RFC 2452

Title Block 💖

Okay bestie, here's the deal: this is RFC 2452, and it's called IP Version 6 Management Information Base for the Transmission Control Protocol 🦋 M. Daniele from Compaq Computer Corporation wrote it, it's on the Standards Track, and it's dated December 1998. The header doesn't list anything it obsoletes or updates, so there's nothing to track there 🧚

Status of this Memo ✨

This document is an Internet standards track protocol for the Internet community, and it's asking for discussion and suggestions for improvements 🌸 For the standardization state and status of this protocol, go check the current edition of the "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited 💅

Copyright Notice 🎀

Copyright (C) The Internet Society (1998). All Rights Reserved. 🔒

Abstract 🌈

Okay so this document is one in a series that defines different MIB objects for IPv6 🧠 Specifically, it's the MIB module that defines managed objects for implementations of the Transmission Control Protocol (TCP) over IP Version 6 (IPv6). Iconic.

It also recommends a specific policy about how RFC 2012 applies to IPv6 implementations. The main point is that most of the managed objects in RFC 2012 don't care which IP version sits underneath TCP. Only the TCP connection information is IP version-specific 👑

And finally, this memo defines an experimental portion of the Management Information Base (MIB) for use with network management protocols in IPv6-based internets 🧪

1. Introduction ✨

Let's set the scene 🎬 A management system has several (potentially many) nodes. Each one has a processing entity called an agent, which can access management instrumentation. There's at least one management station, and there's a management protocol that carries management information between the agents and the stations. The protocol runs under an administrative framework that defines authentication, authorization, access control, and privacy policies. Very organized, very giving.

Management stations run management applications that monitor and control managed elements. Managed elements are devices like hosts, routers, terminal servers, and so on, and they get monitored and controlled through access to their management information 💜

Management information is seen as a collection of managed objects that live in a virtual information store called the Management Information Base (MIB). Related objects are grouped into MIB modules. These modules are written in a subset of OSI's Abstract Syntax Notation One (ASN.1) [1], which is called the Structure of Management Information (SMI) [2] 🍓

2. Overview 🌷

This document is one in the series of documents that define various MIB objects, and statements of conformance, for IPv6. Its job is to define the required instrumentation for implementations of TCP over IPv6 🫶

3. Transparency of IP versions to TCP 🦋

Here's the tea ☕ The fact that a particular TCP connection uses IPv6 instead of IPv4 is mostly invisible to a TCP implementation. A "TCPng" did not need to be defined. Implementations just need to support IPv6 addresses. Literally that's it, no drama.

So the managed objects already defined in [TCP MIB] are enough for managing TCP when IPv6 is involved. These objects work the same whether the managed node supports IPv4 only, IPv6 only, or both IPv4 and IPv6 ✨

For example, tcpActiveOpens counts "The number of times TCP connections have made a direct transition to the SYN-SENT state from the CLOSED state", no matter which version of IP is used between the connection endpoints 🌈

Said another way, TCP implementations don't need separate counters for IPv4 and for IPv6. One set of counters, iconic energy 💅

4. Representing TCP Connections 🌸

The exception to everything in section 3 is the tcpConnTable 🙈 IPv6 addresses can't be represented with the IpAddress syntax, so not every TCP connection can fit in the tcpConnTable defined in [TCP MIB].

This memo defines a new, separate table that only represents TCP connections between IPv6 endpoints. TCP connections between IPv4 endpoints keep going in the tcpConnTable [TCP MIB]. (It is not possible to establish a TCP connection between an IPv4 endpoint and an IPv6 endpoint, so no mixed-up connections, bestie 💀)

A different approach would have been to define one new table for all TCP connections, regardless of IP version. That would require changes to [TCP MIB], and so to existing (IPv4-only) TCP implementations. The approach in this memo has the advantage of leaving IPv4-only implementations intact 🫶

It's assumed that the objects defined in this memo will eventually be defined in an update to [TCP MIB]. For this reason, the module identity is assigned under the experimental portion of the MIB 🧚

5. Conformance 💜

This memo contains conformance statements that define conformance to this MIB for TCP over IPv6 implementations 🎀

6. Definitions 👑

Here's the actual MIB module, so copy it exactly 🤍

IPV6-TCP-MIB DEFINITIONS ::= BEGIN

IMPORTS
   MODULE-COMPLIANCE, OBJECT-GROUP      FROM SNMPv2-CONF
   MODULE-IDENTITY, OBJECT-TYPE,
   mib-2, experimental                  FROM SNMPv2-SMI
   Ipv6Address, Ipv6IfIndexOrZero       FROM IPV6-TC;

ipv6TcpMIB MODULE-IDENTITY
   LAST-UPDATED "9801290000Z"
   ORGANIZATION "IETF IPv6 MIB Working Group"
   CONTACT-INFO
        "       Mike Daniele

                Postal: Compaq Computer Corporation
                        110 Spitbrook Rd
                        Nashua, NH 03062.
                        US

                Phone:  +1 603 884 1423
                Email:  daniele@zk3.dec.com"
   DESCRIPTION
        "The MIB module for entities implementing TCP over IPv6."
   ::= { experimental 86 }

-- objects specific to TCP for IPv6

tcp      OBJECT IDENTIFIER ::= { mib-2 6 }

-- the TCP over IPv6 Connection table

-- This connection table contains information about this
-- entity's existing TCP connections between IPv6 endpoints.
-- Only connections between IPv6 addresses are contained in
-- this table.  This entity's connections between IPv4
-- endpoints are contained in tcpConnTable.

ipv6TcpConnTable OBJECT-TYPE
   SYNTAX      SEQUENCE OF Ipv6TcpConnEntry
   MAX-ACCESS  not-accessible
   STATUS      current
   DESCRIPTION
        "A table containing TCP connection-specific information,
         for only those connections whose endpoints are IPv6 addresses."
   ::= { tcp 16 }

ipv6TcpConnEntry OBJECT-TYPE
   SYNTAX      Ipv6TcpConnEntry
   MAX-ACCESS  not-accessible
   STATUS      current
   DESCRIPTION
        "A conceptual row of the ipv6TcpConnTable containing
         information about a particular current TCP connection.
         Each row of this table is transient, in that it ceases to
         exist when (or soon after) the connection makes the transition
         to the CLOSED state.

         Note that conceptual rows in this table require an additional
         index object compared to tcpConnTable, since IPv6 addresses
         are not guaranteed to be unique on the managed node."
   INDEX   { ipv6TcpConnLocalAddress,
             ipv6TcpConnLocalPort,
             ipv6TcpConnRemAddress,
             ipv6TcpConnRemPort,
             ipv6TcpConnIfIndex }
   ::= { ipv6TcpConnTable 1 }

Ipv6TcpConnEntry ::=
   SEQUENCE { ipv6TcpConnLocalAddress    Ipv6Address,
              ipv6TcpConnLocalPort       INTEGER (0..65535),
              ipv6TcpConnRemAddress      Ipv6Address,
              ipv6TcpConnRemPort         INTEGER (0..65535),
              ipv6TcpConnIfIndex         Ipv6IfIndexOrZero,
              ipv6TcpConnState           INTEGER }

ipv6TcpGroup OBJECT-GROUP
   OBJECTS   { -- these are defined in this module
               -- ipv6TcpConnLocalAddress (not-accessible)
               -- ipv6TcpConnLocalPort (not-accessible)
               -- ipv6TcpConnRemAddress (not-accessible)
               -- ipv6TcpConnRemPort (not-accessible)
               -- ipv6TcpConnIfIndex (not-accessible)
               ipv6TcpConnState }
   STATUS    current
   DESCRIPTION
        "The group of objects providing management of
         TCP over IPv6."
   ::= { ipv6TcpGroups 1 }

END

okay so this is the group that bundles everything up 🎀 It's labelled ipv6TcpGroup, and its STATUS is current. The description says it's the group of objects that gives you management of TCP over IPv6 💅 The only object actually listed is ipv6TcpConnState, and the other connection objects show up as commented-out lines marked not-accessible 🙈 And then the module wraps up with END 🦋

7. Acknowledgments ✨

this memo came out of the IPng work group, and it especially leaned on the contributions of these working group members, which is so iconic of them 🫶

• Dimitry Haskin (Bay Networks)
• Margaret Forsythe (Epilogue)
• Tim Hartrick (Mentat)
• Frank Solensky (FTP)
• Jack McCann (DEC)

8. References 📚

the references are listed below, exactly as they're written in the original, so nothing gets lost in translation 💜

[1]           Information processing systems - Open Systems
              Interconnection - Specification of Abstract Syntax
              Notation One (ASN.1), International Organization for
              Standardization.  International Standard 8824,
              (December, 1987).

[2]           McCloghrie, K., Editor, "Structure of Management
              Information for version 2 of the Simple Network
              Management Protocol (SNMPv2)", RFC 1902, January 1996.

[TCP MIB]     SNMPv2 Working Group, McCloghrie, K., Editor, "SNMPv2
              Management Information Base for the Transmission
              Control Protocol using SMIv2", RFC 2012, November 1996.

[IPV6 MIB TC] Haskin, D., and S. Onishi, "Management Information
              Base for IP Version 6: Textual Conventions and General
              Group", RFC 2465, December 1998.

[IPV6]        Deering, S., and R. Hinden, "Internet Protocol, Version
              6 (IPv6) Specification", RFC 2460, December 1998.

[RFC2274]     Blumenthal, U., and B. Wijnen, "The User-Based Security
              Model for Version 3 of the Simple Network Management
              Protocol (SNMPv3)", RFC 2274, January 1998.

[RFC2275]     Wijnen, B., Presuhn, R., and K. McCloghrie, "View-based
              Access Control Model for the Simple Network Management
              Protocol (SNMP)", RFC 2275, January 1998.

9. Security Considerations 🔒

okay bestie, this part is SERIOUS, so read it carefully 🚨 This MIB has a management object with a MAX-ACCESS clause of read-write and/or read-create. Like, it's possible to delete individual TCP control blocks (aka connections) 😭

So anyone who can issue a SET on this object can mess with how the node operates. That's a whole big deal 💀

Also, a bunch of objects in this MIB might be considered sensitive in some environments. The MIB shows the active TCP connections on the node, and in some places that info could help someone find ports to launch denial-of-service or other attacks 🙈 That said, there are already other ways to get similar info. For example, sending a random TCP packet to an unused port makes the node send back a TCP reset message, so it's not like this is a secret vault 🧚

Soooo, in some environments it's really important to control read and/or write access to these objects, and maybe even encrypt their values when they travel over the network via SNMP 🔐 Not every version of SNMP gives you features for a secure setup. SNMPv1 by itself doesn't provide encryption or strong authentication, so no cap, be careful 🙅‍♀️

implementors should really think about the security features that come with the SNMPv3 framework. Specifically, the User-based Security Model [RFC2274] and the View-based Access Control Model [RFC2275] are the ones to use 🛡️

And the last bit: it's the customer's or user's responsibility to make sure that the SNMP entity giving access to an instance of this MIB is set up properly, so that only the principals (users) with legitimate rights can reach those objects 👑 Not on the MIB, not on you, it's on whoever runs the setup, periodt 💅

10. Author's Address 💌

here's where to reach the author, straight from the original:

Mike Daniele
Compaq Computer Corporation
110 Spit Brook Rd
Nashua, NH 03062

Phone: +1-603-884-1423
EMail: daniele@zk3.dec.com

11. Full Copyright Statement ©️

the copyright statement has to stay complete, so here it is word for word 🎀

Copyright (C) The Internet Society (1998).  All Rights Reserved.

This document and translations of it may be copied and furnished to
others, and derivative works that comment on or otherwise explain it
or assist in its implementation may be prepared, copied, published
and distributed, in whole or in part, without restriction of any
kind, provided that the above copyright notice and this paragraph are
included on all such copies and derivative works.  However, this
document itself may not be modified in any way, such as by removing
the copyright notice or references to the Internet Society or other
Internet organizations, except as needed for the purpose of
developing Internet standards in which case the procedures for
copyrights defined in the Internet Standards process must be
followed, or as required to translate it into languages other than
English.

The limited permissions granted above are perpetual and will not be
revoked by the Internet Society or its successors or assigns.

This document and the information contained herein is provided on an
"AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.