RFC 3417

Transport Mappings for the Simple Network Management Protocol (SNMP)

πŸ“… published December 2002, from ietf

RFC 3417: Transport Mappings for the Simple Network Management Protocol (SNMP) πŸŽ€

Okay bestie, this one is from the Network Working Group, and it's a Standards Track doc (it's also STD 62 πŸ’…), dated December 2002. R. Presuhn of BMC Software, Inc. is the editor of this version. The authors of the previous version were J. Case (SNMP Research, Inc.), K. McCloghrie (Cisco Systems, Inc.), M. Rose (Dover Beach Consulting, Inc.), and S. Waldbusser (International Network Services). It obsoletes RFC 1906, and that's the only thing it lists under obsoletes πŸ‘‹.


Status of this Memo πŸ“œ

This doc is an Internet standards track protocol for the Internet community, and it's asking for discussion and suggestions for improvements πŸ’¬. For the standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1) πŸ“–. Distribution of this memo is unlimited 🌸.

Copyright (C) The Internet Society (2002). All Rights Reserved.

Abstract ✨

TL;DR: this doc defines how Simple Network Management Protocol (SNMP) messages get transported over various protocols πŸš€. It obsoletes RFC 1906, so RFC 1906 is officially retired 🫑.

Table of Contents πŸ’–

   1. Introduction ................................................    2
   2. Definitions .................................................    3
   3. SNMP over UDP over IPv4 .....................................    7
   3.1. Serialization .............................................    7
   3.2. Well-known Values .........................................    7
   4. SNMP over OSI ...............................................    7
   4.1. Serialization .............................................    7
   4.2. Well-known Values .........................................    8
   5. SNMP over DDP ...............................................    8
   5.1. Serialization .............................................    8
   5.2. Well-known Values .........................................    8
   5.3. Discussion of AppleTalk Addressing ........................    9
   5.3.1. How to Acquire NBP names ................................    9
   5.3.2. When to Turn NBP names into DDP addresses ...............   10
   5.3.3. How to Turn NBP names into DDP addresses ................   10
   5.3.4. What if NBP is broken ...................................   10
   6. SNMP over IPX ...............................................   11
   6.1. Serialization .............................................   11
   6.2. Well-known Values .........................................   11
   7. Proxy to SNMPv1 .............................................   12
   8. Serialization using the Basic Encoding Rules ................   12
   8.1. Usage Example .............................................   13
   9. Notice on Intellectual Property .............................   14
   10. Acknowledgments ............................................   14
   11. IANA Considerations ........................................   15
   12. Security Considerations ....................................   16
   13. References .................................................   16
   13.1. Normative References .....................................   16
   13.2. Informative References ...................................   17
   14. Changes from RFC 1906 ......................................   18
   15. Editor's Address ...........................................   18
   16. Full Copyright Statement ...................................   19

1. Introduction ✨

If you want the big-picture tour of the Internet-Standard Management Framework docs, go read section 7 of RFC 3410 [RFC3410] πŸ“š.

Managed objects live in a virtual information store called the Management Information Base, or MIB πŸ—‚οΈ. You usually reach them through the Simple Network Management Protocol (SNMP). Objects in the MIB get defined with the Structure of Management Information (SMI). This memo has a MIB module that's compliant with SMIv2, which is described in STD 58, RFC 2578 [RFC2578], STD 58, RFC 2579 [RFC2579] and STD 58, RFC 2580 [RFC2580].

This doc, Transport Mappings for the Simple Network Management Protocol, explains how the management protocol [RFC3416] can be carried over a variety of protocol suites πŸ¦‹. Its whole job is mapping SNMP onto an initial set of transport domains. When this was written, an IPv6 mapping was in progress and described in [RFC3419]. Other mappings could be defined in the future ✨.

Even though several mappings are defined, the mapping onto UDP over IPv4 is the preferred mapping for systems that support IPv4 πŸ’œ. Systems implementing IPv4 MUST implement the mapping onto UDP over IPv4. For max interoperability, systems supporting other mappings SHOULD also provide for access via the UDP over IPv4 mapping 🫢.

Quick decoder ring: the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14, RFC 2119 [RFC2119] πŸŽ€.

2. Definitions 🧚

Here's the actual MIB module, copied exactly, because every space counts πŸ™ˆ.

   SNMPv2-TM DEFINITIONS ::= BEGIN

   IMPORTS
       MODULE-IDENTITY, OBJECT-IDENTITY,
       snmpModules, snmpDomains, snmpProxys
           FROM SNMPv2-SMI
       TEXTUAL-CONVENTION
           FROM SNMPv2-TC;

   snmpv2tm MODULE-IDENTITY
       LAST-UPDATED "200210160000Z"
       ORGANIZATION "IETF SNMPv3 Working Group"
       CONTACT-INFO
               "WG-EMail:   snmpv3@lists.tislabs.com
                Subscribe:  snmpv3-request@lists.tislabs.com

                Co-Chair:   Russ Mundy
                            Network Associates Laboratories
                postal:     15204 Omega Drive, Suite 300
                            Rockville, MD 20850-4601
                            USA
                EMail:      mundy@tislabs.com
                phone:      +1 301 947-7107
                Co-Chair:   David Harrington
                            Enterasys Networks
                postal:     35 Industrial Way
                            P. O. Box 5005
                            Rochester, NH 03866-5005
                            USA
                EMail:      dbh@enterasys.com
                phone:      +1 603 337-2614

                Editor:     Randy Presuhn
                            BMC Software, Inc.
                postal:     2141 North First Street
                            San Jose, CA 95131
                            USA
                EMail:      randy_presuhn@bmc.com
                phone:      +1 408 546-1006"
       DESCRIPTION
               "The MIB module for SNMP transport mappings.

                Copyright (C) The Internet Society (2002). This
                version of this MIB module is part of RFC 3417;
                see the RFC itself for full legal notices.
               "
       REVISION     "200210160000Z"
       DESCRIPTION
               "Clarifications, published as RFC 3417."
       REVISION    "199601010000Z"
       DESCRIPTION
               "Clarifications, published as RFC 1906."
       REVISION    "199304010000Z"
       DESCRIPTION
               "The initial version, published as RFC 1449."
       ::= { snmpModules 19 }

   -- SNMP over UDP over IPv4

   snmpUDPDomain  OBJECT-IDENTITY
       STATUS     current
       DESCRIPTION
               "The SNMP over UDP over IPv4 transport domain.
               The corresponding transport address is of type
               SnmpUDPAddress."
       ::= { snmpDomains 1 }

   SnmpUDPAddress ::= TEXTUAL-CONVENTION
       DISPLAY-HINT "1d.1d.1d.1d/2d"
       STATUS       current
       DESCRIPTION
               "Represents a UDP over IPv4 address:

                  octets   contents        encoding
                   1-4     IP-address      network-byte order
                   5-6     UDP-port        network-byte order
               "
       SYNTAX       OCTET STRING (SIZE (6))

   -- SNMP over OSI

   snmpCLNSDomain OBJECT-IDENTITY
       STATUS     current
       DESCRIPTION
               "The SNMP over CLNS transport domain.
               The corresponding transport address is of type
               SnmpOSIAddress."
       ::= { snmpDomains 2 }

   snmpCONSDomain OBJECT-IDENTITY
       STATUS     current
       DESCRIPTION
               "The SNMP over CONS transport domain.
               The corresponding transport address is of type
               SnmpOSIAddress."
       ::= { snmpDomains 3 }

   SnmpOSIAddress ::= TEXTUAL-CONVENTION
       DISPLAY-HINT "*1x:/1x:"
       STATUS       current
       DESCRIPTION
               "Represents an OSI transport-address:

             octets   contents           encoding
                1     length of NSAP     'n' as an unsigned-integer
                                            (either 0 or from 3 to 20)
             2..(n+1) NSAP                concrete binary representation
             (n+2)..m TSEL                string of (up to 64) octets
               "
       SYNTAX       OCTET STRING (SIZE (1 | 4..85))

   -- SNMP over DDP

   snmpDDPDomain  OBJECT-IDENTITY
       STATUS     current
       DESCRIPTION
               "The SNMP over DDP transport domain.  The corresponding
               transport address is of type SnmpNBPAddress."
       ::= { snmpDomains 4 }

   SnmpNBPAddress ::= TEXTUAL-CONVENTION
       STATUS       current
       DESCRIPTION
               "Represents an NBP name:

            octets        contents          encoding
               1          length of object  'n' as an unsigned integer
             2..(n+1)     object            string of (up to 32) octets
              n+2         length of type    'p' as an unsigned integer
         (n+3)..(n+2+p)   type              string of (up to 32) octets
             n+3+p        length of zone    'q' as an unsigned integer
       (n+4+p)..(n+3+p+q) zone              string of (up to 32) octets

               For comparison purposes, strings are
               case-insensitive. All strings may contain any octet
               other than 255 (hex ff)."
       SYNTAX       OCTET STRING (SIZE (3..99))

   -- SNMP over IPX

   snmpIPXDomain  OBJECT-IDENTITY
       STATUS     current
       DESCRIPTION
               "The SNMP over IPX transport domain.  The corresponding
               transport address is of type SnmpIPXAddress."
       ::= { snmpDomains 5 }

   SnmpIPXAddress ::= TEXTUAL-CONVENTION
       DISPLAY-HINT "4x.1x:1x:1x:1x:1x:1x.2d"
       STATUS       current
       DESCRIPTION
               "Represents an IPX address:

                  octets   contents            encoding
                   1-4     network-number      network-byte order
                   5-10    physical-address    network-byte order
                  11-12    socket-number       network-byte order
               "
       SYNTAX       OCTET STRING (SIZE (12))

   -- for proxy to SNMPv1 (RFC 1157)

   rfc1157Proxy   OBJECT IDENTIFIER ::= { snmpProxys 1 }

   rfc1157Domain  OBJECT-IDENTITY
       STATUS     deprecated
       DESCRIPTION
               "The transport domain for SNMPv1 over UDP over IPv4.
               The corresponding transport address is of type
               SnmpUDPAddress."
       ::= { rfc1157Proxy 1 }

   --  ::= { rfc1157Proxy 2 }            this OID is obsolete

   END

3. SNMP over UDP over IPv4 ✨

okay so this one is the preferred transport mapping, bestie πŸŽ€ it's the main character of the whole SNMP transport lineup πŸ‘‘

3.1. Serialization

every message instance gets encoded (per the [BER] rules) and tucked into a single UDP [RFC768] datagram riding over IPv4 [RFC791] πŸ“¦ the encoding follows the algorithm in Section 8, so go check that one too πŸ¦‹

3.2. Well-known Values

the spec suggests that admins set their SNMP entities running command responder apps to listen on UDP port 161 🌸 and entities running notification receiver apps should listen on UDP port 162 πŸ””

when an SNMP entity uses this mapping, it must be able to accept messages up to and including 484 octets in size 🫢 it's recommended that implementations accept messages up to 1472 octets, and bigger sizes are encouraged whenever possible πŸ’… go big or go home fr fr πŸ”₯

4. SNMP over OSI

this one is an optional transport mapping 🧚 totally valid, just not required

4.1. Serialization

each message instance gets serialized into a single TSDU [IS8072] [IS8072A] for the OSI Connectionless-mode Transport Service (CLTS) 🌈 and the algorithm is the one from Section 8, same as always πŸ’œ

4.2. Well-known Values

the suggestion here is for admins to set command responder entities to listen on transport selector snmp-l (that's six ASCII characters πŸ“) when they're using a CL-mode network service to realize the CLTS ✨ notification receiver entities should listen on transport selector snmpt-l instead (seven ASCII characters, six letters and a hyphen, so iconic πŸ’€), again over a CL-mode network service πŸ¦‹

if you're using a CO-mode network service to realize the CLTS, the suggested selectors are snmp-o for command responders and snmpt-o for notification receivers πŸŽ€

when an SNMP entity uses this mapping, it must be able to accept messages that are at least 484 octets in size 🌸 bigger values are encouraged whenever possible πŸ’–

5. SNMP over DDP

also an optional transport mapping πŸ¦‹ this is the AppleTalk one, and it's giving vintage πŸ“Ό

5.1. Serialization

each message instance gets serialized onto a single DDP datagram [APPLETALK], and the algorithm is the one in Section 8 🫢

5.2. Well-known Values

SNMP messages go out using DDP protocol type 8 πŸŽ€ command responder entities listen on DDP socket number 8, and notification receiver entities listen on DDP socket number 9 πŸ””

admins must configure command responder entities to use NBP type SNMP Agent (ten ASCII characters πŸ“), while notification receiver entities must be configured to use NBP type SNMP Trap Handler (seventeen ASCII characters, very dramatic 😭)

the NBP name for command responders and notification receivers should be stable πŸͺ¨ NBP names shouldn't change any more often than the IP address of a typical TCP/IP node does πŸ™ˆ it's suggested that the NBP name get stored in some form of stable storage πŸ’Ύ

when an SNMP entity uses this mapping, it must be able to accept messages that are at least 484 octets in size πŸ’… larger values are encouraged whenever possible ✨

5.3. Discussion of AppleTalk Addressing

okay the AppleTalk suite has some features TCP/IP doesn't 🍎 its naming strategy and the dynamic way addresses get assigned can cause real problems for SNMP entities trying to manage AppleTalk networks πŸ˜΅β€πŸ’«

TCP/IP nodes each have an IP address that tells them apart 🌐 AppleTalk nodes usually don't have anything like that πŸ™ƒ the network-level address might be pretty stable, but it can change at every reboot, or even more often πŸ’€

so when SNMP runs over DDP, nodes get identified by a "name" instead of an "address" 🧚 that means every AppleTalk node implementing this mapping is required to respond to NBP lookups and confirms (aka implement the NBP protocol stub) 🫢 that guarantees a mapping from NBP name to DDP address will always be possible πŸ”₯

when figuring out the SNMP identity to register for an SNMP entity, it's suggested that the SNMP identity be a name associated with other network services the machine offers πŸŽ€

NBP lookups map NBP names into DDP addresses, but they can cause a lot of network traffic and eat up CPU resources πŸ™ˆ the NBP lookup is also sensitive to certain network disruptions (like zone table inconsistencies) that wouldn't stop direct AppleTalk communication between two SNMP entities 😀

so it's recommended that NBP lookups be used infrequently, mainly to build a cache of name-to-address mappings πŸ’œ those cached mappings should then be used for any further SNMP traffic 🌸 SNMP entities running command generator apps should keep this cache between reboots πŸ’Ύ caching helps cut network traffic, lowers CPU load on the network, and allows for (some amount of) network trouble shooting when the basic name-to-address translation is broken πŸ”§

5.3.1. How to Acquire NBP names

an SNMP entity running command generator apps might have a pre-configured list of names for "known" SNMP entities running command responder apps πŸ“‹ an entity running command generator or notification receiver apps might also interact with an operator πŸ§‘β€πŸ’» and finally, an entity running command generator or notification receiver apps might communicate with all SNMP entities running command responder or notification originator apps in a set of zones or networks 🌈

5.3.2. When to Turn NBP names into DDP addresses

when an SNMP entity uses a cache entry to address an SNMP packet, it should try to confirm that mapping is still valid, if it hasn't been confirmed within the last T1 seconds ⏰ this cache entry lifetime, T1, has a minimum default value of 60 seconds, and it should be configurable πŸŽ€

an SNMP entity running a command generator app may decide to prime its cache of names before it actually talks to another SNMP entity 🧚 generally, such an entity may want to keep certain mappings "more current" than others πŸ‘‘ e.g., nodes representing the network infrastructure (like routers) may be deemed "more important" πŸ›£οΈ

an entity running command generator apps should not prime its entire cache on initialization πŸ™…β€β™€οΈ instead, it should attempt resolutions over an extended period of time (maybe in some pre-determined or configured priority order) πŸ—“οΈ each of those resolutions might actually be a wildcard lookup in a given zone 🌸

an SNMP entity running command responder apps must never prime its cache 🚫 when generating a response, that entity doesn't need to confirm a cache entry πŸ’… an entity running notification originator apps should do NBP lookups (or confirms) only when it needs to send an SNMP trap or inform πŸ””

5.3.3. How to Turn NBP names into DDP addresses

if the only info available is the NBP name, then an NBP lookup should be performed to turn that name into a DDP address πŸ” but if there's a piece of stale info, it can be used as a hint to do an NBP confirm (which sends a unicast to the network address presumed to be the target of the name lookup) 🎯 that checks whether the stale info is still valid 🫢

an NBP name to DDP address mapping can also be confirmed implicitly using only SNMP transactions 🀯 for example, an entity running command generator apps issuing a retrieval operation could also retrieve the relevant objects from the NBP group [RFC1742] for the entity running the command responder app 🧠 that info can then be correlated with the source DDP address of the response πŸ’–

5.3.4. What if NBP is broken

sometimes there's connectivity between two SNMP entities but the NBP mapping machinery is broken 😭 for example:

  • the NBP FwdReq (forward NBP lookup onto local attached network) mechanism might be broken at a router on the other entity's network; or,
  • the NBP BrRq (NBP broadcast request) mechanism might be broken at a router on the entity's own network; or,
  • NBP might be broken on the other entity's node.

an entity running command generator apps that's dedicated to AppleTalk management might choose to work around some of these failures by directly implementing the router portion of NBP πŸ› οΈ for instance, that entity might already know all the zones on the AppleTalk internet and the networks each zone appears on πŸ—ΊοΈ given an NBP lookup that fails, the entity could send an NBP FwdReq to the network where the SNMP entity running the command responder or notification originator app was last located πŸ“¬ if that fails too, the station could send an NBP LkUp (NBP lookup packet) as a directed (DDP) multicast to each network number on that network πŸ“£ out of those single failures, this combined approach will solve the case where either the local router's BrRq-to-FwdReq mechanism is broken or the remote router's FwdReq-to-LkUp mechanism is broken πŸ™Œ

6. SNMP over IPX

optional transport mapping alert 🧚 it's the IPX one, very early-2000s energy πŸ’Ώ

6.1. Serialization

each message instance gets serialized onto a single IPX datagram [NOVELL], using the algorithm in Section 8 πŸ’œ

6.2. Well-known Values

SNMP messages get sent using IPX packet type 4 (aka Packet Exchange Protocol) πŸ“¨

admins are suggested to set command responder entities to listen on IPX socket 36879 (900f hexadecimal) πŸ”’ entities running notification receiver apps should be configured to listen on IPX socket 36880 (9010 hexadecimal) πŸ””

when an SNMP entity uses this mapping, it must be able to accept messages that are at least 546 octets in size 🫢 bigger values are encouraged whenever possible 🌈

7. Proxy to SNMPv1

okay this section is a little bit of history πŸ“œ to support proxy to SNMPv1 [RFC2576], it was once considered useful to define a transport domain, rfc1157Domain, which indicates the transport mapping for SNMP messages as defined in [RFC1157] πŸ•°οΈβœ¨

8. Serialization using the Basic Encoding Rules ✨

okay so this is the part where we talk about how the bits actually get packed up πŸ“¦ when you use the Basic Encoding Rules [BER]. bestie, pay attention, it's giving precision πŸ’…

(1) Length fields πŸŽ€: when you're encoding the length, you MUST only use the definite form. The indefinite form is prohibited, so don't even go there πŸ™…β€β™€οΈ. ngl, when you're using the definite-long form, you're allowed to use MORE length octets than the minimum needed to encode the length. Extra octets are fine, fr fr 🫢

(2) Value fields πŸ¦‹: for the simple types (INTEGER, OCTET STRING, and OBJECT IDENTIFIER, whether IMPLICIT or explicit), the primitive form SHALL be used. The constructed form is only for the structured types, which means a SEQUENCE or an IMPLICIT SEQUENCE. So simple stuff stays primitive, structured stuff gets constructed, no mixing it up πŸ’–

(3) BITS encoding 🌿: when an object's syntax uses the BITS construct, the value gets encoded as an OCTET STRING. Here's the vibe: you start with the first named bit in the bitstring definition and go to the last one. Those bits go into bits 8 (high order bit) down to 1 (low order bit) of the first octet, then bits 8 to 1 of each following octet in turn, and then as many bits as you need in the final octet, starting at bit 8. Any leftover bits in that final octet are set to zero when you generate them and ignored when you receive them 🌸

These restrictions apply to all aspects of ASN.1 encoding, including the message wrappers, protocol data units, and the data objects they contain. So it's not just one part, it's EVERYTHING πŸ‘‘

8.1. Usage Example 🧚

okay, so let's say you want to encode a GetBulkRequest-PDU [RFC3416] πŸ’œ. Here's what that looks like:

[5] IMPLICIT SEQUENCE {
        request-id      1414684022,
        non-repeaters   1,
        max-repetitions 2,
        variable-bindings {
            { name sysUpTime,
              value { unSpecified NULL } },
            { name ipNetToMediaPhysAddress,
              value { unSpecified NULL } },
            { name ipNetToMediaType,
              value { unSpecified NULL } }
        }
    }

When you apply the BER, it gets encoded in hexadecimal like this πŸ“:

[5] IMPLICIT SEQUENCE          a5 82 00 39
    INTEGER                    02 04 54 52 5d 76
    INTEGER                    02 01 01
    INTEGER                    02 01 02
    SEQUENCE (OF)              30 2b
        SEQUENCE               30 0b
            OBJECT IDENTIFIER  06 07 2b 06 01 02 01 01 03
            NULL               05 00
        SEQUENCE               30 0d
            OBJECT IDENTIFIER  06 09 2b 06 01 02 01 04 16 01 02
            NULL               05 00
        SEQUENCE               30 0d
            OBJECT IDENTIFIER  06 09 2b 06 01 02 01 04 16 01 04
            NULL               05 00

Note that the initial SEQUENCE in this example was NOT encoded using the minimum number of length octets πŸ™ˆ. (The first octet of the length, 82, tells you that the length of the content is encoded in the next two octets.)

9. Notice on Intellectual Property πŸ”₯

The IETF takes no position regarding the validity or scope of any intellectual property or other rights that might be claimed to pertain to the implementation or use of the technology described in this document, or the extent to which any license under such rights might or might not be available. It also doesn't represent that it has made any effort to identify any such rights πŸ€·β€β™€οΈ. Info on the IETF's procedures for rights in standards-track and standards-related documentation can be found in BCP-11. Copies of claims of rights made available for publication, any assurances of licenses to be made available, or the result of an attempt to get a general license or permission for implementors or users of this specification to use such proprietary rights can be obtained from the IETF Secretariat πŸ“¬.

The IETF invites any interested party to bring to its attention any copyrights, patents, patent applications, or other proprietary rights which may cover technology that may be required to practice this standard. Please send that info to the IETF Executive Director πŸ’Œ.

10. Acknowledgments 🌈

This document is the product of the SNMPv3 Working Group πŸ’–. Big thanks to these Working Group members:

  • Randy Bush
  • Jeffrey D. Case
  • Mike Daniele
  • Rob Frye
  • Lauren Heintz
  • Keith McCloghrie
  • Russ Mundy
  • David T. Perkins
  • Randy Presuhn
  • Aleksey Romanov
  • Juergen Schoenwaelder
  • Bert Wijnen

This version, edited by Randy Presuhn, was initially based on the work of a design team whose members were:

  • Jeffrey D. Case
  • Keith McCloghrie
  • David T. Perkins
  • Randy Presuhn
  • Juergen Schoenwaelder

The previous versions, edited by Keith McCloghrie, were the result of significant work by four major contributors:

  • Jeffrey D. Case
  • Keith McCloghrie
  • Marshall T. Rose
  • Steven Waldbusser

The contributions of the SNMPv2 Working Group to the previous versions are also acknowledged 🫢. A special thanks goes to:

  • Alexander I. Alten
  • Dave Arneson
  • Uri Blumenthal
  • Doug Book
  • Kim Curran
  • Jim Galvin
  • Maria Greene
  • Iain Hanson
  • Dave Harrington
  • Nguyen Hien
  • Jeff Johnson
  • Michael Kornegay
  • Deirdre Kostick
  • David Levi
  • Daniel Mahoney
  • Bob Natale
  • Brian O'Keefe
  • Andrew Pearson
  • Dave Perkins
  • Randy Presuhn
  • Aleksey Romanov
  • Shawn Routhier
  • Jon Saperia
  • Juergen Schoenwaelder
  • Bob Stewart
  • Kaj Tesink
  • Glenn Waters
  • Bert Wijnen

11. IANA Considerations πŸ¦‹

The SNMPv2-TM MIB module requires the allocation of a single object identifier for its MODULE-IDENTITY. IANA has allocated this object identifier in the snmpModules subtree, which is defined in the SNMPv2-SMI MIB module ✨.

12. Security Considerations πŸ’€

SNMPv1 by itself is NOT a secure environment 😭. Even if the network itself is secure (for example by using IPSec), there is still no control over who on that secure network is allowed to access and GET/SET (read/change) the objects accessible through a command responder application. Not okay!

It is recommended that implementors consider the security features provided by the SNMPv3 framework πŸ”. Specifically, the use of the User-based Security Model STD 62, RFC 3414 [RFC3414] and the View-based Access Control Model STD 62, RFC 3415 [RFC3415] is recommended.

It is then a customer/user responsibility to make sure the SNMP entity giving access to a MIB is properly configured, so access to the objects is given ONLY to those principals (users) who have legitimate rights to GET or SET (change) them πŸ‘‘.

13. References πŸ“š

13.1. Normative References

  • [BER] Information processing systems - Open Systems Interconnection - Specification of Basic Encoding Rules for Abstract Syntax Notation One (ASN.1), International Organization for Standardization. International Standard 8825, December 1987.
  • [IS8072] Information processing systems - Open Systems Interconnection - Transport Service Definition, International Organization for Standardization. International Standard 8072, June 1986.
  • [IS8072A] Information processing systems - Open Systems Interconnection - Transport Service Definition - Addendum 1: Connectionless-mode Transmission, International Organization for Standardization. International Standard 8072/AD 1, December 1986.
  • [RFC768] Postel, J., "User Datagram Protocol", STD 6, RFC 768, August 1980.
  • [RFC791] Postel, J., "Internet Protocol", STD 5, RFC 791, September 1981.
  • [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
  • [RFC2578] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J., Rose, M. and S. Waldbusser, "Structure of Management Information Version 2 (SMIv2)", STD 58, RFC 2578, April 1999.
  • [RFC2579] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J., Rose, M. and S. Waldbusser, "Textual Conventions for SMIv2", STD 58, RFC 2579, April 1999.
  • [RFC2580] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J., Rose, M. and S. Waldbusser, "Conformance Statements for SMIv2", STD 58, RFC 2580, April 1999.
  • [RFC3414] Blumenthal, U. and B. Wijnen, "The User-Based Security Model (USM) for Version 3 of the Simple Network Management Protocol (SNMPv3)", STD 62, RFC 3414, December 2002.
  • [RFC3415] Wijnen, B., Presuhn, R. and K. McCloghrie, "View-based Access Control Model (VACM) for the Simple Network Management Protocol (SNMP)", STD 62, RFC 3415, December 2002.
  • [RFC3416] Presuhn, R., Case, J., McCloghrie, K., Rose, M. and S. Waldbusser, "Version 2 of the Protocol Operations for the Simple Network Management Protocol (SNMP)", STD 62, RFC 3416, December 2002.

13.2. Informative References

  • [APPLETALK] Sidhu, G., Andrews, R. and A. Oppenheimer, Inside AppleTalk (second edition). Addison-Wesley, 1990.
  • [NOVELL] Network System Technical Interface Overview. Novell, Inc., June 1989.
  • [RFC1157] Case, J., Fedor, M., Schoffstall, M. and J. Davin, "Simple Network Management Protocol", STD 15, RFC 1157, May 1990.
  • [RFC1742] Waldbusser, S. and K. Frisa, "AppleTalk Management Information Base II", RFC 1742, January 1995.
  • [RFC2576] Frye, R., Levi, D., Routhier, S. and B. Wijnen, "Coexistence between Version 1, Version 2, and Version 3 of the Internet-Standard Network Management Framework", RFC 2576, March 2000.
  • [RFC3410] Case, J., Mundy, R., Partain, D. and B. Stewart, "Introduction and Applicability Statements for Internet-Standard Management Framework", RFC 3410, December 2002.
  • [RFC3419] Daniele, M. and J. Schoenwaelder, "Textual Conventions for Transport Addresses", RFC 3419, November 2002.

14. Changes from RFC 1906 🌸

This document differs from RFC 1906 only in editorial improvements. The protocol is unchanged πŸ’œ.

15. Editor's Address πŸ’Œ

Randy Presuhn BMC Software, Inc. 2141 North First Street San Jose, CA 95131 USA

Phone: +1 408 546-1006 EMail: randy_presuhn@bmc.com

Copyright (C) The Internet Society (2002). All Rights Reserved.

Okay so the legal part is giving serious energy, but it's actually pretty chill πŸ’… You're totally allowed to copy this doc and share it with anyone. You can also make derivative works that comment on or explain it or help people implement it, and publish and distribute those, in whole or in part, without any restriction, as long as the copyright notice and this paragraph are on every copy and derivative work. ✨

BUT πŸ›‘ you can't modify this document itself in any way. That means no deleting the copyright notice or the references to the Internet Society or other Internet organizations. The exceptions are if it's needed for developing Internet standards (then the copyright procedures in the Internet Standards process have to be followed) or if you're translating it into a language other than English 🌈

The limited permissions above are perpetual, meaning they will never be revoked by the Internet Society or its successors or assigns. Forever and ever πŸ¦‹πŸ’œ

Now the disclaimer. It's legally important, so here it is word for word 😭

THIS DOCUMENT AND THE INFORMATION CONTAINED HEREIN IS PROVIDED ON AN "AS IS" BASIS AND THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.


Acknowledgement 🫢

Funding for the RFC Editor function is currently provided by the Internet Society. Shoutout to them for keeping the lights on 🌸✨

πŸ“¦ where this page comes from