RFC 3430

Simple Network Management Protocol Over Transmission Control Protocol Transport Mapping

📅 published December 2002, from ietf

RFC 3430: Simple Network Management Protocol (SNMP) over Transmission Control Protocol (TCP) Transport Mapping ✨

Okay bestie, here's the deal 💖 RFC 3430 is an Experimental doc (so not an official Internet standard, just a "let's try this and tell us what you think" kinda thing 🧪). J. Schoenwaelder from TU Braunschweig wrote it, and it dropped in December 2002. Its header doesn't list any RFCs it obsoletes or updates, but the Abstract says it extends the transport mappings from STD 62, RFC 3417. 🦋

Status of this Memo 💅

Okay so, this memo defines an Experimental Protocol for the whole Internet community, and it is NOT an Internet standard of any kind 🙈 The authors are literally asking for discussion and suggestions for improvement. And distribution? Unlimited! Share the tea 🍓

Copyright (C) The Internet Society (2002). All Rights Reserved.

Abstract 💜

This doc is all about a transport mapping for running SNMP over TCP 🎀 It works with any version of SNMP, and it extends the transport mappings from STD 62, RFC 3417, which is giving foundation energy ✨

Table of Contents 🧚

   1.  Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  2
   2.  SNMP over TCP  . . . . . . . . . . . . . . . . . . . . . . . .  2
   2.1 Serialization  . . . . . . . . . . . . . . . . . . . . . . . .  2
   2.2 Well-Known Values  . . . . . . . . . . . . . . . . . . . . . .  3
   2.3 Connection Management  . . . . . . . . . . . . . . . . . . . .  3
   2.4 Reliable Transport versus Confirmed Operations . . . . . . . .  4
   3.  Security Considerations  . . . . . . . . . . . . . . . . . . .  5
   4.  Acknowledgments  . . . . . . . . . . . . . . . . . . . . . . .  6
       References . . . . . . . . . . . . . . . . . . . . . . . . . .  6
   A.  Connection Establishment Alternatives  . . . . . . . . . . . .  8
       Author's Address . . . . . . . . . . . . . . . . . . . . . . .  9
       Full Copyright Statement . . . . . . . . . . . . . . . . . . . 10

1. Introduction ✨

Okay so the big idea is this: a transport mapping for using SNMP [1] over TCP [2] 🦋 Like the last section said, it works with any version of SNMP, and it extends the transport mappings in STD 62, RFC 3417 [3].

SNMP over TCP is an optional transport mapping 💅 BUT here's the catch: any SNMP protocol engine that does implement SNMP over TCP MUST also implement SNMP over UDP, as defined in STD 62, RFC 3417 [3]. No skipping UDP, bestie 🙅‍♀️

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14, RFC 2119 [4]. ⭐

2. SNMP over TCP 🎀

SNMP over TCP is optional again (we love consistency 💖). It's mainly there to support more efficient bulk transfer mechanisms within the SNMP framework [5] 🔥

Here's the vibe check: the originator of a request-response transaction picks the transport protocol for the whole transaction, and the transport protocol MUST NOT change during a transaction. No mid-transaction glow-ups 🚫

Originators can generally use whatever transport they think is best for the situation 🌈 But TCP has a bigger resource footprint than UDP, so engines using SNMP over TCP may switch back to UDP by refusing new TCP connections whenever necessary (e.g. too many open TCP connections). Lowkey a good escape hatch 🧚

When you're picking a transport, think about how SNMP interacts with TCP acknowledgments and timers ⏰ Infrequent SNMP interactions over TCP may lead to additional IP packets carrying acknowledgments for SNMP responses if there's no chance to piggyback them. And it is recommended to configure SNMP retransmission timers to fire later when using SNMP over TCP, so you avoid application specific timeouts before the TCP timers have expired 🙈

2.1 Serialization 🦋

Each message instance gets serialized into a single BER-encoded message, using the algorithm specified in Section 8 of STD 62, RFC 3417 [3]. That BER-encoded message is then sent over a TCP connection. An SNMP engine MUST NOT interleave SNMP messages within the TCP byte stream 🙅‍♀️

All the bytes of one SNMP message must be sent before any bytes of a different SNMP message. It's giving "one thing at a time" energy ✨

It's totally possible to exchange multiple SNMP request/response pairs over a single persistent TCP connection 🌸 TCP connections are full-duplex by default, and data can travel both directions at different speeds. So you can send multiple SNMP messages to a remote SNMP engine before any responses come back from that same engine. Also, an SNMP engine is not required to return responses in the same order it received the requests, so don't be shook if they arrive out of order 😭

Here's the tricky part: the underlying TCP implementation might deliver byte sequences that don't line up with SNMP message boundaries 💀 So a receiving SNMP engine MUST use the length field in the BER-encoded SNMP message to separate multiple requests sent over a single TCP connection. This is called framing 🧁 An SNMP engine that loses framing (for example, due to ASN.1 parse errors) SHOULD close the TCP connection. Then the connection initiator is responsible for establishing a new TCP connection. Fresh start, periodt 🔥

2.2 Well-Known Values 👑

It is RECOMMENDED that administrators configure their SNMP entities containing command responders to listen on TCP port 161 for incoming connections. It is also RECOMMENDED that SNMP entities containing notification receivers be configured to listen on TCP port 162 for connection requests. Those port numbers are the main character ports 💖

SNMP over TCP transport addresses are identified using the generic TCP transport domain and address definitions from RFC 3419 [6], which cover TCP over IPv4 and IPv6 🌈

When an SNMP entity uses the TCP transport mapping, it MUST be capable of accepting and generating messages that are at least 8192 octets in size. Implementing larger values is encouraged whenever possible 🫶

2.3 Connection Management 🌸

Using TCP connections comes with costs [7] 💸 Connection establishment and teardown cause additional network traffic. And keeping connections open ties up resources in the network layer of the underlying operating system. Not free, bestie.

SNMP over TCP is meant for when the amount of transferred data is large, because TCP offers flow control and efficient segmentation 🧚 Moving lots of management data over SNMP over UDP means tons of request/response interactions with small UDP messages, and that makes latency go up way too much 😩

TCP connections get established on behalf of the SNMP applications that start a transaction. Command generator applications are responsible for opening TCP connections to command responder applications. Notification originator applications are responsible for initiating TCP connections to notification receiver applications, which get selected as described in Section 3 of STD 62, RFC 3413 [8]. If the TCP connection can't be established, the transaction is aborted and reported to the application as a timeout error condition. There are alternative connection establishment procedures discussed in Appendix A, but they are NOT part of this specification 📖

All SNMP entities (whether they're in an agent role or a manager role) can close TCP connections at any point in time 💅 This lets them control their resource usage and shut down TCP connections nobody's using. Also, SNMP engines are not required to process SNMP messages if the incoming half of the TCP connection is closed while the outgoing half stays open 🦋

What happens to outstanding SNMP requests when both sides of the TCP connection are closed is implementation dependent 🤷‍♀️ So the sending SNMP entity SHOULD therefore not make assumptions about how outstanding SNMP requests get processed once a TCP connection is closed. And a timeout error condition SHOULD be signaled for confirmed operations if the TCP connection closes before a response has been received ⏰

2.4 Reliable Transport versus Confirmed Operations 🔥

Sending SNMP messages over TCP gives you a reliable exchange of SNMP messages between SNMP engines 💖 TCP guarantees (absent security attacks) that delivered data is not damaged, lost, duplicated, or delivered out of order [2]. Chef's kiss 👌

SNMP was designed to support both confirmed and unconfirmed operations [9] ✨ The inform-request protocol operation is an example of a confirmed operation, and the snmpV2-trap operation is an example of an unconfirmed one.

Here's the important bit, so listen up 👂 There's a big difference between an unconfirmed protocol operation sent over a reliable transport and a confirmed protocol operation. A reliable transport like TCP only guarantees that delivered data isn't damaged, lost, duplicated, or delivered out of order. It does NOT guarantee the delivered data was actually processed by the application process. Even a reliable transport like TCP can't guarantee that data sent to a remote system is eventually delivered on that remote system. And even a graceful close of the TCP connection doesn't guarantee the receiving TCP engine delivered all the data to an application process 😭

With a confirmed SNMP operation, the receiving SNMP engine acknowledges that the data was actually received 🫶 Depending on the SNMP protocol operation, a confirmation may also indicate that further processing was done. For example, the response to an inform-request tells the notification originator that the notification passed the transport and the security model, and that it was queued for delivery to the notification receiver application. Similarly, the response to a set-request indicates that the data passed the transport and the security model, and that the write request was actually processed by the command responder 🎀

So a reliable transport is only a poor approximation for confirmed operations 🙈 Applications that need confirmation of delivery or processing are encouraged to use confirmed operations, like the inform-request, instead of unconfirmed operations, like snmpV2-trap, over a reliable transport. Use the right tool, bestie 🧰

3. Security Considerations 🔐

Okay, security is serious business, so listen up 💀 It is RECOMMENDED that implementors consider the security features provided by the SNMPv3 framework in order to provide SNMP security. Specifically, the use of the User-based Security Model STD 62, RFC 3414 [10] and the View-based Access Control Model STD 62, RFC 3415 [11] is RECOMMENDED 🛡️

Then it's a customer/user responsibility to make sure the SNMP entity giving access to a MIB is properly configured. Access to the objects should go ONLY to those principals (users) who have legitimate rights to actually GET or SET (change) them. Don't let just anyone change your stuff, fr fr 🙅‍♀️

The SNMP over TCP transport mapping does not have any impact on the security mechanisms provided by SNMPv3 🦋 However, SNMP over TCP may introduce new vulnerabilities to denial of service attacks (such as TCP syn flooding) that don't exist in this form in other transport mappings. That's a whole plot twist, so keep your guard up 🚨

Part 1 of 2 wraps up here 🫶 Part 2 picks up with Section 4 (Acknowledgments), then the References, Appendix A and the rest. Stay tuned, bestie 💜

4. Acknowledgments ✨

okay so this section is basically the thank-you list 🫶 the whole spec came out of chats within the Network Management Research Group (NMRG) of the Internet Research Task Force[12] (IRTF), and the people who helped out are the absolute MVPs 💜 Special thanks to Luca Deri, Jean-Philippe Martin-Flatin, Aiko Pras, Ron Sprenkels, and Bert Wijnen for their comments and suggestions 🌸

more shoutouts to Mike Ayers, Jeff Case, Mike Daniele, David Harrington, Lauren Heintz, Keith McCloghrie, Olivier Miakinen, and Dave Shield, who also left super useful comments 🎀

then Luca Deri, Wes Hardaker, Bert Helthuis, and Erik Schoenfelder helped build prototype implementations 🔥 and the SNMP over TCP transport mapping is currently supported by the NET-SNMP package[13] and the Linux CMU SNMP package[14] 🧚 literally the whole squad 😭

References

[1] Case, J., Mundy, R., Partain, D. and B. Stewart, "Introduction and Applicability Statements for Internet-Standard Management Framework", RFC 3410, December 2002. 📚

[2] Postel, J., "Transmission Control Protocol", STD 7, RFC 793, September 1981. 📚

[3] Presuhn, R., Ed., "Transport Mappings for the Simple Network Management Protocol (SNMP)", STD 62, RFC 3417, December 2002. 📚

[4] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997. 📚

[5] Sprenkels, R. and J. Martin-Flatin, "Bulk Transfers of MIB Data", Simple Times 7(1), March 1999. 📚

[6] Daniele, M. and J. Schoenwaelder, "Textual Conventions for Transport Addresses", RFC 3419, December 2002. 📚

[7] Kastenholz, F., "SNMP Communications Services", RFC 1270, October 1991. 📚

[8] Levi, D., Meyer, P. and B. Stewart, "Simple Network Management Protocol (SNMP) Applications", STD 62, RFC 3413, December 2002. 📚

[9] Harrington, D., Presuhn, R. and B. Wijnen, "An Architecture for Describing Simple Network Management Protocol (SNMP) Management Frameworks", STD 62, RFC 3411, December 2002. 📚

[10] Blumenthal, U. and B. Wijnen, "User-based Security Model (USM) for version 3 of the Simple Network Management Protocol (SNMPv3)", STD 62, RFC 3414, December 2002. 📚

[11] Wijnen, B., Presuhn, R. and K. McCloghrie, "View-based Access Control Model (VACM) for the Simple Network Management Protocol (SNMP)", STD 62, RFC 3415, December 2002. 📚

[12] <http://www.irtf.org/> 🌐

[13] <http://net-snmp.sourceforge.net/> 🌐

[14] <http://www.gaertner.de/snmp/> 🌐

Appendix A. Connection Establishment Alternatives 🦋

okay this one is the "what if we did it differently" section and it's giving brainstorm sesh 🧠 the spec says the notification originator or command generator application is responsible for establishing TCP connections to notification receiver or command responder applications 💅 this section just documents the variations and alternatives that got discussed while the spec was being built, and the discussion focuses on notification originator applications since that's where people had different vibes 👀 it also assumes you already know the SNMPv3 notification forwarding model from STD 62, RFC 3413 [8] 🌈

so the main thing: the approach in this memo just drops notifications if the TCP connection can't be established 😬 which means if you need reliable notification delivery, you MUST implement a local notification log to keep a history of the notifications that couldn't be delivered 🫠

Careful here, bestie: the only thing that's MUST-level in this appendix is the requirement that reliable-delivery originators implement a local log. Everything else is discussion, not a rule. 💀

one idea was to deliver notifications via UDP when TCP establishment fails 🦋 this might need augmenting the snmpTargetTable with columns for the alternate UDP transport domain and address 📋 but honestly this only helps when the receiver can't accept more TCP connections. If something else is going wrong, like routing problems, the UDP packet would have no or only marginally better chances to reach the receiver 🙃 so originators that need reliable delivery still need a local notification log in case the UDP packets don't arrive 💜

a generalization of that idea is a sparse augmentation of the snmpTargetTable listing alternate fallback transport endpoints of arbitrary transport domains 🌸 you could have multiple fallbacks using a tag list approach ✨ this gives you a generic, transport independent fallback mechanism that doesn't depend on the TCP transport mapping defined in this memo 🧚

another option is making the notification originator responsible for retrying connection establishment 🔁 this could be done by augmenting the snmpTargetTable with columns for retry counts and timeouts, or by adapting the existing snmpTargetAddrTimeout and snmpTargetAddrRetryCount columns 🎀 but even then, you still need a local notification log for when all the retries fail 😭

then there's the totally different vibe: making the notification receiver responsible for establishing the TCP connection to the notification originator 🔄 the upside is the originator doesn't necessarily need a list of pre-configured notification receiver transport addresses 🙌 but the current notification forwarding model relies on the snmpTargetTable to identify notification targets, so the question is whether (a) new entries get added to the snmpTargetTable when a connection is established, or whether (b) connections are only accepted if they match pre-configured snmpTargetTable entries 🤔

the tea: the target selection logic relies on a tag list, and that tag list can not be reasonably populated when a connection is accepted. So only option (b) seems to be compliant with the current notification forwarding logic. 🍵👑

another thing to think about is denial of service 🚨 a notification originator can be easily attacked by syn-flooding attacks if it listens for incoming TCP connections 💀 the vulnerability is real, bestie 😭

and last but not least, if notification originator and notification receiver applications are gonna coexist easily on a single system, it would be necessary to assign new default port numbers on which notification originators listen for incoming TCP connections 🔌 main character coordination 💅

Author's Address 🖋️

Juergen Schoenwaelder TU Braunschweig Bueltenweg 74/75 38106 Braunschweig Germany Phone: +49 531 391-3283 EMail: schoenw@ibr.cs.tu-bs.de 💌

Copyright (C) The Internet Society (2002). All Rights Reserved. 💖

This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English. 📜

The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns. 🔒

This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 🙏

Acknowledgement 💫

Funding for the RFC Editor function is currently provided by the Internet Society. 💕

📦 where this page comes from