RFC 2573

SNMP Applications

📅 published April 1999, from ietf

RFC 2573: SNMP Applications 🦋

okay bestie, this is RFC 2573, "SNMP Applications" 💖 It came out from the Network Working Group in April 1999 and it's a Standards Track doc, so it's a real spec people implement. The authors are D. Levi (SNMP Research, Inc.), P. Meyer (Secure Computing Corporation), and B. Stewart (Cisco Systems) 👑. It obsoletes RFC 2273 🧹 and it's giving "the new version of the old thing" energy.

Status of This Memo ✨

This doc specifies an Internet standards track protocol for the Internet community, and it's literally asking for discussion and suggestions for improvements 💅 For the standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited 🌸

Copyright (C) The Internet Society (1999). All Rights Reserved. 🫶

Abstract 🧚

This memo describes five types of SNMP applications which make use of an SNMP engine as described in [RFC2571]. The five types are Command Generators, Command Responders, Notification Originators, Notification Receivers, and Proxy Forwarders 🦋

This memo also defines MIB modules for specifying targets of management operations, for notification filtering, and for proxy forwarding 💜

Table Of Contents 📑

   1 Overview .....................................................    2
   1.1 Command Generator Applications .............................    3
   1.2 Command Responder Applications .............................    3
   1.3 Notification Originator Applications .......................    3
   1.4 Notification Receiver Applications .........................    3
   1.5 Proxy Forwarder Applications ...............................    4
   2 Management Targets ...........................................    5
   3 Elements Of Procedure ........................................    6
   3.1 Command Generator Applications .............................    6
   3.2 Command Responder Applications .............................    9
   3.3 Notification Originator Applications .......................   14
   3.4 Notification Receiver Applications .........................   17
   3.5 Proxy Forwarder Applications ...............................   19
   3.5.1 Request Forwarding .......................................   20
   3.5.1.1 Processing an Incoming Request .........................   20
   3.5.1.2 Processing an Incoming Response ........................   23
   3.5.1.3 Processing an Incoming Internal-Class PDU ..............   24
   3.5.2 Notification Forwarding ..................................   25
   4 The Structure of the MIB Modules .............................   28
   4.1 The Management Target MIB Module ...........................   28
   4.1.1 Tag Lists ................................................   29
   4.1.2 Definitions ..............................................   30
   4.2 The Notification MIB Module ................................   43
   4.2.1 Definitions ..............................................   43
   4.3 The Proxy MIB Module .......................................   55
   4.3.1 Definitions ..............................................   55
   5 Identification of Management Targets in Notification
        Originators ...............................................   61
   6 Notification Filtering .......................................   62
   7 Management Target Translation in Proxy  Forwarder  Applica-
        tions .....................................................   63
   7.1 Management Target Translation for Request Forwarding .......   63
   7.2 Management Target Translation for Notification Forwarding
        ...........................................................   64
   8 Intellectual Property ........................................   65
   9 Acknowledgments ..............................................   66
   10 Security Considerations .....................................   67
   11 References ..................................................   67
   12 Editors' Addresses...........................................   69
   A. Trap Configuration Example ..................................   70
   B. Full Copyright Statement ....................................   72

1. Overview 🌈

okay so this doc describes five types of SNMP applications 🧚

  • Applications which initiate SNMP Read-Class, and/or Write-Class requests, called 'command generators.'
  • Applications which respond to SNMP Read-Class, and/or Write-Class requests, called 'command responders.'
  • Applications which generate SNMP Notification-Class PDUs, called 'notification originators.'
  • Applications which receive SNMP Notification-Class PDUs, called 'notification receivers.'
  • Applications which forward SNMP messages, called 'proxy forwarders.'

Note that there are no restrictions on which types of applications may be associated with a particular SNMP engine 💅 For example, a single SNMP engine may, in fact, be associated with both command generator and command responder applications. Main character energy, no limits 👑

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] 🎀

1.1. Command Generator Applications 🦋

A command generator application initiates SNMP Read-Class and/or Write-Class requests, as well as processing the response to a request which it generated 💖

1.2. Command Responder Applications 🌸

A command responder application receives SNMP Read-Class and/or Write-Class requests that are destined for the local system. It knows this because the contextEngineID in the received request is equal to that of the local engine through which the request was received 🫶 The command responder application then performs the appropriate protocol operation, using access control, and generates a response message to be sent back to the request's originator ✨

1.3. Notification Originator Applications 🔥

A notification originator application basically watches a system for particular events or conditions, and generates Notification-Class messages based on those events or conditions 👀 A notification originator must have a mechanism for figuring out where to send messages, and what SNMP version and security parameters to use when sending them. A mechanism and MIB module for this purpose is provided in this document 🧠 Note that Notification-Class PDUs generated by a notification originator may be either Confirmed-Class or Unconfirmed-Class PDU types 🍓

1.4. Notification Receiver Applications 🧚

A notification receiver application listens for notification messages, and generates response messages when a message containing a Confirmed-Class PDU is received 💜

1.5. Proxy Forwarder Applications 🌈

A proxy forwarder application forwards SNMP messages 💅 Note that implementing a proxy forwarder application is optional. The sections describing proxy (4.5, 5.3, and 8) may be skipped for implementations that do not include a proxy forwarder application 🙈

Okay, real talk: the word "proxy" has been used SO loosely over the years that it's basically a mess 😭 It has several different meanings, including (among others):

  1. the forwarding of SNMP requests to other SNMP entities without regard for what managed object types are being accessed; for example, in order to forward an SNMP request from one transport domain to another, or to translate SNMP requests of one version into SNMP requests of another version;
  2. the translation of SNMP requests into operations of some non-SNMP management protocol; and
  3. support for aggregated managed objects where the value of one managed object instance depends upon the values of multiple other (remote) items of management information.

Each of these scenarios can be advantageous 🦋 For example, support for aggregation of management information can significantly reduce the bandwidth requirements of large-scale management activities ✨ But using a single term to cover multiple different scenarios causes confusion, and nobody wants that 🥲

So to avoid the confusion, this document uses the term "proxy" with a much more tightly defined meaning 💖 Here, "proxy" refers to a proxy forwarder application which forwards SNMP messages without regard for what managed objects are contained within those messages. This definition is most closely related to the first definition above 🎀 Note, however, that in the SNMP architecture [RFC2571], a proxy forwarder is actually an application, and it doesn't need to be associated with what is traditionally thought of as an SNMP agent 🧚

Specifically, the difference between a traditional SNMP agent and a proxy forwarder application is simple 💅

  • a proxy forwarder application forwards SNMP messages to other SNMP engines according to the context, and irrespective of the specific managed object types being accessed. It then forwards the response to such previously forwarded messages back to the SNMP engine from which the original message was received;
  • in contrast, the command responder application that is part of what is traditionally thought of as an SNMP agent, and which processes SNMP requests according to the (names of the) individual managed object types and instances being accessed, is not a proxy forwarder application from the perspective of this document 🙅‍♀️

So when a proxy forwarder application forwards a request or notification for a particular contextEngineID / contextName pair, the information on how to forward the request is specifically tied to that context. The proxy forwarder application also has no need for a detailed definition of a MIB view, since it forwards the request irrespective of the managed object types 🌸

In contrast, a command responder application must have the detailed definition of the MIB view. Even if it needs to issue requests to other entities, via SNMP or otherwise, that need depends on the individual managed object instances being accessed (i.e., not only on the context) 👑

Note that it's a design goal of a proxy forwarder application to act as an intermediary between the endpoints of a transaction 🫶 In particular, when forwarding Confirmed Notification-Class messages, the associated response is forwarded when it is received from the target to which the Notification-Class message was forwarded. It is not generated immediately when the Notification-Class message is received 🔥

2. Management Targets ✨

Okay so bestie, some apps (notification generators and proxy forwarders especially) need a way to figure out where and how to send the messages they make 📮 This doc gives us a mechanism and a MIB module for exactly that, and it's giving organized 💅 The whole set of info that says where and how to send a message is called a 'Management Target'. It has two kinds of info:

  • Destination information, consisting of a transport domain and a transport address. This is also called a transport endpoint 🎀
  • SNMP parameters, consisting of message processing model, security model, security level, and security name information 🔐

The SNMP-TARGET-MIB module (we'll get to it later 👀) has one table for each of these two types. The relationship between them in the MIB is many-to-many, which is so iconic 🦋 One transport endpoint can be paired with several sets of SNMP parameters, and one set of SNMP parameters can be paired with several transport endpoints. Mix and match, no cap ✨

3. Elements Of Procedure 🌸

Here's how each type of app behaves when it's generating a message to send or processing one it received. Apps talk to the Dispatcher through the abstract service interfaces defined in [RFC2571]. Let's go, periodt 💜

3.1. Command Generator Applications 💖

A command generator starts an SNMP request by calling the Dispatcher with this abstract service interface:

       statusInformation =              -- sendPduHandle if success
                                        -- errorIndication if failure
         sendPdu(

         IN   transportDomain           -- transport domain to be used
         IN   transportAddress          -- destination network address
         IN   messageProcessingModel    -- typically, SNMP version
         IN   securityModel             -- Security Model to use
         IN   securityName              -- on behalf of this principal
         IN   securityLevel             -- Level of Security requested
         IN   contextEngineID           -- data from/at this entity
         IN   contextName               -- data from/in this context
         IN   pduVersion                -- the version of the PDU
         IN   PDU                       -- SNMP Protocol Data Unit
         IN   expectResponse            -- TRUE or FALSE
              )

Where:

  • The transportDomain is the transport domain of the message's destination 🗺️
  • The transportAddress is the address of the message's destination 📍
  • The messageProcessingModel tells us which Message Processing Model the app wants to use 🛠️
  • The securityModel is the security model the app wants to use 🔒
  • The securityName is the security-model-independent name of the principal the app is acting for, so it's the "on whose behalf" energy 🧚
  • The securityLevel is the level of security the app is asking for 🛡️
  • The contextEngineID is given by the command generator if it wants to spell out exactly where the management info it's requesting lives 📂
  • The contextName is given by the command generator if it wants to name the local context for the management info it's requesting 🏷️
  • The pduVersion says which version of the PDU is getting sent 📦
  • The PDU is the value the command generator builds, holding the management operation it wants to perform ⚙️
  • The expectResponse argument says a response is expected 🙏

The result of the sendPdu interface tells you whether the PDU was successfully sent. If it was, the returned value is a sendPduHandle. The command generator should store that sendPduHandle so it can match a response back to the original request. Main character organization 🎀

The Dispatcher is in charge of delivering the response to a particular request to the correct command generator application. The abstract service interface it uses is:

       processResponsePdu(              -- process Response PDU
         IN   messageProcessingModel    -- typically, SNMP version
         IN   securityModel             -- Security Model in use
         IN   securityName              -- on behalf of this principal
         IN   securityLevel             -- Level of Security
         IN   contextEngineID           -- data from/at this SNMP entity
         IN   contextName               -- data from/in this context
         IN   pduVersion                -- the version of the PDU
         IN   PDU                       -- SNMP Protocol Data Unit
         IN   statusInformation         -- success or errorIndication
         IN   sendPduHandle             -- handle from sendPdu
              )

Where:

  • The messageProcessingModel is the value from the received response 📨
  • The securityModel is the value from the received response 🔒
  • The securityName is the value from the received response 🧚
  • The securityLevel is the value from the received response 🛡️
  • The contextEngineID is the value from the received response 📂
  • The contextName is the value from the received response 🏷️
  • The pduVersion says which version of the PDU was in the received response 📦
  • The PDU is the value from the received response ⚙️
  • The statusInformation tells you whether receiving the response succeeded or failed ✅❌
  • The sendPduHandle is the value that sendPdu returned for the call that made the original request this is answering 🧾

Here's the procedure when a command generator gets a message, and it's a whole vibe 🌈

  1. If the received values of messageProcessingModel, securityModel, securityName, contextEngineID, contextName, and pduVersion are not all equal to the values used in the original request, the response is discarded 🗑️
  2. The operation type, request-id, error-status, error-index, and variable-bindings are pulled out of the PDU and saved. If the request-id is not equal to the value used in the original request, the response is discarded 🙅‍♀️
  3. At this point it's up to the application to decide what to do next. The specific action is implementation dependent 🤷‍♀️ If the statusInformation says the request failed, one option is to try sending the request again, or to let the person running the application know something went wrong 🚨 Totally your call, bestie 💅

3.2. Command Responder Applications ✨

okay bestie, before a command responder application can process messages, it must first associate itself with an SNMP engine 💅 the abstract service interface for that is:

    statusInformation =        -- success or errorIndication
      registerContextEngineID(
      IN   contextEngineID     -- take responsibility for this one
      IN   pduType             -- the pduType(s) to be registered
           )

where:

  • the statusInformation tells you if the registration attempt worked or failed 🎀
  • the contextEngineID is equal to the snmpEngineID of the SNMP engine the command responder is registering with 🦋
  • the pduType indicates a Read-Class and/or Write-Class PDU 🌸

okay so, if another command responder application is already registered with an SNMP engine, any more attempts to register with the same contextEngineID and pduType get denied 🙅‍♀️ that means separate command responder applications could register separately for the different pdu types, but ngl that's messy and literally undesirable 💀 so in practice only a single command responder application should be registered with an SNMP engine at any given time ✨

a command responder application can disassociate from an SNMP engine using this one:

    unregisterContextEngineID(
      IN   contextEngineID     -- give up responsibility for this one
      IN   pduType             -- the pduType(s) to be unregistered
           )

where:

  • the contextEngineID is equal to the snmpEngineID of the SNMP engine the command responder is cancelling the registration with 🧚
  • the pduType indicates a Read-Class and/or Write-Class PDU 💜

once the command responder is registered, it just waits around to receive SNMP messages 👀 the abstract service interface for receiving messages is:

processPdu(                     -- process Request/Notification PDU
  IN   messageProcessingModel   -- typically, SNMP version
  IN   securityModel            -- Security Model in use
  IN   securityName             -- on behalf of this principal
  IN   securityLevel            -- Level of Security
  IN   contextEngineID          -- data from/at this SNMP entity
  IN   contextName              -- data from/in this context
  IN   pduVersion               -- the version of the PDU
  IN   PDU                      -- SNMP Protocol Data Unit
  IN   maxSizeResponseScopedPDU -- maximum size of the Response PDU
  IN   stateReference           -- reference to state information
       )                        -- needed when sending a response

where:

  • the messageProcessingModel indicates which Message Processing Model received and processed the message 🌈
  • the securityModel is the value from the received message 🔥
  • the securityName is the value from the received message 🔥
  • the securityLevel is the value from the received message 🔥
  • the contextEngineID is the value from the received message 🔥
  • the contextName is the value from the received message 🔥
  • the pduVersion indicates the version of the PDU in the received message 🍓
  • the PDU is the value from the received message 🍓
  • the maxSizeResponseScopedPDU is the maximum allowable size of a ScopedPDU containing a Response PDU, based on the maximum message size the originator of the message can accept 🫶
  • the stateReference is a value that references cached information about each received request message 🧠 this value must be returned to the Dispatcher in order to generate a response, so don't lose it bestie 😭

here's the procedure when a message comes in, step by step 📝

(1) the operation type gets figured out from the ASN.1 tag value attached to the PDU parameter 🔍 the operation type should always be one of the types the application registered before 💅

(2) the request-id gets pulled out of the PDU and saved 💾

(3) any PDU type specific parameters get pulled out of the PDU and saved 🎀 for example, if the PDU type is an SNMPv2 GetBulk PDU, the non-repeaters and max-repetitions values get extracted 🦋

(4) the variable-bindings get pulled out of the PDU and saved 🌸

(5) the management operation represented by the PDU type gets performed with respect to the relevant MIB view within the context named by the contextName (for an SNMPv2 PDU type, the operation is performed according to the procedures set forth in [RFC1905]) ✨ the relevant MIB view is determined by the securityLevel, securityModel, contextName, securityName, and the class of the PDU type 🧩 to check whether a particular object instance is within that view, this abstract service interface gets called:

    statusInformation =      -- success or errorIndication
      isAccessAllowed(
      IN   securityModel     -- Security Model in use
      IN   securityName      -- principal who wants to access
      IN   securityLevel     -- Level of Security
      IN   viewType          -- read, write, or notify view
      IN   contextName       -- context containing variableName
      IN   variableName      -- OID for the managed object
           )

where:

  • the securityModel is the value from the received message 💖
  • the securityName is the value from the received message 💖
  • the securityLevel is the value from the received message 💖
  • the viewType indicates whether the PDU type is a Read-Class or Write-Class operation 🌟
  • the contextName is the value from the received message 💖
  • the variableName is the object instance of the variable whose access rights are being checked 🔑

normally the management operation gives you a new PDU value, and processing keeps going at step (6) below ✨ but at any point during the management operation, a few things can happen 👀

  • if the isAccessAllowed ASI returns a noSuchView, noAccessEntry, or noGroupName error, the management operation halts 🛑 a PDU value gets built from the originally received PDU, but the error_status gets replaced with an authorizationError code and the error_index is set to 0, then control passes to step (6) below 🙅‍♀️
  • if the isAccessAllowed ASI returns an otherError, the management operation halts 🛑 a different PDU value gets built from the originally received PDU, but this time the error_status gets replaced with a genError code, and control passes to step (6) below 💀
  • if the isAccessAllowed ASI returns a noSuchContext error, the management operation halts 🛑 no result PDU gets generated, the snmpUnknownContexts counter gets incremented, and control passes to step (6) below 📈
  • if the context named by the contextName parameter is unavailable, the management operation halts 🛑 no result PDU gets generated, the snmpUnavailableContexts counter gets incremented, and control passes to step (6) below 📈

(6) the Dispatcher gets called to generate a response or report message 📣 the abstract service interface is:

returnResponsePdu(
  IN   messageProcessingModel   -- typically, SNMP version
  IN   securityModel            -- Security Model in use
  IN   securityName             -- on behalf of this principal
  IN   securityLevel            -- same as on incoming request
  IN   contextEngineID          -- data from/at this SNMP entity
  IN   contextName              -- data from/in this context
  IN   pduVersion               -- the version of the PDU
  IN   PDU                      -- SNMP Protocol Data Unit
  IN   maxSizeResponseScopedPDU -- maximum size of the Response PDU
  IN   stateReference           -- reference to state information
                                -- as presented with the request
  IN   statusInformation        -- success or errorIndication
       )                        -- error counter OID/value if error

where:

  • the messageProcessingModel is the value from the processPdu call 🌷
  • the securityModel is the value from the processPdu call 🌷
  • the securityName is the value from the processPdu call 🌷
  • the securityLevel is the value from the processPdu call 🌷
  • the contextEngineID is the value from the processPdu call 🌷
  • the contextName is the value from the processPdu call 🌷
  • the pduVersion indicates the version of the PDU to be returned 🎀 if no result PDU was generated, the pduVersion is an undefined value 🤷‍♀️
  • the PDU is the result generated in step (5) above 🎁 if no result PDU was generated, the PDU is an undefined value 🤷‍♀️
  • the maxSizeResponseScopedPDU is a local value indicating the maximum size of a ScopedPDU that the application can accept 🦋
  • the stateReference is the value from the processPdu call 🌸
  • the statusInformation either says no error occurred and a response should be generated, or says an error occurred along with the OID and counter value of the appropriate error counter object 🚨

okay this part is a big deal 🫶 a command responder application should always call the returnResponsePdu abstract service interface, even if there's an error like a resource allocation error 😭 in that case, the PDU value passed to returnResponsePdu should contain appropriate values for errorStatus and errorIndex 💅

and lastly, the difference between the snmpUnknownContexts counter and the snmpUnavailableContexts counter is kinda iconic 🙈 snmpUnknownContexts gets incremented when a request comes in for a context that's unknown to the SNMP entity 👽 snmpUnavailableContexts gets incremented when a request comes in for a context that is known to the SNMP entity, but is currently unavailable 🌙 figuring out when a context is unavailable is implementation specific, so some implementations may never run into that situation, and they may never increment the snmpUnavailableContexts counter 🤍

3.3. Notification Originator Applications

Okay so bestie, a notification originator app is the one that generates SNMP messages carrying Notification-Class PDUs, like SNMPv2-Trap PDUs or Inform PDUs 🔔✨ There's no rule saying which specific Notification-Class PDU types an implementation has to be able to generate, so you do you 💅

Originator apps need a way to figure out which management targets should get the notification. The specific mechanism is up to the implementation 🌸 BUT if your implementation lets you configure management targets over SNMP, it MUST use the SNMP-TARGET-MIB module described in this document. No cap, that one's a hard rule 🫶

When a notification originator wants to send a notification, it must first figure out in which context the info being shared lives. That means the contextEngineID and contextName 🗺️ Then it has to pick the set of management targets the notification should go to. For each target, the app also needs to decide what specific PDU type the message should contain. If it's going to be a Confirmed-Class PDU, it needs the number of retries and the retransmission algorithm too. It's a lot, but we love a main character with a plan 👑

How the originator figures all of this out is implementation dependent 🎀 Once the app has that info, the following procedure runs for each management target:

(1) Any appropriate filtering mechanisms are applied to decide whether the notification should be sent to the management target. If the filters say no, processing moves on to the next management target. Otherwise,

(2) The right set of variable-bindings is pulled from local MIB instrumentation within the relevant MIB view 👀 That view is determined by the securityLevel, securityModel, contextName, and securityName of the management target. To check whether a particular object instance is in that view, the isAccessAllowed abstract service interface gets used, same way as in the preceding section. If the statusInformation returned by isAccessAllowed doesn't say accessAllowed, the notification is not sent to the management target. Rip 💀

(3) The NOTIFICATION-TYPE OBJECT IDENTIFIER of the notification (that's the value of the variable binding whose name is snmpTrapOID.0, aka the second variable binding) gets checked with isAccessAllowed, using the same parameters as the step before. If the statusInformation doesn't indicate accessAllowed, the notification is not sent to the management target. Same energy, different object 🦋

(4) A PDU gets constructed using a locally unique request-id value, a PDU type picked by the implementation, an error-status and error-index value of 0, and the variable-bindings we grabbed back in step (2) 🧚

(5) If the notification contains an Unconfirmed-Class PDU, the Dispatcher gets called using this abstract service interface:

statusInformation =              -- sendPduHandle if success
                                 -- errorIndication if failure
  sendPdu(
  IN   transportDomain           -- transport domain to be used
  IN   transportAddress          -- destination network address
  IN   messageProcessingModel    -- typically, SNMP version
  IN   securityModel             -- Security Model to use
  IN   securityName              -- on behalf of this principal
  IN   securityLevel             -- Level of Security requested
  IN   contextEngineID           -- data from/at this entity
  IN   contextName               -- data from/in this context
  IN   pduVersion                -- the version of the PDU
  IN   PDU                       -- SNMP Protocol Data Unit
  IN   expectResponse            -- TRUE or FALSE
       )

Where the arguments go:

  • The transportDomain is that of the management target.
  • The transportAddress is that of the management target.
  • The messageProcessingModel is that of the management target.
  • The securityModel is that of the management target.
  • The securityName is that of the management target.
  • The securityLevel is that of the management target.
  • The contextEngineID is the value originally determined for the notification.
  • The contextName is the value originally determined for the notification.
  • The pduVersion is the version of the PDU to be sent.
  • The PDU is the value constructed in step (3) above.
  • The expectResponse argument indicates that no response is expected.

Otherwise,

(6) If the notification contains a Confirmed-Class PDU, then:

a) The Dispatcher gets called using the sendPdu abstract service interface, same as in step (4) above, except the expectResponse argument says a response is expected 🙌

b) The app caches info about the management target 📦

c) If a response comes back within an appropriate time interval from the transport endpoint of the management target, the notification is considered acknowledged and the cached info gets deleted. Otherwise,

d) If a response doesn't arrive within an appropriate time period, or if a report indication is received, the info about the management target gets pulled from the cache, and steps a) through d) get repeated. That repeating happens as many times as the previously determined retry count. If the retry count is exceeded, the acknowledgement of the notification is considered to have failed, and processing of the notification for this management target halts 😭 Also, some report indications might count as a failure. Those should be read as meaning the acknowledgement of the notification has failed.

Responses to Confirmed-Class PDU notifications come in through the processResponsePdu abstract service interface 📬

To sum it all up, a notification originator figures out where to send a notification by doing these things:

  • Determine the targets the notification should go to.
  • Apply any required filtering to the list of targets.
  • Determine which targets are authorized to receive the notification.

3.4. Notification Receiver Applications

Notification receiver apps are the ones that take in SNMP Notification messages from the Dispatcher 📥 Before any messages can come in, the receiver has to register with the Dispatcher using the registerContextEngineID abstract service interface. The parameters are:

  • The contextEngineID is an undefined 'wildcard' value. Notifications get delivered to a registered notification receiver no matter what contextEngineID is in the notification message 🌈
  • The pduType says what kinds of notifications the app wants to receive (like SNMPv2-Trap PDUs or Inform PDUs).

Once the receiver is registered, messages come in through the processPdu abstract service interface. The parameters are:

  • The messageProcessingModel says which Message Processing Model received and processed the message.
  • The securityModel is the value from the received message.
  • The securityName is the value from the received message.
  • The securityLevel is the value from the received message.
  • The contextEngineID is the value from the received message.
  • The contextName is the value from the received message.
  • The pduVersion says what version of the PDU is in the received message.
  • The PDU is the value from the received message.
  • The maxSizeResponseScopedPDU is the maximum allowable size of a ScopedPDU containing a Response PDU. It's based on the maximum message size the originator of the message can accept 🍓
  • If the message contains an Unconfirmed-Class PDU, the stateReference is undefined and unused. Otherwise, the stateReference is a value that points to cached info about the notification. This value must be sent back to the Dispatcher in order to generate a response 🔁

When an Unconfirmed-Class PDU gets delivered to a notification receiver app, it first pulls out the SNMP operation type, request-id, error-status, error-index, and variable-bindings from the PDU. After that, what happens next depends on the implementation 🤷‍♀️

When a Confirmed-Class PDU is received, the notification receiver app follows this procedure:

(1) The PDU type, request-id, error-status, error-index, and variable-bindings get extracted from the PDU.

(2) A Response-Class PDU gets constructed using the extracted request-id and variable-bindings, with error-status and error-index both set to 0 ✨

(3) The Dispatcher gets called to generate a response message using the returnResponsePdu abstract service interface. The parameters are:

  • The messageProcessingModel is the value from the processPdu call.
  • The securityModel is the value from the processPdu call.
  • The securityName is the value from the processPdu call.
  • The securityLevel is the value from the processPdu call.
  • The contextEngineID is the value from the processPdu call.
  • The contextName is the value from the processPdu call.
  • The pduVersion says what version of the PDU to return.
  • The PDU is the result generated in step (2) above.
  • The maxSizeResponseScopedPDU is a local value showing the maximum size of a ScopedPDU that the app can accept.
  • The stateReference is the value from the processPdu call.
  • The statusInformation says that no error occurred and that a response should be generated 🎉

3.5. Proxy Forwarder Applications 🎀

okay so a proxy forwarder application is the middle-person of SNMP 💌 its whole job is forwarding SNMP messages along. There are four basic types of messages it might need to forward, and they're grouped by the class of PDU type inside each one:

  • Those containing Read-Class or Write-Class PDU types (for example, Get, GetNext, GetBulk, and Set PDU types). These are about requesting or changing information that lives in a particular context.
  • Those containing Notification-Class PDU types (for example, SNMPv2-Trap and Inform PDU types). These are about notifications concerning information that lives in a particular context.
  • Those containing a Response-Class PDU type. Forwarding a Response PDU always happens because a response came back to a message that was already forwarded. ✨
  • Those containing Internal-Class PDU types (for example, a Report PDU). Forwarding these always happens because an Internal-Class PDU came back in response to a message that was already forwarded. 🧚

For the first type, the proxy forwarder's job is to deliver a request for management information to an SNMP engine which is "closer" or "downstream in the path" to the SNMP engine that has access to that information. It then delivers the response with the information back to the SNMP engine the request came from. The context information in a request is what tells the proxy which SNMP engine has access to the requested information, and that's how it decides where and how to forward the request. 🗺️

For the second type, the proxy forwarder's job is to figure out which SNMP engines should receive notifications about management information from a particular location. The context information in a notification message decides which location the information in the notification applies to, and that location is what determines which SNMP engines should get the notification about this information. 📣

For the third type, the proxy forwarder's job is to work out which previously forwarded request or notification (if there is one) the response matches, and then send the response back to whoever started that request or notification. 🔁

For the fourth type, the proxy forwarder's job is to work out which previously forwarded request or notification (if there is one) the Internal-Class PDU matches, and then send that Internal-Class PDU back to whoever started the request or notification. 🔁

When forwarding messages, a proxy forwarder application has to translate incoming management target information into outgoing management target information. How it does that translation is implementation specific. In lots of cases it's driven by a preconfigured translation table. If a proxy forwarder application makes the contents of this table SNMP manageable, it MUST use the SNMP-PROXY-MIB module defined in this document. 💜

3.5.1. Request Forwarding 🦋

There are two phases for request forwarding. First, the incoming request has to be passed through the proxy application. Then, the resulting response has to be passed back. Both phases get their own section below.

3.5.1.1. Processing an Incoming Request 📨

A proxy forwarder application that wants to forward request messages has to register with the Dispatcher first, using the registerContextEngineID abstract service interface. The proxy forwarder must register each contextEngineID it wants to forward messages for, and it has to do that for each pduType too. Heads up: when the proxy forwarder's configuration changes, the particular contextEngineID values it's forwarding for can change as well. The proxy forwarder should call the registerContextEngineID and unregisterContextEngineID abstract service interfaces as needed so they match its current configuration. 🔄

A proxy forwarder application should never attempt to register a value of contextEngineID that is equal to the snmpEngineID of the SNMP engine the proxy forwarder is associated with. 🙅‍♀️

Once the proxy forwarder has registered for the right contextEngineID values, it can start processing messages. Here's the procedure it follows:

(1) A message is received using the processPdu abstract service interface. The incoming management target information received from the processPdu interface gets translated into outgoing management target information. Note that this translation may vary for different values of contextEngineID and/or contextName. The translation should result in a single management target. 🎯

(2) If appropriate outgoing management target information can't be found, the proxy forwarder increments the snmpProxyDrops counter [RFC1907], and then calls the Dispatcher using the returnResponsePdu abstract service interface. The parameters are:

  • The messageProcessingModel is the value from the processPdu call.
  • The securityModel is the value from the processPdu call.
  • The securityName is the value from the processPdu call.
  • The securityLevel is the value from the processPdu call.
  • The contextEngineID is the value from the processPdu call.
  • The contextName is the value from the processPdu call.
  • The pduVersion is the value from the processPdu call.
  • The PDU is an undefined value.
  • The maxSizeResponseScopedPDU is a local value indicating the maximum size of a ScopedPDU that the application can accept.
  • The stateReference is the value from the processPdu call.
  • The statusInformation indicates that an error occurred and includes the OID and value of the snmpProxyDrops object.

Processing of the message stops right here. Otherwise, 🛑

(3) A new PDU gets constructed. A unique value of request-id should be used in the new PDU (this value is what lets a later response message get matched back up with this request). The rest of the new PDU is identical to the received PDU, unless the incoming SNMP version and the outgoing SNMP version support different PDU versions. In that case, the proxy forwarder may need to translate the PDU (a method for doing that translation is described in [COEX]). 🔧

(4) The proxy forwarder calls the Dispatcher to generate the forwarded message, using the sendPdu abstract service interface. The parameters are:

  • The transportDomain is that of the outgoing management target.
  • The transportAddress is that of the outgoing management target.
  • The messageProcessingModel is that of the outgoing management target.
  • The securityModel is that of the outgoing management target.
  • The securityName is that of the outgoing management target.
  • The securityLevel is that of the outgoing management target.
  • The contextEngineID is the value originally received.
  • The contextName is the value originally received.
  • The pduVersion is the version of the PDU to be sent.
  • The PDU is the value constructed in step (3) above.
  • The expectResponse argument indicates that a response is expected. If the sendPdu call is unsuccessful, the proxy forwarder performs the steps described in (2) above. Otherwise: 📤

(5) The proxy forwarder caches the following information so it can match an incoming response to the forwarded request:

  • The sendPduHandle returned from the call to sendPdu,
  • The request-id from the received PDU,
  • the contextEngineID,
  • the contextName,
  • the stateReference,
  • the incoming management target information,
  • the outgoing management information,
  • any other information needed to match an incoming response to the forwarded request.

If this information can't be cached (possibly because of a lack of resources), the proxy forwarder performs the steps described in (2) above. Otherwise: 💾

(6) Processing of the request stops until a response to the forwarded request is received, or until an appropriate time interval has expired. If that time interval expires before a response has been received, the cached information about this request is removed. ⏰

3.5.1.2. Processing an Incoming Response 📬

A proxy forwarder follows this procedure whenever an incoming response is received:

(1) The incoming response is received using the processResponsePdu interface. The proxy forwarder uses the received parameters to find an entry in its cache of pending forwarded requests. It does this by matching the received parameters against the cached values of sendPduHandle, contextEngineID, contextName, outgoing management target information, and the request-id contained in the received PDU (the proxy forwarder must extract the request-id for this purpose). If an appropriate cache entry can't be found, processing of the response is halted. Otherwise: 🔍

(2) The cache information is extracted, and then removed from the cache. 🗑️

(3) A new Response-Class PDU is constructed, using the request-id value from the original forwarded request (as extracted from the cache). All other values are identical to those in the received Response-Class PDU, unless the incoming SNMP version and the outgoing SNMP version support different PDU versions. In that case, the proxy forwarder may need to translate the PDU. (A method for performing such a translation is described in [COEX].) 🔧

(4) The proxy forwarder calls the Dispatcher using the returnResponsePdu abstract service interface. The parameters are:

  • The messageProcessingModel indicates the Message Processing Model by which the original incoming message was processed.
  • The securityModel is that of the original incoming management target extracted from the cache.
  • The securityName is that of the original incoming management target extracted from the cache.
  • The securityLevel is that of the original incoming management target extracted from the cache.
  • The contextEngineID is the value extracted from the cache.
  • The contextName is the value extracted from the cache.
  • The pduVersion indicates the version of the PDU to be returned.
  • The PDU is the (possibly translated) Response PDU.
  • The maxSizeResponseScopedPDU is a local value indicating the maximum size of a ScopedPDU that the application can accept.
  • The stateReference is the value extracted from the cache.
  • The statusInformation indicates that no error occurred and that a Response PDU message should be generated. 🎉

3.5.1.3. Processing an Incoming Internal-Class PDU ✨

Okay bestie, so here's the procedure a proxy forwarder follows when an incoming Internal-Class PDU shows up 💅

(1) The incoming Internal-Class PDU gets received through the processResponsePdu interface. The proxy forwarder uses the received parameters to dig up an entry in its cache of pending forwarded requests 🔍 It does this by matching the received parameters against the cached values of sendPduHandle. If there's no matching cache entry, processing of the Internal-Class PDU is halted. Otherwise, keep going:

(2) The cache information gets pulled out and then removed from the cache 🧹

(3) If the original incoming management target information says the SNMP version doesn't support Report PDUs, processing of the Internal-Class PDU is halted. Not me the SNMP version being like "no Reports for you" 💀

(4) The proxy forwarder calls the Dispatcher through the returnResponsePdu abstract service interface. The parameters are:

  • The messageProcessingModel indicates the Message Processing Model that processed the original incoming message 🎀
  • The securityModel is the one from the original incoming management target that got extracted from the cache.
  • The securityName is the one from the original incoming management target that got extracted from the cache.
  • The securityLevel is the one from the original incoming management target that got extracted from the cache.
  • The contextEngineID is the value extracted from the cache.
  • The contextName is the value extracted from the cache.
  • The pduVersion indicates the version of the PDU to be returned.
  • The PDU is unused 🫶
  • The maxSizeResponseScopedPDU is a local value showing the maximum size of a ScopedPDU that the application can accept.
  • The stateReference is the value extracted from the cache.
  • The statusInformation holds values specific to the Internal-Class PDU type. For example, for a Report PDU, the statusInformation has the contextEngineID, contextName, counter OID, and counter value from the incoming Report PDU 📊 It's giving organized energy 👑

3.5.2. Notification Forwarding 🦋

Okay so a proxy forwarder gets notifications the same way a notification receiver application does, using the processPdu abstract service interface 🌸 Here's the procedure that runs when a notification comes in:

(1) The incoming management target information received from the processPdu interface gets translated into outgoing management target information. Note that this translation may vary for different values of contextEngineID and/or contextName 🧚 The translation may also result in multiple management targets, which is so iconic 💖

(2) If appropriate outgoing management target information can't be found and the notification was an Unconfirmed-Class PDU, processing of the notification is halted. If appropriate outgoing management target information can't be found and the notification was a Confirmed-Class PDU, the proxy forwarder increments the snmpProxyDrops object and calls the Dispatcher through the returnResponsePdu abstract service interface. The parameters are:

  • The messageProcessingModel is the received value.
  • The securityModel is the received value.
  • The securityName is the received value.
  • The securityLevel is the received value.
  • The contextEngineID is the received value.
  • The contextName is the received value.
  • The pduVersion is the received value.
  • The PDU is an undefined and unused value 🙈
  • The maxSizeResponseScopedPDU is a local value showing the maximum size of a ScopedPDU that the application can accept.
  • The stateReference is the received value.
  • The statusInformation indicates that an error occurred and that a Report message should be generated 😭

Processing of the message stops right here. Otherwise,

(3) The proxy forwarder generates a notification using the procedures from the preceding section on Notification Originators, with these exceptions:

  • The contextEngineID and contextName values from the original received notification are used.
  • The outgoing management targets determined earlier are used.
  • No filtering mechanisms are applied.
  • The variable-bindings from the original received notification are used, instead of retrieving variable-bindings from local MIB instrumentation. In particular, no access-control is applied to these variable-bindings 🔐
  • If the original notification contains a Confirmed-Class PDU, then any outgoing management targets whose outgoing SNMP version doesn't support PDU types that are both Notification-Class and Confirmed-Class PDUs will not be used when generating the forwarded notifications 🚫
  • If, for any of the outgoing management targets, the incoming SNMP version and the outgoing SNMP version support different PDU versions, the proxy forwarder may need to perform a translation on the PDU. (A method for performing such a translation is described in [COEX].) 🔄

(4) If the original received notification contains an Unconfirmed-Class PDU, processing of the notification is now completed. Otherwise, the original received notification must contain a Confirmed-Class PDU, and processing continues 🎀

(5) If the forwarded notifications included any Confirmed-Class PDUs, processing continues once the procedures in the Notification Originators section determine that either:

  • None of the generated notifications containing Confirmed-Class PDUs have been successfully acknowledged within the longest of the time intervals. In that case, processing of the original notification is halted 💀, or,
  • At least one of the generated notifications containing Confirmed-Class PDUs is successfully acknowledged. In that case, a response to the original received notification containing a Confirmed-Class PDU is generated as described in the following steps 🥳

(6) A Response-Class PDU is constructed using the values of request-id and variable-bindings from the original received Notification-Class PDU, with error-status and error-index values of 0 ✨

(7) The Dispatcher is called through the returnResponsePdu abstract service interface. The parameters are:

  • The messageProcessingModel is the originally received value.
  • The securityModel is the originally received value.
  • The securityName is the originally received value.
  • The securityLevel is the originally received value.
  • The contextEngineID is the originally received value.
  • The contextName is the originally received value.
  • The pduVersion indicates the version of the PDU constructed in step (6) above.
  • The PDU is the value constructed in step (6) above.
  • The maxSizeResponseScopedPDU is a local value showing the maximum size of a ScopedPDU that the application can accept.
  • The stateReference is the originally received value.
  • The statusInformation indicates that no error occurred and that a Response-Class PDU message should be generated 🏆

4. The Structure of the MIB Modules 🌈

There are three separate MIB modules described in this document: the management target MIB, the notification MIB, and the proxy MIB. The following sections describe the structure of these three MIB modules 📚

The use of these MIBs by particular types of applications is described later in this document:

  • The use of the management target MIB and the notification MIB in notification originator applications is described in section 6.
  • The use of the notification MIB for filtering notifications in notification originator applications is described in section 7.
  • The use of the management target MIB and the proxy MIB in proxy forwarding applications is described in section 8.

4.1. The Management Target MIB Module 🎯

The SNMP-TARGET-MIB module contains objects for defining management targets. It has two tables and conformance/compliance statements 💜

The first table, the snmpTargetAddrTable, contains information about transport domains and addresses. It also contains an object, snmpTargetAddrTagList, which provides a mechanism for grouping entries 🧁

The second table, the snmpTargetParamsTable, contains information about the SNMP version and security information to be used when sending messages to particular transport domains and addresses 🔑

The Management Target MIB is meant to be a general-purpose mechanism for specifying transport addresses and for specifying parameters of SNMP messages generated by an SNMP entity. It's used within this document for generating notifications and for proxy forwarding. However, it may be used for other purposes. If another document makes use of this MIB, that document is responsible for specifying how it is used. For example, [COEX] uses this MIB for source address validation of SNMPv1 messages 🦋

4.1.1. Tag Lists 🏷️

The snmpTargetAddrTagList object is used for grouping entries in the snmpTargetAddrTable. The value of this object contains a list of tag values, which are used to select target addresses to be used for a particular operation 🎀

A tag value, which may also be used in MIB objects other than snmpTargetAddrTagList, is an arbitrary string of octets, but it may not contain a delimiter character. The delimiter characters are defined to be one of the following characters:

  • An ASCII space character (0x20).
  • An ASCII TAB character (0x09).
  • An ASCII carriage return (CR) character (0x0D).
  • An ASCII line feed (LF) character (0x0B).

In addition, a tag value may not have a zero length. Generally, a particular MIB object may contain either:

  • a single tag value, in which case the value of the MIB object may not contain a delimiter character, or:
  • a MIB object may contain a list of tag values, separated by single delimiter characters.

For a list of tag values, these constraints imply certain restrictions on the value of a MIB object:

  • There cannot be a leading or trailing delimiter character.
  • There cannot be multiple adjacent delimiter characters.

4.1.2. Definitions ✨

okay bestie, this is where the actual MIB module lives 💅 everything below is the real definition, so every character has to stay exactly as written 🫶

   SNMP-TARGET-MIB DEFINITIONS ::= BEGIN

   IMPORTS
       MODULE-IDENTITY,
       OBJECT-TYPE,
       snmpModules,
       Counter32,
       Integer32

           FROM SNMPv2-SMI

       TEXTUAL-CONVENTION,
       TDomain,
       TAddress,
       TimeInterval,
       RowStatus,
       StorageType,
       TestAndIncr
           FROM SNMPv2-TC

       SnmpSecurityModel,
       SnmpMessageProcessingModel,
       SnmpSecurityLevel,
       SnmpAdminString
           FROM SNMP-FRAMEWORK-MIB

       MODULE-COMPLIANCE,
       OBJECT-GROUP
           FROM SNMPv2-CONF;

   snmpTargetMIB MODULE-IDENTITY
       LAST-UPDATED "9808040000Z"
       ORGANIZATION "IETF SNMPv3 Working Group"
       CONTACT-INFO
           "WG-email:   snmpv3@lists.tislabs.com
            Subscribe:  majordomo@lists.tislabs.com
                        In message body:  subscribe snmpv3

            Chair:      Russ Mundy

                        Trusted Information Systems
            Postal:     3060 Washington Rd
                        Glenwood MD 21738
                        USA
            EMail:      mundy@tislabs.com
            Phone:      +1-301-854-6889

            Co-editor:  David B. Levi
                        SNMP Research, Inc.
            Postal:     3001 Kimberlin Heights Road
                        Knoxville, TN 37920-9716
            EMail:      levi@snmp.com
            Phone:      +1 423 573 1434

            Co-editor:  Paul Meyer
                        Secure Computing Corporation
            Postal:     2675 Long Lake Road
                        Roseville, MN 55113
            EMail:      paul_meyer@securecomputing.com
            Phone:      +1 651 628 1592

            Co-editor:  Bob Stewart
                        Cisco Systems, Inc.
            Postal:     170 West Tasman Drive
                        San Jose, CA 95134-1706
            EMail:      bstewart@cisco.com
            Phone:      +1 603 654 2686"
       DESCRIPTION
           "This MIB module defines MIB objects which provide
            mechanisms to remotely configure the parameters used
            by an SNMP entity for the generation of SNMP messages."
       REVISION    "9808040000Z"
       DESCRIPTION "Clarifications, published as
                    RFC2573."
       REVISION    "9707140000Z"
       DESCRIPTION "The initial revision, published as RFC2273."
       ::= { snmpModules 12 }

   snmpTargetObjects       OBJECT IDENTIFIER ::= { snmpTargetMIB 1 }
   snmpTargetConformance   OBJECT IDENTIFIER ::= { snmpTargetMIB 3 }

   SnmpTagValue ::= TEXTUAL-CONVENTION
       DISPLAY-HINT "255a"
       STATUS       current
       DESCRIPTION
           "An octet string containing a tag value.
            Tag values are preferably in human-readable form.

            To facilitate internationalization, this information
            is represented using the ISO/IEC IS 10646-1 character
            set, encoded as an octet string using the UTF-8
            character encoding scheme described in RFC 2279.

            Since additional code points are added by amendments
            to the 10646 standard from time to time,
            implementations must be prepared to encounter any code
            point from 0x00000000 to 0x7fffffff.

            The use of control codes should be avoided, and certain
            control codes are not allowed as described below.

            For code points not directly supported by user
            interface hardware or software, an alternative means
            of entry and display, such as hexadecimal, may be
            provided.

            For information encoded in 7-bit US-ASCII, the UTF-8
            representation is identical to the US-ASCII encoding.

            Note that when this TC is used for an object that
            is used or envisioned to be used as an index, then a
            SIZE restriction must be specified so that the number
            of sub-identifiers for any object instance does not
            exceed the limit of 128, as defined by [RFC1905].

            An object of this type contains a single tag value
            which is used to select a set of entries in a table.

            A tag value is an arbitrary string of octets, but
            may not contain a delimiter character.  Delimiter
            characters are defined to be one of the following:

                -  An ASCII space character (0x20).

                -  An ASCII TAB character (0x09).

                -  An ASCII carriage return (CR) character (0x0D).

                -  An ASCII line feed (LF) character (0x0B).

            Delimiter characters are used to separate tag values
            in a tag list.  An object of this type may only
            contain a single tag value, and so delimiter
            characters are not allowed in a value of this type.

            Some examples of valid tag values are:

                - 'acme'

                - 'router'

                - 'host'

            The use of a tag value to select table entries is
            application and MIB specific."
       SYNTAX       OCTET STRING (SIZE (0..255))

   SnmpTagList ::= TEXTUAL-CONVENTION
       DISPLAY-HINT "255a"
       STATUS       current
       DESCRIPTION
           "An octet string containing a list of tag values.
            Tag values are preferably in human-readable form.

            To facilitate internationalization, this information
            is represented using the ISO/IEC IS 10646-1 character
            set, encoded as an octet string using the UTF-8
            character encoding scheme described in RFC 2279.

            Since additional code points are added by amendments
            to the 10646 standard from time to time,
            implementations must be prepared to encounter any code
            point from 0x00000000 to 0x7fffffff.

            The use of control codes should be avoided, except as
            described below.

            For code points not directly supported by user
            interface hardware or software, an alternative means
            of entry and display, such as hexadecimal, may be
            provided.

            For information encoded in 7-bit US-ASCII, the UTF-8
            representation is identical to the US-ASCII encoding.

            An object of this type contains a list of tag values
            which are used to select a set of entries in a table.

            A tag value is an arbitrary string of octets, but
            may not contain a delimiter character.  Delimiter
            characters are defined to be one of the following:

                -  An ASCII space character (0x20).

                -  An ASCII TAB character (0x09).

                -  An ASCII carriage return (CR) character (0x0D).

                -  An ASCII line feed (LF) character (0x0B).

            Delimiter characters are used to separate tag values
            in a tag list.  Only a single delimiter character may
            occur between two tag values.  A tag value may not
            have a zero length.  These constraints imply certain
            restrictions on the contents of this object:

                - There cannot be a leading or trailing delimiter
                  character.

                - There cannot be multiple adjacent delimiter
                  characters.

            Some examples of valid tag lists are:

                - An empty string

                - 'acme router'

                - 'host managerStation'

            Note that although a tag value may not have a length of
            zero, an empty string is still valid.  This indicates
            an empty list (i.e. there are no tag values in the list).

            The use of the tag list to select table entries is
            application and MIB specific.  Typically, an application
            will provide one or more tag values, and any entry
            which contains some combination of these tag values
            will be selected."
       SYNTAX       OCTET STRING (SIZE (0..255))

   --
   --
   -- The snmpTargetObjects group
   --
   --

   snmpTargetSpinLock OBJECT-TYPE
       SYNTAX      TestAndIncr
       MAX-ACCESS  read-write
       STATUS      current
       DESCRIPTION
           "This object is used to facilitate modification of table
            entries in the SNMP-TARGET-MIB module by multiple
            managers.  In particular, it is useful when modifying
            the value of the snmpTargetAddrTagList object.

            The procedure for modifying the snmpTargetAddrTagList
            object is as follows:

                1.  Retrieve the value of snmpTargetSpinLock and
                    of snmpTargetAddrTagList.

2.  Generate a new value for snmpTargetAddrTagList.

                3.  Set the value of snmpTargetSpinLock to the
                    retrieved value, and the value of
                    snmpTargetAddrTagList to the new value.  If
                    the set fails for the snmpTargetSpinLock
                    object, go back to step 1."
       ::= { snmpTargetObjects 1 }

   snmpTargetAddrTable OBJECT-TYPE
       SYNTAX      SEQUENCE OF SnmpTargetAddrEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "A table of transport addresses to be used in the generation
            of SNMP messages."
       ::= { snmpTargetObjects 2 }

   snmpTargetAddrEntry OBJECT-TYPE
       SYNTAX      SnmpTargetAddrEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "A transport address to be used in the generation
            of SNMP operations.

            Entries in the snmpTargetAddrTable are created and
            deleted using the snmpTargetAddrRowStatus object."
       INDEX { IMPLIED snmpTargetAddrName }
       ::= { snmpTargetAddrTable 1 }

   SnmpTargetAddrEntry ::= SEQUENCE {
       snmpTargetAddrName         SnmpAdminString,
       snmpTargetAddrTDomain      TDomain,
       snmpTargetAddrTAddress     TAddress,
       snmpTargetAddrTimeout      TimeInterval,
       snmpTargetAddrRetryCount   Integer32,
       snmpTargetAddrTagList      SnmpTagList,
       snmpTargetAddrParams       SnmpAdminString,
       snmpTargetAddrStorageType  StorageType,
       snmpTargetAddrRowStatus    RowStatus
   }

   snmpTargetAddrName OBJECT-TYPE
       SYNTAX      SnmpAdminString (SIZE(1..32))
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "The locally arbitrary, but unique identifier associated
            with this snmpTargetAddrEntry."
       ::= { snmpTargetAddrEntry 1 }

   snmpTargetAddrTDomain OBJECT-TYPE
       SYNTAX      TDomain
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "This object indicates the transport type of the address
            contained in the snmpTargetAddrTAddress object."
       ::= { snmpTargetAddrEntry 2 }

   snmpTargetAddrTAddress OBJECT-TYPE
       SYNTAX      TAddress
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "This object contains a transport address.  The format of
            this address depends on the value of the
            snmpTargetAddrTDomain object."
       ::= { snmpTargetAddrEntry 3 }

   snmpTargetAddrTimeout OBJECT-TYPE
       SYNTAX      TimeInterval
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "This object should reflect the expected maximum round
            trip time for communicating with the transport address
            defined by this row.  When a message is sent to this
            address, and a response (if one is expected) is not
            received within this time period, an implementation
            may assume that the response will not be delivered.

more of the snmpTargetAddrTimeout description (and the rest of the MIB) is coming up next, so stay tuned 🦋

Okay so the timeout is not just a number you set and forget, bestie 🫶 the time an app actually waits can be derived from it, and the way it gets derived is up to each implementation 💅

            Note that the time interval that an application waits
            for a response may actually be derived from the value
            of this object.  The method for deriving the actual time
            interval is implementation dependent.  One such method
            is to derive the expected round trip time based on a
            particular retransmission algorithm and on the number
            of timeouts which have occurred.  The type of message may
            also be considered when deriving expected round trip
            times for retransmissions.  For example, if a message is
            being sent with a securityLevel that indicates both
            authentication and privacy, the derived value may be
            increased to compensate for extra processing time spent
            during authentication and encryption processing."
       DEFVAL { 1500 }
       ::= { snmpTargetAddrEntry 4 }

   snmpTargetAddrRetryCount OBJECT-TYPE
       SYNTAX      Integer32 (0..255)
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "This object specifies a default number of retries to be
            attempted when a response is not received for a generated
            message.  An application may provide its own retry count,
            in which case the value of this object is ignored."
       DEFVAL { 3 }
       ::= { snmpTargetAddrEntry 5 }

   snmpTargetAddrTagList OBJECT-TYPE
       SYNTAX      SnmpTagList
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "This object contains a list of tag values which are
            used to select target addresses for a particular
            operation."
       DEFVAL { "" }
       ::= { snmpTargetAddrEntry 6 }

   snmpTargetAddrParams OBJECT-TYPE
       SYNTAX      SnmpAdminString (SIZE(1..32))
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The value of this object identifies an entry in the
            snmpTargetParamsTable.  The identified entry
            contains SNMP parameters to be used when generating
            messages to be sent to this transport address."
       ::= { snmpTargetAddrEntry 7 }

   snmpTargetAddrStorageType OBJECT-TYPE
       SYNTAX      StorageType
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The storage type for this conceptual row."
       DEFVAL { nonVolatile }
       ::= { snmpTargetAddrEntry 8 }

   snmpTargetAddrRowStatus OBJECT-TYPE
       SYNTAX      RowStatus
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The status of this conceptual row.

            To create a row in this table, a manager must
            set this object to either createAndGo(4) or
            createAndWait(5).

            Until instances of all corresponding columns are
            appropriately configured, the value of the
            corresponding instance of the snmpTargetAddrRowStatus
            column is 'notReady'.

            In particular, a newly created row cannot be made
            active until the corresponding instances of
            snmpTargetAddrTDomain, snmpTargetAddrTAddress, and
            snmpTargetAddrParams have all been set.

            The following objects may not be modified while the
            value of this object is active(1):
                - snmpTargetAddrTDomain
                - snmpTargetAddrTAddress
            An attempt to set these objects while the value of
            snmpTargetAddrRowStatus is active(1) will result in
            an inconsistentValue error."
       ::= { snmpTargetAddrEntry 9 }

   snmpTargetParamsTable OBJECT-TYPE
       SYNTAX      SEQUENCE OF SnmpTargetParamsEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "A table of SNMP target information to be used
            in the generation of SNMP messages."
       ::= { snmpTargetObjects 3 }

   snmpTargetParamsEntry OBJECT-TYPE
       SYNTAX      SnmpTargetParamsEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "A set of SNMP target information.

            Entries in the snmpTargetParamsTable are created and
            deleted using the snmpTargetParamsRowStatus object."
       INDEX { IMPLIED snmpTargetParamsName }
       ::= { snmpTargetParamsTable 1 }

   SnmpTargetParamsEntry ::= SEQUENCE {
       snmpTargetParamsName           SnmpAdminString,
       snmpTargetParamsMPModel        SnmpMessageProcessingModel,
       snmpTargetParamsSecurityModel  SnmpSecurityModel,
       snmpTargetParamsSecurityName   SnmpAdminString,
       snmpTargetParamsSecurityLevel  SnmpSecurityLevel,
       snmpTargetParamsStorageType    StorageType,
       snmpTargetParamsRowStatus      RowStatus
   }

   snmpTargetParamsName OBJECT-TYPE
       SYNTAX      SnmpAdminString (SIZE(1..32))
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "The locally arbitrary, but unique identifier associated
            with this snmpTargetParamsEntry."
       ::= { snmpTargetParamsEntry 1 }

   snmpTargetParamsMPModel OBJECT-TYPE
       SYNTAX      SnmpMessageProcessingModel
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The Message Processing Model to be used when generating
            SNMP messages using this entry."
       ::= { snmpTargetParamsEntry 2 }

   snmpTargetParamsSecurityModel OBJECT-TYPE
       SYNTAX      SnmpSecurityModel (1..2147483647)
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The Security Model to be used when generating SNMP
             messages using this entry.  An implementation may
             choose to return an inconsistentValue error if an
             attempt is made to set this variable to a value
             for a security model which the implementation does
             not support."
       ::= { snmpTargetParamsEntry 3 }

   snmpTargetParamsSecurityName OBJECT-TYPE
       SYNTAX      SnmpAdminString
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The securityName which identifies the Principal on
            whose behalf SNMP messages will be generated using
            this entry."
       ::= { snmpTargetParamsEntry 4 }

   snmpTargetParamsSecurityLevel OBJECT-TYPE
       SYNTAX      SnmpSecurityLevel
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The Level of Security to be used when generating
            SNMP messages using this entry."
       ::= { snmpTargetParamsEntry 5 }

   snmpTargetParamsStorageType OBJECT-TYPE
       SYNTAX      StorageType
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The storage type for this conceptual row."
       DEFVAL { nonVolatile }
       ::= { snmpTargetParamsEntry 6 }

   snmpTargetParamsRowStatus OBJECT-TYPE
       SYNTAX      RowStatus
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The status of this conceptual row.

            To create a row in this table, a manager must
            set this object to either createAndGo(4) or
            createAndWait(5).

            Until instances of all corresponding columns are
            appropriately configured, the value of the
            corresponding instance of the snmpTargetParamsRowStatus
            column is 'notReady'.

            In particular, a newly created row cannot be made
            active until the corresponding
            snmpTargetParamsMPModel,
            snmpTargetParamsSecurityModel,
            snmpTargetParamsSecurityName,
            and snmpTargetParamsSecurityLevel have all been set.
            The following objects may not be modified while the
            value of this object is active(1):
                - snmpTargetParamsMPModel
                - snmpTargetParamsSecurityModel
                - snmpTargetParamsSecurityName
                - snmpTargetParamsSecurityLevel
            An attempt to set these objects while the value of
            snmpTargetParamsRowStatus is active(1) will result in
            an inconsistentValue error."
       ::= { snmpTargetParamsEntry 7 }

   snmpUnavailableContexts OBJECT-TYPE
       SYNTAX       Counter32
       MAX-ACCESS   read-only
       STATUS       current
       DESCRIPTION
           "The total number of packets received by the SNMP
            engine which were dropped because the context
            contained in the message was unavailable."
       ::= { snmpTargetObjects 4 }

   snmpUnknownContexts OBJECT-TYPE
       SYNTAX       Counter32
       MAX-ACCESS   read-only
       STATUS       current
       DESCRIPTION
           "The total number of packets received by the SNMP
            engine which were dropped because the context
            contained in the message was unknown."
       ::= { snmpTargetObjects 5 }

   --
   --
   -- Conformance information
   --
   --

   snmpTargetCompliances OBJECT IDENTIFIER ::=
                                           { snmpTargetConformance 1 }
   snmpTargetGroups      OBJECT IDENTIFIER ::=
                                           { snmpTargetConformance 2 }

   --
   --
   -- Compliance statements
   --
   --
   snmpTargetCommandResponderCompliance MODULE-COMPLIANCE
       STATUS      current
       DESCRIPTION
           "The compliance statement for SNMP entities which include
            a command responder application."
       MODULE -- This Module
           MANDATORY-GROUPS { snmpTargetCommandResponderGroup }
       ::= { snmpTargetCompliances 1 }

   snmpTargetBasicGroup OBJECT-GROUP
       OBJECTS {
           snmpTargetSpinLock,
           snmpTargetAddrTDomain,
           snmpTargetAddrTAddress,
           snmpTargetAddrTagList,
           snmpTargetAddrParams,
           snmpTargetAddrStorageType,
           snmpTargetAddrRowStatus,
           snmpTargetParamsMPModel,
           snmpTargetParamsSecurityModel,
           snmpTargetParamsSecurityName,
           snmpTargetParamsSecurityLevel,
           snmpTargetParamsStorageType,
           snmpTargetParamsRowStatus
       }
       STATUS      current
       DESCRIPTION
           "A collection of objects providing basic remote
            configuration of management targets."
       ::= { snmpTargetGroups 1 }

   snmpTargetResponseGroup OBJECT-GROUP
       OBJECTS {
           snmpTargetAddrTimeout,
           snmpTargetAddrRetryCount
       }
       STATUS      current
       DESCRIPTION
           "A collection of objects providing remote configuration
            of management targets for applications which generate
            SNMP messages for which a response message would be
            expected."
       ::= { snmpTargetGroups 2 }

   snmpTargetCommandResponderGroup OBJECT-GROUP
       OBJECTS {
           snmpUnavailableContexts,
           snmpUnknownContexts
       }
       STATUS      current
       DESCRIPTION
           "A collection of objects required for command responder
            applications, used for counting error conditions."
       ::= { snmpTargetGroups 3 }

   END

The next bit is where the groups and the rest of the module get going, and it's a whole vibe 👀🎀

4.2. The Notification MIB Module 💌✨

okay bestie, this is the SNMP-NOTIFICATION-MIB module 🔔, and its whole job is letting you remotely configure the settings an SNMP entity uses when it generates notifications. It has three tables plus conformance/compliance statements, which is giving very organized energy 💅. The first one, the snmpNotifyTable, is the selector 🎯. Its entries pick which entries in the snmpTargetAddrTable should get notifications, and what type of notifications those targets get. The second table sparsely augments the snmpTargetAddrTable with an object that attaches a set of filters to a particular management target 🦋. The third table is where the filters themselves live 🚦, and they limit how many notifications get sent to particular management targets. ngl this is so iconic 😭

4.2.1. Definitions 🌸

SNMP-NOTIFICATION-MIB DEFINITIONS ::= BEGIN

IMPORTS
    MODULE-IDENTITY,
    OBJECT-TYPE,
    snmpModules
        FROM SNMPv2-SMI

    RowStatus,
    StorageType
        FROM SNMPv2-TC

    SnmpAdminString
        FROM SNMP-FRAMEWORK-MIB

    SnmpTagValue,
    snmpTargetParamsName
        FROM SNMP-TARGET-MIB

    MODULE-COMPLIANCE,
    OBJECT-GROUP
        FROM SNMPv2-CONF;

snmpNotificationMIB MODULE-IDENTITY
    LAST-UPDATED "9808040000Z"
    ORGANIZATION "IETF SNMPv3 Working Group"
    CONTACT-INFO
        "WG-email:   snmpv3@lists.tislabs.com
         Subscribe:  majordomo@lists.tislabs.com
                     In message body:  subscribe snmpv3

         Chair:      Russ Mundy
                     Trusted Information Systems
         Postal:     3060 Washington Rd
                     Glenwood MD 21738
                     USA
         EMail:      mundy@tislabs.com
         Phone:      +1-301-854-6889

         Co-editor:  David B. Levi
                     SNMP Research, Inc.
         Postal:     3001 Kimberlin Heights Road
                     Knoxville, TN 37920-9716
         EMail:      levi@snmp.com
         Phone:      +1 423 573 1434

         Co-editor:  Paul Meyer
                     Secure Computing Corporation
         Postal:     2675 Long Lake Road
                     Roseville, MN 55113
         EMail:      paul_meyer@securecomputing.com
         Phone:      +1 651 628 1592

         Co-editor:  Bob Stewart
                     Cisco Systems, Inc.
         Postal:     170 West Tasman Drive
                     San Jose, CA 95134-1706
         EMail:      bstewart@cisco.com
         Phone:      +1 603 654 2686"
    DESCRIPTION
        "This MIB module defines MIB objects which provide
         mechanisms to remotely configure the parameters
         used by an SNMP entity for the generation of
         notifications."
    REVISION    "9808040000Z"
    DESCRIPTION "Clarifications, published as
                 RFC2573"
    REVISION    "9707140000Z"
    DESCRIPTION "The initial revision, published as RFC2273."
    ::= { snmpModules 13 }

snmpNotifyObjects       OBJECT IDENTIFIER ::=
                                          { snmpNotificationMIB 1 }
snmpNotifyConformance   OBJECT IDENTIFIER ::=
                                          { snmpNotificationMIB 3 }

--
--
-- The snmpNotifyObjects group
--
--

snmpNotifyTable OBJECT-TYPE
    SYNTAX      SEQUENCE OF SnmpNotifyEntry
    MAX-ACCESS  not-accessible
    STATUS      current
    DESCRIPTION
        "This table is used to select management targets which should
         receive notifications, as well as the type of notification
         which should be sent to each selected management target."
    ::= { snmpNotifyObjects 1 }

snmpNotifyEntry OBJECT-TYPE
    SYNTAX      SnmpNotifyEntry
    MAX-ACCESS  not-accessible
    STATUS      current
    DESCRIPTION
        "An entry in this table selects a set of management targets
         which should receive notifications, as well as the type of
         notification which should be sent to each selected
         management target.

         Entries in the snmpNotifyTable are created and
         deleted using the snmpNotifyRowStatus object."
    INDEX { IMPLIED snmpNotifyName }
    ::= { snmpNotifyTable 1 }

SnmpNotifyEntry ::= SEQUENCE {
    snmpNotifyName         SnmpAdminString,
    snmpNotifyTag          SnmpTagValue,
    snmpNotifyType         INTEGER,
    snmpNotifyStorageType  StorageType,
    snmpNotifyRowStatus    RowStatus
}

snmpNotifyName OBJECT-TYPE
    SYNTAX      SnmpAdminString (SIZE(1..32))
    MAX-ACCESS  not-accessible
    STATUS      current
    DESCRIPTION
        "The locally arbitrary, but unique identifier associated
         with this snmpNotifyEntry."
    ::= { snmpNotifyEntry 1 }

snmpNotifyTag OBJECT-TYPE
    SYNTAX      SnmpTagValue
    MAX-ACCESS  read-create
    STATUS      current
    DESCRIPTION
        "This object contains a single tag value which is used
         to select entries in the snmpTargetAddrTable.  Any entry
         in the snmpTargetAddrTable which contains a tag value
         which is equal to the value of an instance of this
         object is selected.  If this object contains a value
         of zero length, no entries are selected."
    DEFVAL { "" }
    ::= { snmpNotifyEntry 2 }

snmpNotifyType OBJECT-TYPE
    SYNTAX      INTEGER {
                    trap(1),
                    inform(2)
                }
    MAX-ACCESS  read-create
    STATUS      current
    DESCRIPTION
        "This object determines the type of notification to
         be generated for entries in the snmpTargetAddrTable
         selected by the corresponding instance of
         snmpNotifyTag.  This value is only used when
         generating notifications, and is ignored when
         using the snmpTargetAddrTable for other purposes.

         If the value of this object is trap(1), then any
         messages generated for selected rows will contain
         Unconfirmed-Class PDUs.

         If the value of this object is inform(2), then any
         messages generated for selected rows will contain
         Confirmed-Class PDUs.

         Note that if an SNMP entity only supports
         generation of Unconfirmed-Class PDUs (and not
         Confirmed-Class PDUs), then this object may be
         read-only."
    DEFVAL { trap }
    ::= { snmpNotifyEntry 3 }

snmpNotifyStorageType OBJECT-TYPE
    SYNTAX      StorageType
    MAX-ACCESS  read-create
    STATUS      current
    DESCRIPTION
        "The storage type for this conceptual row."
    DEFVAL { nonVolatile }
    ::= { snmpNotifyEntry 4 }

snmpNotifyRowStatus OBJECT-TYPE
    SYNTAX      RowStatus
    MAX-ACCESS  read-create
    STATUS      current
    DESCRIPTION
        "The status of this conceptual row.

         To create a row in this table, a manager must
         set this object to either createAndGo(4) or
         createAndWait(5)."
    ::= { snmpNotifyEntry 5 }

snmpNotifyFilterProfileTable OBJECT-TYPE
    SYNTAX      SEQUENCE OF SnmpNotifyFilterProfileEntry
    MAX-ACCESS  not-accessible
    STATUS      current
    DESCRIPTION
        "This table is used to associate a notification filter
         profile with a particular set of target parameters."
    ::= { snmpNotifyObjects 2 }

snmpNotifyFilterProfileEntry OBJECT-TYPE
    SYNTAX      SnmpNotifyFilterProfileEntry
    MAX-ACCESS  not-accessible
    STATUS      current
    DESCRIPTION
        "An entry in this table indicates the name of the filter
         profile to be used when generating notifications using
         the corresponding entry in the snmpTargetParamsTable.

         Entries in the snmpNotifyFilterProfileTable are created
         and deleted using the snmpNotifyFilterProfileRowStatus
         object."
    INDEX { IMPLIED snmpTargetParamsName }
    ::= { snmpNotifyFilterProfileTable 1 }

SnmpNotifyFilterProfileEntry ::= SEQUENCE {
    snmpNotifyFilterProfileName         SnmpAdminString,
    snmpNotifyFilterProfileStorType     StorageType,
    snmpNotifyFilterProfileRowStatus    RowStatus
}

snmpNotifyFilterProfileName OBJECT-TYPE
    SYNTAX      SnmpAdminString (SIZE(1..32))
    MAX-ACCESS  read-create
    STATUS      current
    DESCRIPTION
        "The name of the filter profile to be used when generating
         notifications using the corresponding entry in the
         snmpTargetAddrTable."
    ::= { snmpNotifyFilterProfileEntry 1 }

snmpNotifyFilterProfileStorType OBJECT-TYPE
    SYNTAX      StorageType
    MAX-ACCESS  read-create
    STATUS      current
    DESCRIPTION
        "The storage type of this conceptual row."
    DEFVAL { nonVolatile }
    ::= { snmpNotifyFilterProfileEntry 2 }

snmpNotifyFilterProfileRowStatus OBJECT-TYPE
    SYNTAX      RowStatus
    MAX-ACCESS  read-create
    STATUS      current
    DESCRIPTION
        "The status of this conceptual row.

         To create a row in this table, a manager must
         set this object to either createAndGo(4) or
         createAndWait(5).

         Until instances of all corresponding columns are
         appropriately configured, the value of the
         corresponding instance of the
         snmpNotifyFilterProfileRowStatus column is 'notReady'.

         In particular, a newly created row cannot be made
         active until the corresponding instance of
         snmpNotifyFilterProfileName has been set."
    ::= { snmpNotifyFilterProfileEntry 3 }

snmpNotifyFilterTable OBJECT-TYPE
    SYNTAX      SEQUENCE OF SnmpNotifyFilterEntry
    MAX-ACCESS  not-accessible
    STATUS      current
    DESCRIPTION
        "The table of filter profiles.  Filter profiles are used
         to determine whether particular management targets should
         receive particular notifications.

         When a notification is generated, it must be compared
         with the filters associated with each management target
         which is configured to receive notifications, in order to
         determine whether it may be sent to each such management
         target.

         A more complete discussion of notification filtering
         can be found in section 6. of [RFC2573]."
    ::= { snmpNotifyObjects 3 }

snmpNotifyFilterEntry OBJECT-TYPE
    SYNTAX      SnmpNotifyFilterEntry
    MAX-ACCESS  not-accessible
    STATUS      current
    DESCRIPTION
        "An element of a filter profile.

         Entries in the snmpNotifyFilterTable are created and
         deleted using the snmpNotifyFilterRowStatus object."
    INDEX {         snmpNotifyFilterProfileName,
            IMPLIED snmpNotifyFilterSubtree }
    ::= { snmpNotifyFilterTable 1 }

SnmpNotifyFilterEntry ::= SEQUENCE {
    snmpNotifyFilterSubtree           OBJECT IDENTIFIER,
    snmpNotifyFilterMask              OCTET STRING,
    snmpNotifyFilterType              INTEGER,
    snmpNotifyFilterStorageType       StorageType,
    snmpNotifyFilterRowStatus         RowStatus
}

snmpNotifyFilterSubtree OBJECT-TYPE
    SYNTAX      OBJECT IDENTIFIER
    MAX-ACCESS  not-accessible
    STATUS      current
    DESCRIPTION
           "The MIB subtree which, when combined with the corresponding
            instance of snmpNotifyFilterMask, defines a family of
            subtrees which are included in or excluded from the
            filter profile."
       ::= { snmpNotifyFilterEntry 1 }
   snmpNotifyFilterMask OBJECT-TYPE
       SYNTAX      OCTET STRING (SIZE(0..16))
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The bit mask which, in combination with the corresponding
            instance of snmpNotifyFilterSubtree, defines a family of
            subtrees which are included in or excluded from the
            filter profile.

            Each bit of this bit mask corresponds to a
            sub-identifier of snmpNotifyFilterSubtree, with the
            most significant bit of the i-th octet of this octet
            string value (extended if necessary, see below)
            corresponding to the (8*i - 7)-th sub-identifier, and
            the least significant bit of the i-th octet of this
            octet string corresponding to the (8*i)-th
            sub-identifier, where i is in the range 1 through 16.

            Each bit of this bit mask specifies whether or not
            the corresponding sub-identifiers must match when
            determining if an OBJECT IDENTIFIER matches this
            family of filter subtrees; a '1' indicates that an
            exact match must occur; a '0' indicates 'wild card',
            i.e., any sub-identifier value matches.

            Thus, the OBJECT IDENTIFIER X of an object instance
            is contained in a family of filter subtrees if, for
            each sub-identifier of the value of
            snmpNotifyFilterSubtree, either:

              the i-th bit of snmpNotifyFilterMask is 0, or

              the i-th sub-identifier of X is equal to the i-th
              sub-identifier of the value of
              snmpNotifyFilterSubtree.

            If the value of this bit mask is M bits long and
            there are more than M sub-identifiers in the
            corresponding instance of snmpNotifyFilterSubtree,
            then the bit mask is extended with 1's to be the
            required length.

            Note that when the value of this object is the
            zero-length string, this extension rule results in
            a mask of all-1's being used (i.e., no 'wild card'),
            and the family of filter subtrees is the one
            subtree uniquely identified by the corresponding
            instance of snmpNotifyFilterSubtree."
       DEFVAL { ''H }
       ::= { snmpNotifyFilterEntry 2 }

   snmpNotifyFilterType OBJECT-TYPE
       SYNTAX      INTEGER {
                       included(1),
                       excluded(2)
                   }
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "This object indicates whether the family of filter subtrees
            defined by this entry are included in or excluded from a
            filter.  A more detailed discussion of the use of this
            object can be found in section 6. of [RFC2573]."
       DEFVAL { included }
       ::= { snmpNotifyFilterEntry 3 }

   snmpNotifyFilterStorageType OBJECT-TYPE
       SYNTAX      StorageType
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The storage type of this conceptual row."
       DEFVAL { nonVolatile }
       ::= { snmpNotifyFilterEntry 4 }

   snmpNotifyFilterRowStatus OBJECT-TYPE
       SYNTAX      RowStatus
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The status of this conceptual row.

            To create a row in this table, a manager must
            set this object to either createAndGo(4) or
            createAndWait(5)."
       ::= { snmpNotifyFilterEntry 5 }

   --
   --
   -- Conformance information
   --
   --
   snmpNotifyCompliances OBJECT IDENTIFIER ::=
                                           { snmpNotifyConformance 1 }
   snmpNotifyGroups      OBJECT IDENTIFIER ::=
                                           { snmpNotifyConformance 2 }

   --
   --
   -- Compliance statements
   --
   --

   snmpNotifyBasicCompliance MODULE-COMPLIANCE
       STATUS      current
       DESCRIPTION
           "The compliance statement for minimal SNMP entities which
            implement only SNMP Unconfirmed-Class notifications and
            read-create operations on only the snmpTargetAddrTable."
       MODULE SNMP-TARGET-MIB
           MANDATORY-GROUPS { snmpTargetBasicGroup }

           OBJECT snmpTargetParamsMPModel
           MIN-ACCESS    read-only
           DESCRIPTION
               "Create/delete/modify access is not required."

           OBJECT snmpTargetParamsSecurityModel
           MIN-ACCESS    read-only
           DESCRIPTION
               "Create/delete/modify access is not required."

           OBJECT snmpTargetParamsSecurityName
           MIN-ACCESS    read-only
           DESCRIPTION
               "Create/delete/modify access is not required."

           OBJECT snmpTargetParamsSecurityLevel
           MIN-ACCESS    read-only
           DESCRIPTION
               "Create/delete/modify access is not required."

           OBJECT snmpTargetParamsStorageType
           SYNTAX INTEGER {
               readOnly(5)
           }
           MIN-ACCESS    read-only
           DESCRIPTION

               "Create/delete/modify access is not required.
                Support of the values other(1), volatile(2),
                nonVolatile(3), and permanent(4) is not required."

           OBJECT snmpTargetParamsRowStatus
           SYNTAX INTEGER {
               active(1)
           }
           MIN-ACCESS    read-only
           DESCRIPTION
               "Create/delete/modify access to the
                snmpTargetParamsTable is not required.
                Support of the values notInService(2), notReady(3),
                createAndGo(4), createAndWait(5), and destroy(6) is
                not required."

       MODULE -- This Module
           MANDATORY-GROUPS { snmpNotifyGroup }

           OBJECT snmpNotifyTag
           MIN-ACCESS    read-only
           DESCRIPTION
               "Create/delete/modify access is not required."

           OBJECT snmpNotifyType
           SYNTAX INTEGER {
               trap(1)
           }
           MIN-ACCESS    read-only
           DESCRIPTION
               "Create/delete/modify access is not required.
                Support of the value notify(2) is not required."

           OBJECT snmpNotifyStorageType
           SYNTAX INTEGER {
               readOnly(5)
           }
           MIN-ACCESS    read-only
           DESCRIPTION
               "Create/delete/modify access is not required.
                Support of the values other(1), volatile(2),
                nonVolatile(3), and permanent(4) is not required."

           OBJECT snmpNotifyRowStatus
           SYNTAX INTEGER {
               active(1)
           }
           MIN-ACCESS    read-only
           DESCRIPTION
               "Create/delete/modify access to the
                snmpNotifyTable is not required.
                Support of the values notInService(2), notReady(3),
                createAndGo(4), createAndWait(5), and destroy(6) is
                not required."

       ::= { snmpNotifyCompliances 1 }

   snmpNotifyBasicFiltersCompliance MODULE-COMPLIANCE
       STATUS      current
       DESCRIPTION
           "The compliance statement for SNMP entities which implement
            SNMP Unconfirmed-Class notifications with filtering, and
            read-create operations on all related tables."
       MODULE SNMP-TARGET-MIB
           MANDATORY-GROUPS { snmpTargetBasicGroup }
       MODULE -- This Module
           MANDATORY-GROUPS { snmpNotifyGroup,
                              snmpNotifyFilterGroup }
       ::= { snmpNotifyCompliances 2 }

   snmpNotifyFullCompliance MODULE-COMPLIANCE
       STATUS      current
       DESCRIPTION
           "The compliance statement for SNMP entities which either
            implement only SNMP Confirmed-Class notifications, or both
            SNMP Unconfirmed-Class and Confirmed-Class notifications,
            plus filtering and read-create operations on all related
            tables."
       MODULE SNMP-TARGET-MIB
           MANDATORY-GROUPS { snmpTargetBasicGroup,
                              snmpTargetResponseGroup }
       MODULE -- This Module
           MANDATORY-GROUPS { snmpNotifyGroup,
                              snmpNotifyFilterGroup }
       ::= { snmpNotifyCompliances 3 }

   snmpNotifyGroup OBJECT-GROUP
       OBJECTS {
           snmpNotifyTag,
           snmpNotifyType,
           snmpNotifyStorageType,
           snmpNotifyRowStatus
       }
       STATUS      current
       DESCRIPTION
           "A collection of objects for selecting which management

            targets are used for generating notifications, and the
            type of notification to be generated for each selected
            management target."
       ::= { snmpNotifyGroups 1 }

   snmpNotifyFilterGroup OBJECT-GROUP
       OBJECTS {
           snmpNotifyFilterProfileName,
           snmpNotifyFilterProfileStorType,
           snmpNotifyFilterProfileRowStatus,
           snmpNotifyFilterMask,
           snmpNotifyFilterType,
           snmpNotifyFilterStorageType,
           snmpNotifyFilterRowStatus
       }
       STATUS      current
       DESCRIPTION
           "A collection of objects providing remote configuration
            of notification filters."
       ::= { snmpNotifyGroups 2 }

   END

4.3. The Proxy MIB Module ✨

Okay so the SNMP-PROXY-MIB module is the part that defines MIB objects giving you ways to remotely configure the parameters an SNMP entity uses for proxy forwarding operations 🔥 It's giving remote control, bestie 💅 The whole module holds just one table, called snmpProxyTable 🎀, and that table is where you define translations between management targets so messages get forwarded the right way 🦋 Lowkey simple, but so important 🫶

4.3.1. Definitions 📜✨

Okay bestie, here's the full MIB module for the proxy stuff. It's giving "remote config for your proxy forwarder" and it's so iconic. 💅

   SNMP-PROXY-MIB DEFINITIONS ::= BEGIN

   IMPORTS
       MODULE-IDENTITY,
       OBJECT-TYPE,
       snmpModules
           FROM SNMPv2-SMI

       RowStatus,
       StorageType
           FROM SNMPv2-TC

       SnmpEngineID,
       SnmpAdminString
           FROM SNMP-FRAMEWORK-MIB

       SnmpTagValue
           FROM SNMP-TARGET-MIB

       MODULE-COMPLIANCE,
       OBJECT-GROUP
           FROM SNMPv2-CONF;

   snmpProxyMIB MODULE-IDENTITY
       LAST-UPDATED "9808040000Z"
       ORGANIZATION "IETF SNMPv3 Working Group"
       CONTACT-INFO
           "WG-email:   snmpv3@lists.tislabs.com
            Subscribe:  majordomo@lists.tislabs.com
                        In message body:  subscribe snmpv3

            Chair:      Russ Mundy
                        Trusted Information Systems
            Postal:     3060 Washington Rd
                        Glenwood MD 21738
                        USA
            EMail:      mundy@tislabs.com
            Phone:      +1-301-854-6889

            Co-editor:  David B. Levi
                        SNMP Research, Inc.
            Postal:     3001 Kimberlin Heights Road
                        Knoxville, TN 37920-9716
            EMail:      levi@snmp.com
            Phone:      +1 423 573 1434

            Co-editor:  Paul Meyer
                        Secure Computing Corporation
            Postal:     2675 Long Lake Road
                        Roseville, MN 55113
            EMail:      paul_meyer@securecomputing.com
            Phone:      +1 651 628 1592

            Co-editor:  Bob Stewart
                        Cisco Systems, Inc.
            Postal:     170 West Tasman Drive
                        San Jose, CA 95134-1706
            EMail:      bstewart@cisco.com
            Phone:      +1 603 654 2686"
       DESCRIPTION
           "This MIB module defines MIB objects which provide
            mechanisms to remotely configure the parameters
            used by a proxy forwarding application."
       REVISION    "9808040000Z"
       DESCRIPTION "Clarifications, published as
                    RFC2573."
       REVISION    "9707140000Z"
       DESCRIPTION "The initial revision, published as RFC2273."
       ::= { snmpModules 14 }

   snmpProxyObjects        OBJECT IDENTIFIER ::= { snmpProxyMIB 1 }
   snmpProxyConformance    OBJECT IDENTIFIER ::= { snmpProxyMIB 3 }

   --
   --
   -- The snmpProxyObjects group
   --
   --

   snmpProxyTable OBJECT-TYPE
       SYNTAX      SEQUENCE OF SnmpProxyEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "The table of translation parameters used by proxy forwarder
            applications for forwarding SNMP messages."
       ::= { snmpProxyObjects 2 }

   snmpProxyEntry OBJECT-TYPE
       SYNTAX      SnmpProxyEntry
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "A set of translation parameters used by a proxy forwarder
            application for forwarding SNMP messages.

            Entries in the snmpProxyTable are created and deleted
            using the snmpProxyRowStatus object."
       INDEX { IMPLIED snmpProxyName }
       ::= { snmpProxyTable 1 }

   SnmpProxyEntry ::= SEQUENCE {
       snmpProxyName               SnmpAdminString,
       snmpProxyType               INTEGER,
       snmpProxyContextEngineID    SnmpEngineID,
       snmpProxyContextName        SnmpAdminString,
       snmpProxyTargetParamsIn     SnmpAdminString,
       snmpProxySingleTargetOut    SnmpAdminString,
       snmpProxyMultipleTargetOut  SnmpTagValue,
       snmpProxyStorageType        StorageType,
       snmpProxyRowStatus          RowStatus
   }
   snmpProxyName OBJECT-TYPE
       SYNTAX      SnmpAdminString (SIZE(1..32))
       MAX-ACCESS  not-accessible
       STATUS      current
       DESCRIPTION
           "The locally arbitrary, but unique identifier associated
            with this snmpProxyEntry."
       ::= { snmpProxyEntry 1 }

   snmpProxyType OBJECT-TYPE
       SYNTAX      INTEGER {
                       read(1),
                       write(2),
                       trap(3),
                       inform(4)
                   }
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The type of message that may be forwarded using
            the translation parameters defined by this entry."
       ::= { snmpProxyEntry 2 }

   snmpProxyContextEngineID OBJECT-TYPE
       SYNTAX      SnmpEngineID
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The contextEngineID contained in messages that
            may be forwarded using the translation parameters
            defined by this entry."
       ::= { snmpProxyEntry 3 }

   snmpProxyContextName OBJECT-TYPE
       SYNTAX      SnmpAdminString
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The contextName contained in messages that may be
            forwarded using the translation parameters defined
            by this entry.

            This object is optional, and if not supported, the
            contextName contained in a message is ignored when
            selecting an entry in the snmpProxyTable."
       ::= { snmpProxyEntry 4 }

   snmpProxyTargetParamsIn OBJECT-TYPE

       SYNTAX      SnmpAdminString
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "This object selects an entry in the snmpTargetParamsTable.
            The selected entry is used to determine which row of the
            snmpProxyTable to use for forwarding received messages."
       ::= { snmpProxyEntry 5 }

   snmpProxySingleTargetOut OBJECT-TYPE
       SYNTAX      SnmpAdminString
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "This object selects a management target defined in the
            snmpTargetAddrTable (in the SNMP-TARGET-MIB).  The
            selected target is defined by an entry in the
            snmpTargetAddrTable whose index value (snmpTargetAddrName)
            is equal to this object.

            This object is only used when selection of a single
            target is required (i.e. when forwarding an incoming
            read or write request)."
       ::= { snmpProxyEntry 6 }

   snmpProxyMultipleTargetOut OBJECT-TYPE
       SYNTAX      SnmpTagValue
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "This object selects a set of management targets defined
            in the snmpTargetAddrTable (in the SNMP-TARGET-MIB).

            This object is only used when selection of multiple
            targets is required (i.e. when forwarding an incoming
            notification)."
       ::= { snmpProxyEntry 7 }

   snmpProxyStorageType OBJECT-TYPE
       SYNTAX      StorageType
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The storage type of this conceptual row."
       DEFVAL { nonVolatile }
       ::= { snmpProxyEntry 8 }

   snmpProxyRowStatus OBJECT-TYPE

       SYNTAX      RowStatus
       MAX-ACCESS  read-create
       STATUS      current
       DESCRIPTION
           "The status of this conceptual row.

            To create a row in this table, a manager must
            set this object to either createAndGo(4) or
            createAndWait(5).

            The following objects may not be modified while the
            value of this object is active(1):
                - snmpProxyType
                - snmpProxyContextEngineID
                - snmpProxyContextName
                - snmpProxyTargetParamsIn
                - snmpProxySingleTargetOut
                - snmpProxyMultipleTargetOut"
       ::= { snmpProxyEntry 9 }

   --
   --
   -- Conformance information
   --
   --

   snmpProxyCompliances OBJECT IDENTIFIER ::=
                                            { snmpProxyConformance 1 }
   snmpProxyGroups      OBJECT IDENTIFIER ::=
                                            { snmpProxyConformance 2 }

   --
   --
   -- Compliance statements
   --
   --

   snmpProxyCompliance MODULE-COMPLIANCE
       STATUS      current
       DESCRIPTION
           "The compliance statement for SNMP entities which include
            a proxy forwarding application."
       MODULE SNMP-TARGET-MIB
           MANDATORY-GROUPS { snmpTargetBasicGroup,
                              snmpTargetResponseGroup }
       MODULE -- This Module
           MANDATORY-GROUPS { snmpProxyGroup }
       ::= { snmpProxyCompliances 1 }

   snmpProxyGroup OBJECT-GROUP
       OBJECTS {
           snmpProxyType,
           snmpProxyContextEngineID,
           snmpProxyContextName,
           snmpProxyTargetParamsIn,
           snmpProxySingleTargetOut,
           snmpProxyMultipleTargetOut,
           snmpProxyStorageType,
           snmpProxyRowStatus
       }
       STATUS      current
       DESCRIPTION
           "A collection of objects providing remote configuration of
            management target translation parameters for use by
            proxy forwarder applications."
       ::= { snmpProxyGroups 3 }

   END

5. Identification of Management Targets in Notification Originators 🎯💜

Okay so this section is all about how a notification originator app figures out which management targets to send its notifications to. Main character energy, literally. 🦋

A notification originator goes through each entry in the snmpNotifyTable to find its targets. Each active entry in that table picks out zero or more entries in the snmpTargetAddrTable. Any snmpTargetAddrTable entry whose snmpTargetAddrTagList contains a tag value that matches a value of snmpNotifyTag gets selected by the snmpNotifyEntry holding that snmpNotifyTag instance. ngl that's a whole tag-matching glow-up. ✨ Also, a single snmpTargetAddrEntry can get picked by multiple snmpNotifyTable entries, which means that target can end up receiving multiple notifications. 🌸

Each snmpTargetAddrEntry has a pointer into the snmpTargetParamsTable (that's snmpTargetAddrParams). That pointer picks out a set of SNMP parameters used to generate notifications. If the selected entry in the snmpTargetParamsTable doesn't exist, then the management target is not used to generate notifications. 💀 No entry, no notification, periodt.

Now, whether a notification should be an Unconfirmed-Class PDU or a Confirmed-Class PDU is decided by the value of snmpNotifyType. If that value is trap(1), the notification should contain an Unconfirmed-Class PDU. 🎀

If the value is inform(2), then the notification should contain a Confirmed-Class PDU, and the timeout time and number of retries for that notification come from snmpTargetAddrTimeout and snmpTargetAddrRetryCount. 🫶

BUT there's an exception, bestie 👑: when the snmpTargetParamsMPModel object indicates an SNMP version that supports a different PDU version, the notification may be sent using a different PDU type. For example, [COEX] defines the PDU type for when the outgoing SNMP version is SNMPv1. 🧚

6. Notification Filtering ✨

okay bestie, this section is all about how a notification originator app uses this MIB to filter what it sends 🎀 the main tool for the job is the snmpNotifyFilterTable 💅

a notification filter profile can be attached to a particular entry in the snmpTargetParamsTable. the profile gets found in the snmpNotifyFilterProfileTable, using an entry whose index equals the index of that snmpTargetParamsTable entry. if there's no entry like that in the snmpNotifyFilterProfileTable, then no filtering happens for that management target 🙈

if there IS an entry, then its snmpNotifyFilterProfileName value gets compared with the matching part of the index on every active entry in the snmpNotifyFilterTable. every entry where that comparison is an exact match gets used to filter notifications generated with the associated snmpTargetParamsEntry. if no entries match, then no filtering is performed and a notification may be sent to the management target 🦋

otherwise, if matching entries do exist, a notification may be sent only if its NOTIFICATION-TYPE OBJECT IDENTIFIER is specifically included. that's the value in the variable binding whose name is snmpTrapOID.0, aka the second variable binding 🌸 and none of the object instances going into the notification's variable-bindings can be specifically excluded by the matching entries 😭

each set of snmpNotifyFilterTable entries gets split into two collections of filter subtrees: the included filter subtrees and the excluded filter subtrees. the snmpNotifyFilterType object is what decides which collection each matching entry lands in ✨

to figure out whether a notification name or an object instance is excluded by the matching entries, compare its OBJECT IDENTIFIER with each matching entry. for a notification name, if none of them match, the notification name is considered excluded, and the notification should not be sent to this management target 💀 for an object instance, if none match, the object instance is considered included, and the notification may be sent to this management target 🧚 if one or more match, the name or object instance is included or excluded based on the snmpNotifyFilterType value in the entry with the most sub-identifiers in its snmpNotifyFilterSubtree value. if multiple entries match and they have the same number of sub-identifiers, then the lexicographically greatest snmpNotifyFilterType among the matching ones decides it 👑

so when does an OBJECT IDENTIFIER X match an entry in the snmpNotifyFilterTable? it matches when X has at least as many sub-identifiers as the entry's snmpNotifyFilterSubtree value, and each sub-identifier in that subtree matches its counterpart in X. two sub-identifiers match if the corresponding bit of snmpNotifyFilterMask is zero (the 'wild card' value), or if the two sub-identifiers are equal 🍓

7. Management Target Translation in Proxy Forwarder Applications 🦋

this section covers how a proxy forwarder app uses this MIB to turn incoming management target info into outgoing management target info so it can forward messages 💖 there are actually two different mechanisms a proxy forwarder can use: one for forwarding request messages, and one for forwarding notification messages 🫶

7.1. Management Target Translation for Request Forwarding

when forwarding request messages, the proxy forwarder picks a single entry in the snmpProxyTable. to pick it, it runs these comparisons:

  • the snmpProxyType must be read(1) if the request is a Read-Class PDU. the snmpProxyType must be write(2) if the request is a Write-Class PDU.
  • the contextEngineID must equal the snmpProxyContextEngineID object.
  • if the snmpProxyContextName object is supported, it must equal the contextName.
  • the snmpProxyTargetParamsIn object identifies an entry in the snmpTargetParamsTable. the messageProcessingModel, securityLevel, security model, and securityName must match the values of snmpTargetParamsMPModel, snmpTargetParamsSecurityModel, snmpTargetParamsSecurityName, and snmpTargetParamsSecurityLevel of the identified entry in the snmpTargetParamsTable.

there might be multiple snmpProxyTable entries where these comparisons succeed. the proxy forwarder will select the one whose snmpProxyName has the lexicographically smallest value out of the ones that succeeded 🌈

the outgoing management target info is identified by the snmpProxySingleTargetOut object of the selected entry. that object points to an entry in the snmpTargetAddrTable, and that entry has a reference to the snmpTargetParamsTable (snmpTargetAddrParams). if either the snmpTargetAddrTable entry or the snmpTargetParamsTable entry doesn't exist, then this snmpProxyEntry doesn't give valid forwarding info, and the proxy forwarder should try to find another row 🙃

if there's no snmpProxyTable entry where all of the conditions above can be met, then there's no appropriate forwarding info, and the proxy forwarder should take appropriate actions 😬

otherwise, the snmpTargetAddrTDomain, snmpTargetAddrTAddress, snmpTargetAddrTimeout, and snmpTargetRetryCount of the identified snmpTargetAddrEntry, plus the snmpTargetParamsMPModel, snmpTargetParamsSecurityModel, snmpTargetParamsSecurityName, and snmpTargetParamsSecurityLevel of the identified snmpTargetParamsEntry, are used as the destination management target 🎯

7.2. Management Target Translation for Notification Forwarding

when forwarding notification messages, the proxy forwarder picks multiple entries in the snmpProxyTable instead of just one. to pick them, it runs these comparisons:

  • the snmpProxyType must be trap(3) if the notification is an Unconfirmed-Class PDU. the snmpProxyType must be inform(4) if the request is a Confirmed-Class PDU.
  • the contextEngineID must equal the snmpProxyContextEngineID object.
  • if the snmpProxyContextName object is supported, it must equal the contextName.
  • the snmpProxyTargetParamsIn object identifies an entry in the snmpTargetParamsTable. the messageProcessingModel, securityLevel, security model, and securityName must match the values of snmpTargetParamsMPModel, snmpTargetParamsSecurityModel, snmpTargetParamsSecurityName, and snmpTargetParamsSecurityLevel of the identified entry in the snmpTargetParamsTable.

every entry that meets these conditions gets selected 🎉 the snmpProxyMultipleTargetOut object of each one is then used to pick a set of entries in the snmpTargetAddrTable. any snmpTargetAddrEntry whose snmpTargetAddrTagList object contains a tag value equal to the value of snmpProxyMultipleTargetOut, and whose snmpTargetAddrParams object points to an existing entry in the snmpTargetParamsTable, gets selected as a destination for the forwarded notification 💜

8. Intellectual Property 📜

okay, quick legal-ish moment 🧐 the IETF doesn't take a position on whether any intellectual property or other rights that someone claims about the tech in this document are valid or in scope, or whether any license for those rights is available. it also doesn't say it's looked for any such rights. info about the IETF's procedures for rights in standards-track and standards-related docs is in BCP-11. copies of claimed rights made available for publication, assurances of licenses to be made available, or the results of attempts to get a general license or permission for implementers or users of this spec can all be requested from the IETF Secretariat 📎

the IETF also invites any interested party to let it know about any copyrights, patents, patent applications, or other proprietary rights that might cover technology required to practice this standard. send that info to the IETF Executive Director 💌

9. Acknowledgments 🙌

this document came out of the work of the SNMPv3 Working Group, and a big shoutout is due to these SNMPv3 WG members 🫶

  • Harald Tveit Alvestrand (Maxware)
  • Dave Battle (SNMP Research, Inc.)
  • Alan Beard (Disney Worldwide Services)
  • Paul Berrevoets (SWI Systemware/Halcyon Inc.)
  • Martin Bjorklund (Ericsson)
  • Uri Blumenthal (IBM T.J. Watson Research Center)
  • Jeff Case (SNMP Research, Inc.)
  • John Curran (BBN)
  • Mike Daniele (Compaq Computer Corporation)
  • T. Max Devlin (Eltrax Systems)
  • John Flick (Hewlett Packard)
  • Rob Frye (MCI)
  • Wes Hardaker (U.C.Davis, Information Technology - D.C.A.S.)
  • David Harrington (Cabletron Systems Inc.)
  • Lauren Heintz (BMC Software, Inc.)
  • N.C. Hien (IBM T.J. Watson Research Center)
  • Michael Kirkham (InterWorking Labs, Inc.)
  • Dave Levi (SNMP Research, Inc.)
  • Louis A Mamakos (UUNET Technologies Inc.)
  • Joe Marzot (Nortel Networks)
  • Paul Meyer (Secure Computing Corporation)
  • Keith McCloghrie (Cisco Systems)
  • Bob Moore (IBM)
  • Russ Mundy (TIS Labs at Network Associates)
  • Bob Natale (ACE*COMM Corporation)
  • Mike O'Dell (UUNET Technologies Inc.)
  • Dave Perkins (DeskTalk)
  • Peter Polkinghorne (Brunel University)
  • Randy Presuhn (BMC Software, Inc.)
  • David Reeder (TIS Labs at Network Associates)
  • David Reid (SNMP Research, Inc.)
  • Aleksey Romanov (Quality Quorum)
  • Shawn Routhier (Epilogue)
  • Juergen Schoenwaelder (TU Braunschweig)
  • Bob Stewart (Cisco Systems)
  • Mike Thatcher (Independent Consultant)
  • Bert Wijnen (IBM T.J. Watson Research Center)

the document is based on recommendations from the IETF Security and Administrative Framework Evolution for SNMP Advisory Team 🧠 the members of that Advisory Team were:

  • David Harrington (Cabletron Systems Inc.)
  • Jeff Johnson (Cisco Systems)
  • David Levi (SNMP Research Inc.)
  • John Linn (Openvision)
  • Russ Mundy (Trusted Information Systems) chair
  • Shawn Routhier (Epilogue)
  • Glenn Waters (Nortel)
  • Bert Wijnen (IBM T. J. Watson Research Center)

as the Advisory Team and the SNMPv3 Working Group Charter recommended, the design pulls in as much as is practical from previous RFCs and drafts 📚 so special thanks go to the authors of the earlier designs known as SNMPv2u and SNMPv2* 💕

  • Jeff Case (SNMP Research, Inc.)
  • David Harrington (Cabletron Systems Inc.)
  • David Levi (SNMP Research, Inc.)
  • Keith McCloghrie (Cisco Systems)
  • Brian O'Keefe (Hewlett Packard)
  • Marshall T. Rose (Dover Beach Consulting)
  • Jon Saperia (BGS Systems Inc.)
  • Steve Waldbusser (International Network Services)
  • Glenn W. Waters (Bell-Northern Research Ltd.)

10. Security Considerations 🔐✨

okay bestie, this section is SERIOUS but make it cute 🎀. The SNMP applications in this document usually have direct access to MIB instrumentation, so it is very important that these applications are strict about applying access control as described in this document 💅. No cap, this is the main character moment of the whole security section 👑.

There may also be some types of notification generator applications that don't use access control to reach MIB instrumentation, and instead get MIB information some other way (like from a command line) 💻. The implementors and users of those applications have to be responsible for not divulging MIB information that would normally be inaccessible due to access control 🙈. Not me getting all protective, but yes 😭.

Finally, the MIBs described in this document contain potentially sensitive information 🫣. A security administrator may want to limit access to these MIBs 🔒. Literally lock it down, periodt 💖.

11. References 📚

[COEX]

The SNMPv3 Working Group, Frye, R., Levi, D., Wijnen, B., "Coexistence between Version 1, Version 2, and Version 3 of the Internet-standard Network Management Framework", Work in Progress. 🌸

[RFC1157]

Case, J., Fedor, M., Schoffstall, M. and J. Davin, "Simple Network Management Protocol", STD 15, RFC 1157, May 1990. 🦋

[RFC1213]

McCloghrie, K. and M. Rose, Editors, "Management Information Base for Network Management of TCP/IP-based internets: MIB-II", STD 17, RFC 1213, March 1991. 🧚

[RFC2578]

McCloghrie, K., Perkins, D. and J. Schoenwaelder, "Structure of Management Information Version 2 (SMIv2)", STD 58, RFC 2578, April 1999. 💜

[RFC2579]

McCloghrie, K., Perkins, D. and J. Schoenwaelder, "Textual Conventions for SMIv2", STD 58, RFC 2579, April 1999. ✨

[RFC1905]

SNMPv2 Working Group, Case, J., McCloghrie, K., Rose, M. and S. Waldbusser, "Protocol Operations for Version 2 of the Simple Network Management Protocol (SNMPv2)", RFC1905, January 1996. 🍓

[RFC1907]

SNMPv2 Working Group, Case, J., McCloghrie, K., Rose, M. and S. Waldbusser, "Management Information Base for Version 2 of the Simple Network Management Protocol (SNMPv2)", RFC1905, January 1996. 🌈

[RFC1908]

SNMPv2 Working Group, Case, J., McCloghrie, K., Rose, M. and S. Waldbusser, "Coexistence between Version 1 and Version 2 of the Internet-standard Network Management Framework", RFC1905, January 1996. 🫶

[RFC2119]

Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC2119, March 1997. 👑

[RFC2571]

Harrington, D., Presuhn, R. and B. Wijnen, "An Architecture for Describing SNMP Management Frameworks", RFC 2571, April 1999. 🔥

[RFC2572]

Case, J., Harrington, D., Presuhn, R. and B. Wijnen, "Message Processing and Dispatching for the Simple Network Management Protocol (SNMP)", RFC 2572, April 1999. 🎀

[RFC2575]

Wijnen, B., Presuhn, R. and K. McCloghrie, "View-based Access Control Model for the Simple Network Management Protocol (SNMP)", RFC 2575, April 1999. 💅

[RFC2573]

Levi, D. B., Meyer, P. and B. Stewart, "SNMP Applications", RFC 2573, April 1999. 🌸

12. Editors' Addresses 💌

David B. Levi SNMP Research, Inc. 3001 Kimberlin Heights Road Knoxville, TN 37920-9716 U.S.A.

Phone: +1 423 573 1434 EMail: levi@snmp.com

Paul Meyer Secure Computing Corporation 2675 Long Lake Road Roseville, MN 55113 U.S.A.

Phone: +1 651 628 1592 EMail: paul_meyer@securecomputing.com

Bob Stewart Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 U.S.A.

Phone: +1 603 654 2686 EMail: bstewart@cisco.com

APPENDIX A - Trap Configuration Example 🎀

This section describes an example configuration for a Notification Generator application which implements the snmpNotifyBasicCompliance level. The example configuration specifies that the Notification Generator should send notifications to 3 separate managers, using authentication and no privacy for the first 2 managers, and using both authentication and privacy for the third manager. ✨

The configuration consists of three rows in the snmpTargetAddrTable, and two rows in the snmpTargetTable. 🦋

       snmpTargetAddrName         SnmpAdminString,
       snmpTargetAddrTDomain      TDomain,
       snmpTargetAddrTAddress     TAddress,
       snmpTargetAddrTimeout      TimeInterval,
       snmpTargetAddrRetryCount   Integer32,
       snmpTargetAddrTagList      SnmpAdminString,
       snmpTargetAddrParams       SnmpAdminString,
       snmpTargetAddrStorageType  StorageType,
       snmpTargetAddrRowStatus    RowStatus

     * snmpTargetAddrName        = "addr1"
       snmpTargetAddrTDomain     = snmpUDPDomain
       snmpTargetAddrTAddress    = 128.1.2.3/162
       snmpTargetAddrTagList     = "group1"
       snmpTargetAddrParams      = "AuthNoPriv-joe"
       snmpTargetAddrStorageType = readOnly(5)
       snmpTargetAddrRowStatus   = active(1)

     * snmpTargetAddrName        = "addr2"
       snmpTargetAddrTDomain     = snmpUDPDomain
       snmpTargetAddrTAddress    = 128.2.4.6/162
       snmpTargetAddrTagList     = "group1"
       snmpTargetAddrParams      = "AuthNoPriv-joe"
       snmpTargetAddrStorageType = readOnly(5)
       snmpTargetAddrRowStatus   = active(1)

     * snmpTargetAddrName        = "addr3"
       snmpTargetAddrTDomain     = snmpUDPDomain
       snmpTargetAddrTAddress    = 128.1.2.3/162
       snmpTargetAddrTagList     = "group2"
       snmpTargetAddrParams      = "AuthPriv-bob"
       snmpTargetAddrStorageType = readOnly(5)
       snmpTargetAddrRowStatus   = active(1)

     * snmpTargetParamsName                   = "AuthNoPriv-joe"
       snmpTargetParamsMPModel                = 3m
       snmpTargetParamsSecurityModel          = 3 (USM)
       snmpTargetParamsSecurityName           = "joe"
       snmpTargetParamsSecurityLevel          = authNoPriv(2)
       snmpTargetParamsStorageType            = readOnly(5)
       snmpTargetParamsRowStatus              = active(1)

     * snmpTargetParamsName                   = "AuthPriv-bob"
       snmpTargetParamsMPModel                = 3
       snmpTargetParamsSecurityModel          = 3 (USM)
       snmpTargetParamsSecurityName           = "bob"
       snmpTargetParamsSecurityLevel          = authPriv(3)
       snmpTargetParamsStorageType            = readOnly(5)
       snmpTargetParamsRowStatus              = active(1)

     * snmpNotifyName         = "group1"
       snmpNotifyTag          = "group1"
       snmpNotifyType         = trap(1)
       snmpNotifyStorageType  = readOnly(5)
       snmpNotifyRowStatus    = active(1)

     * snmpNotifyName         = "group2"
       snmpNotifyTag          = "group2"
       snmpNotifyType         = trap(1)
       snmpNotifyStorageType  = readOnly(5)
       snmpNotifyRowStatus    = active(1)

These entries define two groups of management targets. The first group contains two management targets: 🌷

                             first target      second target
                             ------------      -------------
    messageProcessingModel   SNMPv3            SNMPv3
             securityModel   3 (USM)           3 (USM)
              securityName   "joe"             "joe"
             securityLevel   authNoPriv(2)     authNoPriv(2)
           transportDomain   snmpUDPDomain     snmpUDPDomain
          transportAddress   128.1.2.3/162     128.2.4.6/162

And the second group contains a single management target: 🧚

    messageProcessingModel   SNMPv3
             securityLevel   authPriv(3)
             securityModel   3 (USM)
              securityName   "bob"
           transportDomain   snmpUDPDomain
          transportAddress   128.1.5.9/162

Copyright (C) The Internet Society (1999). All Rights Reserved. 💖

This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English. 🌈

The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns. 🫶

This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 💅

Acknowledgement 🌸

Funding for the RFC Editor function is currently provided by the Internet Society. ✨

📦 where this page comes from