
       DESCRIPTION
           "This object is used to facilitate modification of table
            entries in the SNMP-TARGET-MIB module by multiple
            managers.  In particular, it is useful when modifying
            the value of the snmpTargetAddrTagList object.

            The procedure for modifying the snmpTargetAddrTagList
            object is as follows:

                1.  Retrieve the value of snmpTargetSpinLock and
                    of snmpTargetAddrTagList.

2.  Generate a new value for snmpTargetAddrTagList.

                3.  Set the value of snmpTargetSpinLock to the
                    retrieved value, and the value of
                    snmpTargetAddrTagList to the new value.  If
                    the set fails for the snmpTargetSpinLock
                    object, go back to step 1."
       ::= { snmpTargetObjects 1 }

   snmpTargetAddrTable OBJECT-TYPE
       SYNTAX      SEQUENCE OF SnmpTargetAddrEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "A table of transport addresses to be used in the generation
            of SNMP messages."

       ::= { snmpTargetObjects 2 }

   snmpTargetAddrEntry OBJECT-TYPE
       SYNTAX      SnmpTargetAddrEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "A transport address to be used in the generation
            of SNMP operations.

            Entries in the snmpTargetAddrTable are created and
            deleted using the snmpTargetAddrRowStatus object."
       INDEX { IMPLIED snmpTargetAddrName }
       ::= { snmpTargetAddrTable 1 }

okay so this is where the target tables really get going 💖 the addr table is basically the list of where your messages go 📬, and the params table is the "how do I talk to them" settings 🎀 they point at each other by name, which is lowkey iconic 🧚

Heads up: these entries are literally full of little rules about when rows can go active, so read the status descriptions 👀

   SnmpTargetAddrEntry ::= SEQUENCE {
       snmpTargetAddrName         SnmpAdminString,
       snmpTargetAddrTDomain      TDomain,
       snmpTargetAddrTAddress     TAddress,
       snmpTargetAddrTimeout      TimeInterval,
       snmpTargetAddrRetryCount   Integer32,
       snmpTargetAddrTagList      SnmpTagList,
       snmpTargetAddrParams       SnmpAdminString,
       snmpTargetAddrStorageType  StorageType,
       snmpTargetAddrRowStatus    RowStatus
   }

   snmpTargetAddrName OBJECT-TYPE
       SYNTAX      SnmpAdminString (SIZE(1..32))
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "The locally arbitrary, but unique identifier associated
            with this snmpTargetAddrEntry."
       ::= { snmpTargetAddrEntry 1 }

   snmpTargetAddrTDomain OBJECT-TYPE
       SYNTAX      TDomain
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "This object indicates the transport type of the address
            contained in the snmpTargetAddrTAddress object."
       ::= { snmpTargetAddrEntry 2 }

   snmpTargetAddrTAddress OBJECT-TYPE
       SYNTAX      TAddress
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "This object contains a transport address.  The format of
            this address depends on the value of the
            snmpTargetAddrTDomain object."
       ::= { snmpTargetAddrEntry 3 }

   snmpTargetAddrTimeout OBJECT-TYPE
       SYNTAX      TimeInterval
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "This object should reflect the expected maximum round
            trip time for communicating with the transport address
            defined by this row.  When a message is sent to this
            address, and a response (if one is expected) is not
            received within this time period, an implementation
            may assume that the response will not be delivered.

            Note that the time interval that an application waits
            for a response may actually be derived from the value
            of this object.  The method for deriving the actual time
            interval is implementation dependent.  One such method
            is to derive the expected round trip time based on a
            particular retransmission algorithm and on the number
            of timeouts which have occurred.  The type of message may
            also be considered when deriving expected round trip
            times for retransmissions.  For example, if a message is
            being sent with a securityLevel that indicates both
            authentication and privacy, the derived value may be
            increased to compensate for extra processing time spent
            during authentication and encryption processing."
       DEFVAL { 1500 }
       ::= { snmpTargetAddrEntry 4 }

   snmpTargetAddrRetryCount OBJECT-TYPE
       SYNTAX      Integer32 (0..255)
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "This object specifies a default number of retries to be
            attempted when a response is not received for a generated
            message.  An application may provide its own retry count,
            in which case the value of this object is ignored."
       DEFVAL { 3 }
       ::= { snmpTargetAddrEntry 5 }

   snmpTargetAddrTagList OBJECT-TYPE
       SYNTAX      SnmpTagList
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "This object contains a list of tag values which are
            used to select target addresses for a particular
            operation."
       ::= { snmpTargetAddrEntry 6 }

   snmpTargetAddrParams OBJECT-TYPE
       SYNTAX      SnmpAdminString (SIZE(1..32))
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The value of this object identifies an entry in the
            snmpTargetParamsTable.  The identified entry
            contains SNMP parameters to be used when generating
            messages to be sent to this transport address."
       ::= { snmpTargetAddrEntry 7 }

   snmpTargetAddrStorageType OBJECT-TYPE
       SYNTAX      StorageType
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The storage type for this conceptual row."
       ::= { snmpTargetAddrEntry 8 }

   snmpTargetAddrRowStatus OBJECT-TYPE
       SYNTAX      RowStatus
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The status of this conceptual row.

            To create a row in this table, a manager must
            set this object to either createAndGo(4) or
            createAndWait(5).

            Until instances of all corresponding columns are
            appropriately configured, the value of the
            corresponding instance of the snmpTargetAddrRowStatus
            column is 'notReady'.

            In particular, a newly created row cannot be made
            active until the corresponding snmpTargetAddrTDomain
            and snmpTargetAddrTAddress have both been set.

            The following objects may not be modified while the
            value of this object is active(1):
                - snmpTargetAddrTDomain
                - snmpTargetAddrTAddress"
       ::= { snmpTargetAddrEntry 9 }

   snmpTargetParamsTable OBJECT-TYPE
       SYNTAX      SEQUENCE OF SnmpTargetParamsEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "A table of SNMP target information to be used
            in the generation of SNMP messages."
       ::= { snmpTargetObjects 3 }

   snmpTargetParamsEntry OBJECT-TYPE
       SYNTAX      SnmpTargetParamsEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "A set of SNMP target information.

            Entries in the snmpTargetParamsTable are created and
            deleted using the snmpTargetParamsRowStatus object."
       INDEX { IMPLIED snmpTargetParamsName }
       ::= { snmpTargetParamsTable 1 }

   SnmpTargetParamsEntry ::= SEQUENCE {
       snmpTargetParamsName           SnmpAdminString,
       snmpTargetParamsMPModel        SnmpMessageProcessingModel,
       snmpTargetParamsSecurityModel  SnmpSecurityModel,
       snmpTargetParamsSecurityName   SnmpAdminString,
       snmpTargetParamsSecurityLevel  SnmpSecurityLevel,
       snmpTargetParamsStorageType    StorageType,
       snmpTargetParamsRowStatus      RowStatus
   }

   snmpTargetParamsName OBJECT-TYPE
       SYNTAX      SnmpAdminString (SIZE(1..32))
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "The locally arbitrary, but unique identifier associated
            with this snmpTargetParamsEntry."
       ::= { snmpTargetParamsEntry 1 }

   snmpTargetParamsMPModel OBJECT-TYPE
       SYNTAX      SnmpMessageProcessingModel
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The Message Processing Model to be used when generating
            SNMP messages using this entry."
       ::= { snmpTargetParamsEntry 2 }

   snmpTargetParamsSecurityModel OBJECT-TYPE
       SYNTAX      SnmpSecurityModel (0..254 | 256..2147483647)
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The Security Model to be used when generating SNMP
             messages using this entry."
       ::= { snmpTargetParamsEntry 3 }

   snmpTargetParamsSecurityName OBJECT-TYPE
       SYNTAX      SnmpAdminString
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The securityName which identifies the Principal on
            whose behalf SNMP messages will be generated using
            this entry."
       ::= { snmpTargetParamsEntry 4 }

   snmpTargetParamsSecurityLevel OBJECT-TYPE
       SYNTAX      SnmpSecurityLevel
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The Level of Security to be used when generating
            SNMP messages using this entry."
       ::= { snmpTargetParamsEntry 5 }

   snmpTargetParamsStorageType OBJECT-TYPE
       SYNTAX      StorageType
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The storage type for this conceptual row."
       ::= { snmpTargetParamsEntry 6 }

   snmpTargetParamsRowStatus OBJECT-TYPE
       SYNTAX      RowStatus
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The status of this conceptual row.

            To create a row in this table, a manager must
            set this object to either createAndGo(4) or
            createAndWait(5).

            Until instances of all corresponding columns are
            appropriately configured, the value of the
            corresponding instance of the snmpTargetParamsRowStatus
            column is 'notReady'.

            In particular, a newly created row cannot be made
            active until the corresponding
            snmpTargetParamsMPModel,
            snmpTargetParamsSecurityModel,
            snmpTargetParamsSecurityName,
            and snmpTargetParamsSecurityLevel have all been set.

            The following objects may not be modified while the
            value of this object is active(1):
                - snmpTargetParamsMPModel
                - snmpTargetParamsSecurityModel
                - snmpTargetParamsSecurityName
                - snmpTargetParamsSecurityLevel"
       ::= { snmpTargetParamsEntry 7 }

   snmpUnavailableContexts OBJECT-TYPE
       SYNTAX       Counter32
       MAX-ACCESS   read-only
       STATUS       current
       DESCRIPTION
           "The total number of packets received by the SNMP
            engine which were dropped because the context
            contained in the mesage was unavailable."
       ::= { snmpTargetObjects 4 }

   snmpUnknownContexts OBJECT-TYPE
       SYNTAX       Counter32
       MAX-ACCESS   read-only
       STATUS       current
       DESCRIPTION
           "The total number of packets received by the SNMP
            engine which were dropped because the context
            contained in the mesage was unknown."

       ::= { snmpTargetObjects 5 }

   --
   --
   -- Conformance information
   --
   --

   snmpTargetCompliances OBJECT IDENTIFIER ::=
                                           { snmpTargetConformance 1 }
   snmpTargetGroups      OBJECT IDENTIFIER ::=
                                           { snmpTargetConformance 2 }

   --
   --
   -- Compliance statements
   --
   --


   snmpTargetCommandResponderCompliance MODULE-COMPLIANCE
       STATUS      current
       DESCRIPTION
           "The compliance statement for SNMP entities which include
            a command responder application."
       MODULE -- This Module
           MANDATORY-GROUPS { snmpTargetCommandResponderGroup }
       ::= { snmpTargetCompliances 1 }

   snmpTargetBasicGroup OBJECT-GROUP
       OBJECTS {
           snmpTargetSpinLock,
           snmpTargetAddrTDomain,
           snmpTargetAddrTAddress,
           snmpTargetAddrTagList,
           snmpTargetAddrParams,
           snmpTargetAddrStorageType,
           snmpTargetAddrRowStatus,
           snmpTargetParamsMPModel,
           snmpTargetParamsSecurityModel,
           snmpTargetParamsSecurityName,
           snmpTargetParamsSecurityLevel,
           snmpTargetParamsStorageType,
           snmpTargetParamsRowStatus
       }
       STATUS      current
       DESCRIPTION

           "A collection of objects providing basic remote
            configuration of management targets."

       ::= { snmpTargetGroups 1 }

that's the whole chunk for this part 🫶 the conformance bits at the bottom are basically the "these are the groups you need" checklist ✨ more coming up, so stay tuned 👀💅

okay so the target MIB wraps up with two more groups 💖

   snmpTargetResponseGroup OBJECT-GROUP
       OBJECTS {
           snmpTargetAddrTimeout,
           snmpTargetAddrRetryCount
       }
       STATUS      current
       DESCRIPTION
           "A collection of objects providing remote configuration
            of management targets for applications which generate
            SNMP messages for which a response message would be
            expected."
       ::= { snmpTargetGroups 2 }

   snmpTargetCommandResponderGroup OBJECT-GROUP
       OBJECTS {
           snmpUnavailableContexts,
           snmpUnknownContexts
       }
       STATUS      current
       DESCRIPTION
           "A collection of objects required for command responder
            applications, used for counting error conditions."
       ::= { snmpTargetGroups 3 }

   END

4.2. The Notification MIB Module ✨

okay so the SNMP-NOTIFICATION-MIB module is basically the remote control for how an SNMP entity sets up its notifications 🔔 It's got three tables plus conformance/compliance statements 💅

Table one, the snmpNotifyTable, is the picker 🎯 It selects which entries in the snmpTargetAddrTable should be used for generating notifications, and it also decides what type of notifications get sent 🦋

Table two sparsely augments the snmpTargetAddrTable with an object that links a set of filters to one particular management target 🧚

Table three defines the filters that limit how many notifications get generated through particular management targets 🛡️

4.2.1. Definitions 💜

the MIB module definition itself, served fresh 🍓

   SNMP-NOTIFICATION-MIB DEFINITIONS ::= BEGIN

   IMPORTS
       MODULE-IDENTITY,
       OBJECT-TYPE,
       snmpModules
           FROM SNMPv2-SMI

       RowStatus,
       StorageType
           FROM SNMPv2-TC

       SnmpAdminString
           FROM SNMP-FRAMEWORK-MIB

       SnmpTagValue,
       snmpTargetParamsName
           FROM SNMP-TARGET-MIB

       MODULE-COMPLIANCE,
       OBJECT-GROUP
           FROM SNMPv2-CONF;

   snmpNotificationMIB MODULE-IDENTITY
       LAST-UPDATED "9711210000Z"
       ORGANIZATION "IETF SNMPv3 Working Group"
       CONTACT-INFO
           "WG-email:   snmpv3@tis.com
            Subscribe:  majordomo@tis.com
                        In message body:  subscribe snmpv3

            Chair:      Russ Mundy
                        Trusted Information Systems
            Postal:     3060 Washington Rd
                        Glenwood MD 21738
                        USA
            Email:      mundy@tis.com
            Phone:      +1-301-854-6889

            Co-editor:  David B. Levi
                        SNMP Research, Inc.
            Postal:     3001 Kimberlin Heights Road
                        Knoxville, TN 37920-9716
            E-mail:     levi@snmp.com
            Phone:      +1 423 573 1434
            Co-editor:  Paul Meyer
                        Secure Computing Corporation
            Postal:     2675 Long Lake Road
                        Roseville, MN 55113
            E-mail:     paul_meyer@securecomputing.com
            Phone:      +1 612 628 1592

            Co-editor:  Bob Stewart
                        Cisco Systems, Inc.
            Postal:     170 West Tasman Drive
                        San Jose, CA 95134-1706
            E-mail:     bstewart@cisco.com
            Phone:      +1 603 654 6923"
       DESCRIPTION
           "This MIB module defines MIB objects which provide
            mechanisms to remotely configure the parameters
            used by an SNMP entity for the generation of
            notifications."
       REVISION    "9707140000Z"
       DESCRIPTION
           "The initial revision."
       ::= { snmpModules 13 }

   snmpNotifyObjects       OBJECT IDENTIFIER ::=
                                             { snmpNotificationMIB 1 }
   snmpNotifyConformance   OBJECT IDENTIFIER ::=
                                             { snmpNotificationMIB 3 }


   --
   --
   -- The snmpNotifyObjects group
   --
   --

   snmpNotifyTable OBJECT-TYPE
       SYNTAX      SEQUENCE OF SnmpNotifyEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "This table is used to select management targets which should
            receive notifications, as well as the type of notification
            which should be sent to each selected management target."
       ::= { snmpNotifyObjects 1 }

   snmpNotifyEntry OBJECT-TYPE
       SYNTAX      SnmpNotifyEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "An entry in this table selects a set of management targets
            which should receive notifications, as well as the type of
            notification which should be sent to each selected
            management target.

            Entries in the snmpNotifyTable are created and
            deleted using the snmpNotifyRowStatus object."
       INDEX { IMPLIED snmpNotifyName }
       ::= { snmpNotifyTable 1 }

   SnmpNotifyEntry ::= SEQUENCE {
       snmpNotifyName         SnmpAdminString,
       snmpNotifyTag          SnmpTagValue,
       snmpNotifyType         INTEGER,
       snmpNotifyStorageType  StorageType,
       snmpNotifyRowStatus    RowStatus
   }

   snmpNotifyName OBJECT-TYPE
       SYNTAX      SnmpAdminString (SIZE(1..32))
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "The locally arbitrary, but unique identifier associated
            with this snmpNotifyEntry."
       ::= { snmpNotifyEntry 1 }

   snmpNotifyTag OBJECT-TYPE
       SYNTAX      SnmpTagValue
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "This object contains a single tag value which is used
            to select entries in the snmpTargetAddrTable.  Any entry
            in the snmpTargetAddrTable which contains a tag value
            which is equal to the value of an instance of this
            object is selected.  If this object contains a value
            of zero length, no entries are selected."
       ::= { snmpNotifyEntry 2 }

   snmpNotifyType OBJECT-TYPE
       SYNTAX      INTEGER {
                       trap(1),
                       inform(2)
                   }
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "This object determines the type of notification to
            be generated for entries in the snmpTargetAddrTable
            selected by the corresponding instance of
            snmpNotifyTag.

            If the value of this object is trap(1), then any
            messages generated for selected rows will contain
            SNMPv2-Trap PDUs.

            If the value of this object is inform(2), then any
            messages generated for selected rows will contain
            Inform PDUs.

            Note that if an SNMP entity only supports
            generation of traps (and not informs), then this
            object may be read-only."
       DEFVAL { trap }
       ::= { snmpNotifyEntry 3 }

   snmpNotifyStorageType OBJECT-TYPE
       SYNTAX      StorageType
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The storage type for this conceptual row."
       ::= { snmpNotifyEntry 4 }

   snmpNotifyRowStatus OBJECT-TYPE
       SYNTAX      RowStatus
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The status of this conceptual row.

            To create a row in this table, a manager must
            set this object to either createAndGo(4) or
            createAndWait(5).

            Until instances of all corresponding columns are
            appropriately configured, the value of the
            corresponding instance of the snmpNotifyRowStatus
            column is 'notReady'.

            In particular, a newly created row cannot be made
            active until the corresponding snmpNotifyTag has
            been set."

       ::= { snmpNotifyEntry 5 }

   snmpNotifyFilterProfileTable OBJECT-TYPE
       SYNTAX      SEQUENCE OF SnmpNotifyFilterProfileEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "This table is used to associate a notification filter
            profile with a particular set of target parameters."
       ::= { snmpNotifyObjects 2 }

   snmpNotifyFilterProfileEntry OBJECT-TYPE
       SYNTAX      SnmpNotifyFilterProfileEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "An entry in this table indicates the name of the filter
            profile to be used when generating notifications using
            the corresponding entry in the snmpTargetParamsTable.

            Entries in the snmpNotifyFilterProfileTable are created
            and deleted using the snmpNotifyFilterProfileRowStatus
            object."
       INDEX { IMPLIED snmpTargetParamsName }
       ::= { snmpNotifyFilterProfileTable 1 }

   SnmpNotifyFilterProfileEntry ::= SEQUENCE {
       snmpNotifyFilterProfileName         SnmpAdminString,
       snmpNotifyFilterProfileStorType     StorageType,
       snmpNotifyFilterProfileRowStatus    RowStatus
   }

   snmpNotifyFilterProfileName OBJECT-TYPE
       SYNTAX      SnmpAdminString (SIZE(1..32))
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The name of the filter profile to be used when generating
            notifications using the corresponding entry in the
            snmpTargetAddrTable."
       ::= { snmpNotifyFilterProfileEntry 1 }

   snmpNotifyFilterProfileStorType OBJECT-TYPE
       SYNTAX      StorageType
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The storage type of this conceptual row."

       ::= { snmpNotifyFilterProfileEntry 2 }

   snmpNotifyFilterProfileRowStatus OBJECT-TYPE
       SYNTAX      RowStatus
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The status of this conceptual row.

            To create a row in this table, a manager must
            set this object to either createAndGo(4) or
            createAndWait(5)."
       ::= { snmpNotifyFilterProfileEntry 3 }

   snmpNotifyFilterTable OBJECT-TYPE
       SYNTAX      SEQUENCE OF SnmpNotifyFilterEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "The table of filter profiles.  Filter profiles are used
            to determine whether particular management targets should
            receive particular notifications.

            When a notification is generated, it must be compared
            with the filters associated with each management target
            which is configured to receive notifications.  If the
            notification is matched by a filter, it is not sent to
            the management target with which the filter is
            associated."
       ::= { snmpNotifyObjects 3 }

   snmpNotifyFilterEntry OBJECT-TYPE
       SYNTAX      SnmpNotifyFilterEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "An element of a filter profile.

            Entries in the snmpNotifyFilterTable are created and
            deleted using the snmpNotifyFilterRowStatus object."
       INDEX {         snmpNotifyFilterProfileName,
               IMPLIED snmpNotifyFilterSubtree }
       ::= { snmpNotifyFilterTable 1 }

   SnmpNotifyFilterEntry ::= SEQUENCE {
       snmpNotifyFilterSubtree           OBJECT IDENTIFIER,
       snmpNotifyFilterMask              OCTET STRING,
       snmpNotifyFilterType              INTEGER,
       snmpNotifyFilterStorageType       StorageType,
       snmpNotifyFilterRowStatus         RowStatus
   }

okay so the filter table's columns are where it gets spicy 🌶️ and the mask is basically the main character of this whole section 💅

   snmpNotifyFilterSubtree OBJECT-TYPE
       SYNTAX      OBJECT IDENTIFIER
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "The MIB subtree which, when combined with the corresponding
            instance of snmpNotifyFilterMask, defines a family of
            subtrees which are included in or excluded from the
            filter profile."
       ::= { snmpNotifyFilterEntry 1 }

   snmpNotifyFilterMask OBJECT-TYPE
       SYNTAX      OCTET STRING (SIZE(0..16))
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The bit mask which, in combination with the corresponding
            instance of snmpNotifyFilterSubtree, defines a family of
            subtrees which are included in or excluded from the
            filter profile.

            Each bit of this bit mask corresponds to a
            sub-identifier of snmpNotifyFilterSubtree, with the
            most significant bit of the i-th octet of this octet
            string value (extended if necessary, see below)
            corresponding to the (8*i - 7)-th sub-identifier, and
            the least significant bit of the i-th octet of this
            octet string corresponding to the (8*i)-th
            sub-identifier, where i is in the range 1 through 16.

            Each bit of this bit mask specifies whether or not
            the corresponding sub-identifiers must match when
            determining if an OBJECT IDENTIFIER matches this
            family of filter subtrees; a '1' indicates that an
            exact match must occur; a '0' indicates 'wild card',
            i.e., any sub-identifier value matches.

            Thus, the OBJECT IDENTIFIER X of an object instance
            is contained in a family of filter subtrees if, for
            each sub-identifier of the value of
            snmpNotifyFilterSubtree, either:

              the i-th bit of snmpNotifyFilterMask is 0, or
              the i-th sub-identifier of X is equal to the i-th
              sub-identifier of the value of
              snmpNotifyFilterSubtree.

            If the value of this bit mask is M bits long and
            there are more than M sub-identifiers in the
            corresponding instance of snmpNotifyFilterSubtree,
            then the bit mask is extended with 1's to be the
            required length.

            Note that when the value of this object is the
            zero-length string, this extension rule results in
            a mask of all-1's being used (i.e., no 'wild card'),
            and the family of filter subtrees is the one
            subtree uniquely identified by the corresponding
            instance of snmpNotifyFilterSubtree."
       DEFVAL { ''H }
       ::= { snmpNotifyFilterEntry 2 }

   snmpNotifyFilterType OBJECT-TYPE
       SYNTAX      INTEGER {
                       included(1),
                       excluded(2)
                   }
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "This object indicates whether the family of filter subtrees
            defined by this entry are included in or excluded from a
            filter."
       DEFVAL { included }
       ::= { snmpNotifyFilterEntry 3 }

   snmpNotifyFilterStorageType OBJECT-TYPE
       SYNTAX      StorageType
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The storage type of this conceptual row."
       ::= { snmpNotifyFilterEntry 4 }

   snmpNotifyFilterRowStatus OBJECT-TYPE
       SYNTAX      RowStatus
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The status of this conceptual row.

            To create a row in this table, a manager must
            set this object to either createAndGo(4) or
            createAndWait(5)."
       ::= { snmpNotifyFilterEntry 5 }

so the mask is like a bouncer 🚪✨ each bit gets to decide whether its sub-identifier has to match exactly (a 1) or is a total wild card (a 0). the first octet's most significant bit handles sub-identifier 1, and the least significant bit handles sub-identifier 8, and it keeps going like that all the way up to 16 octets 🧚 if your mask is shorter than the number of sub-identifiers, the extra bits get filled in with 1's, so nothing sneaks through as a wild card by accident 🙈

and the zero-length version is kinda iconic: it turns into all 1's, which means no wild cards at all, and the family is just the one exact subtree 💜

   --
   --
   -- Conformance information
   --
   --

   snmpNotifyCompliances OBJECT IDENTIFIER ::=
                                           { snmpNotifyConformance 1 }
   snmpNotifyGroups      OBJECT IDENTIFIER ::=
                                           { snmpNotifyConformance 2 }

   --
   --
   -- Compliance statements
   --
   --

   snmpNotifyBasicCompliance MODULE-COMPLIANCE
       STATUS      current
       DESCRIPTION
           "The compliance statement for minimal SNMP entities which
            implement only SNMP Traps and read-create operations on
            only the snmpTargetAddrTable."
       MODULE SNMP-TARGET-MIB
           MANDATORY-GROUPS { snmpTargetBasicGroup }

           OBJECT snmpTargetParamsMPModel
           MIN-ACCESS    read-only
           DESCRIPTION
               "Create/delete/modify access is not required."

           OBJECT snmpTargetParamsSecurityModel
           MIN-ACCESS    read-only
           DESCRIPTION
               "Create/delete/modify access is not required."

           OBJECT snmpTargetParamsSecurityName
           MIN-ACCESS    read-only
           DESCRIPTION
               "Create/delete/modify access is not required."

           OBJECT snmpTargetParamsSecurityLevel
           MIN-ACCESS    read-only
           DESCRIPTION
               "Create/delete/modify access is not required."

           OBJECT snmpTargetParamsStorageType
           SYNTAX INTEGER {
               readOnly(5)
           }
           MIN-ACCESS    read-only
           DESCRIPTION
               "Create/delete/modify access is not required.
                Support of the values other(1), volatile(2),
                nonVolatile(3), and permanent(4) is not required."

           OBJECT snmpTargetParamsRowStatus
           SYNTAX INTEGER {
               active(1)
           }
           MIN-ACCESS    read-only
           DESCRIPTION
               "Create/delete/modify access to the
                snmpTargetParamsTable is not required.
                Support of the values notInService(2), notReady(3),
                createAndGo(4), createAndWait(5), and destroy(6) is
                not required."

       MODULE -- This Module
           MANDATORY-GROUPS { snmpNotifyGroup }

           OBJECT snmpNotifyTag
           MIN-ACCESS    read-only
           DESCRIPTION
               "Create/delete/modify access is not required."

           OBJECT snmpNotifyType
           SYNTAX INTEGER {
               trap(1)
           }
           MIN-ACCESS    read-only
           DESCRIPTION
               "Create/delete/modify access is not required.
                Support of the value notify(2) is not required."

           OBJECT snmpNotifyStorageType
           SYNTAX INTEGER {
               readOnly(5)
           }
           MIN-ACCESS    read-only
           DESCRIPTION

               "Create/delete/modify access is not required.
                Support of the values other(1), volatile(2),
                nonVolatile(3), and permanent(4) is not required."

           OBJECT snmpNotifyRowStatus
           SYNTAX INTEGER {
               active(1)
           }
           MIN-ACCESS    read-only
           DESCRIPTION
               "Create/delete/modify access to the
                snmpNotifyTable is not required.
                Support of the values notInService(2), notReady(3),
                createAndGo(4), createAndWait(5), and destroy(6) is
                not required."

       ::= { snmpNotifyCompliances 1 }

   snmpNotifyBasicFiltersCompliance MODULE-COMPLIANCE
       STATUS      current
       DESCRIPTION
           "The compliance statement for SNMP entities which implement
            SNMP Traps with filtering, and read-create operations on
            all related tables."
       MODULE SNMP-TARGET-MIB
           MANDATORY-GROUPS { snmpTargetBasicGroup }
       MODULE -- This Module
           MANDATORY-GROUPS { snmpNotifyGroup,
                              snmpNotifyFilterGroup }
       ::= { snmpNotifyCompliances 2 }

   snmpNotifyFullCompliance MODULE-COMPLIANCE
       STATUS      current
       DESCRIPTION
           "The compliance statement for SNMP entities which either
            implement only SNMP Informs, or both SNMP Traps and SNMP
            Informs, plus filtering and read-create operations on
            all related tables."
       MODULE SNMP-TARGET-MIB
           MANDATORY-GROUPS { snmpTargetBasicGroup,
                              snmpTargetResponseGroup }
       MODULE -- This Module
           MANDATORY-GROUPS { snmpNotifyGroup,
                              snmpNotifyFilterGroup }
       ::= { snmpNotifyCompliances 3 }

now the compliance statements are basically the "how much do you need to support to get the badge" 🏅 the basic one is for the tiny minimal entities that only do traps plus read-create on the snmpTargetAddrTable, and the access stuff is read-only everywhere else, so no drama there 🌸 the filters one bumps it up to traps with filtering and read-create on all the related tables 🦋 and the full one is for entities doing informs, or traps and informs, plus filtering and read-create on everything related 👑

   snmpNotifyGroup OBJECT-GROUP
       OBJECTS {

           snmpNotifyTag,
           snmpNotifyType,
           snmpNotifyStorageType,
           snmpNotifyRowStatus
       }
       STATUS      current
       DESCRIPTION
           "A collection of objects for selecting which management
            targets are used for generating notifications, and the
            type of notification to be generated for each selected
            management target."
       ::= { snmpNotifyGroups 1 }

   snmpNotifyFilterGroup OBJECT-GROUP
       OBJECTS {
           snmpNotifyFilterProfileName,
           snmpNotifyFilterProfileStorType,
           snmpNotifyFilterProfileRowStatus,
           snmpNotifyFilterMask,
           snmpNotifyFilterType,
           snmpNotifyFilterStorageType,
           snmpNotifyFilterRowStatus
       }
       STATUS      current
       DESCRIPTION
           "A collection of objects providing remote configuration
            of notification filters."
       ::= { snmpNotifyGroups 2 }

   END

and the groups are just the bundles that the compliance statements point at 🎀 one group is for picking which management targets get notifications and what kind they get, and the other is for remotely configuring the notification filters 💖

4.3. The Proxy MIB Module 🧚

okay the SNMP-PROXY-MIB module is giving proxy forwarding vibes 🔥 it defines MIB objects that let you remotely configure the parameters an SNMP entity uses when it does proxy forwarding operations ✨ and it only has one table, snmpProxyTable 💅 that table is where you define translations between management targets for when messages get forwarded, so it's basically the translation tab for your forwarded messages 🦋

4.3.1. Definitions

   SNMP-PROXY-MIB DEFINITIONS ::= BEGIN

   IMPORTS
       MODULE-IDENTITY,
       OBJECT-TYPE,
       snmpModules
           FROM SNMPv2-SMI

       RowStatus,
       StorageType
           FROM SNMPv2-TC

       SnmpEngineID,
       SnmpAdminString
           FROM SNMP-FRAMEWORK-MIB

       SnmpTagValue,
           FROM SNMP-TARGET-MIB

       MODULE-COMPLIANCE,
       OBJECT-GROUP
           FROM SNMPv2-CONF;

   snmpProxyMIB MODULE-IDENTITY
       LAST-UPDATED "9711210000Z"
       ORGANIZATION "IETF SNMPv3 Working Group"
       CONTACT-INFO
           "WG-email:   snmpv3@tis.com
            Subscribe:  majordomo@tis.com
                        In message body:  subscribe snmpv3

            Chair:      Russ Mundy
                        Trusted Information Systems
            Postal:     3060 Washington Rd
                        Glenwood MD 21738
                        USA
            Email:      mundy@tis.com
            Phone:      +1-301-854-6889

            Co-editor:  David B. Levi
                        SNMP Research, Inc.
            Postal:     3001 Kimberlin Heights Road
                        Knoxville, TN 37920-9716
            E-mail:     levi@snmp.com
            Phone:      +1 423 573 1434

            Co-editor:  Paul Meyer
                        Secure Computing Corporation
            Postal:     2675 Long Lake Road
                        Roseville, MN 55113
            E-mail:     paul_meyer@securecomputing.com
            Phone:      +1 612 628 1592

            Co-editor:  Bob Stewart
                        Cisco Systems, Inc.
            Postal:     170 West Tasman Drive

                        San Jose, CA 95134-1706
            E-mail:     bstewart@cisco.com
            Phone:      +1 603 654 6923"
       DESCRIPTION
           "This MIB module defines MIB objects which provide
            mechanisms to remotely configure the parameters
            used by a proxy forwarding application."
       REVISION    "9707140000Z"
       DESCRIPTION
           "The initial revision."
       ::= { snmpModules 14 }

   snmpProxyObjects        OBJECT IDENTIFIER ::= { snmpProxyMIB 1 }
   snmpProxyConformance    OBJECT IDENTIFIER ::= { snmpProxyMIB 3 }

   --
   --
   -- The snmpProxyObjects group
   --
   --

   snmpProxyTable OBJECT-TYPE
       SYNTAX      SEQUENCE OF SnmpProxyEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "The table of translation parameters used by proxy forwarder
            applications for forwarding SNMP messages."
       ::= { snmpProxyObjects 2 }

   snmpProxyEntry OBJECT-TYPE
       SYNTAX      SnmpProxyEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "A set of translation parameters used by a proxy forwarder
            application for forwarding SNMP messages.

            Entries in the snmpProxyTable are created and deleted
            using the snmpProxyRowStatus object."
       INDEX { IMPLIED snmpProxyName }
       ::= { snmpProxyTable 1 }

   SnmpProxyEntry ::= SEQUENCE {
       snmpProxyName               SnmpAdminString,
       snmpProxyType               INTEGER,
       snmpProxyContextEngineID    SnmpEngineID,
       snmpProxyContextName        SnmpAdminString,
       snmpProxyTargetParamsIn     SnmpAdminString,
       snmpProxySingleTargetOut    SnmpAdminString,
       snmpProxyMultipleTargetOut  SnmpTagValue,
       snmpProxyStorageType        StorageType,
       snmpProxyRowStatus          RowStatus
   }

   snmpProxyName OBJECT-TYPE
       SYNTAX      SnmpAdminString (SIZE(1..32))
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "The locally arbitrary, but unique identifier associated
            with this snmpProxyEntry."
       ::= { snmpProxyEntry 1 }

   snmpProxyType OBJECT-TYPE
       SYNTAX      INTEGER {
                       read(1),
                       write(2),
                       trap(3),
                       inform(4)
                   }
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The type of message that may be forwarded using
            the translation parameters defined by this entry."
       ::= { snmpProxyEntry 2 }

   snmpProxyContextEngineID OBJECT-TYPE
       SYNTAX      SnmpEngineID
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The contextEngineID contained in messages that
            may be forwarded using the translation parameters
            defined by this entry."
       ::= { snmpProxyEntry 3 }

   snmpProxyContextName OBJECT-TYPE
       SYNTAX      SnmpAdminString
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The contextName contained in messages that may be
            forwarded using the translation parameters defined
            by this entry.

            This object is optional, and if not supported, the
            contextName contained in a message is ignored when
            selecting an entry in the snmpProxyTable."
       ::= { snmpProxyEntry 4 }

   snmpProxyTargetParamsIn OBJECT-TYPE
       SYNTAX      SnmpAdminString
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "This object selects an entry in the snmpTargetParamsTable.
            The selected entry is used to determine which row of the
            snmpProxyTable to use for forwarding received messages."
       ::= { snmpProxyEntry 5 }

   snmpProxySingleTargetOut OBJECT-TYPE
       SYNTAX      SnmpAdminString
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "This object selects a management target defined in the
            snmpTargetAddrTable (in the SNMP-TARGET-MIB).  The
            selected target is defined by an entry in the
            snmpTargetAddrTable whose index value (snmpTargetAddrName)
            is equal to this object.

            This object is only used when selection of a single
            target is required (i.e. when forwarding an incoming
            read or write request)."
       ::= { snmpProxyEntry 6 }

   snmpProxyMultipleTargetOut OBJECT-TYPE
       SYNTAX      SnmpTagValue
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "This object selects a set of management targets defined
            in the snmpTargetAddrTable (in the SNMP-TARGET-MIB).

            This object is only used when selection of multiple
            targets is required (i.e. when forwarding an incoming
            notification)."
       ::= { snmpProxyEntry 7 }

   snmpProxyStorageType OBJECT-TYPE
       SYNTAX      StorageType
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The storage type of this conceptual row."
       ::= { snmpProxyEntry 8 }

   snmpProxyRowStatus OBJECT-TYPE
       SYNTAX      RowStatus
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The status of this conceptual row.

            To create a row in this table, a manager must
            set this object to either createAndGo(4) or
            createAndWait(5).

            The following objects may not be modified while the
            value of this object is active(1):
                - snmpProxyType
                - snmpProxyContextEngineID
                - snmpProxyContextName
                - snmpProxyTargetParamsIn
                - snmpProxySingleTargetOut
                - snmpProxyMultipleTargetOut"

       ::= { snmpProxyEntry 9 }

   --
   --
   -- Conformance information
   --
   --

   snmpProxyCompliances OBJECT IDENTIFIER ::=
                                            { snmpProxyConformance 1 }
   snmpProxyGroups      OBJECT IDENTIFIER ::=
                                            { snmpProxyConformance 2 }

   --
   --
   -- Compliance statements
   --
   --

   snmpProxyCompliance MODULE-COMPLIANCE
       STATUS      current
       DESCRIPTION
           "The compliance statement for SNMP entities which include
            a proxy forwarding application."

       MODULE SNMP-TARGET-MIB
           MANDATORY-GROUPS { snmpTargetBasicGroup,
                              snmpTargetResponseGroup }
       MODULE -- This Module
           MANDATORY-GROUPS { snmpProxyGroup }
       ::= { snmpProxyCompliances 1 }

   snmpProxyGroup OBJECT-GROUP
       OBJECTS {
           snmpProxyType,
           snmpProxyContextEngineID,
           snmpProxyContextName,
           snmpProxyTargetParamsIn,
           snmpProxySingleTargetOut,
           snmpProxyMultipleTargetOut,
           snmpProxyStorageType,
           snmpProxyRowStatus
       }
       STATUS      current
       DESCRIPTION
           "A collection of objects providing remote configuration of
            management target translation parameters for use by
            proxy forwarder applications."

       ::= { snmpProxyGroups 3 }

   END

5. Identification of Management Targets in Notification Originators 🎀

okay so this section is all about how a notification originator app figures out WHICH management targets to send its notifications to, using the MIB module from this doc 💖

the originator looks at the snmpNotifyTable to find its targets 🔍 every active row in that table can point at zero or more rows in the snmpTargetAddrTable. any snmpTargetAddrTable row whose snmpTargetAddrTagList contains a tag value that matches a snmpNotifyTag value gets picked by the snmpNotifyEntry holding that snmpNotifyTag 🦋 and bestie, a single snmpTargetAddrEntry can get picked by MULTIPLE snmpNotifyTable rows 😭 which means that same target can end up receiving several notifications 💅

each snmpTargetAddrEntry also has a pointer into the snmpTargetParamsTable, called snmpTargetAddrParams 🧚 that pointer is what selects the set of SNMP parameters used to generate the notifications. ngl, if the entry it points at doesn't exist, that management target just doesn't get used for notifications at all 💀

now the big decision: is it an SNMPv2-Trap PDU or an Inform PDU? that is decided by the snmpNotifyType object ✨ if it's trap(1), the notification should contain an SNMPv2-Trap PDU. if it's inform(2), the notification should contain an Inform PDU, and for those the timeout and retry count come from snmpTargetAddrTimeout and snmpTargetAddrRetryCount 🌸

BUT there's a plot twist 🙈 the exception is when snmpTargetParamsMPModel says SNMPv1. in that case the notification gets sent as a Trap if snmpNotifyTargetType is either trap(1) or inform(2) 👑 literally the main character move of this whole section 🔥

6. Notification Filtering ✨

okay bestie, this part is all about how a notification originator app uses this MIB to filter which notifications actually get sent 💅. It starts in the snmpNotifyFilterTable. A notification filter profile can be linked to an entry in the snmpTargetParamsTable, and that profile is found in the snmpNotifyFilterProfileTable by matching the entry's index. If there's no matching entry in the snmpNotifyFilterProfileTable, then no filtering happens for that management target 🙈.

If the profile entry does exist, its snmpNotifyFilterProfileName value gets compared with the matching part of the index of every active entry in the snmpNotifyFilterTable. The entries that match exactly are the ones used to filter a notification generated with the associated snmpTargetParamsEntry. If there are no matches at all, no filtering happens, and a notification may be sent to the management target 🦋.

Otherwise, if matching entries do exist, a notification may be sent only if its NOTIFICATION-TYPE OBJECT IDENTIFIER (that's the value of the element of the variable bindings whose name is snmpTrapOID.0, i.e., the second variable binding) and all of the object instances to be included in the variable-bindings of the notification are not specifically excluded by the matching entries 🔥.

Each set of snmpNotifyFilterTable entries is split into two collections of filter subtrees: the included filter subtrees and the excluded filter subtrees. The snmpNotifyFilterType object tells you which collection each matching entry belongs to 🎀.

To figure out whether a notification name or object instance is excluded by the matching entries, compare its OBJECT IDENTIFIER with each matching entry. If none of them match, the notification name or object instance is considered excluded, and the notification should not be sent to this management target 💀. If one or more match, the notification name or object instance is included or excluded based on the snmpNotifyFilterType value in the entry whose snmpNotifyFilterSubtree has the most sub-identifiers. If multiple entries match and they all have the same number of sub-identifiers, the lexicographically greatest snmpNotifyFilterType among the matching ones decides inclusion or exclusion 👑.

A notification name's or object instance's OBJECT IDENTIFIER X matches an entry in the snmpNotifyFilterTable when X has at least as many sub-identifiers as the entry's snmpNotifyFilterSubtree, and each sub-identifier in that subtree matches its corresponding sub-identifier in X. Two sub-identifiers match if the corresponding bit of snmpNotifyFilterMask is zero (the 'wild card' value), or if the two sub-identifiers are equal 🧚.

7. Management Target Translation in Proxy Forwarder Applications ✨

okay so this section is about how a proxy forwarder app takes incoming management target info and turns it into outgoing management target info so messages can get forwarded 🦋. There are actually two different mechanisms a proxy forwarder can use: one for forwarding request messages, and one for forwarding notification messages 💖.

7.1. Management Target Translation for Request Forwarding

When forwarding request messages, the proxy forwarder selects a single entry in the snmpProxyTable. To pick that entry, it runs these comparisons:

  • The snmpProxyType must be read(1) if the request is a Get, GetNext, or GetBulk request. The snmpProxyType must be write(2) if the request is a Set request.
  • The contextEngineId must equal the snmpProxyContextEngineID object.
  • If the snmpProxyContextName object is supported, it must equal the contextName.
  • The snmpProxyTargetParamsIn object identifies an entry in the snmpTargetParamsTable. The messageProcessingModel, securityLevel, security model, and securityName must match the values of snmpTargetParamsMPModel, snmpTargetParamsSecurityModel, snmpTargetParamsSecurityName, and snmpTargetParamsSecurityLevel of the identified entry in the snmpTargetParamsTable.

There may be multiple entries in the snmpProxyTable where these comparisons succeed. The proxy forwarder picks the entry whose snmpProxyName has the lexicographically smallest value and for which the comparisons succeed 🌸.

The outgoing management target info is identified by the value of the snmpProxySingleTargetOut object in the selected entry. That object points to an entry in the snmpTargetAddrTable. The identified snmpTargetAddrTable entry also contains a reference to the snmpTargetParamsTable (snmpTargetAddrParams). If either the identified entry in the snmpTargetAddrTable or the identified entry in the snmpTargetParamsTable doesn't exist, then this snmpProxyEntry doesn't give valid forwarding info, and the proxy forwarder should try to find another row 🙈.

If there's no entry in the snmpProxyTable where all of the conditions above can be met, then there's no appropriate forwarding info, and the proxy forwarder should take appropriate actions 😭.

Otherwise, The snmpTargetAddrTDomain, snmpTargetAddrTAddress, snmpTargetAddrTimeout, and snmpTargetRetryCount of the identified snmpTargetAddrEntry, and the snmpTargetParamsMPModel, snmpTargetParamsSecurityModel, snmpTargetParamsSecurityName, and snmpTargetParamsSecurityLevel of the identified snmpTargetParamsEntry are used as the destination management target 🎯.

7.2. Management Target Translation for Notification Forwarding

When forwarding notification messages, the proxy forwarder selects multiple entries in the snmpProxyTable. To pick these entries, it runs these comparisons:

  • The snmpProxyType must be trap(3) if the notification is a Trap. The snmpProxyType must be inform(4) if the request is an Inform.
  • The contextEngineId must equal the snmpProxyContextEngineID object.
  • If the snmpProxyContextName object is supported, it must equal the contextName.
  • The snmpProxyTargetParamsIn object identifies an entry in the snmpTargetParamsTable. The messageProcessingModel, securityLevel, security model, and securityName must match the values of snmpTargetParamsMPModel, snmpTargetParamsSecurityModel, snmpTargetParamsSecurityName, and snmpTargetParamsSecurityLevel of the identified entry in the snmpTargetParamsTable.

Every entry where these conditions are met gets selected 🫶. The snmpProxyMultipleTargetOut object of each of those entries is then used to select a set of entries in the snmpTargetAddrTable. Any snmpTargetAddrEntry whose snmpTargetAddrTagList object contains a tag value equal to the value of snmpProxyMultipleTargetOut, and whose snmpTargetAddrParams object references an existing entry in the snmpTargetParamsTable, gets selected as a destination for the forwarded notification 🔥.

8. Intellectual Property ✨

okay, quick legal-ish bit, but it matters 💅. The IETF takes no position on whether any intellectual property or other rights that someone might claim about the tech in this document are valid or in scope, or whether any license under those rights might or might not be available. It also doesn't say it has tried to find any of those rights. You can find info about the IETF's procedures for rights in standards-track and standards-related docs in BCP-11. Copies of rights claims made available for publication, plus any assurances of licenses to be made available, or the result of an attempt to get a general license or permission for implementers or users to use proprietary rights, can be obtained from the IETF Secretariat 📎.

The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to practice this standard. Send that info to the IETF Executive Director 🎀.

9. Acknowledgments 🫶

this doc is the result of the efforts of the SNMPv3 Working Group, and they deserve ALL the flowers 💐. Some special thanks go to these SNMPv3 WG members:

  • Dave Battle (SNMP Research, Inc.)
  • Uri Blumenthal (IBM T.J. Watson Research Center)
  • Jeff Case (SNMP Research, Inc.)
  • John Curran (BBN)
  • T. Max Devlin (Hi-TECH Connections)
  • John Flick (Hewlett Packard)
  • David Harrington (Cabletron Systems Inc.)
  • N.C. Hien (IBM T.J. Watson Research Center)
  • Dave Levi (SNMP Research, Inc.)
  • Louis A Mamakos (UUNET Technologies Inc.)
  • Paul Meyer (Secure Computing Corporation)
  • Keith McCloghrie (Cisco Systems)
  • Russ Mundy (Trusted Information Systems, Inc.)
  • Bob Natale (ACE*COMM Corporation)
  • Mike O'Dell (UUNET Technologies Inc.)
  • Dave Perkins (DeskTalk)
  • Peter Polkinghorne (Brunel University)
  • Randy Presuhn (BMC Software, Inc.)
  • David Reid (SNMP Research, Inc.)
  • Shawn Routhier (Epilogue)
  • Juergen Schoenwaelder (TU Braunschweig)
  • Bob Stewart (Cisco Systems)
  • Bert Wijnen (IBM T.J. Watson Research Center)

The document is based on recommendations from the IETF Security and Administrative Framework Evolution for SNMP Advisory Team. The members of that Advisory Team were:

  • David Harrington (Cabletron Systems Inc.)
  • Jeff Johnson (Cisco Systems)
  • David Levi (SNMP Research Inc.)
  • John Linn (Openvision)
  • Russ Mundy (Trusted Information Systems) chair
  • Shawn Routhier (Epilogue)
  • Glenn Waters (Nortel)
  • Bert Wijnen (IBM T. J. Watson Research Center)

As recommended by the Advisory Team and the SNMPv3 Working Group Charter, the design pulls in as much as is practical from previous RFCs and drafts 🧠. So big thanks are due to the authors of the earlier designs known as SNMPv2u and SNMPv2*:

  • Jeff Case (SNMP Research, Inc.)
  • David Harrington (Cabletron Systems Inc.)
  • David Levi (SNMP Research, Inc.)
  • Keith McCloghrie (Cisco Systems)
  • Brian O'Keefe (Hewlett Packard)
  • Marshall T. Rose (Dover Beach Consulting)
  • Jon Saperia (BGS Systems Inc.)
  • Steve Waldbusser (International Network Services)
  • Glenn W. Waters (Bell-Northern Research Ltd.)

10. Security Considerations 🚨

this part is SERIOUS, bestie 😭. The SNMP applications described in this document typically have direct access to MIB instrumentation. So it is very important that these applications be strict in how they apply access control, as described in this document 🔒.

Also, there may be some types of notification generator applications that, instead of accessing MIB instrumentation through access control, get MIB info through other means (like from a command line). The implementors and users of those applications must be responsible for not divulging MIB info that would normally be inaccessible due to access control 💀🙏.

11. References 📚

okay bestie, the reference list is where the receipts live 🧾✨ every spec this doc leans on is listed right here, with full details, so nothing gets lost in the vibes 💅

[RFC1157]
  Case, J., Fedor, M., Schoffstall, M. and J. Davin, "Simple Network
  Management Protocol", RFC 1157, May 1990.

[RFC1213]
  McCloghrie, K. and M. Rose, Editors, "Management Information Base
  for Network Management of TCP/IP-based internets: MIB-II", STD 17,
  RFC 1213, March 1991.

[RFC1902]
  Case, J., McCloghrie, K., Rose, M. and S. Waldbusser, "Structure of
  Management Information for Version 2 of the Simple Network
  Management Protocol (SNMPv2)", RFC 1902, January 1996.

[RFC1903]
  Case, J., McCloghrie, K., Rose, M. and S. Waldbusser, "Textual
  Conventions for Version 2 of the Simple Network Management Protocol
  (SNMPv2)", RFC 1903, January 1996.

[RFC1905]
  SNMPv2 Working Group, Case, J., McCloghrie, K., Rose, M., and S.
  Waldbusser, "Protocol Operations for Version 2 of the Simple
  Network Management Protocol (SNMPv2)", RFC 1905, January 1996.

[RFC1907]
  SNMPv2 Working Group, Case, J., McCloghrie, K., Rose, M., and S.
  Waldbusser, "Management Information Base for Version 2 of the
  Simple Network Management Protocol (SNMPv2)", RFC 1907, January
  1996.

[RFC1908]
  SNMPv2 Working Group, Case, J., McCloghrie, K., Rose, M., and S.
  Waldbusser, "Coexistence between Version 1 and Version 2 of the
  Internet-standard Network Management Framework", RFC 1908, January
  1996.

[RFC2271]
  Harrington, D., and B. Wijnen, "An Architecture for Describing SNMP
  Management Frameworks", RFC 2271, January 1998.

[RFC2272]
  Case, J., Harrington, D., and B. Wijnen, "Message Processing and
  Dispatching for the Simple Network Management Protocol (SNMP)", RFC
  2272, January 1998.

[RFC2275]
  Wijnen, B., Presuhn, R., and K. McCloghrie, "View-based Access
  Control Model for the Simple Network Management Protocol (SNMP)",
  RFC 2275, January 1998.

12. Editors' Addresses 🌸

these are the three editors who put this thing together, and yes, you can reach out to them 💌 here are their details, exactly as they're written 🫶

David B. Levi
SNMP Research, Inc.
3001 Kimberlin Heights Road
Knoxville, TN 37920-9716
U.S.A.

Phone: +1 423 573 1434
EMail: levi@snmp.com


Paul Meyer
Secure Computing Corporation
2675 Long Lake Road
Roseville, MN 55113
U.S.A.

Phone: +1 612 628 1592
EMail: paul_meyer@securecomputing.com


Bob Stewart
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
U.S.A.

Phone: +1 603 654 6923
EMail: bstewart@cisco.com

APPENDIX A - Trap Configuration Example 🎀

okay this is the fun part, bestie 🦋 it's a worked example of setting up a Notification Generator that hits the snmpNotifyBasicCompliance level 💖 the generator sends notifications to 3 separate managers. the first 2 get authentication with no privacy, and the third gets both authentication and privacy 🔐✨

the setup is three rows in the snmpTargetAddrTable and two rows in the snmpTargetTable, and it looks like this 👑

      snmpTargetAddrName         SnmpAdminString,
      snmpTargetAddrTDomain      TDomain,
      snmpTargetAddrTAddress     TAddress,
      snmpTargetAddrTimeout      TimeInterval,
      snmpTargetAddrRetryCount   Integer32,
      snmpTargetAddrTagList      SnmpAdminString,
      snmpTargetAddrParams       SnmpAdminString,
      snmpTargetAddrStorageType  StorageType,
      snmpTargetAddrRowStatus    RowStatus

    * snmpTargetAddrName        = "addr1"
      snmpTargetAddrTDomain     = snmpUDPDomain
      snmpTargetAddrTAddress    = 128.1.2.3:162
      snmpTargetAddrTagList     = "group1"
      snmpTargetAddrParams      = "AuthNoPriv joe"
      snmpTargetAddrStorageType = readOnly(5)
      snmpTargetAddrRowStatus   = active(1)

    * snmpTargetAddrName        = "addr2"
      snmpTargetAddrTDomain     = snmpUDPDomain
      snmpTargetAddrTAddress    = 128.2.4.6:162
      snmpTargetAddrTagList     = "group1"
      snmpTargetAddrParams      = "AuthNoPriv-joe"
      snmpTargetAddrStorageType = readOnly(5)
      snmpTargetAddrRowStatus   = active(1)

    * snmpTargetAddrName        = "addr3"
      snmpTargetAddrTDomain     = snmpUDPDomain
      snmpTargetAddrTAddress    = 128.1.2.3:162
      snmpTargetAddrTagList     = "group2"
      snmpTargetAddrParams      = "AuthPriv-bob"
      snmpTargetAddrStorageType = readOnly(5)
      snmpTargetAddrRowStatus   = active(1)

    * snmpTargetParamsName                   = "AuthNoPriv-joe"
      snmpTargetParamsMPModel                = 3
      snmpTargetParamsSecurityModel          = 3 (USM)
      snmpTargetParamsSecurityName           = "joe"
      snmpTargetParamsSecurityLevel          = authNoPriv(2)
      snmpTargetParamsStorageType            = readOnly(5)
      snmpTargetParamsRowStatus              = active(1)

    * snmpTargetParamsName                   = "AuthPriv-bob"
      snmpTargetParamsMPModel                = 3
      snmpTargetParamsSecurityModel          = 3 (USM)
      snmpTargetParamsSecurityName           = "bob"
      snmpTargetParamsSecurityLevel          = authPriv(3)
      snmpTargetParamsStorageType            = readOnly(5)
      snmpTargetParamsRowStatus              = active(1)

    * snmpNotifyName         = "group1"
      snmpNotifyTag          = "group1"
      snmpNotifyType         = trap(1)
      snmpNotifyStorageType  = readOnly(5)
      snmpNotifyRowStatus    = active(1)

    * snmpNotifyName         = "group2"
      snmpNotifyTag          = "group2"
      snmpNotifyType         = trap(1)
      snmpNotifyStorageType  = readOnly(5)
      snmpNotifyRowStatus    = active(1)

these entries define two groups of management targets 🧚 the first group has two targets:

                            first target      second target
                            ------------      -------------
   messageProcessingModel   SNMPv3            SNMPv3
            securityModel   3 (USM)           3 (USM)
             securityName   "joe"             "joe"
            securityLevel   authNoPriv(2)     authNoPriv(2)
          transportDomain   snmpUDPDomain     snmpUDPDomain
         transportAddress   128.1.2.3:162     128.2.4.6:162

and the second group has a single target 🍓

   messageProcessingModel   SNMPv3
            securityLevel   authPriv(3)
            securityModel   3 (USM)
             securityName   "bob"
          transportDomain   snmpUDPDomain
         transportAddress   128.1.5.9:162

the legal bit, served straight, because it has to stay complete 🙈

Copyright (C) The Internet Society (1998). All Rights Reserved.

This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English.

The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns.

This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

📦 where this page comes from