RFC 4149
Definition of Managed Objects for Synthetic Sources for Performance Monitoring Algorithms
RFC 4149: Definition of Managed Objects for Synthetic Sources for Performance Monitoring Algorithms 💖
okay bestie, let's start with the basics 🎀 This is RFC 4149, and it's a Standards Track doc from the Network Working Group. It came out in August 2005. The authors are C. Kalbfleisch (Consultant), R. Cole (JHU/APL), and D. Romascanu (Avaya). The header doesn't say it obsoletes or updates anything, so it stands on its own 🦋
Status of This Memo ✨
This doc specifies an Internet standards track protocol for the Internet community, and it asks for discussion and suggestions for improvements 💌 For the standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited 🌸
Copyright Notice 📜
Copyright (C) The Internet Society (2005).
Abstract 🧚
This memo defines a portion of the Management Information Base (MIB) for use with network management protocols in the Internet community. In particular, it describes objects for configuring Synthetic Sources for Performance Monitoring (SSPM) algorithms.
Table of Contents 📚
1. Introduction ....................................................2
2. The Internet-Standard Management Framework ......................2
3. Overview ........................................................3
3.1. Terms ......................................................3
4. Relationship to Other MIB modules ...............................4
5. Relationship to Other Work ......................................4
5.1. IPPM .......................................................4
5.2. DISMAN .....................................................5
5.3. RMON .......................................................6
5.4. ApplMIB ....................................................6
5.5. SNMPCONF ...................................................7
5.6. RTFM .......................................................8
5.7. Relationship to Other Work: Summary ........................8
6. MIB Structure ...................................................9
6.1. General Information .......................................10
6.2. Source Configuration ......................................10
6.3. Sink Configuration ........................................10
7. Definitions ....................................................10
8. Security Considerations ........................................32
9. Acknowledgements ...............................................34
10. Normative References ..........................................34
11. Informative References ........................................361. Introduction ✨
This memo defines a portion of the Management Information Base (MIB) for use with network management protocols in the Internet community.
So basically, this defines a way to describe Synthetic Sources for Performance Monitoring (SSPM) 🧚 It fits into the Remote Monitoring (RMON) framework [RFC3577] for when you want to inject packets into the network so you can watch how they perform, using the other MIBs in that framework. It's giving very useful energy 💅
This memo also includes a MIB module 🎀
The BCP 14 vibes are next 🔥 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119].
2. The Internet-Standard Management Framework 🌈
If you want the full tour of the documents that make up the current Internet-Standard Management Framework, check out section 7 of RFC 3410 [RFC3410] 📖
Managed objects are accessed via a virtual information store, called the Management Information Base or MIB. MIB objects are usually accessed through the Simple Network Management Protocol (SNMP). Objects in the MIB are defined using the mechanisms in the Structure of Management Information (SMI). This memo specifies a MIB module that is compliant to the SMIv2, which is described in STD 58, RFC 2578 [RFC2578], STD 58, RFC 2579 [RFC2579] and STD 58, RFC 2580 [RFC2580].
3. Overview 👑
This document defines a MIB module for remotely controlling synthetic sources (or 'active' probes) and sinks. The goal is to boost remote performance monitoring within IP networks and services. Lots of IETF work already covers performance monitoring, but here's the tea: none of it explicitly defines an 'active' probe capability. An active probe capability is complementary to the existing stuff, and this MIB module was developed to fill that gap 🫶
3.1. Terms 📖
The following definitions apply throughout this document:
- 'Performance monitoring' is the act of monitoring traffic for the purpose of evaluating a statistic of a metric related to the performance of the system. A performance monitoring system is comprised of a) traffic generators, b) measurement, c) data reduction, and d) reporting. The traffic generators may be natural sources, synthetic sources, or intrusive sources.
- A 'synthetic source' is a device or an embedded software program that generates a data packet (or packets) and injects it (or them) onto the path to a corresponding probe or existing server solely in support of a performance monitoring function. A synthetic source may talk intrusively to existing application servers.
The design goals for this MIB module are:
- Complementing the overall performance management architecture being defined within the RMONMIB WG; refer to the RMONMIB framework document [RFC3577]. This MIB module is defined within the context of the APM-MIB [RFC3729].
- Extensibility: the MIB module should be easily extended to include a greater set of protocols and applications for performance monitoring purposes.
- Flexibility: the module should support both round-trip and one-way measurements.
- Security: the control of the source and sink of traffic is handled by a management application, and communication is recommended via SNMPv3.
This document is organized as follows. The next section covers how this MIB module relates to others from the RMONMIB and Distributed Management (DISMAN) working groups. After that, we talk about the structure of the MIB module. Finally, the MIB module definitions are given 🎀
4. Relationship to Other MIB modules 🧩
This MIB module is designed to be used alongside the RMON MIB Working Group's two other MIB modules for application performance measurement: Application Performance Measurement MIB [RFC3729] and Transport Performance Metrics MIB [RFC4150]. These MIB modules define reporting capabilities for that framework. The intent of this MIB module is to define a method for injecting packets into the network, using probe capabilities defined in the base MIB modules and measured with the reporting MIB modules. Other reporting MIB modules may be used as well.
Specifically, this MIB module uses the AppLocalIndex as defined in the APM-MIB to map measurement configuration information to definition and reporting structures defined in the APM-MIB 🦋
5. Relationship to Other Work 🔗
Much work has already been done within the IETF that has a direct bearing on the development of active performance probe definitions. This body of work has been handled in various working groups over the years. In this section, we focus on the work of a) the IP Performance Metrics (IPPM) working group, b) the DISMAN working group, c) the RMON working group, d) the Application MIB (ApplMIB) working group, and e) the Realtime Traffic Flow Measurement (RTFM) working group.
5.1. IPPM 📊
The IPPM working group has defined in detail a set of performance metrics, sampling techniques, and associated statistics for transport-level or connectivity-level measurements. The IPPM framework document [RFC2330] covers a lot of issues around sampling techniques, clock accuracy, resolution and skew, wire time versus host time, error analysis, etc. Many of these are considerations for the configuration and implementation issues discussed below. The IPPM working group has defined several metrics and their associated statistics, including:
- a connectivity metric [RFC2678],
- a one-way delay metric [RFC2679],
- a one-way loss metric [RFC2680],
- round-trip delay and loss metrics [RFC2681],
- a delay variation metric [RFC3393],
- a streaming media metric [RFC3432],
- a throughput metric [EBT] and [TBT], and
- others are under development.
These (or a subset) could form the basis for a set of active, connectivity-level, probe types designed for monitoring the quality of transport services. Thinking through some of these metrics could be a set of work activities and early deliverables for a group developing an active probe capability 💜
During the early development of the SSPM-MIB, it became apparent that a one-way measurement protocol was required in order for the SSPM-MIB to control a one-way measurement. This led to the current work with the IPPM WG on the development of the One-Way Measurement Protocol (OWDP) [ODP]. This work includes both the measurement protocol itself and the development of a separate control protocol. This later control protocol is redundant with the current work on the SSPM-MIB. The SSPM-MIB could be used as an alternative to the one-way delay control protocol 🤔
5.2. DISMAN 🛠
The DISMAN working group has defined a set of 'active' tools for remote management. Of relevance to this document are:
- the pingMIB [RFC2925],
- the DNS Lookup MIB [RFC2925],
- the tracerouteMIB [RFC2925],
- the scriptMIB [RFC3165], and
- the expressionMIB [RFC2982].
The pingMIB and tracerouteMIB define an active probe capability, mostly for remotely figuring out a path and whether it's connected. There are some performance-related metrics collected from the pingMIB, and you could conceivably use those measurements to evaluate a limited set of performance statistics. But there's a fundamental difference between determining connectivity and determining the quality of that connectivity. In the context of performance monitoring, though, a fault can be viewed as not performing at all. So both should be monitored with the same probes to reduce network traffic 💅
The DNS Lookup MIB also includes some probe-like capabilities and performance time measurements for the DNS lookup. This could be used to suggest details of a related session-level, active probe ✨
The scriptMIB lets a network management application distribute and manage scripts to remote devices. Conceivably, those scripts could be designed to run a set of active probe monitors on remote devices 🧚
5.3. RMON 🎀
okay so the RMON working group already built a huge passive monitoring capability 👀 it's defined in RFC 2819 [RFC2819] and RFC 2021 [RFC2021], plus a bunch of extra MIB modules. the monitors started out collecting stats at the MAC layer, but now they can do higher-layer stats too 💅 those higher-layer stats are identified through a Protocol Directory [RFC2021]. if you want the big-picture overview of RMONMIB, check out the RMONMIB framework document [RFC3577] 📚
and ngl, building an active traffic source for performance monitoring fits SO well into the overall performance monitoring architecture the RMON WG is defining 🫶 it's giving puzzle piece energy 🧩
5.4. ApplMIB 🌸
the ApplMIB working group made a whole series of MIB modules that keep an eye on different parts of applications, processes, and services 👀
the System Application MIB [RFC2287] is the basic one 🧚 it covers fault, configuration, and performance management of applications from a systems point of view. the vibe is that it only tracks stuff the system can figure out by itself, so applications don't need any special instrumentation added to them to make that info available ✨
then the Application MIB [RFC2564] comes in and completes the System Application MIB 🎀 it handles management of the common attributes that applications have, the kind you usually couldn't see without the software being managed actually cooperating. and yes, some of these attributes give info on application and communication performance 🔥
the WWW MIB [RFC2594] is the one for networked services in the Internet Community, especially World Wide Web (WWW) services 🌈 it has performance attributes for each WWW service, each type of request, each type of response, and the top-accessed documents. so many details, I'm obsessed 😭
okay now the important bit 🚨 when you're developing synthetic application-level probes, you should think about how the application MIB modules relate to the measurements your synthetic application-level probe is doing. similar cross-indexing issues show up when you combine RMON monitoring with synthetic application-level active probes 🦋
5.5. SNMPCONF 💜
the Configuration Management with SNMP (SNMPCONF) working group put out the informational RFC 3512 [RFC3512] 📖 it explains the best ways to use the SNMP Framework for configuration management. that covers device-specific config and network-wide (Policy) config too 🫶 the group is also chartered to write any MIB modules needed to make config management easier. specifically, they're writing a MIB module that describes what a network entity can do and how much it can handle, so management entities can make policy decisions at the network level or the device level 🧠
right now the SNMPCONF working group is focused on the SNMP Configuration MIB for policy [RFC4011] 💅 honestly it makes sense you'd want to watch how newly configured policies perform once they're live in a network. that would mean correlating the implemented policy with a related performance monitoring policy that specifies synthetic probe definitions 🔍
for synthetic probes, you'd need to configure a) a single probe, b) several probes, c) source and destination probes, and d) intermediate probes 🍓 you might even need to configure any or all of those combos at the same time 😵 the hope is that SNMPCONF's work will cover it all 🙏 the scripting language from the SNMP Configuration MIB could let active monitoring get turned on and configured from a policy management script 🪄 and then the results of active monitoring could feed into later policy decisions. this whole idea is shown in the decision flow in Figure 1 below ⭐
5.6. RTFM 🦋
the Realtime Traffic Flow Measurement (RTFM) working group cares about traffic flow measurements and usage reporting for network traffic and Internet accounting 📊 there are documents covering requirements [RFC1272], traffic flow measurement architectures [RFC2722], and a traffic flow MIB [RFC2720]. their work is focused on passive measurements of user traffic, so it's related to the RMON WG's monitoring work 💖 but basically, they haven't looked into methods of active traffic generation at all 🙈
5.7. Relationship to Other Work: Summary ✨
so in summary, building an active traffic generation capability (mainly for performance monitoring) should borrow from various activities, past and present, across the IETF 🌈 Figure 1 shows how all of the work we just touched on connects 🔥
horizontally, across the top of the figure, you've got the overall control functions that coordinate the different parts of the performance monitoring systems 👑 down at the bottom, vertically, are the functions that make up the minimum performance monitoring capability: traffic generation, monitoring and measurements, and data reduction 🫶 this MIB module handles traffic generation. monitoring and measurement are handled by the APM-MIB [RFC3729] and TPM-MIB [RFC4150] modules 💅 data reduction isn't addressed within the IETF yet 😭 but data reduction could include both spatial and temporal aggregations at different levels of reduction. the figure shows this with the arrow labeled "Various levels and span" 🏹
+-----------------------------------+
| |
V |
+------------------------------------------+ |
+------| Application [script], [expr], [snmpconf],|---+ |
| | [apmmib] | | |
| +------------------------------------------+ | |
| | | |
+--------------------------------+ | |
| Synchronization Control | | |
+--------------------------------+ | |
| | | |
V V V |
+----------------+ +----------------------+ +-------------------+ |
| Traffic | |Monitoring Metrics | |Data Reduction | |
| Generation | |Control [rmon],[ippm],| |Control [applmib], | |
| Control [sspm]| | [applmib] | |[wwwservmib],[expr]| |
+----------------+ +----------------------+ +-------------------+ |
| | | |
| | | |
V V V |
+------------------+ +-------------------+ +----------------+ |
|Traffic Generation| |Monitoring Metrics | |Data Reduction | |
| Instrumentation| | Instrumentation | +-->| Instrumentation| |
+------------------+ +-------------------+ | +----------------+ |
| | |
| | |
Various levels | | |
and span +--------------| |
| |
| |
V |
Reports ---+Figure 1: Coverage for an overall performance monitoring system
6. MIB Structure 🧚
this section lays out how the MIB module is structured 🎀 the objects are sorted into these groups:
- general information
- source configuration
- sink configuration
6.1. General Information 🌸
this section gives general info about what the probe can do 💅 right now it's all about the resolution of the probe clock and where that clock comes from ⏰
6.2. Source Configuration 🔥
the source gets configured with a pair of tables 👯 the first one, sspmSourceProfileTable, defines a set of profiles for monitoring. then the second table, sspmSourceControlTable, uses those profiles to instantiate a specific measurement 🪄 this MIB module takes an IP-centric view of how the measurement gets configured 🌐
6.3. Sink Configuration 💖
this part configures the sink for measurements 🫶 if the test is round-trip, this table lives on the same probe as the source configuration. if the test is one-way, the table is on a different probe 🦋 the sspmSinkInstance is a unique identifier for the entry per probe ✨ and there are extra attributes for test type and test source that let you identify entries in the table uniquely 🔍
7. Definitions 💜
SSPM-MIB DEFINITIONS ::= BEGIN
IMPORTS
MODULE-IDENTITY, OBJECT-TYPE,
Counter32, Integer32, Unsigned32
FROM SNMPv2-SMI --[RFC2578]
TEXTUAL-CONVENTION, StorageType,
TruthValue, RowStatus
FROM SNMPv2-TC --[RFC2579]
MODULE-COMPLIANCE, OBJECT-GROUP
FROM SNMPv2-CONF --[RFC2578,
-- RFC2579,
-- RFC2580]
OwnerString, rmon
FROM RMON-MIB --[RFC2819]
InetAddressType, InetAddress
FROM INET-ADDRESS-MIB --[RFC3291]
InterfaceIndexOrZero
FROM IF-MIB --[RFC2863]
AppLocalIndex
FROM APM-MIB --[RFC3729]
Utf8String
FROM SYSAPPL-MIB; --[RFC2287]
sspmMIB MODULE-IDENTITY
LAST-UPDATED "200507280000Z" -- July 28, 2005
ORGANIZATION "IETF RMON MIB working group"
CONTACT-INFO
" Carl W. Kalbfleisch
Consultant
E-mail: ietf@kalbfleisch.us
Working group mailing list: rmonmib@ietf.org
To subscribe send email to rmonmib-request@ietf.org"
DESCRIPTION
"This SSPM MIB module is applicable to probes
implementing Synthetic Source for Performance
Monitoring functions.
Copyright (C) The Internet Society (2005). This version
of this MIB module is part of RFC 4149; see the RFC
itself for full legal notices."
-- revision history
REVISION "200507280000Z" -- July 28, 2005
DESCRIPTION
"The original version of this MIB module,
was published as RFC4149."
::= { rmon 28 }
--
-- Object Identifier Assignments
--
sspmMIBObjects OBJECT IDENTIFIER ::= { sspmMIB 1 }
sspmMIBNotifications OBJECT IDENTIFIER ::= { sspmMIB 2 }
sspmMIBConformance OBJECT IDENTIFIER ::= { sspmMIB 3 }Okay bestie, we're still deep in the MIB definitions 🧚✨ Here's the next batch: the clock-related textual conventions and the sspmGeneral, sspmCapabilities, and sspmSource tables, all the way down to the flow label. 💜
--
-- Textual Conventions
--
SspmMicroSeconds ::= TEXTUAL-CONVENTION
DISPLAY-HINT "d"
STATUS current
DESCRIPTION
"A unit of time with resolution of MicroSeconds."
SYNTAX Unsigned32
SspmClockSource ::= TEXTUAL-CONVENTION
DISPLAY-HINT "d"
STATUS current
DESCRIPTION
"An indication of the source of the clock as defined by the
NTP specification RFC1305 [RFC1305] definition of stratum:
Stratum (sys.stratum, peer.stratum, pkt.stratum): This is
an integer indicating the stratum of the local clock,
with values defined as follows:
0 unspecified
1 primary reference (e.g., calibrated atomic clock,
radio clock)
2-255 secondary reference (via NTP)."
REFERENCE
"RFC1305."
SYNTAX Integer32 (0..255)
SspmClockMaxSkew ::= TEXTUAL-CONVENTION
DISPLAY-HINT "d"
STATUS current
-- UNITS "Seconds"
DESCRIPTION
"An indication of the accuracy of the clock as defined by
RFC1305. This variable indicates the maximum offset
error due to skew of the local clock over the
time interval 86400 seconds, in seconds."
REFERENCE
"RFC1305."
SYNTAX Integer32 (1..65535)
--
-- sspmGeneral
--
sspmGeneral OBJECT IDENTIFIER ::= { sspmMIBObjects 1 }
sspmGeneralClockResolution OBJECT-TYPE
SYNTAX SspmMicroSeconds
MAX-ACCESS read-only
STATUS current
-- UNITS Microseconds
DESCRIPTION
"A read-only variable indicating the resolution
of the measurements possible by this device."
::= { sspmGeneral 1 }
sspmGeneralClockMaxSkew OBJECT-TYPE
SYNTAX SspmClockMaxSkew
MAX-ACCESS read-only
STATUS current
-- UNITS Seconds
DESCRIPTION
"A read-only variable indicating the maximum offset
error due to skew of the local clock over the
time interval 86400 seconds, in seconds."
::= { sspmGeneral 2 }
sspmGeneralClockSource OBJECT-TYPE
SYNTAX SspmClockSource
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"A read-only variable indicating the source of the clock.
This is provided to allow a user to determine how accurate
the timing mechanism is compared with other devices. This
is needed for the coordination of time values
between probes for one-way measurements."
::= { sspmGeneral 3 }
sspmGeneralMinFrequency OBJECT-TYPE
SYNTAX SspmMicroSeconds
MAX-ACCESS read-only
-- units MicroSeconds
STATUS current
DESCRIPTION
"A read-only variable that indicates the devices'
capability for the minimum supported
sspmSourceFrequency. If sspmSourceFrequency is
set to a value lower than the value reported
by this attribute, then the set of sspmSourceFrequency
will fail with an inconsistent value error."
::= { sspmGeneral 4 }
--
-- sspmCapabilities
--
-- Describes the capabilities of the SSPM device.
--
sspmCapabilitiesTable OBJECT-TYPE
SYNTAX SEQUENCE OF SspmCapabilitiesEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The table of SSPM capabilities."
::= { sspmGeneral 5 }
sspmCapabilitiesEntry OBJECT-TYPE
SYNTAX SspmCapabilitiesEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Details about a particular SSPM capability."
INDEX { sspmCapabilitiesInstance }
::= { sspmCapabilitiesTable 1 }
SspmCapabilitiesEntry ::= SEQUENCE {
sspmCapabilitiesInstance AppLocalIndex
}
sspmCapabilitiesInstance OBJECT-TYPE
SYNTAX AppLocalIndex
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Indicates whether SSPM configuration of the corresponding
AppLocalIndex is supported by this device. Generally,
entries in this table are only made by the device when the
configuration of the measurement is available."
::= { sspmCapabilitiesEntry 1 }
--
-- sspmSource
--
-- Contains the details of the source of the
-- Synthetic Sources for Performance Monitoring algorithms.
-- This information is split into two tables. The first defines
-- profiles that can be applied to specific sources in the
-- control table.
--
sspmSource OBJECT IDENTIFIER ::= { sspmMIBObjects 2 }
--
-- sspmSourceProfileTable
-- Defines template profiles for measurements.
--
sspmSourceProfileTable OBJECT-TYPE
SYNTAX SEQUENCE OF SspmSourceProfileEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The table of SSPM Source Profiles configured."
::= { sspmSource 1 }
sspmSourceProfileEntry OBJECT-TYPE
SYNTAX SspmSourceProfileEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Details about a particular SSPM Source Profile
configuration. Entries must exist in this table
in order to be referenced by rows in the
sspmSourceControlTable."
INDEX { sspmSourceProfileInstance }
::= { sspmSourceProfileTable 1 }
SspmSourceProfileEntry ::= SEQUENCE {
sspmSourceProfileInstance Unsigned32,
sspmSourceProfileType AppLocalIndex,
sspmSourceProfilePacketSize Unsigned32,
sspmSourceProfilePacketFillType INTEGER,
sspmSourceProfilePacketFillValue OCTET STRING,
sspmSourceProfileTOS Integer32,
sspmSourceProfileFlowLabel Integer32,
sspmSourceProfileLooseSrcRteFill OCTET STRING,
sspmSourceProfileLooseSrcRteLen Integer32,
sspmSourceProfileTTL Integer32,
sspmSourceProfileNoFrag TruthValue,
sspmSourceProfile8021Tagging Integer32,
sspmSourceProfileUsername Utf8String,
sspmSourceProfilePassword Utf8String,
sspmSourceProfileParameter OCTET STRING,
sspmSourceProfileOwner OwnerString,
sspmSourceProfileStorageType StorageType,
sspmSourceProfileStatus RowStatus
}
sspmSourceProfileInstance OBJECT-TYPE
SYNTAX Unsigned32 (1..65535)
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"An arbitrary index."
::= { sspmSourceProfileEntry 1 }
sspmSourceProfileType OBJECT-TYPE
SYNTAX AppLocalIndex
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The AppLocalIndex value that uniquely identifies the
measurement per the APM-MIB. In order to create a row
in this table, there must be a corresponding row in the
sspmCapabilitiesTable.
When attempting to set this object, if no
corresponding row exists in the sspmCapabilitiesTable,
then the agent should return a 'badValue' error."
::= { sspmSourceProfileEntry 2}
sspmSourceProfilePacketSize OBJECT-TYPE
SYNTAX Unsigned32
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The size of packet to be transmitted in bytes. The
size accounts for all data within the IPv4 or IPv6
payloads, excluding the IP headers, IP header options
and link-level protocol headers.
If the size is set smaller than the minimum allowed
packet size or greater than the maximum allowed
packet size, then the set should fail, and the agent
should return a 'badValue' error."
::= { sspmSourceProfileEntry 3 }
sspmSourceProfilePacketFillType OBJECT-TYPE
SYNTAX INTEGER {
random (1),
pattern (2),
url(3)
}
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"Indicates how the packet is filled.
'random' indicates that the packet contains random
data patterns. This is probe and implementation
dependent.
'pattern' indicates that the pattern defined in the
sspmSourceProfilePacketFillValue attribute is used to
fill the packet.
'url' indicates that the value of
sspmSourceProfilePacketFillValue should
contain a URL. The contents of the document
at that URL are retrieved when sspmSourceStatus becomes
active and utilized in the packet. If the attempt to
access that URL fails, then the row status is set to
'notReady', and the set should fail with
'inconsistentValue'. This value must contain a
dereferencable URL of the type 'http:', 'https:', or
'ftp:' only."
::= { sspmSourceProfileEntry 4 }
sspmSourceProfilePacketFillValue OBJECT-TYPE
SYNTAX OCTET STRING (SIZE(0..255))
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The string value with which to fill the packet. If
sspmSourceProfilePacketFillType is set to 'pattern',
then this pattern is repeated until the packet is
sspmSourcePacketSize in bytes. Note that if the
length of the octet string specified for this
value does not divide evenly into the packet
size, then an incomplete last copy of this data
may be copied into the packet. If the value of
sspmSourceProfilePacketFillType is set to 'random', then
this attribute is unused. If the value of the
sspmSourceProfilePacketFillType is set to 'url', then
the URL specified in this attribute is retrieved
and used by the probe. In the case of a URL, this value
must contain a dereferencable URL of the type
'http:', 'https:', or 'ftp:' only."
::= { sspmSourceProfileEntry 5 }
sspmSourceProfileTOS OBJECT-TYPE
SYNTAX Integer32 (0..255)
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"Represents the TOS field in the IP packet header. The
value of this object defaults to zero if not set."
DEFVAL { 0 }
::= { sspmSourceProfileEntry 6 }
sspmSourceProfileFlowLabel OBJECT-TYPE
SYNTAX Integer32 (0..1048575) -- 20-bit range (0 to 0xfffff)
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"This object is used to specify the Flow Label in a IPv6
packet (RFC 2460) to force special handling by the IPv6
routers; e.g., non-default quality-of-service handling.
This object is meaningful only when the object
sspmSourceDestAddressType is IPv6(2).
The value of this object defaults to zero if not set."
DEFVAL { 0 }
::= { sspmSourceProfileEntry 7 }okay bestie, we're still in the MIB definitions 💖 the source profile table gets its routing and packet knobs here, like loose source routes, TTL, and the Don't Fragment bit 🦋
sspmSourceProfileLooseSrcRteFill OBJECT-TYPE
SYNTAX OCTET STRING (SIZE(0..240))
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"In the event that the test should run over a
specific route, the intent is to force the route using the
Loose Source Route option in IPv4 [RFC791] and
IPv6 [RFC2460]. This object contains a
series of IP addresses along the path that would be
put into the loose source route option in the IP header.
The IPv4 addresses are to be listed as 32-bit
address values, and the IPv6 addresses are to be
listed as a string of 128-bit addresses. The
maximum length allowed within the IPv4 source route
option is 63 addresses. To simply account for
IPv6 addresses as well, the maximum length of the
octet string is 240. This allows up to 60
IPv4 addresses or up to 15 IPv6 addresses in the
string."
::= { sspmSourceProfileEntry 8 }
sspmSourceProfileLooseSrcRteLen OBJECT-TYPE
SYNTAX Integer32(0..240)
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"In the event that the test should run over a
specific route, the intent is to force the route.
This attribute specifies the length of data to
be copied from the sspmSourceProfileLooseSrcRteFill
into the route data fields of the loose source route
options in the IPv4 or IPv6 headers."
::= { sspmSourceProfileEntry 9 }
sspmSourceProfileTTL OBJECT-TYPE
SYNTAX Integer32(1..255)
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"If non-zero, this specifies the value to place into
the TTL field on transmission."
::= { sspmSourceProfileEntry 10 }
sspmSourceProfileNoFrag OBJECT-TYPE
SYNTAX TruthValue
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"When true, the 'Don't Fragment Bit' should be set
on the packet header."
::= { sspmSourceProfileEntry 11 }
sspmSourceProfile8021Tagging OBJECT-TYPE
SYNTAX Integer32 (-1..65535)
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"IEEE 802.1Q tagging used in IEEE 802.1D bridged
environments.
A value of -1 indicates that the packets are untagged.
A value of 0 to 65535 is the value of the tag to be
inserted in the tagged packets.
Note that according to IEEE 802.1Q, VLAN-ID tags with
a value of 4095 shall not be transmitted on the wire.
As the VLAN-ID is encoded in the 12 least significant
bits on the tag, values that translate in a binary
representation of all 1's in the last 12 bits
SHALL NOT be configured. In this case, the set should
fail, and return an error-status of 'inconsistentValue'."
::= { sspmSourceProfileEntry 12 }
sspmSourceProfileUsername OBJECT-TYPE
SYNTAX Utf8String
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"An optional username used by the application protocol."
::= { sspmSourceProfileEntry 13 }
sspmSourceProfilePassword OBJECT-TYPE
SYNTAX Utf8String
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"An optional password used by the application protocol."
::= { sspmSourceProfileEntry 14 }
sspmSourceProfileParameter OBJECT-TYPE
SYNTAX OCTET STRING (SIZE(0..65535))
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"An optional parameter used by the application protocol.
For DNS, this would be the hostname or IP. For HTTP,
this would be the URL. For nntp, this would be the
news group. For TCP, this would be the port number.
For SMTP, this would be the recipient (and could
assume the message is predefined)."
::= { sspmSourceProfileEntry 15 }
sspmSourceProfileOwner OBJECT-TYPE
SYNTAX OwnerString
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"Name of the management station/application that
set up the profile."
::= { sspmSourceProfileEntry 16 }
sspmSourceProfileStorageType OBJECT-TYPE
SYNTAX StorageType
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The storage type of this sspmSourceProfileEntry. If the
value of this object is 'permanent', no objects in this row
need to be writable."
::= { sspmSourceProfileEntry 17 }
sspmSourceProfileStatus OBJECT-TYPE
SYNTAX RowStatus
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"Status of this profile.
An entry may not exist in the active state unless all
objects in the entry have an appropriate value.
Once this object is set to active(1), no objects in the
sspmSourceProfileTable can be changed."
::= { sspmSourceProfileEntry 18 }Next up is the sspmSourceControlTable 🎀 This is where you actually kick off specific measurements, and each one points back at a profile you've already set up as a template. The profiles have to be pre-configured first, so no skipping ahead 💅
--
-- sspmSourceControlTable
-- Defines specific measurement instances based on template
-- profiles in the sspmSourceProfileTable which must be
-- pre-configured.
--
sspmSourceControlTable OBJECT-TYPE
SYNTAX SEQUENCE OF SspmSourceControlEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The table of SSPM measurements configured."
::= { sspmSource 2 }
sspmSourceControlEntry OBJECT-TYPE
SYNTAX SspmSourceControlEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Details about a particular SSPM configuration."
INDEX { sspmSourceControlInstance }
::= { sspmSourceControlTable 1 }
SspmSourceControlEntry ::= SEQUENCE {
sspmSourceControlInstance Unsigned32,
sspmSourceControlProfile Integer32,
sspmSourceControlSrc InterfaceIndexOrZero,
sspmSourceControlDestAddrType InetAddressType,
sspmSourceControlDestAddr InetAddress,
sspmSourceControlEnabled TruthValue,
sspmSourceControlTimeOut SspmMicroSeconds,
sspmSourceControlSamplingDist INTEGER,
sspmSourceControlFrequency SspmMicroSeconds,
sspmSourceControlFirstSeqNum Unsigned32,
sspmSourceControlLastSeqNum Unsigned32,
sspmSourceControlOwner OwnerString,
sspmSourceControlStorageType StorageType,
sspmSourceControlStatus RowStatus
}
sspmSourceControlInstance OBJECT-TYPE
SYNTAX Unsigned32 (1..65535)
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"An arbitrary index."
::= { sspmSourceControlEntry 1 }
sspmSourceControlProfile OBJECT-TYPE
SYNTAX Integer32 (1..65535)
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"A pointer to the profile (sspmSourceProfileEntry) that
this control entry uses to define the test being
performed."
::= { sspmSourceControlEntry 2 }
sspmSourceControlSrc OBJECT-TYPE
SYNTAX InterfaceIndexOrZero
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The ifIndex where the packet should originate from the
probe (if it matters). A value of zero indicates that
it does not matter and that the device decides."
::= { sspmSourceControlEntry 3 }
sspmSourceControlDestAddrType OBJECT-TYPE
SYNTAX InetAddressType
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The type of Internet address by which the destination
is accessed."
::= { sspmSourceControlEntry 4 }
sspmSourceControlDestAddr OBJECT-TYPE
SYNTAX InetAddress
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The Internet address for the destination. The formatting
of this object is controlled by the
sspmSourceControlDestAddrType object above.
When this object contains a DNS name, then the name is
resolved to an address each time measurement is to be made.
Further, the agent should not cache this address,
but instead should perform the resolution prior to each
measurement."
::= { sspmSourceControlEntry 5 }
sspmSourceControlEnabled OBJECT-TYPE
SYNTAX TruthValue
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"When set to 'true', this test is enabled. When set to
'false', it is disabled."
::= { sspmSourceControlEntry 6 }
sspmSourceControlTimeOut OBJECT-TYPE
SYNTAX SspmMicroSeconds
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"Timeout value for the measurement response. If no
response is received in the time specified, then
the test fails."
::= { sspmSourceControlEntry 7 }
sspmSourceControlSamplingDist OBJECT-TYPE
SYNTAX INTEGER {
deterministic(1),
poisson(2)
}
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"When this attribute is set to 'deterministic', then
packets are generated at with a fixed inter-packet
injection time specified by sspmSourceFrequency.
When this attribute is set to 'Poisson', then packets
are generated with inter-packet injection times sampled
from an exponential distribution with the single
distributional parameter determined by the inverse
frequency)."
::= { sspmSourceControlEntry 8 }
sspmSourceControlFrequency OBJECT-TYPE
SYNTAX SspmMicroSeconds
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The inverse of this value is the rate at which packets
are generated. Refer to sspmSourceSamplingDistribution.
If the value set is less than the value of
sspmGeneralMinFrequency, then the set will fail with an
error-status of 'inconsistentValue'."
::= { sspmSourceControlEntry 9 }
sspmSourceControlFirstSeqNum OBJECT-TYPE
SYNTAX Unsigned32
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The first sequence number of packets to be transmitted."
::= { sspmSourceControlEntry 10 }
sspmSourceControlLastSeqNum OBJECT-TYPE
SYNTAX Unsigned32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The last sequence number transmitted. This value is updated
by the agent after packet generation."
::= { sspmSourceControlEntry 11 }
sspmSourceControlOwner OBJECT-TYPE
SYNTAX OwnerString
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"Name of the management station/application that set
up the test."
::= { sspmSourceControlEntry 12 }
sspmSourceControlStorageType OBJECT-TYPE
SYNTAX StorageType
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The storage type of this sspmSourceControlEntry. If the
value of this object is 'permanent', no objects in this row
need to be writable."
::= { sspmSourceControlEntry 13 }okay so we're picking up right where the source control status object wraps up 💖 the sink side is next, and it's giving receiver energy 🦋 the MIB definitions below are verbatim because implementers need every single character 🫶
sspmSourceControlStatus OBJECT-TYPE
SYNTAX RowStatus
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"Status of this source control entry.
An entry may not exist in the active state unless all
objects in the entry have an appropriate value.
When this attribute has the value of
'active', none of the read-write or read-create attributes
in this table may be modified, with the exception of
sspmSourceControlEnabled."
::= { sspmSourceControlEntry 14 }
--
-- sspmSinkTable
--
-- Contains attributes for configuration of Synthetic
-- Sources for Performance Monitoring sinks, i.e.,
-- sinks for receipt of one-way delay measurements.
--
sspmSink OBJECT IDENTIFIER ::= { sspmMIBObjects 5 }
sspmSinkTable OBJECT-TYPE
SYNTAX SEQUENCE OF SspmSinkEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A table configuring the sink for measurements."
::= { sspmSink 1 }
sspmSinkEntry OBJECT-TYPE
SYNTAX SspmSinkEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The details of a particular sink entry. If the measurement
is a round-trip type, then the sink entry will be on the
same probe as the corresponding sspmSourceEntry. If the
measurement is a one-way, type then the sink entry will be
on a different probe."
INDEX { sspmSinkInstance }
::= { sspmSinkTable 1}
SspmSinkEntry ::= SEQUENCE {
sspmSinkInstance Unsigned32,
sspmSinkType AppLocalIndex,
sspmSinkSourceAddressType InetAddressType,
sspmSinkSourceAddress InetAddress,
sspmSinkExpectedRate SspmMicroSeconds,
sspmSinkEnable TruthValue,
sspmSinkExpectedFirstSequenceNum Unsigned32,
sspmSinkLastSequenceNumber Unsigned32,
sspmSinkLastSequenceInvalid Counter32,
sspmSinkStorageType StorageType,
sspmSinkStatus RowStatus
}
sspmSinkInstance OBJECT-TYPE
SYNTAX Unsigned32 (1..65535)
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"An index. When the measurement is for a round-trip
measurement, then this table entry is on the same probe as
the corresponding sspmSourceEntry, and the value of this
attribute should correspond to the value of
sspmSourceInstance. Management applications configuring
sinks for one-way measurements could define some
scheme whereby the sspmSinkInstance is unique across
all probes. Note that the unique key to this entry is
also constructed with sspmSinkType,
sspmSinkSourceAddressType, and sspmSinkSourceAddress.
To make the implementation simpler, those other
attributes are not included in the index but uniqueness
is still needed to receive all the packets."
::= { sspmSinkEntry 1 }
sspmSinkType OBJECT-TYPE
SYNTAX AppLocalIndex
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The AppLocalIndex value that uniquely identifies the
measurement per the APM-MIB. In order to create a row
in this table, there must be a corresponding row in the
sspmCapabilitiesTable. If there is no corresponding
row in the sspmCapabilitiestable, then the agent will
return an error-status of 'inconsistentValue'."
::= { sspmSinkEntry 2}
sspmSinkSourceAddressType OBJECT-TYPE
SYNTAX InetAddressType
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The type of Internet address of the source."
::= { sspmSinkEntry 3 }
sspmSinkSourceAddress OBJECT-TYPE
SYNTAX InetAddress
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The Internet address of the source. The formatting
of this object is controlled by the sspmSinkSourceAddressType
object above.
This object should be set only to a valid device address
that has been administratively configured into the
device. If a set attempts to set this object to an
address that does not belong (i.e., is not administratively
configured into the device), the set should fail, and the
agent should return a error-status of 'inconsistentValue'."
::= { sspmSinkEntry 4 }
sspmSinkExpectedRate OBJECT-TYPE
SYNTAX SspmMicroSeconds
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The expected rate at which packets will arrive."
::= { sspmSinkEntry 5 }
sspmSinkEnable OBJECT-TYPE
SYNTAX TruthValue
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"Indicates if the sink is enabled or not."
::= { sspmSinkEntry 6 }
sspmSinkExpectedFirstSequenceNum OBJECT-TYPE
SYNTAX Unsigned32
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The expected first sequence number of packets.
This is used by the sink to determine if packets
were lost at the initiation of the test."
::= { sspmSinkEntry 7 }
sspmSinkLastSequenceNumber OBJECT-TYPE
SYNTAX Unsigned32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The last sequence number received."
::= { sspmSinkEntry 8 }
sspmSinkLastSequenceInvalid OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of packets that arrived whose
sequence number was not one plus the value of
sspmSinkLastSequenceNumber."
::= { sspmSinkEntry 9 }
sspmSinkStorageType OBJECT-TYPE
SYNTAX StorageType
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The storage type of this sspmSinkEntry. If the value
of this object is 'permanent', no objects in this row
need to be writable."
::= { sspmSinkEntry 10 }
sspmSinkStatus OBJECT-TYPE
SYNTAX RowStatus
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"Status of this conceptual row.
An entry may not exist in the active state unless all
objects in the entry have an appropriate value.
Once this object is set to active(1), no objects with
MAX-ACCESS of read-create in the sspmSinkTable can
be changed."
::= { sspmSinkEntry 11 }
--
-- Notifications
--
--
-- Conformance information
--
sspmCompliances OBJECT IDENTIFIER ::= { sspmMIBConformance 1 }
sspmGroups OBJECT IDENTIFIER ::= { sspmMIBConformance 2 }
-- Compliance Statements
sspmGeneralCompliance MODULE-COMPLIANCE
STATUS current
DESCRIPTION
"A general compliance that allows all things to be optional."
MODULE -- this module
MANDATORY-GROUPS { sspmGeneralGroup }
GROUP sspmSourceGroup
DESCRIPTION
"The SSPM Source Group is optional."
GROUP sspmSinkGroup
DESCRIPTION
"The SSPM Sink Group is optional."
GROUP sspmUserPassGroup
DESCRIPTION
"The SSPM User Pass Group is optional."
::= { sspmCompliances 1 }
--
-- SSPM Source Compliance
--
sspmSourceFullCompliance MODULE-COMPLIANCE
STATUS current
DESCRIPTION
"A source compliance. Use this compliance when implementing
a traffic-source-only device. This is useful for implementing
devices that probe other devices for intrusive application
monitoring. It is also useful for implementing the source
of one-way tests used with a sink-only device."
MODULE -- this module
MANDATORY-GROUPS { sspmGeneralGroup, sspmSourceGroup }
GROUP sspmUserPassGroup
DESCRIPTION
"The SSPM User Pass Group is optional."
::= { sspmCompliances 2 }
--
-- SSPM Sink Compliance
--
sspmSinkFullCompliance MODULE-COMPLIANCE
STATUS current
DESCRIPTION
"A sink-only compliance. Use this compliance when implementing a
sink-only device. This is useful for devices to receive one-way
measurements."
MODULE -- this module
MANDATORY-GROUPS { sspmGeneralGroup, sspmSinkGroup }
::= { sspmCompliances 3 }
--
-- Groups
--
sspmGeneralGroup OBJECT-GROUP
OBJECTS {
sspmGeneralClockResolution,
sspmGeneralClockMaxSkew,
sspmGeneralClockSource,
sspmGeneralMinFrequency,
sspmCapabilitiesInstance
}
STATUS current
DESCRIPTION
"The objects in the SSPM General Group."
::= { sspmGroups 1 }
sspmSourceGroup OBJECT-GROUP
OBJECTS {
sspmSourceProfileType,
sspmSourceProfilePacketSize,
sspmSourceProfilePacketFillType,
sspmSourceProfilePacketFillValue,
sspmSourceProfileTOS,
sspmSourceProfileFlowLabel,
sspmSourceProfileLooseSrcRteFill,
sspmSourceProfileLooseSrcRteLen,
sspmSourceProfileTTL,
sspmSourceProfileNoFrag,
sspmSourceProfile8021Tagging,
sspmSourceProfileUsername,
sspmSourceProfilePassword,
sspmSourceProfileParameter,
sspmSourceProfileOwner,
sspmSourceProfileStorageType,
sspmSourceProfileStatus,
sspmSourceControlProfile,
sspmSourceControlSrc,
sspmSourceControlDestAddrType,
sspmSourceControlDestAddr,
sspmSourceControlEnabled,
sspmSourceControlTimeOut,
sspmSourceControlSamplingDist,
sspmSourceControlFrequency,
sspmSourceControlFirstSeqNum,
sspmSourceControlLastSeqNum,
sspmSourceControlOwner,
sspmSourceControlStorageType,
sspmSourceControlStatus
}
STATUS current
DESCRIPTION
"The objects in the SSPM Source Group."
::= { sspmGroups 2 }
sspmUserPassGroup OBJECT-GROUP
OBJECTS {
sspmSourceProfileUsername,
sspmSourceProfilePassword
}
STATUS current
DESCRIPTION
"The objects in the SSPM Username and password group."
::= { sspmGroups 3 }
sspmSinkGroup OBJECT-GROUP
OBJECTS {
sspmSinkType,
sspmSinkSourceAddressType,
sspmSinkSourceAddress,
sspmSinkExpectedRate,
sspmSinkEnable,
sspmSinkExpectedFirstSequenceNum,
sspmSinkLastSequenceNumber,
sspmSinkLastSequenceInvalid,
sspmSinkStorageType,
sspmSinkStatus
}
STATUS current
DESCRIPTION
"The objects in the SSPM Sink Group."
::= { sspmGroups 4 }
END8. Security Considerations 🔐✨
Okay bestie, this section is serious, but I'm going to make it cute 💅. This MIB module defines objects that let packets get injected into the network so you can measure performance 🦋. That means the module may hold sensitive network and application data, like user IDs and passwords 😭. If security gets compromised, this module could be a source for denial-of-service attacks and potentially other attacks 💀. We'll go through all of that here.
There are a bunch of management objects in this MIB module with a MAX-ACCESS clause of read-write and/or read-create. In some network environments those objects might be sensitive or vulnerable 🙈. Supporting SET operations in a non-secure environment, without proper protection, can seriously mess with network operations. Here are the tables and objects, and how sensitive or vulnerable they are:
- The
sspmSourceProfileTableholds objects that configure link-level, IP, and application-level data used within test suites. The objects in it with aMAX-ACCESSclause ofread-writeand/orread-createare:sspmSourcePacketSizeconfigures the overall size of the test packets,sspmSourceProfileTOSsets the TOS field in the IPv4 and IPv6 headers,sspmSourceProfileLooseSrcRteFillandsspmSourceProfileLooseSrcRteLengive a list of IPv4 or IPv6 addresses for the loose source route options in the IP headers,sspmSourceProfileFlowLabelsets the Flow Label in the IPv6 header,sspmSourceProfileTTLsets the TTL field in the packet headers,sspmSourceProfileNoFragsets the No Fragment bit in the packet headers,sspmSourceProfile8021Taggingsets the Tag field in the 802.1 headers, andsspmSourceProfileUsernameandsspmSourceProfilePasswordhold the ID and passwords specific to an application test profile.,
- The
sspmSourceControlTableholds objects that configure IP and application-level data used within a given test. The objects in it with aMAX-ACCESSclause ofread-writeand/orread-createare:sspmSourceControlSrccontrols the source IP address used on the test packets,sspmSourceControlDestAddrholds the destination address for the specific test packet,sspmSourceControlTimeout,sspmSourceControlSamplingDist, andsspmSourceControlFrequencycontrol the nature and frequency of the test packet injection onto the network, andsspmSourceControlFirstSeqNumandsspmSourceControlLastSeqNumset the first and last sequence numbers for the specific test.
- The
sspmSinkTableholds objects that configure the recipient of the test packets. Because of that, the objects in this table have no security issues related to them 🎀.
Some attributes configure username and password information for some application-level protocols, as mentioned above. Access to these attributes might give someone unauthorized use of resources 😬. Those attributes are sspmSourceProfileUsername and sspmSourceProfilePassword.
Some attributes configure the size and rate of traffic flows for performance measurements. Access to these can make it easier to use this MIB module in denial-of-service attacks 🚨. It's possible to define a maximum packet rate on the device and show that rate through the sspmSourceFrequency object. This object reflects the maximum acceptable packet rate that a device supporting this MIB module is willing to generate. That puts a bound on setting the test packet rate through the sspmSourceControlFrequency object. The other objects that control aspects of the test packets related to packet size and rate are sspmSourceControlTimeOut, sspmSourceControlSamplingDist, and sspmSourceControlFrequency.
The objects sspmSourceControlSrc, sspmSourceControlDestAddr, sspmSourceControlLooseSrcRteFill, and sspmSourceControlLooseSrcRteLen control how the source and destination addresses get set in the packet headers, and how the packets get routed 🗺️. The device should not allow source addresses on the test packets other than the ones administratively configured onto the device. This is controlled by using the syntax InterfaceIndexOrZero for controlling the source address through the sspmSourceControlSrc object.
It's really important to control even GET access to these objects, and possibly to encrypt their values when sending them over the network via SNMP 🔒. Not all versions of SNMP have features for such a secure environment.
SNMP versions prior to SNMPv3 didn't include adequate security 🙃. Even if the network itself is secure (for example, by using IPSec), there's still no control over who on that secure network gets to access and GET/SET (read/change/create/delete) the objects in this MIB module.
It is RECOMMENDED that implementers consider the security features provided by the SNMPv3 framework (see [RFC3410], section 8), including full support for the SNMPv3 cryptographic mechanisms (for authentication and privacy) 🛡️.
Further, deploying SNMP versions prior to SNMPv3 is NOT RECOMMENDED. Instead, it is RECOMMENDED to deploy SNMPv3 and to enable cryptographic security 💜. Then it becomes a customer/operator responsibility to make sure the SNMP entity giving access to an instance of this MIB module is properly configured. Access to the objects should only go to principals (users) who have legitimate rights to GET or SET (change/create/delete) them 👑.
9. Acknowledgements 🫶
This document was produced by the IETF Remote Network Monitoring Working Group. The editors gratefully acknowledge the comments of the following individuals: Andy Bierman, Lester D'Souza, Jim McQuaid, and Steven Waldbusser 🌸.
10. Normative References 📚
[RFC791] Postel, J., "Internet Protocol", STD 5, RFC 791, September 1981.
[RFC1305] Mills, D., "Network Time Protocol (Version 3) Specification, Implementation and Analysis", RFC 1305, March 1992.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC2287] Krupczak, C. and J. Saperia, "Definitions of System-Level Managed Objects for Applications", RFC 2287, February 1998.
[RFC2460] Deering, S. and R. Hinden, "Internet Protocol, Version 6 (IPv6) Specification", RFC 2460, December 1998.
[RFC2578] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J., Rose, M., and S. Waldbusser, "Structure of Management Information Version 2 (SMIv2)", STD 58, RFC 2578, April 1999.
[RFC2579] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J., Rose, M., and S. Waldbusser, "Textual Conventions for SMIv2", STD 58, RFC 2579, April 1999.
[RFC2580] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J., Rose, M., and S. Waldbusser, "Conformance Statements for SMIv2", STD 58, RFC 2580, April 1999.
[RFC2680] Almes, G., Kalidindi, S., and M. Zekauskas, "A One-Way Packet Loss Metric for IPPM" RFC 2680, September 1999.
[RFC2863] McCloghrie, K. and F. Kastenholz, "The Interfaces Group MIB", RFC 2863, June 2000.
[RFC3291] Daniele, M., Haberman, B., Routhier, S., and J. Schoenwaelder, "Textual Conventions for Internet Network Addresses ", RFC 3291, May 2002.
[RFC3393] Demichelis, C. and P. Chimento, "IP Packet Delay Variation Metric for IP Performance Metrics (IPPM)", RFC 3393, November 2002.
[RFC3432] Raisanen, V., Grotefeld, G., and A. Morton, "Network Performance Measurement with Periodic Streams", RFC 3432, November 2002.
[RFC3577] Waldbusser, S., Cole, R.G., Kalbfleisch, C., and D. Romascanu, "Introduction to the Remote Monitoring (RMON) Family of MIB Modules", RFC 3577, August 2003.
[RFC3729] Waldbusser, S., "Application Performance Measurement MIB", RFC 3729, March 2004.
[RFC4150] Dietz, R. and R. Cole, "Transport Performance Metrics MIB", RFC 4150, August 2005.
11. Informative References 🦋
[RFC1272] Mills, C., Hirsch, G., and G. Ruth, "Internet Accounting Background", RFC 1272, November 1991.
[RFC2021] Waldbusser, S., "Remote Network Monitoring Management Information Base Version 2 using SMIv2", RFC 2021, January 1997.
[RFC2722] Browlee, N., Mills, C., and G. Ruth, "Traffic Flow Measurement: Architecture", RFC 2722, October 1999.
[RFC2720] Brownlee, N. "Traffic Flow Measurement: Meter MIB", RFC 2720, October 1999.
[RFC2330] Paxson, V., Almes, G., Mahdavi, J., and M. Mathis, "Framework for IP Performance Metrics", RFC 2330, May 1998.
[RFC2564] Kalbfleisch, C., Krupczak, C., Presuhn, R., and J. Saperia, "Application Management MIB", RFC 2564, May 1999.
[RFC2594] Hazewinkel, H., Kalbfleisch, C., and J. Schoenwaelder, "Definitions of Managed Objects for WWW Services", RFC 2594, May 1999.
[RFC3165] Levi, D. and J. Schoenwaelder, "Definitions of Managed Objects for the Delegation of Management Scripts", RFC 3165, August 2001.
[RFC2678] Mahdavi, J. and V. Paxson, "IPPM metrics for Measuring Connectivity", RFC 2678, September 1999.
[RFC2679] Almes, G., Kalidindi, S., and M. Zekauskas, "A One-way Delay Metric for IPPM", RFC 2679, September 1999.
[RFC2681] Almes, G., Kalidindi, S., and M. Zekauskas, "A Round-Trip Delay Metric for IPPM", RFC 2681, September 1999.
[RFC2819] Waldbusser, S., "Remote Network Monitoring Management Information Base", STD 59, RFC 2819, February 1995.
[RFC2925] White, K., "Definitions of Managed Objects for Remote Ping, Traceroute, and Lookup Operations", RFC 2925, September 2000.
[RFC2982] Kavasseri, R., "Distributed Management Expression MIB", RFC 2982, October 2000.
[RFC3410] Case, J., Mundy, R., Partain, D., and B. Stewart, "Introduction and Applicability Statements for Internet-Standard Management Framework", RFC 3410, December 2002.
[RFC3512] MacFaden, M., Partain, D., Saperia, J., and W. Tackabury, "Configuring Networks and Devices with Simple Network Management Protocol (SNMP)", RFC 3512, April 2003.
[EBT] Mathis, M. and M. Allman, "Empirical Bulk Transfer Capacity", Work in Progress, October 1999.
[ODP] Shalunov, S., Teitelbaum, B., and M. Zekauskas, "A One-Way Delay Protocol for IP Performance Measurements", Work in Progress, December 2000.
[RFC4011] Waldbusser, S., Saperia, J., and T. Hongal, "Policy Based Management MIB", RFC 4011, March 2005.
[TBT] Mathis, M., "TReno Bulk transfer Capacity", Work in Progress, February 1999.
Authors' Addresses ✨
Carl W. Kalbfleisch 🎀 Consultant
EMail: ietf@kalbfleisch.us
Robert G. Cole 🦋 Johns Hopkins University Applied Physics Laboratory MP2-170 11100 Johns Hopkins Road Laurel, MD 20723-6099 USA
Tel: +1 443-778-6951 EMail: robert.cole@jhuapl.edu
Dan Romascanu 🌸 Avaya Atidim Technology Park, Bldg. #3 Tel Aviv, 61131 Israel
Tel: +972-3-645-8414 EMail: dromasca@avaya.com
Full Copyright Statement 💜
Copyright (C) The Internet Society (2005).
This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.
This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property 🔥
Okay so the IETF is being very clear here, bestie 🫶 It takes no position on whether any Intellectual Property Rights or other rights that someone might claim over the technology in this document are valid or in scope. It also doesn't say whether a license under those rights is or isn't available. And it hasn't made any independent effort to find out what those rights are, so don't go assuming it has 🙈 If you want the procedures for rights in RFC documents, check out BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat are a thing, and so are any assurances of licenses that are going to be made available. You can also get the result of an attempt to obtain a general license or permission for implementers or users to use those proprietary rights. All of that lives in the IETF on-line IPR repository at http://www.ietf.org/ipr ✨
The IETF also invites any interested party to bring its attention to any copyrights, patents or patent applications, or other proprietary rights that may cover technology required to implement this standard. Send that info to the IETF at ietf-ipr@ietf.org 💅
Acknowledgement 🌈
Funding for the RFC Editor function is currently provided by the Internet Society. Thank you to the Internet Society for keeping the RFC Editor running, because honestly the whole Internet runs on these documents 🧚💖
📦 where this page comes from
- ietf: rfc4149 2005-08
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms