RFC 4363
Definitions of Managed Objects for Bridges with Traffic Classes, Multicast Filtering, and Virtual LAN Extensions
RFC 4363: Definitions of Managed Objects for Bridges with Traffic Classes, Multicast Filtering, and Virtual LAN Extensions ✨
Okay bestie, let's get the title block sorted first 🎀. This one comes from the Network Working Group, and it's a Standards Track document, so it's an actual Internet standard and not just a vibe. The authors are D. Levi from Nortel Networks and D. Harrington from Effective Software, and it's dated January 2006 📅. It obsoletes RFC 2674 💅, which means RFC 2674 is retired and this one takes its place. (It doesn't mention updating anything else in the title block.)
Okay the title is literally giving: bridges, traffic classes, multicast filtering, and VLAN extensions all in one MIB spec 🌈
Status of This Memo
Here's the vibe check on what this document is. It specifies an Internet standards track protocol for the Internet community, and it's basically asking everyone to talk about it and suggest improvements 🗣️. If you want to know where this protocol stands on the official standardization ladder, go check the current edition of the "Internet Official Protocol Standards" (STD 1) ✅. Also, distribution of this memo is unlimited, so share the tea 🍵.
Copyright Notice
Copyright (C) The Internet Society (2006). Mine, yours, the Internet Society's 🔒.
Abstract
Okay so this memo defines a chunk of the Management Information Base (MIB) 🧠. The MIB is what network management protocols use to poke at stuff in TCP/IP-based internets 🌐. Specifically, it defines two MIB modules for managing MAC bridges. Those bridges come from IEEE 802.1D-1998 (TM) MAC Bridges and IEEE 802.1Q-2003 (TM) Virtual LAN (VLAN) standards, and they do the job of bridging between Local Area Network (LAN) segments 🌉.
The first MIB module handles the 'Traffic Classes' and 'Enhanced Multicast Filtering' components from IEEE 802.1D-1998 and P802.1t-2001 (TM) ✨. The second one handles VLANs, which are covered by IEEE 802.1Q-2003, P802.1u (TM), and P802.1v (TM) 💜.
Transparent bridging is supported 🦋. On top of that, these objects are also set up to work for bridges connected by subnetworks other than LAN segments, so they're not stuck in one lane 🛣️.
Last but not least, this memo supplements RFC 4188 and obsoletes RFC 2674 🫶.
Table of Contents
1. The Internet-Standard Management Framework ......................3
2. Overview ........................................................3
2.1. Scope ......................................................3
3. Structure of MIBs ...............................................4
3.1. Structure of Extended Bridge MIB Module ....................5
3.1.1. Relationship to IEEE 802.1D-1998 Manageable
Objects .............................................5
3.1.2. Relationship to IEEE 802.1Q Manageable Objects ......6
3.1.3. The dot1dExtBase Subtree ............................7
3.1.4. The dot1dPriority Subtree ...........................7
3.1.5. The dot1dGarp Subtree ...............................7
3.1.6. The dot1dGmrp Subtree ...............................7
3.1.7. The dot1dTpHCPortTable ..............................8
3.1.8. The dot1dTpPortOverflowTable ........................8
3.2. Structure of Virtual Bridge MIB module .....................8
3.2.1. Relationship to IEEE 802.1Q Manageable Objects ......8
3.2.2. The dot1qBase Subtree ..............................12
3.2.3. The dot1qTp Subtree ................................12
3.2.4. The dot1qStatic Subtree ............................12
3.2.5. The dot1qVlan Subtree ..............................12
3.3. Textual Conventions .......................................12
3.4. Relationship to Other MIBs ................................13
3.4.1. Relationship to the SNMPv2-MIB .....................13
3.4.2. Relationship to the IF-MIB .........................13
3.4.2.1. Layering Model ............................14
3.4.2.2. ifStackTable ..............................15
3.4.2.3. ifRcvAddressTable .........................15
3.4.3. Relationship to the BRIDGE-MIB .....................16
3.4.3.1. The dot1dBase Subtree .....................16
3.4.3.2. The dot1dStp Subtree ......................16
3.4.3.3. The dot1dTp Subtree .......................16
3.4.3.4. The dot1dStatic Subtree ...................17
3.4.3.5. Additions to the BRIDGE-MIB ...............17
4. Definitions for Extended Bridge MIB ............................18
5. Definitions for Virtual Bridge MIB .............................42
6. Acknowledgements ...............................................91
7. Security Considerations ........................................91
8. Normative References ...........................................94
9. Informative References .........................................95
Appendix A. Email from Tony Jeffrey from IEEE .....................961. The Internet-Standard Management Framework ✨
If you want the full tour of the current Internet-Standard Management Framework docs, check out section 7 of RFC 3410 [RFC3410] 🗺️.
Managed objects live in a virtual information store called the Management Information Base, or MIB 🗄️. You usually get at MIB objects through the Simple Network Management Protocol (SNMP) 📡. The objects are defined using the Structure of Management Information (SMI) 🧩. This memo has a MIB module that's compliant with SMIv2, which is described in STD 58, RFC 2578 [RFC2578], STD 58, RFC 2579 [RFC2579] and STD 58, RFC 2580 [RFC2580] 💖.
2. Overview 🌸
Bridges are super common in networks 🌷. They connect Local Area Network segments below the network layer, and people often call them 'layer 2 switches' 🔀.
Transparent bridging is defined in IEEE 802.1D-1998 [802.1D], and its managed objects are in the BRIDGE-MIB [BRIDGE-MIB] 🫧.
IEEE 802.1Q-2003 [802.1Q] adds to the original IEEE 802.1D to support 'virtual bridged LANs' 🦄. The idea is that one physical bridged LAN can run multiple logical bridged LANs, and each one acts about the same as an IEEE 802.1D bridge would 🪄. These Virtual LANs (VLANs) are a huge part of switched LAN networks 👑. A VLAN is basically a group of end-stations spread across multiple LAN segments that can talk to each other like they're all on one LAN 🫶.
IEEE 802.1Q has two flavours of VLAN 🍓. The first is port-based, where membership depends on which bridge port the data frames came in on 🚪. The second is port-and-protocol-based, where membership depends on both the bridge port the frames arrived on and the protocol identifier in the frame 🧁. This memo only defines the objects needed to manage port-based VLANs in bridge entities 💅.
This memo supplements RFC 4188 [BRIDGE-MIB] and obsoletes RFC 2674 [RFC2674] 🎀.
2.1. Scope 🔍
The MIB modules in this document are meant to be a comprehensive set of managed objects that tries to match what IEEE 802.1D and IEEE 802.1Q define 📚. But, to stay in the spirit of the SNMP Framework, a subjective judgement was made to leave out the objects from those standards that are the most 'costly' to implement in an agent and the least 'essential' for fault and configuration management 🙈. The omissions are described in Section 3 below 👀.
Historical note:
The original BRIDGE-MIB [RFC1493] used these principles to decide whether an object made it into the BRIDGE-MIB module 🕰️:
- Start with a small set of essential objects and add only as further objects are needed.
- Require that objects be essential for either fault or configuration management.
- Consider evidence of current use and/or utility.
- Limit the total number of objects.
- Exclude objects that are simply derivable from others in this or other MIBs.
- Avoid causing critical sections to be heavily instrumented. The guideline that was followed is one counter per critical section per layer.
3. Structure of MIBs 🧱
This document defines objects that supplement the ones in the BRIDGE-MIB module [BRIDGE-MIB] 💫. Section 3.4.3 of the present document has some recommendations about how devices that use the enhancements defined here should use the BRIDGE-MIB objects 📝.
There's an extended bridge MIB module, P-BRIDGE-MIB, that manages the traffic class and multicast filtering enhancements from IEEE 802.1D-1998 [802.1D]. It also covers the Restricted Group Registration control from IEEE P802.1t [802.1t] 🌈.
There's also a virtual bridge MIB module, Q-BRIDGE-MIB, that manages the Virtual LAN bridging enhancements from IEEE 802.1Q-2003 [802.1Q]. That includes the Restricted VLAN Registration control from IEEE P802.1u [802.1u], and the VLAN Classification by Protocol and Port enhancement from IEEE P802.1v [802.1v] 🦋.
3.1. Structure of Extended Bridge MIB Module 🧩
Objects in this MIB are sorted into subtrees, and each subtree is a set of related objects 🌳. The overall structure and how objects get assigned to their subtrees is shown below 👇.
More parts are coming, bestie, so stay tuned 🎀💖
3.1.1. Relationship to IEEE 802.1D-1998 Manageable Objects ✨
okay so this section is basically your cheat sheet 📝 It cross-references the objects in IEEE 802.1D-1998 [802.1D] and also spills the tea on which ones we didn't bring into this MIB module 🙈
some IEEE 802.1D-1998 objects went into the virtual bridge MIB module instead of this one 🫶 the entries in dot1qTpGroupTable, dot1qForwardAllTable, and dot1qForwardUnregisteredTable need virtual bridged LANs with extra indexing (e.g., per-VLAN, per-Filtering-Database (per-FDB)), so they aren't defined here 💅
devices that don't do virtual bridged LANs but DO do the Extended Forwarding Services from IEEE 802.1D (aka dynamic learning of multicast group addresses and group service requirements in the filtering database) should implement these tables with a fixed value for dot1qFdbId (the value 1 is recommended) or dot1qVlanIndex (the value 1 is recommended). and devices that support Extended Filtering Services should support dot1qTpGroupTable, dot1qForwardAllTable, and dot1qForwardUnregisteredTable 🌸
here's the mapping table, lined up nice and neat:
Extended Bridge MIB Name IEEE 802.1D-1998 Name
dot1dExtBase Bridge
dot1dDeviceCapabilities
dot1dExtendedFilteringServices
dot1dTrafficClasses
dot1dTrafficClassesEnabled
dot1dGmrpStatus .ApplicantAdministrativeControl
dot1dPriority
dot1dPortPriorityTable
dot1dPortDefaultUserPriority .UserPriority
dot1dPortNumTrafficClasses
dot1dUserPriorityRegenTable .UserPriorityRegenerationTable
dot1dUserPriority
dot1dRegenUserPriority
dot1dTrafficClassTable .TrafficClassTable
dot1dTrafficClassPriority
dot1dTrafficClass
dot1dPortOutboundAccessPriorityTable
.OutboundAccessPriorityTable
dot1dPortOutboundAccessPriority
dot1dGarp
dot1dPortGarpTable
dot1dPortGarpJoinTime .JoinTime
dot1dPortGarpLeaveTime .LeaveTime
dot1dPortGarpLeaveAllTime .LeaveAllTime
dot1dGmrp
dot1dPortGmrpTable
dot1dPortGmrpStatus .ApplicantAdministrativeControl
dot1dPortGmrpFailedRegistrations .FailedRegistrations
dot1dPortGmrpLastPduOrigin .OriginatorOfLastPDU
dot1dPortRestrictedGroupRegistration
Restricted Group Registration
(Ref. IEEE 802.1t 10.3.2.3)
dot1dTp
dot1dTpHCPortTable
dot1dTpHCPortInFrames .BridgePort.FramesReceived
dot1dTpHCPortOutFrames .ForwardOutBound
dot1dTpHCPortInDiscards .DiscardInbound
dot1dTpPortOverflowTable
dot1dTpPortInOverflowFrames .BridgePort.FramesReceived
dot1dTpPortOutOverflowFrames .ForwardOutBound
dot1dTpPortInOverflowDiscards .DiscardInboundnow the IEEE 802.1D-1998 management objects that didn't make the cut in the Bridge MIB, and why 👀
IEEE 802.1D-1998 Object Disposition
Bridge.StateValue not considered useful
Bridge.ApplicantAdministrativeControl
not provided per-attribute
(e.g., per-VLAN, per-Group).
Only per-{device,port,application}
control is provided in this MIB.
notify group registration failure not considered useful
(IEEE 802.1t 14.10.1.2)3.1.2. Relationship to IEEE 802.1Q Manageable Objects 🎀
this part has section number cross-references to the manageable objects in IEEE 802.1Q-2003 [802.1Q] 📚 They're in this MIB because they're a natural fit next to the IEEE 802.1D objects they hang out with 🍓
Extended Bridge MIB Name IEEE 802.1Q-2003 Section and Name
dot1dExtBase Bridge
dot1dDeviceCapabilities
dot1qStaticEntryIndividualPort 5.2 implementation options
dot1qIVLCapable
dot1qSVLCapable
dot1qHybridCapable
dot1qConfigurablePvidTagging 12.10.1.1 read bridge vlan
config
dot1dLocalVlanCapable
dot1dPortCapabilitiesTable
dot1dPortCapabilities
dot1qDot1qTagging 5.2 implementation options
dot1qConfigurableAcceptableFrameTypes
5.2 implementation options
dot1qIngressFiltering 5.2 implementation options3.1.3. The dot1dExtBase Subtree 🧚
this subtree holds the objects that apply to ALL bridges doing the traffic class and multicast filtering features of IEEE 802.1D-1998 [802.1D] 💖 It also includes per-device configuration for the Generic Attribute Registration Protocol (GARP) and the GARP Multicast Registration Protocol (GMRP) 🌈
3.1.4. The dot1dPriority Subtree 💜
this one is all about configuring and checking priority-based queuing in a bridge 🔥 That covers per-port user_priority treatment, mapping user_priority in frames into internal traffic classes, and outbound user_priority and access_priority ⭐
3.1.5. The dot1dGarp Subtree 🦋
this subtree has the objects for configuring and reporting on how the Generic Attribute Registration Protocol (GARP) operates 🫧
3.1.6. The dot1dGmrp Subtree 🌷
this subtree has the objects for configuring and reporting on how the GARP Multicast Registration Protocol (GMRP) operates 💅
3.1.7. The dot1dTpHCPortTable ✨
this table extends the dot1dTp subtree from the BRIDGE-MIB [BRIDGE-MIB] and holds the objects for reporting port-bridging statistics on high-capacity network interfaces 🚀
3.1.8. The dot1dTpPortOverflowTable 🫶
this table also extends the dot1dTp subtree from the BRIDGE-MIB [BRIDGE-MIB] 📦 It holds the objects for reporting the upper bits of port-bridging statistics on high-capacity network interfaces, for when 32-bit counters aren't enough 🔢
3.2. Structure of Virtual Bridge MIB module 🌈
the objects in this MIB are sorted into subtrees, and each subtree is a set of related objects 🗂️ The overall layout and which objects go in which subtree is shown below. some manageable objects defined in the BRIDGE-MIB [BRIDGE-MIB] need different indexing when they're used in a VLAN bridging environment 🙃 So those objects get effectively duplicated by new objects with different indexing, and those new ones are defined in the Virtual Bridge MIB 👑
3.2.1. Relationship to IEEE 802.1Q Manageable Objects ✨
okay so this section is basically the cheat sheet 📋 that maps every Virtual Bridge MIB object back to the clause 12 section of IEEE 802.1Q-2003 [802.1Q] where it came from. it also lists the 802.1Q objects that were left out of this MIB because they weren't considered necessary 🫶
💅 heads up: unlike IEEE 802.1D-1998, IEEE 802.1Q-2003 [802.1Q] never gave exact syntax for its managed objects. so the numbers below point at the descriptions of the management operations in clause 12 of that doc, not at real object definitions.
Virtual Bridge MIB object IEEE 802.1Q-2003 Reference
dot1qBase
dot1qVlanVersionNumber 12.10.1.1 read bridge vlan config
dot1qMaxVlanId 12.10.1.1 read bridge vlan config
dot1qMaxSupportedVlans 12.10.1.1 read bridge vlan config
dot1qNumVlans
dot1qGvrpStatus 12.9.2.1/2 read/set garp
applicant controls
dot1qTp
dot1qFdbTable
dot1qFdbId
dot1qFdbDynamicCount 12.7.1.1.3 read filtering d/base
dot1qTpFdbTable
dot1qTpFdbAddress
dot1qTpFdbPort
dot1qTpFdbStatus
dot1qTpGroupTable 12.7.7.1 read filtering entry
dot1qTpGroupAddress
dot1qTpGroupEgressPorts
dot1qTpGroupLearnt
dot1qForwardAllTable 12.7.7.1 read filtering entry
dot1qForwardAllPorts
dot1qForwardAllStaticPorts
dot1qForwardAllForbiddenPorts
dot1qForwardUnregisteredTable 12.7.7.1 read filtering entry
dot1qForwardUnregisteredPorts
dot1qForwardUnregisteredStaticPorts
dot1qForwardUnregisteredForbiddenPorts
dot1qStatic
dot1qStaticUnicastTable 12.7.7.1 create/delete/read
filtering entry
12.7.6.1 read permanent database
dot1qStaticUnicastAddress
dot1qStaticUnicastReceivePort
dot1qStaticUnicastAllowedToGoTo
dot1qStaticUnicastStatus
dot1qStaticMulticastTable 12.7.7.1 create/delete/read
filtering entry
12.7.6.1 read permanent database
dot1qStaticMulticastAddress
dot1qStaticMulticastReceivePort
dot1qStaticMulticastStaticEgressPorts
dot1qStaticMulticastForbiddenEgressPorts
dot1qStaticMulticastStatus
dot1qVlan
dot1qVlanNumDeletes
dot1qVlanCurrentTable 12.10.2.1 read vlan configuration
12.10.3.5 read VID to FID
allocations
12.10.3.6 read FID allocated to
VID
12.10.3.7 read VIDs allocated to
FID
dot1qVlanTimeMark
dot1qVlanIndex
dot1qVlanFdbId
dot1qVlanCurrentEgressPorts
dot1qVlanCurrentUntaggedPorts
dot1qVlanStatus
dot1qVlanCreationTime
dot1qVlanStaticTable 12.7.7.1/2/3 create/delete/read
filtering entry
12.7.6.1 read permanent database
12.10.2.2 create vlan config
12.10.2.3 delete vlan config
dot1qVlanStaticName 12.4.1.3 set bridge name
dot1qVlanStaticEgressPorts
dot1qVlanForbiddenEgressPorts
dot1qVlanStaticUntaggedPorts
dot1qVlanStaticRowStatus
dot1qNextFreeLocalVlanIndex
dot1qPortVlanTable 12.10.1.1 read bridge vlan
configuration
dot1qPvid 12.10.1.2 configure PVID values
dot1qPortAcceptableFrameTypes 12.10.1.3 configure acceptable
frame types parameter
dot1qPortIngressFiltering 12.10.1.4 configure ingress
filtering parameters
dot1qPortGvrpStatus 12.9.2.2 read/set garp applicant
controls
dot1qPortGvrpFailedRegistrations
dot1qPortGvrpLastPduOrigin
dot1qPortRestrictedVlanRegistration
IEEE 802.1u 11.2.3.2.3
Restricted VLAN Registration
dot1qPortVlanStatisticsTable 12.6.1.1 read forwarding port
counters
dot1qTpVlanPortInFrames
dot1qTpVlanPortOutFrames
dot1qTpVlanPortInDiscards
dot1qTpVlanPortInOverflowFrames
dot1qTpVlanPortOutOverflowFrames
dot1qTpVlanPortInOverflowDiscards
dot1qPortVlanHCStatisticsTable 12.6.1.1 read forwarding port
counters
dot1qTpVlanPortHCInFrames
dot1qTpVlanPortHCOutFrames
dot1qTpVlanPortHCInDiscards
dot1qLearningConstraintsTable 12.10.3.1/3/4 read/set/delete
vlan learning constraints
12.10.3.2 read vlan learning
constraints for VID
dot1qConstraintVlan
dot1qConstraintSet
dot1qConstraintType
dot1qConstraintStatus
dot1qConstraintSetDefault
dot1qConstraintTypeDefault
dot1vProtocol IEEE 802.1v Reference:
dot1vProtocolGroupTable 8.6.4 Protocol Group Database,
8.6.2 Protocol Template
dot1vProtocolTemplateFrameType
dot1vProtocolTemplateProtocolValue
dot1vProtocolGroupId 8.6.3 Protocol Group Identifier
dot1vProtocolGroupRowStatus
dot1vProtocolPortTable 8.4.4 VID Set for each Port
dot1vProtocolPortGroupId
dot1vProtocolGroupVid
dot1vProtocolPortRowStatusnow the other half 🥺 these are the 802.1Q management objects that the Bridge MIB deliberately skipped, and why:
The following IEEE 802.1Q management objects have not been included
in the Bridge MIB for the indicated reasons.
IEEE 802.1Q-2003 Operation Disposition
reset bridge (12.4.1.4) not considered useful
reset vlan bridge (12.10.1.5) not considered useful
read forwarding port counters (12.6.1.1)
discard on error details not considered useful
read permanent database (12.7.6.1)
permanent database size not considered useful
number of static filtering count rows in
entries dot1qStaticUnicastTable +
dot1qStaticMulticastTable
number of static VLAN count rows in
registration entries dot1qVlanStaticTable
read filtering entry range use GetNext operation.
(12.7.7.4)
read filtering database (12.7.1.1)
filtering database size not considered useful
number of dynamic group address count rows applicable to each
entries (12.7.1.3) FDB in dot1dTpGroupTable
read garp state (12.9.3.1) not considered useful
notify vlan registration failure not considered useful
(12.10.1.6)
notify learning constraint violation
(12.10.3.10) not considered useful3.2.2. The dot1qBase Subtree 🌸
this subtree is the group chat for everything that applies to any bridge running IEEE 802.1Q virtual LANs 🫧
3.2.3. The dot1qTp Subtree 🦋
this one handles the stuff that controls transparent bridging and shows how it's doing 📊 it covers managing the dynamic Filtering Databases for both unicast and multicast forwarding. this subtree will be implemented by all bridges that do destination-address filtering 💜
3.2.4. The dot1qStatic Subtree 🎀
this is where the static configuration lives for transparent bridging ✨ it covers managing the static entries in the Filtering Databases for both unicast and multicast forwarding 🧚
3.2.5. The dot1qVlan Subtree 👑
this subtree is all about configuring the VLANs a bridge knows about and reporting their status 🌈 that includes the statically configured VLANs and the ones found some other way, like through GARP VLAN Registration Protocol (GVRP). it also handles the per-port VLAN objects, reports traffic statistics, and manages the VLAN Learning Constraints 💅
3.3. Textual Conventions 🍓
so a bunch of Working Groups have already written standards-track MIB documents (like [RFC2613] and [RFC3318]) with objects and Textual Conventions for a Virtual Local Area Network Identifier (VLAN-ID) [802.1Q]. newer docs keep popping up too (like [RFC4323] and [RFC4149]) 🙈 the tea is that they all define the same info in different ways, which is confusing and extra complicated 💀
to fix that, the Q-BRIDGE-MIB defines three new textual conventions: VlanIdOrAny, VlanIdOrNone, and VlanIdOrAnyOrNone. other MIB modules should (re)use these so every one of them represents a VLAN-ID the same way 🫶
these conventions let an object point at a specific VLAN, any VLAN, or no VLAN at all 🔥 for example, picture an object with a SYNTAX of VlanIdOrAnyOrNone that says which VLAN to accept packets of a certain protocol on. that object could be set to accept those packets with one specific 802.1q tag value, with any 802.1q tag value, or with no 802.1q tag at all 🦋
✨ important: any object that uses one of these textual conventions should clarify what "any VLAN" and/or "no VLAN" mean in its DESCRIPTION clause.
3.4. Relationship to Other MIBs 🧚
like we said above, some IEEE 802.1D management objects didn't make it into this MIB, because they overlap with objects in other MIBs that apply to a bridge running this MIB module 🫶
3.4.1. Relationship to the SNMPv2-MIB 💖
the SNMPv2-MIB [RFC3418] defines objects that work for managed devices in general 🌸 these apply to the whole device, whether bridging is its only job or just one of its jobs 🍓
full support for the 802.1D management objects requires that the SNMPv2-MIB objects sysDescr and sysUpTime be implemented 🔥 also, compliance with the current SNMPv2-MIB module needs extra objects and notifications too, as specified in RFC 3418 [RFC3418] 💅
3.4.2. Relationship to the IF-MIB
okay so the IF-MIB, [RFC2863], says any MIB that's an adjunct of it has to clarify certain areas inside the IF-MIB 💅. Those areas were left vague on purpose so the IF-MIB wouldn't over-constrain things and accidentally rule out managing certain media types 🦋.
The IF-MIB lists several areas that a media-specific MIB has to clarify. Each one gets its own subsection below 🎀. If you're the implementor, go read the IF-MIB to get the general vibe of what these areas are for 📖.
The IF-MIB [RFC2863] defines managed objects for managing network interfaces. A network interface is considered attached to a 'subnetwork' 🌸. (Quick side note: don't mix this up with 'subnet', which is an addressing partitioning scheme in the Internet protocol suite 🙈.) This memo uses the term 'segment' for such a subnetwork, whether it's an Ethernet segment, a 'ring', a WAN link, or even an X.25 virtual circuit 🧚.
Full support for the 802.1D management objects requires that the IF-MIB objects ifIndex, ifType, ifDescr, ifPhysAddress, and ifLastChange are implemented 💖. Also, compliance with the current IF-MIB module needs extra objects and notifications too, as specified in RFC 2863 [RFC2863] ✨.
This Extended Bridge MIB is built on the idea of ports on a bridge 🌈. Each port is tied to one interface from the 'interfaces' subtree (one row in ifTable), and most of the time each port maps to a different interface 💜. But sometimes several ports share the same interface 👑. Picture several ports, each one-to-one with a bunch of X.25 virtual circuits, all living on the same interface 🦋.
Every port gets a unique port number 🎀. A port number doesn't have to match up with an interface number, but in the simple case the port number has the same value as the interface's interface number 💅. Port numbers fall in the range (1..dot1dBaseNumPorts) 🔥.
Some entities do other stuff on top of bridging, like sending and receiving data on their interfaces 🌸. In those cases, only a subset of the data sent or received on an interface is in the bridging functionality's domain 🧚. That subset is split up by protocol, so some protocols get bridged and others don't 🙈. Like, an entity that only bridges would bridge every protocol ✨, but an entity that does IP routing on IP datagrams and bridges everything else would only count the non-IP data as bridged 💀.
So this Extended Bridge MIB (and especially its counters) only applies to the part of an entity's interface data that's sent or received for a bridged protocol 😭. All of that data goes through the bridge's ports 💖.
3.4.2.1. Layering Model
This memo goes with the IF-MIB [RFC2863] reading of the Interfaces Subtree 🦋. The IF-MIB says the interfaces table (ifTable) holds info on the managed resource's interfaces, and every sub-layer below the internetwork layer of a network interface counts as an interface 🌈.
This document doesn't assume that VLANs instantiated as entries in dot1qVlanCurrentTable are also represented as entries in ifTable 🙅♀️. That's true no matter whether they came from management configuration through dot1qVlanStaticTable or from dynamic means (like GVRP) 💅.
If an entity has higher-layer protocol entities (for example, IP-layer interfaces that send and receive traffic to and from a VLAN), those should show up in ifTable as interfaces of type propVirtual(53) 🎀. Don't use protocol-specific types like l3ipxvlan(137) here 🙈, because there's no guarantee the bridge does any protocol filtering before it hands data up to these virtual interfaces 💀.
3.4.2.2. ifStackTable
The IF-MIB [RFC2863] also defines a table called 'ifStackTable' for describing how logical interfaces relate to each other inside an entity 🧚. People are expected to use this table to show how things like IP interfaces bind to physical ports 🌸. Still, VLANs make it a bit less than perfect for showing connectivity 😭.
The ifStackTable can't capture the full power of IEEE 802.1Q VLAN bridging 💅, because 802.1Q distinguishes between VLAN bindings on 'ingress' to a port and 'egress' from a port 🔥. Those relationships might or might not be symmetrical, but Interface MIB Evolution assumes a symmetrical binding for transmit and receive 🙈. So other manageable objects are needed for configuring which ports are members of which VLANs 👑.
3.4.2.3. ifRcvAddressTable
This table holds all MAC addresses (unicast, multicast, and broadcast) that an interface will receive packets for and then forward up to a higher-layer entity for local consumption 💖. Heads up: it does not include addresses for data-link layer control protocols like Spanning-Tree, GMRP, or GVRP 🙅♀️. The address format in ifRcvAddressAddress is the same as for ifPhysAddress ✨.
This table also doesn't include unicast or multicast addresses that are accepted for possible forwarding out some other port 🦋. It's explicitly not meant to be a bridge address filtering mechanism 💅.
3.4.3. Relationship to the BRIDGE-MIB
This section explains how objects in the BRIDGE-MIB module [BRIDGE-MIB] should be represented for devices that implement these extensions 🌈. Some of the old objects are less useful on such devices, but they still have to be implemented for backwards compatibility reasons 🥹.
3.4.3.1. The dot1dBase Subtree
This subtree has objects that apply to all types of bridges 🎀. Its interpretation hasn't changed 💅.
3.4.3.2. The dot1dStp Subtree
This subtree has the objects that show the bridge's state with respect to the Spanning Tree Protocol 🌸. Its interpretation hasn't changed either 🧚.
3.4.3.3. The dot1dTp Subtree
This subtree has objects that describe the entity's state with respect to transparent bridging 🦋.
If a device runs a single Filtering Database, the interpretation of this subtree stays the same 💖.
If a device supports multiple Filtering Databases, this subtree gets interpreted like this 👑:
dot1dTpLearnedEntryDiscards
The number of times that any of the FDBs became full. 💀
dot1dTpAgingTime
This applies to all Filtering Databases. ✨
dot1dTpFdbTable
Report MAC addresses learned on each port, no matter which Filtering Database they were learned in 🌈. If an address was learned in multiple databases on a single port, report it only once 🙈. If an address was learned in multiple databases on more than one port, report the entry on any one of the valid ports 🫶.
dot1dTpPortTable
This table is port-based and isn't affected by multiple Filtering Databases or multiple VLANs 💅. The counters should include frames received or transmitted for all VLANs 🎀. Also, equivalent 64-bit port statistics counters, plus other objects that represent the upper 32 bits of these counters, are defined in this document for high-capacity network interfaces 🔥. They have conformance statements that say which interface speeds need them 😭.
3.4.3.4. The dot1dStatic Subtree
This optional subtree has objects that describe the configuration of destination-address filtering 🧚.
If a device runs a single Filtering Database, the interpretation of this subtree stays the same 🌸.
If a device supports multiple Filtering Databases, this subtree gets interpreted like this 🦋:
dot1dStaticTable
Entries read from this table include all static entries from all of the Filtering Databases 💜. Entries for the same MAC address and receive port in more than one Filtering Database must appear only once, since those are this table's indices 🙅♀️. This table should be implemented as read-only on devices that support multiple Forwarding Databases 💖. Write access should be provided through dot1qStaticUnicastTable and dot1qStaticMulticastTable instead, which are defined in this document 👑.
3.4.3.5. Additions to the BRIDGE-MIB
To supplement the BRIDGE-MIB [BRIDGE-MIB], this module adds the following 🎀:
(1) support for multiple traffic classes and dynamic multicast filtering as per IEEE 802.1D-1998 [802.1D] 🌈.
(2) support for bridged Virtual LANs as per IEEE 802.1Q-2003 [802.1Q] 💅.
(3) support for 64-bit versions of BRIDGE-MIB [BRIDGE-MIB] port counters 🔥.
4. Definitions for Extended Bridge MIB ✨
Here's the MIB module, starting with its header and imports 💖:
P-BRIDGE-MIB DEFINITIONS ::= BEGIN
-- -------------------------------------------------------------
-- MIB for IEEE 802.1p devices
-- -------------------------------------------------------------
IMPORTS
MODULE-IDENTITY, OBJECT-TYPE, Counter32, Integer32, Counter64
FROM SNMPv2-SMI
TruthValue, TimeInterval, MacAddress, TEXTUAL-CONVENTION
FROM SNMPv2-TC
MODULE-COMPLIANCE, OBJECT-GROUP
FROM SNMPv2-CONF
dot1dTp, dot1dTpPort, dot1dBridge,
dot1dBasePortEntry, dot1dBasePort
FROM BRIDGE-MIB;okay bestie, this is the actual MIB module 🎀 Everything below is code, so every character stays exactly as written 💅
pBridgeMIB MODULE-IDENTITY
LAST-UPDATED "200601090000Z"
ORGANIZATION "IETF Bridge MIB Working Group"
CONTACT-INFO
"Email: bridge-mib@ietf.org
ietfmibs@ops.ietf.org
David Levi
Postal: Nortel Networks
4655 Great America Parkway
Santa Clara, CA 95054
USA
Phone: +1 865 686 0432
Email: dlevi@nortel.com
David Harrington
Postal: Effective Software
50 Harding Rd.
Portsmouth, NH 03801
USA
Phone: +1 603 436 8634
Email: ietfdbh@comcast.net
Les Bell
Postal: Hemel Hempstead, Herts. HP2 7YU
UK
Email: elbell@ntlworld.com
Vivian Ngai
Email: vivian_ngai@acm.org
Andrew Smith
Postal: Beijing Harbour Networks
Jiuling Building
21 North Xisanhuan Ave.
Beijing, 100089
PRC
Fax: +1 415 345 1827
Email: ah_smith@acm.org
Paul Langille
Postal: Newbridge Networks
5 Corporate Drive
Andover, MA 01810
USA
Phone: +1 978 691 4665
Email: langille@newbridge.com
Anil Rijhsinghani
Postal: Accton Technology Corporation
5 Mount Royal Ave
Marlboro, MA 01752
USA
Phone:
Email: anil@accton.com
Keith McCloghrie
Postal: Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
Phone: +1 408 526 5260
Email: kzm@cisco.com"
DESCRIPTION
"The Bridge MIB Extension module for managing Priority
and Multicast Filtering, defined by IEEE 802.1D-1998,
including Restricted Group Registration defined by
IEEE 802.1t-2001.
Copyright (C) The Internet Society (2006). This version of
this MIB module is part of RFC 4363; See the RFC itself for
full legal notices."
REVISION "200601090000Z"
DESCRIPTION
"Added dot1dPortRestrictedGroupRegistration.
Deprecated pBridgePortGmrpGroup and pBridgeCompliance
and added pBridgePortGmrpGroup2 and pBridgeCompliance2."
REVISION "199908250000Z"
DESCRIPTION
"The Bridge MIB Extension module for managing Priority
and Multicast Filtering, defined by IEEE 802.1D-1998.
Initial version, published as RFC 2674."
::= { dot1dBridge 6 }
pBridgeMIBObjects OBJECT IDENTIFIER ::= { pBridgeMIB 1 }
-- -------------------------------------------------------------
-- Textual Conventions
-- -------------------------------------------------------------
EnabledStatus ::= TEXTUAL-CONVENTION
STATUS current
DESCRIPTION
"A simple status value for the object."
SYNTAX INTEGER { enabled(1), disabled(2) }
-- -------------------------------------------------------------
-- subtrees in the P-BRIDGE MIB
-- -------------------------------------------------------------
dot1dExtBase OBJECT IDENTIFIER ::= { pBridgeMIBObjects 1 }
dot1dPriority OBJECT IDENTIFIER ::= { pBridgeMIBObjects 2 }
dot1dGarp OBJECT IDENTIFIER ::= { pBridgeMIBObjects 3 }
dot1dGmrp OBJECT IDENTIFIER ::= { pBridgeMIBObjects 4 }
-- -------------------------------------------------------------
-- the dot1dExtBase subtree
-- -------------------------------------------------------------
dot1dDeviceCapabilities OBJECT-TYPE
SYNTAX BITS {
dot1dExtendedFilteringServices(0),
dot1dTrafficClasses(1),
dot1qStaticEntryIndividualPort(2),
dot1qIVLCapable(3),
dot1qSVLCapable(4),
dot1qHybridCapable(5),
dot1qConfigurablePvidTagging(6),
dot1dLocalVlanCapable(7)
}
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Indicates the optional parts of IEEE 802.1D and 802.1Q
that are implemented by this device and are manageable
through this MIB. Capabilities that are allowed on a
per-port basis are indicated in dot1dPortCapabilities.
dot1dExtendedFilteringServices(0),
-- can perform filtering of
-- individual multicast addresses
-- controlled by GMRP.
dot1dTrafficClasses(1),
-- can map user priority to
-- multiple traffic classes.
dot1qStaticEntryIndividualPort(2),
-- dot1qStaticUnicastReceivePort &
-- dot1qStaticMulticastReceivePort
-- can represent non-zero entries.
dot1qIVLCapable(3), -- Independent VLAN Learning (IVL).
dot1qSVLCapable(4), -- Shared VLAN Learning (SVL).
dot1qHybridCapable(5),
-- both IVL & SVL simultaneously.
dot1qConfigurablePvidTagging(6),
-- whether the implementation
-- supports the ability to
-- override the default PVID
-- setting and its egress status
-- (VLAN-Tagged or Untagged) on
-- each port.
dot1dLocalVlanCapable(7)
-- can support multiple local
-- bridges, outside of the scope
-- of 802.1Q defined VLANs."
REFERENCE
"ISO/IEC 15802-3 Section 5.2,
IEEE 802.1Q/D11 Section 5.2, 12.10.1.1.3/b/2"
::= { dot1dExtBase 1 }
dot1dTrafficClassesEnabled OBJECT-TYPE
SYNTAX TruthValue
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The value true(1) indicates that Traffic Classes are
enabled on this bridge. When false(2), the bridge
operates with a single priority level for all traffic.
The value of this object MUST be retained across
reinitializations of the management system."
DEFVAL { true }
::= { dot1dExtBase 2 }
dot1dGmrpStatus OBJECT-TYPE
SYNTAX EnabledStatus
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The administrative status requested by management for
GMRP. The value enabled(1) indicates that GMRP should
be enabled on this device, in all VLANs, on all ports
for which it has not been specifically disabled. When
disabled(2), GMRP is disabled, in all VLANs and on all
ports, and all GMRP packets will be forwarded
transparently. This object affects both Applicant and
Registrar state machines. A transition from disabled(2)
to enabled(1) will cause a reset of all GMRP state
machines on all ports.
The value of this object MUST be retained across
reinitializations of the management system."
DEFVAL { enabled }
::= { dot1dExtBase 3 }
-- -------------------------------------------------------------
-- Port Capabilities Table
-- -------------------------------------------------------------
dot1dPortCapabilitiesTable OBJECT-TYPE
SYNTAX SEQUENCE OF Dot1dPortCapabilitiesEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A table that contains capabilities information about
every port that is associated with this bridge."
::= { dot1dExtBase 4 }
dot1dPortCapabilitiesEntry OBJECT-TYPE
SYNTAX Dot1dPortCapabilitiesEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A set of capabilities information about this port
indexed by dot1dBasePort."
AUGMENTS { dot1dBasePortEntry }
::= { dot1dPortCapabilitiesTable 1 }
Dot1dPortCapabilitiesEntry ::=
SEQUENCE {
dot1dPortCapabilities
BITS
}
dot1dPortCapabilities OBJECT-TYPE
SYNTAX BITS {
dot1qDot1qTagging(0),
dot1qConfigurableAcceptableFrameTypes(1),
dot1qIngressFiltering(2)
}
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Indicates the parts of IEEE 802.1D and 802.1Q that are
optional on a per-port basis, that are implemented by
this device, and that are manageable through this MIB.
dot1qDot1qTagging(0), -- supports 802.1Q VLAN tagging of
-- frames and GVRP.
dot1qConfigurableAcceptableFrameTypes(1),
-- allows modified values of
-- dot1qPortAcceptableFrameTypes.
dot1qIngressFiltering(2)
-- supports the discarding of any
-- frame received on a Port whose
-- VLAN classification does not
-- include that Port in its Member
-- set."
REFERENCE
"ISO/IEC 15802-3 Section 5.2,
IEEE 802.1Q/D11 Section 5.2"
::= { dot1dPortCapabilitiesEntry 1 }
-- -------------------------------------------------------------
-- the dot1dPriority subtree
-- -------------------------------------------------------------
-- -------------------------------------------------------------
-- Port Priority Table
-- -------------------------------------------------------------
dot1dPortPriorityTable OBJECT-TYPE
SYNTAX SEQUENCE OF Dot1dPortPriorityEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A table that contains information about every port that
is associated with this transparent bridge."
::= { dot1dPriority 1 }
dot1dPortPriorityEntry OBJECT-TYPE
SYNTAX Dot1dPortPriorityEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A list of Default User Priorities for each port of a
transparent bridge. This is indexed by dot1dBasePort."
AUGMENTS { dot1dBasePortEntry }
::= { dot1dPortPriorityTable 1 }
Dot1dPortPriorityEntry ::=
SEQUENCE {
dot1dPortDefaultUserPriority
Integer32,
dot1dPortNumTrafficClasses
Integer32
}
dot1dPortDefaultUserPriority OBJECT-TYPE
SYNTAX Integer32 (0..7)
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The default ingress User Priority for this port. This
only has effect on media, such as Ethernet, that do not
support native User Priority.
The value of this object MUST be retained across
reinitializations of the management system."
::= { dot1dPortPriorityEntry 1 }
dot1dPortNumTrafficClasses OBJECT-TYPE
SYNTAX Integer32 (1..8)
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The number of egress traffic classes supported on this
port. This object may optionally be read-only.
The value of this object MUST be retained across
reinitializations of the management system."
::= { dot1dPortPriorityEntry 2 }
-- -------------------------------------------------------------
-- User Priority Regeneration Table
-- -------------------------------------------------------------the MIB objects above are the real deal, so the exact text, dashes and all, is what implementers rely on 🫶
okay bestie, the regen table is up first and it's giving main character energy 💖
dot1dUserPriorityRegenTable OBJECT-TYPE
SYNTAX SEQUENCE OF Dot1dUserPriorityRegenEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A list of Regenerated User Priorities for each received
User Priority on each port of a bridge. The Regenerated
User Priority value may be used to index the Traffic
Class Table for each input port. This only has effect
on media that support native User Priority. The default
values for Regenerated User Priorities are the same as
the User Priorities."
REFERENCE
"ISO/IEC 15802-3 Section 6.4"
::= { dot1dPriority 2 }
dot1dUserPriorityRegenEntry OBJECT-TYPE
SYNTAX Dot1dUserPriorityRegenEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A mapping of incoming User Priority to a Regenerated
User Priority."
INDEX { dot1dBasePort, dot1dUserPriority }
::= { dot1dUserPriorityRegenTable 1 }
Dot1dUserPriorityRegenEntry ::=
SEQUENCE {
dot1dUserPriority
Integer32,
dot1dRegenUserPriority
Integer32
}
dot1dUserPriority OBJECT-TYPE
SYNTAX Integer32 (0..7)
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The User Priority for a frame received on this port."
::= { dot1dUserPriorityRegenEntry 1 }
dot1dRegenUserPriority OBJECT-TYPE
SYNTAX Integer32 (0..7)
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The Regenerated User Priority that the incoming User
Priority is mapped to for this port.
The value of this object MUST be retained across
reinitializations of the management system."
::= { dot1dUserPriorityRegenEntry 2 }the traffic class table is next, and ngl the descriptions in here are so specific 🎀
-- -------------------------------------------------------------
-- Traffic Class Table
-- -------------------------------------------------------------
dot1dTrafficClassTable OBJECT-TYPE
SYNTAX SEQUENCE OF Dot1dTrafficClassEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A table mapping evaluated User Priority to Traffic
Class, for forwarding by the bridge. Traffic class is a
number in the range (0..(dot1dPortNumTrafficClasses-1))."
REFERENCE
"ISO/IEC 15802-3 Table 7-2"
::= { dot1dPriority 3 }
dot1dTrafficClassEntry OBJECT-TYPE
SYNTAX Dot1dTrafficClassEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"User Priority to Traffic Class mapping."
INDEX { dot1dBasePort, dot1dTrafficClassPriority }
::= { dot1dTrafficClassTable 1 }
Dot1dTrafficClassEntry ::=
SEQUENCE {
dot1dTrafficClassPriority
Integer32,
dot1dTrafficClass
Integer32
}
dot1dTrafficClassPriority OBJECT-TYPE
SYNTAX Integer32 (0..7)
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The Priority value determined for the received frame.
This value is equivalent to the priority indicated in
the tagged frame received, or one of the evaluated
priorities, determined according to the media-type.
For untagged frames received from Ethernet media, this
value is equal to the dot1dPortDefaultUserPriority value
for the ingress port.
For untagged frames received from non-Ethernet media,
this value is equal to the dot1dRegenUserPriority value
for the ingress port and media-specific user priority."
::= { dot1dTrafficClassEntry 1 }
dot1dTrafficClass OBJECT-TYPE
SYNTAX Integer32 (0..7)
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The Traffic Class the received frame is mapped to.
The value of this object MUST be retained across
reinitializations of the management system."
::= { dot1dTrafficClassEntry 2 }outbound access priority is up next, and it's giving very organised 🧚
-- -------------------------------------------------------------
-- Outbound Access Priority Table
-- -------------------------------------------------------------
dot1dPortOutboundAccessPriorityTable OBJECT-TYPE
SYNTAX SEQUENCE OF Dot1dPortOutboundAccessPriorityEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A table mapping Regenerated User Priority to Outbound
Access Priority. This is a fixed mapping for all port
types, with two options for 802.5 Token Ring."
REFERENCE
"ISO/IEC 15802-3 Table 7-3"
::= { dot1dPriority 4 }
dot1dPortOutboundAccessPriorityEntry OBJECT-TYPE
SYNTAX Dot1dPortOutboundAccessPriorityEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Regenerated User Priority to Outbound Access Priority
mapping."
INDEX { dot1dBasePort, dot1dRegenUserPriority }
::= { dot1dPortOutboundAccessPriorityTable 1 }
Dot1dPortOutboundAccessPriorityEntry ::=
SEQUENCE {
dot1dPortOutboundAccessPriority
Integer32
}
dot1dPortOutboundAccessPriority OBJECT-TYPE
SYNTAX Integer32 (0..7)
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The Outbound Access Priority the received frame is
mapped to."
::= { dot1dPortOutboundAccessPriorityEntry 1 }now the dot1dGarp subtree 🦋 the GARP timers are a whole vibe
-- -------------------------------------------------------------
-- the dot1dGarp subtree
-- -------------------------------------------------------------
-- -------------------------------------------------------------
-- The GARP Port Table
-- -------------------------------------------------------------
dot1dPortGarpTable OBJECT-TYPE
SYNTAX SEQUENCE OF Dot1dPortGarpEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A table of GARP control information about every bridge
port. This is indexed by dot1dBasePort."
::= { dot1dGarp 1 }
dot1dPortGarpEntry OBJECT-TYPE
SYNTAX Dot1dPortGarpEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"GARP control information for a bridge port."
AUGMENTS { dot1dBasePortEntry }
::= { dot1dPortGarpTable 1 }
Dot1dPortGarpEntry ::=
SEQUENCE {
dot1dPortGarpJoinTime
TimeInterval,
dot1dPortGarpLeaveTime
TimeInterval,
dot1dPortGarpLeaveAllTime
TimeInterval
}
dot1dPortGarpJoinTime OBJECT-TYPE
SYNTAX TimeInterval
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The GARP Join time, in centiseconds.
The value of this object MUST be retained across
reinitializations of the management system."
DEFVAL { 20 }
::= { dot1dPortGarpEntry 1 }
dot1dPortGarpLeaveTime OBJECT-TYPE
SYNTAX TimeInterval
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The GARP Leave time, in centiseconds.
The value of this object MUST be retained across
reinitializations of the management system."
DEFVAL { 60 }
::= { dot1dPortGarpEntry 2 }
dot1dPortGarpLeaveAllTime OBJECT-TYPE
SYNTAX TimeInterval
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The GARP LeaveAll time, in centiseconds.
The value of this object MUST be retained across
reinitializations of the management system."
DEFVAL { 1000 }
::= { dot1dPortGarpEntry 3 }GMRP is next and the restricted group registration part is lowkey iconic 💅
-- -------------------------------------------------------------
-- The GMRP Port Configuration and Status Table
-- -------------------------------------------------------------
dot1dPortGmrpTable OBJECT-TYPE
SYNTAX SEQUENCE OF Dot1dPortGmrpEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A table of GMRP control and status information about
every bridge port. Augments the dot1dBasePortTable."
::= { dot1dGmrp 1 }
dot1dPortGmrpEntry OBJECT-TYPE
SYNTAX Dot1dPortGmrpEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"GMRP control and status information for a bridge port."
AUGMENTS { dot1dBasePortEntry }
::= { dot1dPortGmrpTable 1 }
Dot1dPortGmrpEntry ::=
SEQUENCE {
dot1dPortGmrpStatus
EnabledStatus,
dot1dPortGmrpFailedRegistrations
Counter32,
dot1dPortGmrpLastPduOrigin
MacAddress,
dot1dPortRestrictedGroupRegistration
TruthValue
}
dot1dPortGmrpStatus OBJECT-TYPE
SYNTAX EnabledStatus
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The administrative state of GMRP operation on this port. The
value enabled(1) indicates that GMRP is enabled on this port
in all VLANs as long as dot1dGmrpStatus is also enabled(1).
A value of disabled(2) indicates that GMRP is disabled on
this port in all VLANs: any GMRP packets received will
be silently discarded, and no GMRP registrations will be
propagated from other ports. Setting this to a value of
enabled(1) will be stored by the agent but will only take
effect on the GMRP protocol operation if dot1dGmrpStatus
also indicates the value enabled(1). This object affects
all GMRP Applicant and Registrar state machines on this
port. A transition from disabled(2) to enabled(1) will
cause a reset of all GMRP state machines on this port.
The value of this object MUST be retained across
reinitializations of the management system."
DEFVAL { enabled }
::= { dot1dPortGmrpEntry 1 }
dot1dPortGmrpFailedRegistrations OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The total number of failed GMRP registrations, for any
reason, in all VLANs, on this port."
::= { dot1dPortGmrpEntry 2 }
dot1dPortGmrpLastPduOrigin OBJECT-TYPE
SYNTAX MacAddress
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The Source MAC Address of the last GMRP message
received on this port."
::= { dot1dPortGmrpEntry 3 }
dot1dPortRestrictedGroupRegistration OBJECT-TYPE
SYNTAX TruthValue
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The state of Restricted Group Registration on this port.
If the value of this control is true(1), then creation
of a new dynamic entry is permitted only if there is a
Static Filtering Entry for the VLAN concerned, in which
the Registrar Administrative Control value is Normal
Registration.
The value of this object MUST be retained across
reinitializations of the management system."
REFERENCE
"IEEE 802.1t clause 10.3.2.3, 14.10.1.3."
DEFVAL { false }
::= { dot1dPortGmrpEntry 4 }last bit of this chunk: the high-capacity port table for transparent bridges 🌈✨
-- -------------------------------------------------------------
-- High-Capacity Port Table for Transparent Bridges
-- -------------------------------------------------------------
dot1dTpHCPortTable OBJECT-TYPE
SYNTAX SEQUENCE OF Dot1dTpHCPortEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A table that contains information about every high-
capacity port that is associated with this transparent
bridge."
::= { dot1dTp 5 }
dot1dTpHCPortEntry OBJECT-TYPE
SYNTAX Dot1dTpHCPortEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Statistics information for each high-capacity port of a
transparent bridge."
INDEX { dot1dTpPort }
::= { dot1dTpHCPortTable 1 }
Dot1dTpHCPortEntry ::=
SEQUENCE {
dot1dTpHCPortInFrames
Counter64,
dot1dTpHCPortOutFrames
Counter64,
dot1dTpHCPortInDiscards
Counter64
}okay so bestie, we're picking up right where the high-capacity port table left off 💖✨ these three counters are literally the stats for each port 🦋
dot1dTpHCPortInFrames OBJECT-TYPE
SYNTAX Counter64
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of frames that have been received by this
port from its segment. Note that a frame received on
the interface corresponding to this port is only counted
by this object if and only if it is for a protocol being
processed by the local bridging function, including
bridge management frames."
REFERENCE
"ISO/IEC 15802-3 Section 14.6.1.1.3"
::= { dot1dTpHCPortEntry 1 }
dot1dTpHCPortOutFrames OBJECT-TYPE
SYNTAX Counter64
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of frames that have been transmitted by this
port to its segment. Note that a frame transmitted on
the interface corresponding to this port is only counted
by this object if and only if it is for a protocol being
processed by the local bridging function, including
bridge management frames."
REFERENCE
"ISO/IEC 15802-3 Section 14.6.1.1.3"
::= { dot1dTpHCPortEntry 2 }
dot1dTpHCPortInDiscards OBJECT-TYPE
SYNTAX Counter64
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Count of valid frames that have been received by this
port from its segment that were discarded (i.e.,
filtered) by the Forwarding Process."
REFERENCE
"ISO/IEC 15802-3 Section 14.6.1.1.3"
::= { dot1dTpHCPortEntry 3 }
-- ----------------------------------------------------
-- Upper part of High-Capacity Port Table for Transparent Bridges
-- ----------------------------------------------------
dot1dTpPortOverflowTable OBJECT-TYPE
SYNTAX SEQUENCE OF Dot1dTpPortOverflowEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A table that contains the most-significant bits of
statistics counters for ports that are associated with this
transparent bridge that are on high-capacity interfaces, as
defined in the conformance clauses for this table. This table
is provided as a way to read 64-bit counters for agents that
support only SNMPv1.
Note that the reporting of most-significant and
least-significant counter bits separately runs the risk of
missing an overflow of the lower bits in the interval between
sampling. The manager must be aware of this possibility, even
within the same varbindlist, when interpreting the results of
a request or asynchronous notification."
::= { dot1dTp 6 }
dot1dTpPortOverflowEntry OBJECT-TYPE
SYNTAX Dot1dTpPortOverflowEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The most significant bits of statistics counters for a high-
capacity interface of a transparent bridge. Each object is
associated with a corresponding object in dot1dTpPortTable
that indicates the least significant bits of the counter."
INDEX { dot1dTpPort }
::= { dot1dTpPortOverflowTable 1 }
Dot1dTpPortOverflowEntry ::=
SEQUENCE {
dot1dTpPortInOverflowFrames
Counter32,
dot1dTpPortOutOverflowFrames
Counter32,
dot1dTpPortInOverflowDiscards
Counter32
}
dot1dTpPortInOverflowFrames OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of times the associated dot1dTpPortInFrames
counter has overflowed."
REFERENCE
"ISO/IEC 15802-3 Section 14.6.1.1.3"
::= { dot1dTpPortOverflowEntry 1 }
dot1dTpPortOutOverflowFrames OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of times the associated dot1dTpPortOutFrames
counter has overflowed."
REFERENCE
"ISO/IEC 15802-3 Section 14.6.1.1.3"
::= { dot1dTpPortOverflowEntry 2 }
dot1dTpPortInOverflowDiscards OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of times the associated
dot1dTpPortInDiscards counter has overflowed."
REFERENCE
"ISO/IEC 15802-3 Section 14.6.1.1.3"
::= { dot1dTpPortOverflowEntry 3 }
-- -------------------------------------------------------------
-- IEEE 802.1p MIB - Conformance Information
-- -------------------------------------------------------------
pBridgeConformance OBJECT IDENTIFIER ::= { pBridgeMIB 2 }
pBridgeGroups OBJECT IDENTIFIER ::= { pBridgeConformance 1 }
pBridgeCompliances OBJECT IDENTIFIER
::= { pBridgeConformance 2 }
-- -------------------------------------------------------------
-- units of conformance
-- -------------------------------------------------------------
pBridgeExtCapGroup OBJECT-GROUP
OBJECTS {
dot1dDeviceCapabilities,
dot1dPortCapabilities
}
STATUS current
DESCRIPTION
"A collection of objects indicating the optional
capabilities of the device."
::= { pBridgeGroups 1 }
pBridgeDeviceGmrpGroup OBJECT-GROUP
OBJECTS {
dot1dGmrpStatus
}
STATUS current
DESCRIPTION
"A collection of objects providing device-level control
for the Multicast Filtering extended bridge services."
::= { pBridgeGroups 2 }
pBridgeDevicePriorityGroup OBJECT-GROUP
OBJECTS {
dot1dTrafficClassesEnabled
}
STATUS current
DESCRIPTION
"A collection of objects providing device-level control
for the Priority services."
::= { pBridgeGroups 3 }
pBridgeDefaultPriorityGroup OBJECT-GROUP
OBJECTS {
dot1dPortDefaultUserPriority
}
STATUS current
DESCRIPTION
"A collection of objects defining the User Priority
applicable to each port for media that do not support
native User Priority."
::= { pBridgeGroups 4 }
pBridgeRegenPriorityGroup OBJECT-GROUP
OBJECTS {
dot1dRegenUserPriority
}
STATUS current
DESCRIPTION
"A collection of objects defining the User Priorities
applicable to each port for media that support native
User Priority."
::= { pBridgeGroups 5 }
pBridgePriorityGroup OBJECT-GROUP
OBJECTS {
dot1dPortNumTrafficClasses,
dot1dTrafficClass
}
STATUS current
DESCRIPTION
"A collection of objects defining the traffic classes
within a bridge for each evaluated User Priority."
::= { pBridgeGroups 6 }
pBridgeAccessPriorityGroup OBJECT-GROUP
OBJECTS {
dot1dPortOutboundAccessPriority
}
STATUS current
DESCRIPTION
"A collection of objects defining the media-dependent
outbound access level for each priority."
::= { pBridgeGroups 7 }
pBridgePortGarpGroup OBJECT-GROUP
OBJECTS {
dot1dPortGarpJoinTime,
dot1dPortGarpLeaveTime,
dot1dPortGarpLeaveAllTime
}
STATUS current
DESCRIPTION
"A collection of objects providing port level control
and status information for GARP operation."
::= { pBridgeGroups 8 }
pBridgePortGmrpGroup OBJECT-GROUP
OBJECTS {
dot1dPortGmrpStatus,
dot1dPortGmrpFailedRegistrations,
dot1dPortGmrpLastPduOrigin
}
STATUS deprecated
DESCRIPTION
"A collection of objects providing port level control
and status information for GMRP operation."
::= { pBridgeGroups 9 }
pBridgeHCPortGroup OBJECT-GROUP
OBJECTS {
dot1dTpHCPortInFrames,
dot1dTpHCPortOutFrames,
dot1dTpHCPortInDiscards
}
STATUS current
DESCRIPTION
"A collection of objects providing 64-bit statistics
counters for high-capacity bridge ports."
::= { pBridgeGroups 10 }
pBridgePortOverflowGroup OBJECT-GROUP
OBJECTS {
dot1dTpPortInOverflowFrames,
dot1dTpPortOutOverflowFrames,
dot1dTpPortInOverflowDiscards
}
STATUS current
DESCRIPTION
"A collection of objects providing overflow statistics
counters for high-capacity bridge ports."
::= { pBridgeGroups 11 }
pBridgePortGmrpGroup2 OBJECT-GROUP
OBJECTS {
dot1dPortGmrpStatus,
dot1dPortGmrpFailedRegistrations,
dot1dPortGmrpLastPduOrigin,
dot1dPortRestrictedGroupRegistration
}
STATUS current
DESCRIPTION
"A collection of objects providing port level control
and status information for GMRP operation."
::= { pBridgeGroups 12 }
-- -------------------------------------------------------------
-- compliance statements
-- -------------------------------------------------------------the overflow table is basically the "backup singers" 🎤💜 it holds the most-significant bits for the high-capacity counters, and it's there so SNMPv1 agents can still read those 64-bit numbers 🙈
ngl this part is important 💀 the overflow table warns that the most-significant and least-significant bits get reported separately, so an overflow of the lower bits can slip through between samples. managers need to be aware of this, even inside the same varbindlist 🫶
the groups are like little bundles of objects, each one with its own number, all grouped under pBridgeGroups 🧚🌸 the GMRP ones are a bit of a glow-up situation: pBridgePortGmrpGroup is marked deprecated, and pBridgePortGmrpGroup2 is the current one that adds dot1dPortRestrictedGroupRegistration 👑
pBridgeCompliance MODULE-COMPLIANCE
STATUS deprecated
DESCRIPTION
"The compliance statement for device support of Priority
and Multicast Filtering extended bridging services."
MODULE
MANDATORY-GROUPS { pBridgeExtCapGroup }
GROUP pBridgeDeviceGmrpGroup
DESCRIPTION
"This group is mandatory for devices supporting the GMRP
application, defined by IEEE 802.1D Extended Filtering
Services."
GROUP pBridgeDevicePriorityGroup
DESCRIPTION
"This group is mandatory only for devices supporting
the priority forwarding operations defined by IEEE
802.1D."
GROUP pBridgeDefaultPriorityGroup
DESCRIPTION
"This group is mandatory only for devices supporting
the priority forwarding operations defined by the
extended bridge services with media types, such as
Ethernet, that do not support native User Priority."
GROUP pBridgeRegenPriorityGroup
DESCRIPTION
"This group is mandatory only for devices supporting
the priority forwarding operations defined by IEEE 802.1D
and that have interface media types that support
native User Priority, e.g., IEEE 802.5."
GROUP pBridgePriorityGroup
DESCRIPTION
"This group is mandatory only for devices supporting
the priority forwarding operations defined by IEEE 802.1D."
GROUP pBridgeAccessPriorityGroup
DESCRIPTION
"This group is optional and is relevant only for devices
supporting the priority forwarding operations defined by
IEEE 802.1D and that have interface media types that
support native Access Priority, e.g., IEEE 802.5."
GROUP pBridgePortGarpGroup
DESCRIPTION
"This group is mandatory for devices supporting any
of the GARP applications: e.g., GMRP, defined by the
extended filtering services of 802.1D; or GVRP,
defined by 802.1Q (refer to the Q-BRIDGE-MIB for
conformance statements for GVRP)."
GROUP pBridgePortGmrpGroup
DESCRIPTION
"This group is mandatory for devices supporting the
GMRP application, as defined by IEEE 802.1D Extended
Filtering Services."
GROUP pBridgeHCPortGroup
DESCRIPTION
"Support for this group in a device is mandatory for those
bridge ports that map to network interfaces that have the
value of the corresponding instance of ifSpeed
greater than 650,000,000 bits/second."
GROUP pBridgePortOverflowGroup
DESCRIPTION
"Support for this group in a device is mandatory for those
bridge ports that map to network interfaces that have the
value of the corresponding instance of ifSpeed
greater than 650,000,000 bits/second."
OBJECT dot1dPortNumTrafficClasses
MIN-ACCESS read-only
DESCRIPTION
"Write access is not required."
OBJECT dot1dTrafficClass
MIN-ACCESS read-only
DESCRIPTION
"Write access is not required."
OBJECT dot1dRegenUserPriority
MIN-ACCESS read-only
DESCRIPTION
"Write access is not required."
::= { pBridgeCompliances 1 }
pBridgeCompliance2 MODULE-COMPLIANCE
STATUS current
DESCRIPTION
"The compliance statement for device support of Priority
and Multicast Filtering extended bridging services."
MODULE
MANDATORY-GROUPS { pBridgeExtCapGroup }
GROUP pBridgeDeviceGmrpGroup
DESCRIPTION
"This group is mandatory for devices supporting the GMRP
application, defined by IEEE 802.1D Extended Filtering
Services."
GROUP pBridgeDevicePriorityGroup
DESCRIPTION
"This group is mandatory only for devices supporting
the priority forwarding operations defined by IEEE
802.1D."
GROUP pBridgeDefaultPriorityGroup
DESCRIPTION
"This group is mandatory only for devices supporting
the priority forwarding operations defined by the
extended bridge services with media types, such as
Ethernet, that do not support native User Priority."
GROUP pBridgeRegenPriorityGroup
DESCRIPTION
"This group is mandatory only for devices supporting
the priority forwarding operations defined by IEEE 802.1D
and that have interface media types that support
native User Priority, e.g., IEEE 802.5."
GROUP pBridgePriorityGroup
DESCRIPTION
"This group is mandatory only for devices supporting
the priority forwarding operations defined by IEEE 802.1D."
GROUP pBridgeAccessPriorityGroup
DESCRIPTION
"This group is optional and is relevant only for devices
supporting the priority forwarding operations defined by
IEEE 802.1D and that have interface media types that
support native Access Priority, e.g., IEEE 802.5."
GROUP pBridgePortGarpGroup
DESCRIPTION
"This group is mandatory for devices supporting any
of the GARP applications: e.g., GMRP, defined by the
extended filtering services of 802.1D; or GVRP,
defined by 802.1Q (refer to the Q-BRIDGE-MIB for
conformance statements for GVRP)."
GROUP pBridgePortGmrpGroup2
DESCRIPTION
"This group is mandatory for devices supporting the
GMRP application, as defined by IEEE 802.1D Extended
Filtering Services."
GROUP pBridgeHCPortGroup
DESCRIPTION
"Support for this group in a device is mandatory for those
bridge ports that map to network interfaces that have the
value of the corresponding instance of ifSpeed
greater than 650,000,000 bits/second."
GROUP pBridgePortOverflowGroup
DESCRIPTION
"Support for this group in a device is mandatory for those
bridge ports that map to network interfaces that have the
value of the corresponding instance of ifSpeed
greater than 650,000,000 bits/second."
OBJECT dot1dPortNumTrafficClasses
MIN-ACCESS read-only
DESCRIPTION
"Write access is not required."
OBJECT dot1dTrafficClass
MIN-ACCESS read-only
DESCRIPTION
"Write access is not required."
OBJECT dot1dRegenUserPriority
MIN-ACCESS read-only
DESCRIPTION
"Write access is not required."
::= { pBridgeCompliances 2 }
END5. Definitions for Virtual Bridge MIB ✨
okay so this is where the Virtual Bridge MIB comes in, and it's giving big 802.1Q energy 💜. The whole module is written in SMIv2 (the MIB language, which is the grammar for describing managed objects), so it looks a little formal, but the vibe is pure organization. Everything below is copied exactly as written, so the names and details stay precise. 🎀
Q-BRIDGE-MIB DEFINITIONS ::= BEGIN
-- -------------------------------------------------------------
-- MIB for IEEE 802.1Q Devices
-- -------------------------------------------------------------
IMPORTS
MODULE-IDENTITY, OBJECT-TYPE,
Counter32, Counter64, Unsigned32, TimeTicks, Integer32
FROM SNMPv2-SMI
RowStatus, TruthValue, TEXTUAL-CONVENTION, MacAddress
FROM SNMPv2-TC
SnmpAdminString
FROM SNMP-FRAMEWORK-MIB
MODULE-COMPLIANCE, OBJECT-GROUP
FROM SNMPv2-CONF
dot1dBridge, dot1dBasePortEntry, dot1dBasePort
FROM BRIDGE-MIB
EnabledStatus
FROM P-BRIDGE-MIB
TimeFilter
FROM RMON2-MIB;
qBridgeMIB MODULE-IDENTITY
LAST-UPDATED "200601090000Z"
ORGANIZATION "IETF Bridge MIB Working Group"
CONTACT-INFO
"Email: Bridge-mib@ietf.org
ietfmibs@ops.ietf.org
David Levi
Postal: Nortel Networks
4655 Great America Parkway
Santa Clara, CA 95054
USA
Phone: +1 865 686 0432
Email: dlevi@nortel.com
David Harrington
Postal: Effective Software
50 Harding Rd.
Portsmouth, NH 03801
USA
Phone: +1 603 436 8634
Email: ietfdbh@comcast.net
Les Bell
Postal: Hemel Hempstead, Herts. HP2 7YU
UK
Email: elbell@ntlworld.com
Andrew Smith
Postal: Beijing Harbour Networks
Jiuling Building
21 North Xisanhuan Ave.
Beijing, 100089
PRC
Fax: +1 415 345 1827
Email: ah_smith@acm.org
Paul Langille
Postal: Newbridge Networks
5 Corporate Drive
Andover, MA 01810
USA
Phone: +1 978 691 4665
Email: langille@newbridge.com
Anil Rijhsinghani
Postal: Accton Technology Corporation
5 Mount Royal Ave
Marlboro, MA 01752
USA
Phone:
Email: anil@accton.com
Keith McCloghrie
Postal: Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
Phone: +1 408 526 5260
Email: kzm@cisco.com"
DESCRIPTION
"The VLAN Bridge MIB module for managing Virtual Bridged
Local Area Networks, as defined by IEEE 802.1Q-2003,
including Restricted Vlan Registration defined by
IEEE 802.1u-2001 and Vlan Classification defined by
IEEE 802.1v-2001.
Copyright (C) The Internet Society (2006). This version of
this MIB module is part of RFC 4363; See the RFC itself for
full legal notices."
REVISION "200601090000Z"
DESCRIPTION
"Added Vlan TEXTUAL-CONVENTIONs,
dot1qPortRestrictedVlanRegistration, dot1vProtocol subtree,
qBridgeClassificationDeviceGroup, qBridgePortGroup2,
qBridgeClassificationPortGroup, and qBridgeCompliance2.
Clarified dot1qForwardAllStaticPorts,
qPortAcceptableFrameTypes, and qBridgeCompliance.
Deprecated qBridgePortGroup and qBridgeCompliance."
REVISION "199908250000Z"
DESCRIPTION
"The VLAN Bridge MIB module for managing Virtual Bridged
Local Area Networks, as defined by IEEE 802.1Q-1998.
Initial version, published as RFC 2674."
::= { dot1dBridge 7 }
qBridgeMIBObjects OBJECT IDENTIFIER ::= { qBridgeMIB 1 }
-- -------------------------------------------------------------
-- Textual Conventions
-- -------------------------------------------------------------
PortList ::= TEXTUAL-CONVENTION
STATUS current
DESCRIPTION
"Each octet within this value specifies a set of eight
ports, with the first octet specifying ports 1 through
8, the second octet specifying ports 9 through 16, etc.
Within each octet, the most significant bit represents
the lowest numbered port, and the least significant bit
represents the highest numbered port. Thus, each port
of the bridge is represented by a single bit within the
value of this object. If that bit has a value of '1',
then that port is included in the set of ports; the port
is not included if its bit has a value of '0'."
SYNTAX OCTET STRINGokay bestie, we're deep in the MIB now 🎀 these are the VLAN-ID textual conventions, the per-VLAN table indexes, and the Filtering Database stuff, all in the Q-BRIDGE MIB, so let's go 🦋
VlanIndex ::= TEXTUAL-CONVENTION
DISPLAY-HINT "d"
STATUS current
DESCRIPTION
"A value used to index per-VLAN tables: values of 0 and
4095 are not permitted. If the value is between 1 and
4094 inclusive, it represents an IEEE 802.1Q VLAN-ID with
global scope within a given bridged domain (see VlanId
textual convention). If the value is greater than 4095,
then it represents a VLAN with scope local to the
particular agent, i.e., one without a global VLAN-ID
assigned to it. Such VLANs are outside the scope of
IEEE 802.1Q, but it is convenient to be able to manage them
in the same way using this MIB."
SYNTAX Unsigned32
VlanId ::= TEXTUAL-CONVENTION
DISPLAY-HINT "d"
STATUS current
DESCRIPTION
"The VLAN-ID that uniquely identifies a VLAN. This
is the 12-bit VLAN-ID used in the VLAN Tag header.
The range is defined by the REFERENCEd specification."
REFERENCE
"IEEE Std 802.1Q 2003 Edition, Virtual Bridged
Local Area Networks."
SYNTAX Integer32 (1..4094)
VlanIdOrAny ::= TEXTUAL-CONVENTION
DISPLAY-HINT "d"
STATUS current
DESCRIPTION
"The VLAN-ID that uniquely identifies a specific VLAN,
or any VLAN. The special value of 4095 is used to
indicate a wildcard, i.e., any VLAN. This can be used
in any situation where an object or table entry must
refer either to a specific VLAN or to any VLAN.
Note that a MIB object that is defined using this
TEXTUAL-CONVENTION should clarify the meaning of
'any VLAN' (i.e., the special value 4095)."
SYNTAX Integer32 (1..4094 | 4095)
VlanIdOrNone ::= TEXTUAL-CONVENTION
DISPLAY-HINT "d"
STATUS current
DESCRIPTION
"The VLAN-ID that uniquely identifies a specific VLAN,
or no VLAN. The special value of zero is used to
indicate that no VLAN-ID is present or used. This can
be used in any situation where an object or a table entry
must refer either to a specific VLAN, or to no VLAN.
Note that a MIB object that is defined using this
TEXTUAL-CONVENTION should clarify the meaning of
'no VLAN' (i.e., the special value 0)."
SYNTAX Integer32 (0 | 1..4094)
VlanIdOrAnyOrNone ::= TEXTUAL-CONVENTION
DISPLAY-HINT "d"
STATUS current
DESCRIPTION
"The VLAN-ID that uniquely identifies a specific VLAN,
any VLAN, or no VLAN. The special values 0 and 4095
have the same meaning as described in the VlanIdOrAny
and VlanIdOrNone TEXTUAL-CONVENTIONs.
Note that a MIB object that is defined using this
TEXTUAL-CONVENTION should clarify the meaning of
'any VLAN' and 'no VLAN' (i.e., the special values
0 and 4095)."
SYNTAX Integer32 (0 | 1..4094 | 4095)
-- -------------------------------------------------------------
-- subtrees in the Q-BRIDGE MIB
-- -------------------------------------------------------------
dot1qBase OBJECT IDENTIFIER ::= { qBridgeMIBObjects 1 }
dot1qTp OBJECT IDENTIFIER ::= { qBridgeMIBObjects 2 }
dot1qStatic OBJECT IDENTIFIER ::= { qBridgeMIBObjects 3 }
dot1qVlan OBJECT IDENTIFIER ::= { qBridgeMIBObjects 4 }
dot1vProtocol OBJECT IDENTIFIER ::= { qBridgeMIBObjects 5 }
-- -------------------------------------------------------------
-- dot1qBase subtree
-- -------------------------------------------------------------
dot1qVlanVersionNumber OBJECT-TYPE
SYNTAX INTEGER {
version1(1)
}
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The version number of IEEE 802.1Q that this device
supports."
REFERENCE
"IEEE 802.1Q/D11 Section 12.10.1.1"
::= { dot1qBase 1 }
dot1qMaxVlanId OBJECT-TYPE
SYNTAX VlanId
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The maximum IEEE 802.1Q VLAN-ID that this device
supports."
REFERENCE
"IEEE 802.1Q/D11 Section 9.3.2.3"
::= { dot1qBase 2 }
dot1qMaxSupportedVlans OBJECT-TYPE
SYNTAX Unsigned32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The maximum number of IEEE 802.1Q VLANs that this
device supports."
REFERENCE
"IEEE 802.1Q/D11 Section 12.10.1.1"
::= { dot1qBase 3 }
dot1qNumVlans OBJECT-TYPE
SYNTAX Unsigned32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The current number of IEEE 802.1Q VLANs that are
configured in this device."
REFERENCE
"IEEE 802.1Q/D11 Section 12.7.1.1"
::= { dot1qBase 4 }
dot1qGvrpStatus OBJECT-TYPE
SYNTAX EnabledStatus
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The administrative status requested by management for
GVRP. The value enabled(1) indicates that GVRP should
be enabled on this device, on all ports for which it has
not been specifically disabled. When disabled(2), GVRP
is disabled on all ports, and all GVRP packets will be
forwarded transparently. This object affects all GVRP
Applicant and Registrar state machines. A transition
from disabled(2) to enabled(1) will cause a reset of all
GVRP state machines on all ports.
The value of this object MUST be retained across
reinitializations of the management system."
DEFVAL { enabled }
::= { dot1qBase 5 }
-- -------------------------------------------------------------
-- the dot1qTp subtree
-- -------------------------------------------------------------
-- -------------------------------------------------------------
-- the current Filtering Database Table
-- -------------------------------------------------------------
dot1qFdbTable OBJECT-TYPE
SYNTAX SEQUENCE OF Dot1qFdbEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A table that contains configuration and control
information for each Filtering Database currently
operating on this device. Entries in this table appear
automatically when VLANs are assigned FDB IDs in the
dot1qVlanCurrentTable."
::= { dot1qTp 1 }
dot1qFdbEntry OBJECT-TYPE
SYNTAX Dot1qFdbEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Information about a specific Filtering Database."
INDEX { dot1qFdbId }
::= { dot1qFdbTable 1 }
Dot1qFdbEntry ::=
SEQUENCE {
dot1qFdbId
Unsigned32,
dot1qFdbDynamicCount
Counter32
}
dot1qFdbId OBJECT-TYPE
SYNTAX Unsigned32
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The identity of this Filtering Database."
::= { dot1qFdbEntry 1 }
dot1qFdbDynamicCount OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The current number of dynamic entries in this
Filtering Database."
REFERENCE
"IEEE 802.1Q/D11 Section 12.7.1.1.3"
::= { dot1qFdbEntry 2 }
-- -------------------------------------------------------------
-- Multiple Forwarding Databases for 802.1Q Transparent Devices
-- This table is an alternative to the dot1dTpFdbTable,
-- previously defined for 802.1D devices that only support a
-- single Forwarding Database.
-- -------------------------------------------------------------
dot1qTpFdbTable OBJECT-TYPE
SYNTAX SEQUENCE OF Dot1qTpFdbEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A table that contains information about unicast entries
for which the device has forwarding and/or filtering
information. This information is used by the
transparent bridging function in determining how to
propagate a received frame."
REFERENCE
"IEEE 802.1Q/D11 Section 12.7.7"
::= { dot1qTp 2 }
dot1qTpFdbEntry OBJECT-TYPE
SYNTAX Dot1qTpFdbEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Information about a specific unicast MAC address for
which the device has some forwarding and/or filtering
information."
INDEX { dot1qFdbId, dot1qTpFdbAddress }
::= { dot1qTpFdbTable 1 }
Dot1qTpFdbEntry ::=
SEQUENCE {
dot1qTpFdbAddress
MacAddress,
dot1qTpFdbPort
Integer32,
dot1qTpFdbStatus
INTEGER
}
dot1qTpFdbAddress OBJECT-TYPE
SYNTAX MacAddress
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A unicast MAC address for which the device has
forwarding and/or filtering information."
::= { dot1qTpFdbEntry 1 }
dot1qTpFdbPort OBJECT-TYPE
SYNTAX Integer32 (0..65535)
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Either the value '0', or the port number of the port on
which a frame having a source address equal to the value
of the corresponding instance of dot1qTpFdbAddress has
been seen. A value of '0' indicates that the port
number has not been learned but that the device does
have some forwarding/filtering information about this
address (e.g., in the dot1qStaticUnicastTable).
Implementors are encouraged to assign the port value to
this object whenever it is learned, even for addresses
for which the corresponding value of dot1qTpFdbStatus is
not learned(3)."
::= { dot1qTpFdbEntry 2 }
dot1qTpFdbStatus OBJECT-TYPE
SYNTAX INTEGER {
other(1),
invalid(2),
learned(3),
self(4),
mgmt(5)
}
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The status of this entry. The meanings of the values
are:
other(1) - none of the following. This may include
the case where some other MIB object (not the
corresponding instance of dot1qTpFdbPort, nor an
entry in the dot1qStaticUnicastTable) is being
used to determine if and how frames addressed to
the value of the corresponding instance of
dot1qTpFdbAddress are being forwarded.
invalid(2) - this entry is no longer valid (e.g., it
was learned but has since aged out), but has not
yet been flushed from the table.
learned(3) - the value of the corresponding instance
of dot1qTpFdbPort was learned and is being used.
self(4) - the value of the corresponding instance of
dot1qTpFdbAddress represents one of the device's
addresses. The corresponding instance of
dot1qTpFdbPort indicates which of the device's
ports has this address.
mgmt(5) - the value of the corresponding instance of
dot1qTpFdbAddress is also the value of an
existing instance of dot1qStaticAddress."
::= { dot1qTpFdbEntry 3 }
-- -------------------------------------------------------------
-- Dynamic Group Registration Table
-- -------------------------------------------------------------ngl the GVRP bit is giving main character energy 🦋 dot1qGvrpStatus MUST be retained across reinitializations, so it's not just a passing vibe 💅
Okay bestie, the group table is where things get really fun 🦋 It's basically a VLAN-by-VLAN guest list for multicast group addresses: for each group MAC address, it tracks which ports frames are allowed to go out of. 💅
dot1qTpGroupTable OBJECT-TYPE
SYNTAX SEQUENCE OF Dot1qTpGroupEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A table containing filtering information for VLANs
configured into the bridge by (local or network)
management, or learned dynamically, specifying the set of
ports to which frames received on a VLAN for this FDB
and containing a specific Group destination address are
allowed to be forwarded."
::= { dot1qTp 3 }
dot1qTpGroupEntry OBJECT-TYPE
SYNTAX Dot1qTpGroupEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Filtering information configured into the bridge by
management, or learned dynamically, specifying the set of
ports to which frames received on a VLAN and containing
a specific Group destination address are allowed to be
forwarded. The subset of these ports learned dynamically
is also provided."
INDEX { dot1qVlanIndex, dot1qTpGroupAddress }
::= { dot1qTpGroupTable 1 }
Dot1qTpGroupEntry ::=
SEQUENCE {
dot1qTpGroupAddress
MacAddress,
dot1qTpGroupEgressPorts
PortList,
dot1qTpGroupLearnt
PortList
}
dot1qTpGroupAddress OBJECT-TYPE
SYNTAX MacAddress
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The destination Group MAC address in a frame to which
this entry's filtering information applies."
::= { dot1qTpGroupEntry 1 }
dot1qTpGroupEgressPorts OBJECT-TYPE
SYNTAX PortList
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The complete set of ports, in this VLAN, to which
frames destined for this Group MAC address are currently
being explicitly forwarded. This does not include ports
for which this address is only implicitly forwarded, in
the dot1qForwardAllPorts list."
::= { dot1qTpGroupEntry 2 }
dot1qTpGroupLearnt OBJECT-TYPE
SYNTAX PortList
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The subset of ports in dot1qTpGroupEgressPorts that
were learned by GMRP or some other dynamic mechanism, in
this Filtering database."
::= { dot1qTpGroupEntry 3 }
-- -------------------------------------------------------------
-- Service Requirements subtree
-- -------------------------------------------------------------
dot1qForwardAllTable OBJECT-TYPE
SYNTAX SEQUENCE OF Dot1qForwardAllEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A table containing forwarding information for each
VLAN, specifying the set of ports to which forwarding of
all multicasts applies, configured statically by
management or dynamically by GMRP. An entry appears in
this table for all VLANs that are currently
instantiated."
REFERENCE
"IEEE 802.1Q/D11 Section 12.7.2, 12.7.7"
::= { dot1qTp 4 }
dot1qForwardAllEntry OBJECT-TYPE
SYNTAX Dot1qForwardAllEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Forwarding information for a VLAN, specifying the set
of ports to which all multicasts should be forwarded,
configured statically by management or dynamically by
GMRP."
INDEX { dot1qVlanIndex }
::= { dot1qForwardAllTable 1 }
Dot1qForwardAllEntry ::=
SEQUENCE {
dot1qForwardAllPorts
PortList,
dot1qForwardAllStaticPorts
PortList,
dot1qForwardAllForbiddenPorts
PortList
}
dot1qForwardAllPorts OBJECT-TYPE
SYNTAX PortList
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The complete set of ports in this VLAN to which all
multicast group-addressed frames are to be forwarded.
This includes ports for which this need has been
determined dynamically by GMRP, or configured statically
by management."
::= { dot1qForwardAllEntry 1 }
dot1qForwardAllStaticPorts OBJECT-TYPE
SYNTAX PortList
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The set of ports configured by management in this VLAN
to which all multicast group-addressed frames are to be
forwarded. Ports entered in this list will also appear
in the complete set shown by dot1qForwardAllPorts. This
value will be restored after the device is reset. This
only applies to ports that are members of the VLAN,
defined by dot1qVlanCurrentEgressPorts. A port may not
be added in this set if it is already a member of the
set of ports in dot1qForwardAllForbiddenPorts. The
default value is a string of ones of appropriate length,
to indicate the standard behaviour of using basic
filtering services, i.e., forward all multicasts to all
ports.
The value of this object MUST be retained across
reinitializations of the management system."
::= { dot1qForwardAllEntry 2 }
dot1qForwardAllForbiddenPorts OBJECT-TYPE
SYNTAX PortList
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The set of ports configured by management in this VLAN
for which the Service Requirement attribute Forward All
Multicast Groups may not be dynamically registered by
GMRP. This value will be restored after the device is
reset. A port may not be added in this set if it is
already a member of the set of ports in
dot1qForwardAllStaticPorts. The default value is a
string of zeros of appropriate length.
The value of this object MUST be retained across
reinitializations of the management system."
::= { dot1qForwardAllEntry 3 }
dot1qForwardUnregisteredTable OBJECT-TYPE
SYNTAX SEQUENCE OF Dot1qForwardUnregisteredEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A table containing forwarding information for each
VLAN, specifying the set of ports to which forwarding of
multicast group-addressed frames for which no
more specific forwarding information applies. This is
configured statically by management and determined
dynamically by GMRP. An entry appears in this table for
all VLANs that are currently instantiated."
REFERENCE
"IEEE 802.1Q/D11 Section 12.7.2, 12.7.7"
::= { dot1qTp 5 }
dot1qForwardUnregisteredEntry OBJECT-TYPE
SYNTAX Dot1qForwardUnregisteredEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Forwarding information for a VLAN, specifying the set
of ports to which all multicasts for which there is no
more specific forwarding information shall be forwarded.
This is configured statically by management or
dynamically by GMRP."
INDEX { dot1qVlanIndex }
::= { dot1qForwardUnregisteredTable 1 }
Dot1qForwardUnregisteredEntry ::=
SEQUENCE {
dot1qForwardUnregisteredPorts
PortList,
dot1qForwardUnregisteredStaticPorts
PortList,
dot1qForwardUnregisteredForbiddenPorts
PortList
}
dot1qForwardUnregisteredPorts OBJECT-TYPE
SYNTAX PortList
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The complete set of ports in this VLAN to which
multicast group-addressed frames for which there is no
more specific forwarding information will be forwarded.
This includes ports for which this need has been
determined dynamically by GMRP, or configured statically
by management."
::= { dot1qForwardUnregisteredEntry 1 }
dot1qForwardUnregisteredStaticPorts OBJECT-TYPE
SYNTAX PortList
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The set of ports configured by management, in this
VLAN, to which multicast group-addressed frames for
which there is no more specific forwarding information
are to be forwarded. Ports entered in this list will
also appear in the complete set shown by
dot1qForwardUnregisteredPorts. This value will be
restored after the device is reset. A port may not be
added in this set if it is already a member of the set
of ports in dot1qForwardUnregisteredForbiddenPorts. The
default value is a string of zeros of appropriate
length, although this has no effect with the default
value of dot1qForwardAllStaticPorts.
The value of this object MUST be retained across
reinitializations of the management system."
::= { dot1qForwardUnregisteredEntry 2 }
dot1qForwardUnregisteredForbiddenPorts OBJECT-TYPE
SYNTAX PortList
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The set of ports configured by management in this VLAN
for which the Service Requirement attribute Forward
Unregistered Multicast Groups may not be dynamically
registered by GMRP. This value will be restored after
the device is reset. A port may not be added in this
set if it is already a member of the set of ports in
dot1qForwardUnregisteredStaticPorts. The default value
is a string of zeros of appropriate length.
The value of this object MUST be retained across
reinitializations of the management system."
::= { dot1qForwardUnregisteredEntry 3 }
-- -------------------------------------------------------------
-- The Static (Destination-Address Filtering) Database
-- -------------------------------------------------------------
dot1qStaticUnicastTable OBJECT-TYPE
SYNTAX SEQUENCE OF Dot1qStaticUnicastEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A table containing filtering information for Unicast
MAC addresses for each Filtering Database, configured
into the device by (local or network) management
specifying the set of ports to which frames received
from specific ports and containing specific unicast
destination addresses are allowed to be forwarded. A
value of zero in this table (as the port number from
which frames with a specific destination address are
received) is used to specify all ports for which there
is no specific entry in this table for that particular
destination address. Entries are valid for unicast
addresses only."
REFERENCE
"IEEE 802.1Q/D11 Section 12.7.7,
ISO/IEC 15802-3 Section 7.9.1"
::= { dot1qStatic 1 }
dot1qStaticUnicastEntry OBJECT-TYPE
SYNTAX Dot1qStaticUnicastEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Filtering information configured into the device by
(local or network) management specifying the set of
ports to which frames received from a specific port and
containing a specific unicast destination address are
allowed to be forwarded."
INDEX {
dot1qFdbId,
dot1qStaticUnicastAddress,
dot1qStaticUnicastReceivePort
}
::= { dot1qStaticUnicastTable 1 }
Dot1qStaticUnicastEntry ::=
SEQUENCE {
dot1qStaticUnicastAddress
MacAddress,
dot1qStaticUnicastReceivePort
Integer32,
dot1qStaticUnicastAllowedToGoTo
PortList,
dot1qStaticUnicastStatus
INTEGER
}okay so the unicast static table is giving main character energy 💅 each row is basically a little rule saying "if THIS unicast MAC shows up on THIS port, here's what happens" 🦋
dot1qStaticUnicastAddress OBJECT-TYPE
SYNTAX MacAddress
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The destination MAC address in a frame to which this
entry's filtering information applies. This object must
take the value of a unicast address."
::= { dot1qStaticUnicastEntry 1 }
dot1qStaticUnicastReceivePort OBJECT-TYPE
SYNTAX Integer32 (0..65535)
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Either the value '0' or the port number of the port
from which a frame must be received in order for this
entry's filtering information to apply. A value of zero
indicates that this entry applies on all ports of the
device for which there is no other applicable entry."
::= { dot1qStaticUnicastEntry 2 }so the address is the destination MAC 🫶 and it has to be a unicast one, not multicast or broadcast 🙈 the receive port is the other half of the key. a zero there is the catch-all ✨ it covers every port that doesn't have a more specific entry of its own 🌸
dot1qStaticUnicastAllowedToGoTo OBJECT-TYPE
SYNTAX PortList
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The set of ports for which a frame with a specific
unicast address will be flooded in the event that it
has not been learned. It also specifies the set of
ports on which a specific unicast address may be dynamically
learned. The dot1qTpFdbTable will have an equivalent
entry with a dot1qTpFdbPort value of '0' until this
address has been learned, at which point it will be updated
with the port the address has been seen on. This only
applies to ports that are members of the VLAN, defined
by dot1qVlanCurrentEgressPorts. The default value of
this object is a string of ones of appropriate length.
The value of this object MUST be retained across
reinitializations of the management system."
REFERENCE
"IEEE 802.1Q/D11 Table 8-5, ISO/IEC 15802-3 Table 7-5"
::= { dot1qStaticUnicastEntry 3 }this one is so dramatic 😭 it's the set of ports where an unknown unicast gets flooded, and it's also where that address is allowed to be learned 🔥 until it's learned, the dot1qTpFdbTable shows it on port 0 🧚 then once it's been seen, the entry gets updated to the real port. it only counts for ports already in the VLAN (hello, dot1qVlanCurrentEgressPorts 💜). the default is all ones, and this value has to survive a reinit of the management system, periodt 💖
dot1qStaticUnicastStatus OBJECT-TYPE
SYNTAX INTEGER {
other(1),
invalid(2),
permanent(3),
deleteOnReset(4),
deleteOnTimeout(5)
}
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"This object indicates the status of this entry.
other(1) - this entry is currently in use, but
the conditions under which it will remain
so differ from the following values.
invalid(2) - writing this value to the object
removes the corresponding entry.
permanent(3) - this entry is currently in use
and will remain so after the next reset of
the bridge.
deleteOnReset(4) - this entry is currently in
use and will remain so until the next
reset of the bridge.
deleteOnTimeout(5) - this entry is currently in
use and will remain so until it is aged out.
The value of this object MUST be retained across
reinitializations of the management system."
DEFVAL { permanent }
::= { dot1qStaticUnicastEntry 4 }the status column is the lifecycle vibe ✨ other(1) means it's live but it's got its own rules 💅 invalid(2) is the delete button 💀 writing it removes the entry. permanent(3) is the default and it sticks around after a reset of the bridge 👑 deleteOnReset(4) lasts until the next reset, and deleteOnTimeout(5) lasts until it ages out ⏳ and yes, this one MUST also survive reinitialization, no cap 🫶
now the multicast and broadcast side 🌈 this table holds filtering info for multicast and broadcast MAC addresses, per VLAN. zero as the receive port means "every port without a more specific entry for that destination" 🦋 and these entries are for multicast and broadcast addresses only 🙈
dot1qStaticMulticastTable OBJECT-TYPE
SYNTAX SEQUENCE OF Dot1qStaticMulticastEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A table containing filtering information for Multicast
and Broadcast MAC addresses for each VLAN, configured
into the device by (local or network) management
specifying the set of ports to which frames received
from specific ports and containing specific Multicast
and Broadcast destination addresses are allowed to be
forwarded. A value of zero in this table (as the port
number from which frames with a specific destination
address are received) is used to specify all ports for
which there is no specific entry in this table for that
particular destination address. Entries are valid for
Multicast and Broadcast addresses only."
REFERENCE
"IEEE 802.1Q/D11 Section 12.7.7,
ISO/IEC 15802-3 Section 7.9.1"
::= { dot1qStatic 2 }
dot1qStaticMulticastEntry OBJECT-TYPE
SYNTAX Dot1qStaticMulticastEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Filtering information configured into the device by
(local or network) management specifying the set of
ports to which frames received from this specific port
for this VLAN and containing this Multicast or Broadcast
destination address are allowed to be forwarded."
INDEX {
dot1qVlanIndex,
dot1qStaticMulticastAddress,
dot1qStaticMulticastReceivePort
}
::= { dot1qStaticMulticastTable 1 }
Dot1qStaticMulticastEntry ::=
SEQUENCE {
dot1qStaticMulticastAddress
MacAddress,
dot1qStaticMulticastReceivePort
Integer32,
dot1qStaticMulticastStaticEgressPorts
PortList,
dot1qStaticMulticastForbiddenEgressPorts
PortList,
dot1qStaticMulticastStatus
INTEGER
}each multicast entry is keyed by the VLAN, the destination address, and the receive port 🧩 the entry's job is to say which ports frames from that receive port, aimed at that address, are allowed out of 💅
dot1qStaticMulticastAddress OBJECT-TYPE
SYNTAX MacAddress
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The destination MAC address in a frame to which this
entry's filtering information applies. This object must
take the value of a Multicast or Broadcast address."
::= { dot1qStaticMulticastEntry 1 }
dot1qStaticMulticastReceivePort OBJECT-TYPE
SYNTAX Integer32 (0..65535)
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Either the value '0' or the port number of the port
from which a frame must be received in order for this
entry's filtering information to apply. A value of zero
indicates that this entry applies on all ports of the
device for which there is no other applicable entry."
::= { dot1qStaticMulticastEntry 2 }the address here has to be multicast or broadcast 🌸 the receive port is the same deal as on the unicast side, zero being the all-the-others catch-all ✨
dot1qStaticMulticastStaticEgressPorts OBJECT-TYPE
SYNTAX PortList
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The set of ports to which frames received from a
specific port and destined for a specific Multicast or
Broadcast MAC address must be forwarded, regardless of
any dynamic information, e.g., from GMRP. A port may not
be added in this set if it is already a member of the
set of ports in dot1qStaticMulticastForbiddenEgressPorts.
The default value of this object is a string of ones of
appropriate length.
The value of this object MUST be retained across
reinitializations of the management system."
::= { dot1qStaticMulticastEntry 3 }
dot1qStaticMulticastForbiddenEgressPorts OBJECT-TYPE
SYNTAX PortList
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The set of ports to which frames received from a
specific port and destined for a specific Multicast or
Broadcast MAC address must not be forwarded, regardless
of any dynamic information, e.g., from GMRP. A port may
not be added in this set if it is already a member of the
set of ports in dot1qStaticMulticastStaticEgressPorts.
The default value of this object is a string of zeros of
appropriate length.
The value of this object MUST be retained across
reinitializations of the management system."
::= { dot1qStaticMulticastEntry 4 }so the static egress ports are the "always send here" list, no matter what the dynamic stuff (like GMRP) says 🚀 and the forbidden list is the opposite, the "never send here" list 🙅♀️ a port can't be in both. static defaults to all ones, forbidden defaults to all zeros, and both stick around through reinits 💜
dot1qStaticMulticastStatus OBJECT-TYPE
SYNTAX INTEGER {
other(1),
invalid(2),
permanent(3),
deleteOnReset(4),
deleteOnTimeout(5)
}
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"This object indicates the status of this entry.
other(1) - this entry is currently in use, but
the conditions under which it will remain
so differ from the following values.
invalid(2) - writing this value to the object
removes the corresponding entry.
permanent(3) - this entry is currently in use
and will remain so after the next reset of
the bridge.
deleteOnReset(4) - this entry is currently in
use and will remain so until the next
reset of the bridge.
deleteOnTimeout(5) - this entry is currently in
use and will remain so until it is aged out.
The value of this object MUST be retained across
reinitializations of the management system."
DEFVAL { permanent }
::= { dot1qStaticMulticastEntry 5 }same status menu as the unicast side 🎀 other, invalid, permanent, deleteOnReset, deleteOnTimeout, all doing the same jobs as before ✨ default is permanent, and it has to be retained across reinits 🫶
next up is the current VLAN database 🎀
-- -------------------------------------------------------------
-- The Current VLAN Database
-- -------------------------------------------------------------
dot1qVlanNumDeletes OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of times a VLAN entry has been deleted from
the dot1qVlanCurrentTable (for any reason). If an entry
is deleted, then inserted, and then deleted, this
counter will be incremented by 2."
::= { dot1qVlan 1 }
dot1qVlanCurrentTable OBJECT-TYPE
SYNTAX SEQUENCE OF Dot1qVlanCurrentEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A table containing current configuration information
for each VLAN currently configured into the device by
(local or network) management, or dynamically created
as a result of GVRP requests received."
::= { dot1qVlan 2 }
dot1qVlanCurrentEntry OBJECT-TYPE
SYNTAX Dot1qVlanCurrentEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Information for a VLAN configured into the device by
(local or network) management, or dynamically created
as a result of GVRP requests received."
INDEX { dot1qVlanTimeMark, dot1qVlanIndex }
::= { dot1qVlanCurrentTable 1 }
Dot1qVlanCurrentEntry ::=
SEQUENCE {
dot1qVlanTimeMark
TimeFilter,
dot1qVlanIndex
VlanIndex,
dot1qVlanFdbId
Unsigned32,
dot1qVlanCurrentEgressPorts
PortList,
dot1qVlanCurrentUntaggedPorts
PortList,
dot1qVlanStatus
INTEGER,
dot1qVlanCreationTime
TimeTicks
}
dot1qVlanTimeMark OBJECT-TYPE
SYNTAX TimeFilter
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A TimeFilter for this entry. See the TimeFilter
textual convention to see how this works."
::= { dot1qVlanCurrentEntry 1 }
dot1qVlanIndex OBJECT-TYPE
SYNTAX VlanIndex
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The VLAN-ID or other identifier referring to this VLAN."
::= { dot1qVlanCurrentEntry 2 }
dot1qVlanFdbId OBJECT-TYPE
SYNTAX Unsigned32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The Filtering Database used by this VLAN. This is one
of the dot1qFdbId values in the dot1qFdbTable. This
value is allocated automatically by the device whenever
the VLAN is created: either dynamically by GVRP, or by
management, in dot1qVlanStaticTable. Allocation of this
value follows the learning constraints defined for this
VLAN in dot1qLearningConstraintsTable."
::= { dot1qVlanCurrentEntry 3 }the VLAN table is a running tally of VLANs 🌈 dot1qVlanNumDeletes is a read-only counter that goes up every time a VLAN entry gets deleted, and if you delete, re-add, then delete again, it jumps by 2 🙈 every current VLAN gets its own row, whether an admin made it or GVRP spun it up dynamically 🧚 each row is keyed by a time mark and the VLAN index, and the time mark is explained by the TimeFilter textual convention, which I'm not going to pretend I can summarise in one breath 😭 dot1qVlanFdbId is the filtering database this VLAN uses. the device picks it automatically when the VLAN gets created, and it follows the learning constraints from dot1qLearningConstraintsTable 💅
Okay so this batch is all about what's happening RIGHT NOW on the VLAN side 🦋 First up, the egress port sets, which tell you which ports are actually sending traffic for a VLAN. ✨
dot1qVlanCurrentEgressPorts OBJECT-TYPE
SYNTAX PortList
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The set of ports that are transmitting traffic for
this VLAN as either tagged or untagged frames."
REFERENCE
"IEEE 802.1Q/D11 Section 12.10.2.1"
::= { dot1qVlanCurrentEntry 4 }
dot1qVlanCurrentUntaggedPorts OBJECT-TYPE
SYNTAX PortList
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The set of ports that are transmitting traffic for
this VLAN as untagged frames."
REFERENCE
"IEEE 802.1Q/D11 Section 12.10.2.1"
::= { dot1qVlanCurrentEntry 5 }
dot1qVlanStatus OBJECT-TYPE
SYNTAX INTEGER {
other(1),
permanent(2),
dynamicGvrp(3)
}
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"This object indicates the status of this entry.
other(1) - this entry is currently in use, but the
conditions under which it will remain so differ
from the following values.
permanent(2) - this entry, corresponding to an entry
in dot1qVlanStaticTable, is currently in use and
will remain so after the next reset of the
device. The port lists for this entry include
ports from the equivalent dot1qVlanStaticTable
entry and ports learned dynamically.
dynamicGvrp(3) - this entry is currently in use
and will remain so until removed by GVRP. There
is no static entry for this VLAN, and it will be
removed when the last port leaves the VLAN."
::= { dot1qVlanCurrentEntry 6 }
dot1qVlanCreationTime OBJECT-TYPE
SYNTAX TimeTicks
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of sysUpTime when this VLAN was created."
::= { dot1qVlanCurrentEntry 7 }The untagged one is the same idea but only for ports sending that VLAN's frames untagged 🎀 The status object is giving "where did this VLAN come from" energy. ✨ It can say other(1), which means the entry is in use but will only stick around under conditions that differ from the other two values. permanent(2) means it matches a static entry, survives a device reset, and its port lists combine the static ports with dynamically learned ones. dynamicGvrp(3) means it stays until GVRP removes it, has no static entry behind it, and disappears once the last port leaves the VLAN 💀 Last one in this group is the creation time, which is the sysUpTime value at the moment the VLAN got made 🌸
-- -------------------------------------------------------------
-- The Static VLAN Database
-- -------------------------------------------------------------
dot1qVlanStaticTable OBJECT-TYPE
SYNTAX SEQUENCE OF Dot1qVlanStaticEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A table containing static configuration information for
each VLAN configured into the device by (local or
network) management. All entries are permanent and will
be restored after the device is reset."
::= { dot1qVlan 3 }
dot1qVlanStaticEntry OBJECT-TYPE
SYNTAX Dot1qVlanStaticEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Static information for a VLAN configured into the
device by (local or network) management."
INDEX { dot1qVlanIndex }
::= { dot1qVlanStaticTable 1 }
Dot1qVlanStaticEntry ::=
SEQUENCE {
dot1qVlanStaticName
SnmpAdminString,
dot1qVlanStaticEgressPorts
PortList,
dot1qVlanForbiddenEgressPorts
PortList,
dot1qVlanStaticUntaggedPorts
PortList,
dot1qVlanStaticRowStatus
RowStatus
}
dot1qVlanStaticName OBJECT-TYPE
SYNTAX SnmpAdminString (SIZE (0..32))
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"An administratively assigned string, which may be used
to identify the VLAN."
REFERENCE
"IEEE 802.1Q/D11 Section 12.10.2.1"
::= { dot1qVlanStaticEntry 1 }
dot1qVlanStaticEgressPorts OBJECT-TYPE
SYNTAX PortList
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The set of ports that are permanently assigned to the
egress list for this VLAN by management. Changes to a
bit in this object affect the per-port, per-VLAN
Registrar control for Registration Fixed for the
relevant GVRP state machine on each port. A port may
not be added in this set if it is already a member of
the set of ports in dot1qVlanForbiddenEgressPorts. The
default value of this object is a string of zeros of
appropriate length, indicating not fixed."
REFERENCE
"IEEE 802.1Q/D11 Section 12.7.7.3, 11.2.3.2.3"
::= { dot1qVlanStaticEntry 2 }
dot1qVlanForbiddenEgressPorts OBJECT-TYPE
SYNTAX PortList
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The set of ports that are prohibited by management
from being included in the egress list for this VLAN.
Changes to this object that cause a port to be included
or excluded affect the per-port, per-VLAN Registrar
control for Registration Forbidden for the relevant GVRP
state machine on each port. A port may not be added in
this set if it is already a member of the set of ports
in dot1qVlanStaticEgressPorts. The default value of
this object is a string of zeros of appropriate length,
excluding all ports from the forbidden set."
REFERENCE
"IEEE 802.1Q/D11 Section 12.7.7.3, 11.2.3.2.3"
::= { dot1qVlanStaticEntry 3 }
dot1qVlanStaticUntaggedPorts OBJECT-TYPE
SYNTAX PortList
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The set of ports that should transmit egress packets
for this VLAN as untagged. The default value of this
object for the default VLAN (dot1qVlanIndex = 1) is a string
of appropriate length including all ports. There is no
specified default for other VLANs. If a device agent cannot
support the set of ports being set, then it will reject the
set operation with an error. For example, a
manager might attempt to set more than one VLAN to be untagged
on egress where the device does not support this IEEE 802.1Q
option."
REFERENCE
"IEEE 802.1Q/D11 Section 12.10.2.1"
::= { dot1qVlanStaticEntry 4 }
dot1qVlanStaticRowStatus OBJECT-TYPE
SYNTAX RowStatus
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"This object indicates the status of this entry."
::= { dot1qVlanStaticEntry 5 }
dot1qNextFreeLocalVlanIndex OBJECT-TYPE
SYNTAX Integer32 (0|4096..2147483647)
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The next available value for dot1qVlanIndex of a local
VLAN entry in dot1qVlanStaticTable. This will report
values >=4096 if a new Local VLAN may be created or else
the value 0 if this is not possible.
A row creation operation in this table for an entry with a local
VlanIndex value may fail if the current value of this object
is not used as the index. Even if the value read is used,
there is no guarantee that it will still be the valid index
when the create operation is attempted; another manager may
have already got in during the intervening time interval.
In this case, dot1qNextFreeLocalVlanIndex should be re-read
and the creation re-tried with the new value.
This value will automatically change when the current value is
used to create a new row."
::= { dot1qVlan 4 }Okay the static database is the "permanent record" side of things 💅 The table holds the static config for every VLAN that local or network management set up, and all of those entries stick around even after a reset 🧚 Each row is indexed by dot1qVlanIndex, and the columns are the name (up to 32 characters 🍓), the static egress ports, the forbidden egress ports, the static untagged ports, and the row status. The egress and forbidden lists are basically mutual exclusives: a port can't be in both, and their defaults both start as strings of zeros, meaning nothing is fixed and nothing is forbidden. The untagged ports default is a bit different. The default VLAN (index 1) starts with all ports included, other VLANs have no specified default, and if a device can't support the port set you try to set, it'll reject the whole operation with an error 🙈 The next free local VLAN index is a sneaky one, because it only tells you a value to use, and by the time you try to create with it, somebody else might have grabbed it first. If that happens, just re-read it and try again 🦋
-- -------------------------------------------------------------
-- The VLAN Port Configuration Table
-- -------------------------------------------------------------
dot1qPortVlanTable OBJECT-TYPE
SYNTAX SEQUENCE OF Dot1qPortVlanEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A table containing per-port control and status
information for VLAN configuration in the device."
::= { dot1qVlan 5 }
dot1qPortVlanEntry OBJECT-TYPE
SYNTAX Dot1qPortVlanEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Information controlling VLAN configuration for a port
on the device. This is indexed by dot1dBasePort."
AUGMENTS { dot1dBasePortEntry }
::= { dot1qPortVlanTable 1 }
Dot1qPortVlanEntry ::=
SEQUENCE {
dot1qPvid
VlanIndex,
dot1qPortAcceptableFrameTypes
INTEGER,
dot1qPortIngressFiltering
TruthValue,
dot1qPortGvrpStatus
EnabledStatus,
dot1qPortGvrpFailedRegistrations
Counter32,
dot1qPortGvrpLastPduOrigin
MacAddress,
dot1qPortRestrictedVlanRegistration
TruthValue
}
dot1qPvid OBJECT-TYPE
SYNTAX VlanIndex
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The PVID, the VLAN-ID assigned to untagged frames or
Priority-Tagged frames received on this port.
The value of this object MUST be retained across
reinitializations of the management system."
REFERENCE
"IEEE 802.1Q/D11 Section 12.10.1.1"
DEFVAL { 1 }
::= { dot1qPortVlanEntry 1 }
dot1qPortAcceptableFrameTypes OBJECT-TYPE
SYNTAX INTEGER {
admitAll(1),
admitOnlyVlanTagged(2)
}
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"When this is admitOnlyVlanTagged(2), the device will
discard untagged frames or Priority-Tagged frames
received on this port. When admitAll(1), untagged
frames or Priority-Tagged frames received on this port
will be accepted and assigned to a VID based on the
PVID and VID Set for this port.
This control does not affect VLAN-independent Bridge
Protocol Data Unit (BPDU) frames, such as GVRP and
Spanning Tree Protocol (STP). It does affect VLAN-
dependent BPDU frames, such as GMRP.
The value of this object MUST be retained across
reinitializations of the management system."
REFERENCE
"IEEE 802.1Q/D11 Section 12.10.1.3"
DEFVAL { admitAll }
::= { dot1qPortVlanEntry 2 }
dot1qPortIngressFiltering OBJECT-TYPE
SYNTAX TruthValue
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"When this is true(1), the device will discard incoming
frames for VLANs that do not include this Port in its
Member set. When false(2), the port will accept all
incoming frames.
This control does not affect VLAN-independent BPDU
frames, such as GVRP and STP. It does affect VLAN-
dependent BPDU frames, such as GMRP.
The value of this object MUST be retained across
reinitializations of the management system."
REFERENCE
"IEEE 802.1Q/D11 Section 12.10.1.4"
DEFVAL { false }
::= { dot1qPortVlanEntry 3 }
dot1qPortGvrpStatus OBJECT-TYPE
SYNTAX EnabledStatus
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The state of GVRP operation on this port. The value
enabled(1) indicates that GVRP is enabled on this port,
as long as dot1qGvrpStatus is also enabled for this
device. When disabled(2) but dot1qGvrpStatus is still
enabled for the device, GVRP is disabled on this port:
any GVRP packets received will be silently discarded, and
no GVRP registrations will be propagated from other
ports. This object affects all GVRP Applicant and
Registrar state machines on this port. A transition
from disabled(2) to enabled(1) will cause a reset of all
GVRP state machines on this port.
The value of this object MUST be retained across
reinitializations of the management system."
DEFVAL { enabled }
::= { dot1qPortVlanEntry 4 }Last stop of this batch is the per-port VLAN config table 🌈 It's indexed by dot1dBasePort and augments dot1dBasePortEntry, so every port gets its own little control panel 🎀 The PVID is the VLAN-ID that untagged or Priority-Tagged frames get on arrival, and it defaults to 1. Its value has to be kept through management system reinitializations, same as the acceptable frame types, which default to admitAll and can be switched to only admitting VLAN-tagged frames. That control leaves VLAN-independent BPDUs like GVRP and STP alone, but it does touch VLAN-dependent BPDUs like GMRP 👑 Ingress filtering is the bouncer of the group: when it's on, frames for VLANs that don't include this port in their Member set get dropped, and when it's off, everything gets in. It defaults to false and has the same retention rule. The GVRP status is the last column in this batch, and it defaults to enabled 🫶 It only does its thing if dot1qGvrpStatus is also enabled for the device. Turning it off makes the port silently drop incoming GVRP packets and stops GVRP registrations from being passed along from other ports. Switching it back on from disabled resets all the GVRP state machines on that port, so it's not a fully pain-free toggle 😭
Okay bestie, the GVRP counters are next 📊 Failed registrations, last PDU origin, and Restricted VLAN Registration all live in this batch, so let's go 💅
dot1qPortGvrpFailedRegistrations OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The total number of failed GVRP registrations, for any
reason, on this port."
::= { dot1qPortVlanEntry 5 }
dot1qPortGvrpLastPduOrigin OBJECT-TYPE
SYNTAX MacAddress
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The Source MAC Address of the last GVRP message
received on this port."
::= { dot1qPortVlanEntry 6 }
dot1qPortRestrictedVlanRegistration OBJECT-TYPE
SYNTAX TruthValue
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The state of Restricted VLAN Registration on this port.
If the value of this control is true(1), then creation
of a new dynamic VLAN entry is permitted only if there
is a Static VLAN Registration Entry for the VLAN concerned,
in which the Registrar Administrative Control value for
this port is Normal Registration.
The value of this object MUST be retained across
reinitializations of the management system."
REFERENCE
"IEEE 802.1u clause 11.2.3.2.3, 12.10.1.7."
DEFVAL { false }
::= { dot1qPortVlanEntry 7 }
-- -------------------------------------------------------------
-- Per port VLAN Statistics Table
-- -------------------------------------------------------------
dot1qPortVlanStatisticsTable OBJECT-TYPE
SYNTAX SEQUENCE OF Dot1qPortVlanStatisticsEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A table containing per-port, per-VLAN statistics for
traffic received. Separate objects are provided for both the
most-significant and least-significant bits of statistics
counters for ports that are associated with this transparent
bridge. The most-significant bit objects are only required on
high-capacity interfaces, as defined in the conformance clauses
for these objects. This mechanism is provided as a way to read
64-bit counters for agents that support only SNMPv1.
Note that the reporting of most-significant and least-
significant counter bits separately runs the risk of missing
an overflow of the lower bits in the interval between sampling.
The manager must be aware of this possibility, even within the
same varbindlist, when interpreting the results of a request or
asynchronous notification."
::= { dot1qVlan 6 }
dot1qPortVlanStatisticsEntry OBJECT-TYPE
SYNTAX Dot1qPortVlanStatisticsEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Traffic statistics for a VLAN on an interface."
INDEX { dot1dBasePort, dot1qVlanIndex }
::= { dot1qPortVlanStatisticsTable 1 }
Dot1qPortVlanStatisticsEntry ::=
SEQUENCE {
dot1qTpVlanPortInFrames
Counter32,
dot1qTpVlanPortOutFrames
Counter32,
dot1qTpVlanPortInDiscards
Counter32,
dot1qTpVlanPortInOverflowFrames
Counter32,
dot1qTpVlanPortOutOverflowFrames
Counter32,
dot1qTpVlanPortInOverflowDiscards
Counter32
}
dot1qTpVlanPortInFrames OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of valid frames received by this port from
its segment that were classified as belonging to this
VLAN. Note that a frame received on this port is
counted by this object if and only if it is for a
protocol being processed by the local forwarding process
for this VLAN. This object includes received bridge
management frames classified as belonging to this VLAN
(e.g., GMRP, but not GVRP or STP."
REFERENCE
"IEEE 802.1Q/D11 Section 12.6.1.1.3(a)"
::= { dot1qPortVlanStatisticsEntry 1 }
dot1qTpVlanPortOutFrames OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of valid frames transmitted by this port to
its segment from the local forwarding process for this
VLAN. This includes bridge management frames originated
by this device that are classified as belonging to this
VLAN (e.g., GMRP, but not GVRP or STP)."
REFERENCE
"IEEE 802.1Q/D11 Section 12.6.1.1.3(d)"
::= { dot1qPortVlanStatisticsEntry 2 }
dot1qTpVlanPortInDiscards OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of valid frames received by this port from
its segment that were classified as belonging to this
VLAN and that were discarded due to VLAN-related reasons.
Specifically, the IEEE 802.1Q counters for Discard
Inbound and Discard on Ingress Filtering."
REFERENCE
"IEEE 802.1Q/D11 Section 12.6.1.1.3"
::= { dot1qPortVlanStatisticsEntry 3 }
dot1qTpVlanPortInOverflowFrames OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of times the associated
dot1qTpVlanPortInFrames counter has overflowed."
REFERENCE
"ISO/IEC 15802-3 Section 14.6.1.1.3"
::= { dot1qPortVlanStatisticsEntry 4 }
dot1qTpVlanPortOutOverflowFrames OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of times the associated
dot1qTpVlanPortOutFrames counter has overflowed."
REFERENCE
"ISO/IEC 15802-3 Section 14.6.1.1.3"
::= { dot1qPortVlanStatisticsEntry 5 }
dot1qTpVlanPortInOverflowDiscards OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of times the associated
dot1qTpVlanPortInDiscards counter has overflowed."
REFERENCE
"ISO/IEC 15802-3 Section 14.6.1.1.3"
::= { dot1qPortVlanStatisticsEntry 6 }
dot1qPortVlanHCStatisticsTable OBJECT-TYPE
SYNTAX SEQUENCE OF Dot1qPortVlanHCStatisticsEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A table containing per-port, per-VLAN statistics for
traffic on high-capacity interfaces."
::= { dot1qVlan 7 }
dot1qPortVlanHCStatisticsEntry OBJECT-TYPE
SYNTAX Dot1qPortVlanHCStatisticsEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Traffic statistics for a VLAN on a high-capacity
interface."
INDEX { dot1dBasePort, dot1qVlanIndex }
::= { dot1qPortVlanHCStatisticsTable 1 }
Dot1qPortVlanHCStatisticsEntry ::=
SEQUENCE {
dot1qTpVlanPortHCInFrames
Counter64,
dot1qTpVlanPortHCOutFrames
Counter64,
dot1qTpVlanPortHCInDiscards
Counter64
}
dot1qTpVlanPortHCInFrames OBJECT-TYPE
SYNTAX Counter64
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of valid frames received by this port from
its segment that were classified as belonging to this
VLAN. Note that a frame received on this port is
counted by this object if and only if it is for a
protocol being processed by the local forwarding process
for this VLAN. This object includes received bridge
management frames classified as belonging to this VLAN
(e.g., GMRP, but not GVRP or STP)."
REFERENCE
"IEEE 802.1Q/D11 Section 12.6.1.1.3(a)"
::= { dot1qPortVlanHCStatisticsEntry 1 }
dot1qTpVlanPortHCOutFrames OBJECT-TYPE
SYNTAX Counter64
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of valid frames transmitted by this port to
its segment from the local forwarding process for this
VLAN. This includes bridge management frames originated
by this device that are classified as belonging to this
VLAN (e.g., GMRP, but not GVRP or STP)."
REFERENCE
"IEEE 802.1Q/D11 Section 12.6.1.1.3(d)"
::= { dot1qPortVlanHCStatisticsEntry 2 }
dot1qTpVlanPortHCInDiscards OBJECT-TYPE
SYNTAX Counter64
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of valid frames received by this port from
its segment that were classified as belonging to this
VLAN and that were discarded due to VLAN-related reasons.
Specifically, the IEEE 802.1Q counters for Discard
Inbound and Discard on Ingress Filtering."
REFERENCE
"IEEE 802.1Q/D11 Section 12.6.1.1.3"
::= { dot1qPortVlanHCStatisticsEntry 3 }
-- -------------------------------------------------------------
-- The VLAN Learning Constraints Table
-- -------------------------------------------------------------
dot1qLearningConstraintsTable OBJECT-TYPE
SYNTAX SEQUENCE OF Dot1qLearningConstraintsEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A table containing learning constraints for sets of
Shared and Independent VLANs."
REFERENCE
"IEEE 802.1Q/D11 Section 12.10.3.1"
::= { dot1qVlan 8 }
dot1qLearningConstraintsEntry OBJECT-TYPE
SYNTAX Dot1qLearningConstraintsEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A learning constraint defined for a VLAN."
INDEX { dot1qConstraintVlan, dot1qConstraintSet }
::= { dot1qLearningConstraintsTable 1 }
Dot1qLearningConstraintsEntry ::=
SEQUENCE {
dot1qConstraintVlan
VlanIndex,
dot1qConstraintSet
Integer32,
dot1qConstraintType
INTEGER,
dot1qConstraintStatus
RowStatus
}
dot1qConstraintVlan OBJECT-TYPE
SYNTAX VlanIndex
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The index of the row in dot1qVlanCurrentTable for the
VLAN constrained by this entry."
::= { dot1qLearningConstraintsEntry 1 }
dot1qConstraintSet OBJECT-TYPE
SYNTAX Integer32 (0..65535)
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The identity of the constraint set to which
dot1qConstraintVlan belongs. These values may be chosen
by the management station."
::= { dot1qLearningConstraintsEntry 2 }
dot1qConstraintType OBJECT-TYPE
SYNTAX INTEGER {
independent(1),
shared(2)
}
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The type of constraint this entry defines.
independent(1) - the VLAN, dot1qConstraintVlan,
uses a filtering database independent from all
other VLANs in the same set, defined by
dot1qConstraintSet.
shared(2) - the VLAN, dot1qConstraintVlan, shares
the same filtering database as all other VLANs
in the same set, defined by dot1qConstraintSet."
::= { dot1qLearningConstraintsEntry 3 }
dot1qConstraintStatus OBJECT-TYPE
SYNTAX RowStatus
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The status of this entry."
::= { dot1qLearningConstraintsEntry 4 }
dot1qConstraintSetDefault OBJECT-TYPE
SYNTAX Integer32 (0..65535)
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The identity of the constraint set to which a VLAN
belongs, if there is not an explicit entry for that VLAN
in dot1qLearningConstraintsTable.
The value of this object MUST be retained across
reinitializations of the management system."
::= { dot1qVlan 9 }okay bestie, we're picking right back up 💖 this next bit is all MIB code, so the DESCRIPTION strings stay exactly as written 🧚
dot1qConstraintTypeDefault OBJECT-TYPE
SYNTAX INTEGER {
independent(1),
shared(2)
}
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The type of constraint set to which a VLAN belongs, if
there is not an explicit entry for that VLAN in
dot1qLearningConstraintsTable. The types are as defined
for dot1qConstraintType.
The value of this object MUST be retained across
reinitializations of the management system."
::= { dot1qVlan 10 }
-- -------------------------------------------------------------
-- dot1vProtocol subtree
-- -------------------------------------------------------------
dot1vProtocolGroupTable OBJECT-TYPE
SYNTAX SEQUENCE OF Dot1vProtocolGroupEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A table that contains mappings from Protocol
Templates to Protocol Group Identifiers used for
Port-and-Protocol-based VLAN Classification."
REFERENCE
"IEEE 802.1v clause 8.6.4"
::= { dot1vProtocol 1 }
dot1vProtocolGroupEntry OBJECT-TYPE
SYNTAX Dot1vProtocolGroupEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A mapping from a Protocol Template to a Protocol
Group Identifier."
INDEX { dot1vProtocolTemplateFrameType,
dot1vProtocolTemplateProtocolValue }
::= { dot1vProtocolGroupTable 1 }
Dot1vProtocolGroupEntry ::=
SEQUENCE {
dot1vProtocolTemplateFrameType
INTEGER,
dot1vProtocolTemplateProtocolValue
OCTET STRING,
dot1vProtocolGroupId
Integer32,
dot1vProtocolGroupRowStatus
RowStatus
}
dot1vProtocolTemplateFrameType OBJECT-TYPE
SYNTAX INTEGER {
ethernet (1),
rfc1042 (2),
snap8021H (3),
snapOther (4),
llcOther (5)
}
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The data-link encapsulation format or the
'detagged_frame_type' in a Protocol Template."
REFERENCE
"IEEE 802.1v clause 8.6.2"
::= { dot1vProtocolGroupEntry 1 }
dot1vProtocolTemplateProtocolValue OBJECT-TYPE
SYNTAX OCTET STRING (SIZE (2 | 5))
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The identification of the protocol above the data-link
layer in a Protocol Template. Depending on the
frame type, the octet string will have one of the
following values:
For 'ethernet', 'rfc1042' and 'snap8021H',
this is the 16-bit (2-octet) IEEE 802.3 Type Field.
For 'snapOther',
this is the 40-bit (5-octet) PID.
For 'llcOther',
this is the 2-octet IEEE 802.2 Link Service Access
Point (LSAP) pair: first octet for Destination Service
Access Point (DSAP) and second octet for Source Service
Access Point (SSAP)."
REFERENCE
"IEEE 802.1v clause 8.6.2"
::= { dot1vProtocolGroupEntry 2 }
dot1vProtocolGroupId OBJECT-TYPE
SYNTAX Integer32 (0..2147483647)
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"Represents a group of protocols that are associated
together when assigning a VID to a frame."
REFERENCE
"IEEE 802.1v clause 8.6.3, 12.10.2.1"
::= { dot1vProtocolGroupEntry 3 }
dot1vProtocolGroupRowStatus OBJECT-TYPE
SYNTAX RowStatus
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"This object indicates the status of this entry."
::= { dot1vProtocolGroupEntry 4 }
dot1vProtocolPortTable OBJECT-TYPE
SYNTAX SEQUENCE OF Dot1vProtocolPortEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A table that contains VID sets used for
Port-and-Protocol-based VLAN Classification."
REFERENCE
"IEEE 802.1v clause 8.4.4"
::= { dot1vProtocol 2 }
dot1vProtocolPortEntry OBJECT-TYPE
SYNTAX Dot1vProtocolPortEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A VID set for a port."
INDEX { dot1dBasePort,
dot1vProtocolPortGroupId }
::= { dot1vProtocolPortTable 1 }
Dot1vProtocolPortEntry ::=
SEQUENCE {
dot1vProtocolPortGroupId
Integer32,
dot1vProtocolPortGroupVid
Integer32,
dot1vProtocolPortRowStatus
RowStatus
}
dot1vProtocolPortGroupId OBJECT-TYPE
SYNTAX Integer32 (1..2147483647)
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Designates a group of protocols in the Protocol
Group Database."
REFERENCE
"IEEE 802.1v clause 8.6.3, 12.10.1.2"
::= { dot1vProtocolPortEntry 1 }
dot1vProtocolPortGroupVid OBJECT-TYPE
SYNTAX Integer32 (1..4094)
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The VID associated with a group of protocols for
each port."
REFERENCE
"IEEE 802.1v clause 8.4.4, 12.10.1.2"
::= { dot1vProtocolPortEntry 2 }
dot1vProtocolPortRowStatus OBJECT-TYPE
SYNTAX RowStatus
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"This object indicates the status of this entry."
::= { dot1vProtocolPortEntry 3 }
-- -------------------------------------------------------------
-- IEEE 802.1Q MIB - Conformance Information
-- -------------------------------------------------------------
qBridgeConformance OBJECT IDENTIFIER ::= { qBridgeMIB 2 }
qBridgeGroups OBJECT IDENTIFIER ::= { qBridgeConformance 1 }
qBridgeCompliances OBJECT IDENTIFIER ::= { qBridgeConformance 2 }
-- -------------------------------------------------------------
-- units of conformance
-- -------------------------------------------------------------
qBridgeBaseGroup OBJECT-GROUP
OBJECTS {
dot1qVlanVersionNumber,
dot1qMaxVlanId,
dot1qMaxSupportedVlans,
dot1qNumVlans,
dot1qGvrpStatus
}
STATUS current
DESCRIPTION
"A collection of objects providing device-level control
and status information for the Virtual LAN bridge
services."
::= { qBridgeGroups 1 }
qBridgeFdbUnicastGroup OBJECT-GROUP
OBJECTS {
dot1qFdbDynamicCount,
dot1qTpFdbPort,
dot1qTpFdbStatus
}
STATUS current
DESCRIPTION
"A collection of objects providing information about all
unicast addresses, learned dynamically or statically
configured by management, in each Filtering Database."
::= { qBridgeGroups 2 }
qBridgeFdbMulticastGroup OBJECT-GROUP
OBJECTS {
dot1qTpGroupEgressPorts,
dot1qTpGroupLearnt
}
STATUS current
DESCRIPTION
"A collection of objects providing information about all
multicast addresses, learned dynamically or statically
configured by management, in each Filtering Database."
::= { qBridgeGroups 3 }
qBridgeServiceRequirementsGroup OBJECT-GROUP
OBJECTS {
dot1qForwardAllPorts,
dot1qForwardAllStaticPorts,
dot1qForwardAllForbiddenPorts,
dot1qForwardUnregisteredPorts,
dot1qForwardUnregisteredStaticPorts,
dot1qForwardUnregisteredForbiddenPorts
}
STATUS current
DESCRIPTION
"A collection of objects providing information about
service requirements, learned dynamically or statically
configured by management, in each Filtering Database."
::= { qBridgeGroups 4 }
qBridgeFdbStaticGroup OBJECT-GROUP
OBJECTS {
dot1qStaticUnicastAllowedToGoTo,
dot1qStaticUnicastStatus,
dot1qStaticMulticastStaticEgressPorts,
dot1qStaticMulticastForbiddenEgressPorts,
dot1qStaticMulticastStatus
}
STATUS current
DESCRIPTION
"A collection of objects providing information about
unicast and multicast addresses statically configured by
management, in each Filtering Database or VLAN."
::= { qBridgeGroups 5 }
qBridgeVlanGroup OBJECT-GROUP
OBJECTS {
dot1qVlanNumDeletes,
dot1qVlanFdbId,
dot1qVlanCurrentEgressPorts,
dot1qVlanCurrentUntaggedPorts,
dot1qVlanStatus,
dot1qVlanCreationTime
}
STATUS current
DESCRIPTION
"A collection of objects providing information about
all VLANs currently configured on this device."
::= { qBridgeGroups 6 }
qBridgeVlanStaticGroup OBJECT-GROUP
OBJECTS {
dot1qVlanStaticName,
dot1qVlanStaticEgressPorts,
dot1qVlanForbiddenEgressPorts,
dot1qVlanStaticUntaggedPorts,
dot1qVlanStaticRowStatus,
dot1qNextFreeLocalVlanIndex
}
STATUS current
DESCRIPTION
"A collection of objects providing information about
VLANs statically configured by management."
::= { qBridgeGroups 7 }
qBridgePortGroup OBJECT-GROUP
OBJECTS {
dot1qPvid,
dot1qPortAcceptableFrameTypes,
dot1qPortIngressFiltering,
dot1qPortGvrpStatus,
dot1qPortGvrpFailedRegistrations,
dot1qPortGvrpLastPduOrigin
}
STATUS deprecated
DESCRIPTION
"A collection of objects providing port-level VLAN
control and status information for all ports."
::= { qBridgeGroups 8 }
qBridgeVlanStatisticsGroup OBJECT-GROUP
OBJECTS {
dot1qTpVlanPortInFrames,
dot1qTpVlanPortOutFrames,
dot1qTpVlanPortInDiscards
}
STATUS current
DESCRIPTION
"A collection of objects providing per-port packet
statistics for all VLANs currently configured on this
device."
::= { qBridgeGroups 9 }
qBridgeVlanStatisticsOverflowGroup OBJECT-GROUP
OBJECTS {
dot1qTpVlanPortInOverflowFrames,
dot1qTpVlanPortOutOverflowFrames,
dot1qTpVlanPortInOverflowDiscards
}
STATUS current
DESCRIPTION
"A collection of objects providing overflow counters for
per-port packet statistics for all VLANs currently configured
on this device for high-capacity interfaces, defined as those
that have the value of the corresponding instance of
ifSpeed greater than 650,000,000 bits/second."
::= { qBridgeGroups 10 }
qBridgeVlanHCStatisticsGroup OBJECT-GROUP
OBJECTS {
dot1qTpVlanPortHCInFrames,
dot1qTpVlanPortHCOutFrames,
dot1qTpVlanPortHCInDiscards
}
STATUS current
DESCRIPTION
"A collection of objects providing per-port packet
statistics for all VLANs currently configured on this
device for high-capacity interfaces, defined as those
that have the value of the corresponding instance of
ifSpeed greater than 650,000,000 bits/second."
::= { qBridgeGroups 11 }
qBridgeLearningConstraintsGroup OBJECT-GROUP
OBJECTS {
dot1qConstraintType,
dot1qConstraintStatus
}
STATUS current
DESCRIPTION
"A collection of objects defining the Filtering Database
constraints all VLANs have with each other."
::= { qBridgeGroups 12 }
qBridgeLearningConstraintDefaultGroup OBJECT-GROUP
OBJECTS {
dot1qConstraintSetDefault,
dot1qConstraintTypeDefault
}
STATUS current
DESCRIPTION
"A collection of objects defining the default Filtering
Database constraints for VLANs that have no specific
constraints defined."
::= { qBridgeGroups 13 }that's a wrap on this chunk, and the MIB stays exactly as the spec wrote it 🎀✨
qBridgeClassificationDeviceGroup OBJECT-GROUP
OBJECTS {
dot1vProtocolGroupId,
dot1vProtocolGroupRowStatus
}
STATUS current
DESCRIPTION
"VLAN classification information for the bridge."
::= { qBridgeGroups 14 }
qBridgeClassificationPortGroup OBJECT-GROUP
OBJECTS {
dot1vProtocolPortGroupVid,
dot1vProtocolPortRowStatus
}
STATUS current
DESCRIPTION
"VLAN classification information for individual ports."
::= { qBridgeGroups 15 }
qBridgePortGroup2 OBJECT-GROUP
OBJECTS {
dot1qPvid,
dot1qPortAcceptableFrameTypes,
dot1qPortIngressFiltering,
dot1qPortGvrpStatus,
dot1qPortGvrpFailedRegistrations,
dot1qPortGvrpLastPduOrigin,
dot1qPortRestrictedVlanRegistration
}
STATUS current
DESCRIPTION
"A collection of objects providing port-level VLAN
control and status information for all ports."
::= { qBridgeGroups 16 }
-- -------------------------------------------------------------
-- compliance statements
-- -------------------------------------------------------------
qBridgeCompliance MODULE-COMPLIANCE
STATUS deprecated
DESCRIPTION
"The compliance statement for device support of Virtual
LAN Bridge services.
RFC2674 was silent about the expected persistence of the
read-write objects in this MIB module. Applications MUST
NOT assume that the values of the read-write objects are
persistent across reinitializations of the management
system and MUST NOT assume that the values are not
persistent across reinitializations of the management
system."
MODULE
MANDATORY-GROUPS {
qBridgeBaseGroup,
qBridgeVlanGroup,
qBridgeVlanStaticGroup,
qBridgePortGroup
}
GROUP qBridgeFdbUnicastGroup
DESCRIPTION
"This group is mandatory for bridges that implement
802.1Q transparent bridging."
GROUP qBridgeFdbMulticastGroup
DESCRIPTION
"This group is mandatory for bridges that implement
802.1Q transparent bridging."
GROUP qBridgeServiceRequirementsGroup
DESCRIPTION
"This group is mandatory for bridges that implement
extended filtering services. All objects must be
read-write if extended-filtering services are
enabled."
GROUP qBridgeFdbStaticGroup
DESCRIPTION
"This group is optional."
GROUP qBridgeVlanStatisticsGroup
DESCRIPTION
"This group is optional as there may be significant
implementation cost associated with its support."
GROUP qBridgeVlanStatisticsOverflowGroup
DESCRIPTION
"This group is optional as there may be significant
implementation cost associated with its support. It is most
relevant for high-capacity interfaces where the SNMP agent
supports only SNMPv1."
GROUP qBridgeVlanHCStatisticsGroup
DESCRIPTION
"This group is optional as there may be significant
implementation cost associated with its support. It is most
relevant for high-capacity interfaces."
GROUP qBridgeLearningConstraintsGroup
DESCRIPTION
"This group is mandatory for devices implementing
both Independent VLAN Learning (IVL) and Shared
VLAN Learning (SVL) modes of operation of the
filtering database, as defined by IEEE 802.1Q."
GROUP qBridgeLearningConstraintDefaultGroup
DESCRIPTION
"This group is mandatory for devices implementing
both Independent VLAN Learning (IVL) and Shared
VLAN Learning (SVL) modes of operation of the
filtering database, as defined by IEEE 802.1Q."
OBJECT dot1qPortAcceptableFrameTypes
MIN-ACCESS read-only
DESCRIPTION
"Write access is not required as this is an optional
capability in IEEE 802.1Q."
OBJECT dot1qPortIngressFiltering
MIN-ACCESS read-only
DESCRIPTION
"Write access is not required as this is an optional
capability in IEEE 802.1Q."
OBJECT dot1qConstraintSetDefault
MIN-ACCESS read-only
DESCRIPTION
"Write access is not required as this is an optional
capability in IEEE 802.1Q."
OBJECT dot1qConstraintTypeDefault
MIN-ACCESS read-only
DESCRIPTION
"Write access is not required as this is an optional
capability in IEEE 802.1Q."
::= { qBridgeCompliances 1 }
qBridgeCompliance2 MODULE-COMPLIANCE
STATUS current
DESCRIPTION
"The compliance statement for device support of Virtual
LAN Bridge services.
This document clarifies the persistence requirements for
the read-write objects in this MIB module. All
implementations claiming compliance to qBridgeCompliance2
MUST retain the values of those read-write objects that
specify this requirement."
MODULE
MANDATORY-GROUPS {
qBridgeBaseGroup,
qBridgeVlanGroup,
qBridgeVlanStaticGroup,
qBridgePortGroup2
}
GROUP qBridgeFdbUnicastGroup
DESCRIPTION
"This group is mandatory for bridges that implement
802.1Q transparent bridging."
GROUP qBridgeFdbMulticastGroup
DESCRIPTION
"This group is mandatory for bridges that implement
802.1Q transparent bridging."
GROUP qBridgeServiceRequirementsGroup
DESCRIPTION
"This group is mandatory for bridges that implement
extended filtering services. All objects must be
read-write if extended-filtering services are
enabled."
GROUP qBridgeFdbStaticGroup
DESCRIPTION
"This group is optional."
GROUP qBridgeVlanStatisticsGroup
DESCRIPTION
"This group is optional as there may be significant
implementation cost associated with its support."
GROUP qBridgeVlanStatisticsOverflowGroup
DESCRIPTION
"This group is optional as there may be significant
implementation cost associated with its support. It is most
relevant for high-capacity interfaces where the SNMP agent
supports only SNMPv1."
GROUP qBridgeVlanHCStatisticsGroup
DESCRIPTION
"This group is optional as there may be significant
implementation cost associated with its support. It is most
relevant for high-capacity interfaces."
GROUP qBridgeLearningConstraintsGroup
DESCRIPTION
"This group is mandatory for devices implementing
both Independent VLAN Learning (IVL) and Shared
VLAN Learning (SVL) modes of operation of the
filtering database, as defined by IEEE 802.1Q."
GROUP qBridgeLearningConstraintDefaultGroup
DESCRIPTION
"This group is mandatory for devices implementing
both Independent VLAN Learning (IVL) and Shared
VLAN Learning (SVL) modes of operation of the
filtering database, as defined by IEEE 802.1Q."
GROUP qBridgeClassificationDeviceGroup
DESCRIPTION
"This group is mandatory ONLY for devices implementing
VLAN Classification as specified in IEEE 802.1v."
GROUP qBridgeClassificationPortGroup
DESCRIPTION
"This group is mandatory ONLY for devices implementing
VLAN Classification as specified in IEEE 802.1v."
OBJECT dot1qPortAcceptableFrameTypes
MIN-ACCESS read-only
DESCRIPTION
"Write access is not required as this is an optional
capability in IEEE 802.1Q."
OBJECT dot1qPortIngressFiltering
MIN-ACCESS read-only
DESCRIPTION
"Write access is not required as this is an optional
capability in IEEE 802.1Q."
OBJECT dot1qConstraintSetDefault
MIN-ACCESS read-only
DESCRIPTION
"Write access is not required as this is an optional
capability in IEEE 802.1Q."
OBJECT dot1qConstraintTypeDefault
MIN-ACCESS read-only
DESCRIPTION
"Write access is not required as this is an optional
capability in IEEE 802.1Q."
OBJECT dot1vProtocolGroupId
MIN-ACCESS read-only
DESCRIPTION
"Write access is not required as this is an optional
capability in IEEE 802.1v."
OBJECT dot1vProtocolGroupRowStatus
MIN-ACCESS read-only
DESCRIPTION
"Write access is not required as this is an optional
capability in IEEE 802.1v."
::= { qBridgeCompliances 2 }
END6. Acknowledgements ✨
Okay bestie, huge shoutout first 💖 A lot of the groundwork for this whole doc came from the IEEE 802.1 working group, who did the heavy lifting on the IEEE 802.1D updates [802.1D] and IEEE 802.1Q [802.1Q]. 🙌
The authors also want to thank the members of the Bridge Working Group 🌸 and, in particular, David Harrington, Anders SW Christensen, Andrew Smith, Paul Langille, Anil Rijhsinghani, and Keith McCloghrie, for their comments and suggestions that made this effort so much better. 🫶
Editing for the final version was done by David Levi. 💅
The new textual conventions for VLAN-IDs 🦋 came out of a review of how VLAN-ID was used across several MIB modules. Then the team found that VLAN-ID objects were also defined in a few other MIB modules, so the discussion kept growing. 🧚 The editor wants to thank everyone who joined that conversation, especially Bert Wijnen, Les Bell, Andrew Smith, Mike Heard, Randy Presuhn, Dan Romascanu, Eduardo Cardona, Tom Petch, Juergen Schoenwaelder, Richard Woundy, Tony Jeffree, and William Murwin. 👑
IEEE also gave input and feedback 🌈 confirming that the values 0 and 4095 are not used to identify a specific VLAN-ID, so they can be used to represent none or a wildcard (see Appendix A). ⭐ Iconic behaviour, honestly. 😭
7. Security Considerations ✨
Okay bestie, this part is serious, so I'm going to be serious too. 🫶 This MIB module has a bunch of objects with a MAX-ACCESS of read-write and/or read-create. Those can be really sensitive or vulnerable depending on the network. If you let SET operations happen in a non-secure environment without proper protection, that can mess up network operations big time 💀.
These are the tables and objects that need extra care, and why:
The following tables and objects in the P-BRIDGE-MIB can be messed with to interfere with priority classes. Somebody could force a reinitialization of state machines and cause network instability 😭. Another possibility is an attacker overriding established policy on port priorities, which would give a user (or an attacker) unauthorized preferential treatment. Not it. 🙅♀️
dot1dTrafficClassesEnabled
dot1dGmrpStatus
dot1dPortPriorityTable
dot1qUserPriorityRegenTable
dot1dTrafficClassTable
dot1dPortGarpTable
dot1dPortGmrpTableWait, I need to be exact here: the list above was copied from the original, so the entry is dot1dUserPriorityRegenTable, not what I just typed. Here is the correct list:
dot1dTrafficClassesEnabled
dot1dGmrpStatus
dot1dPortPriorityTable
dot1dUserPriorityRegenTable
dot1dTrafficClassTable
dot1dPortGarpTable
dot1dPortGmrpTableThe following tables and objects in the Q-BRIDGE-MIB could be manipulated to interfere with virtual LANs. Someone could force a reinitialization of state machines to cause network instability, or change the forwarding and filtering policies. Chaos energy 🌪️.
dot1qGvrpStatus
dot1qForwardAllTable
dot1qStaticUnicastTable
dot1qStaticMulticastTable
dot1qVlanStaticTable
dot1qPortVlanTable
dot1qLearningConstraintsTable
dot1vProtocolGroupTable
dot1vProtocolPortTableSome of the readable objects in this MIB module (the ones with a MAX-ACCESS other than not-accessible) may be considered sensitive or vulnerable in some network environments. So it's important to control even GET and/or NOTIFY access to these objects, and possibly even encrypt their values when they're sent over the network via SNMP 🔐. These are the tables and objects with that sensitivity and vulnerability:
The objects dot1dDeviceCapabilities and dot1dPortCapabilitiesTable in the P-BRIDGE-MIB could be used by an attacker to figure out which attacks might be useful against a given device 🕵️♀️.
The following read-only tables and objects in the Q-BRIDGE-MIB could be used by an attacker to figure out which attacks might be useful against a given device. They could also help an attacker detect whether their attacks are being blocked or filtered, or help them understand the logical topology of the network 👀.
dot1qMaxVlanID
dot1qMaxSupportedVlans
dot1qNumVlans
dot1qFdbTable
dot1qTpFdbTable
dot1qTpGroupTable
dot1qVlanCurrentTable
dot1qPortVlanStatisticsTableSNMP versions prior to SNMPv3 did not include adequate security. Even if the network itself is secure (for example, by using IPSec), there's still no control over who on that secure network is allowed to access and GET/SET (read/change/create/delete) the objects in this MIB module. Lowkey terrifying 😭.
It is RECOMMENDED that implementers consider the security features provided by the SNMPv3 framework (see [RFC3410], section 8), including full support for the SNMPv3 cryptographic mechanisms for authentication and privacy 🔒✨.
Further, deployment of SNMP versions prior to SNMPv3 is NOT RECOMMENDED. Instead, it is RECOMMENDED to deploy SNMPv3 and enable cryptographic security. Then it becomes a customer/operator responsibility to make sure the SNMP entity giving access to an instance of this MIB module is properly configured, so the objects are only accessible to principals (users) who have legitimate rights to GET or SET (change/create/delete) them. Main character energy for whoever's in charge of the config 👑.
8. Normative References
- [BRIDGE-MIB] Norseth, K. and E. Bell, "Definitions of Managed Objects for Bridges", RFC 4188, September 2005.
- [RFC2578] McCloghrie, K., Perkins, D., and J. Schoenwaelder, "Structure of Management Information Version 2 (SMIv2)", STD 58, RFC 2578, April 1999.
- [RFC2579] McCloghrie, K., Perkins, D., and J. Schoenwaelder, "Textual Conventions for SMIv2", STD 58, RFC 2579, April 1999.
- [RFC2580] McCloghrie, K., Perkins, D., and J. Schoenwaelder, "Conformance Statements for SMIv2", STD 58, RFC 2580, April 1999.
- [RFC2674] Bell, E., Smith, A., Langille, P., Rijhsinghani, A., and K. McCloghrie, "Definitions of Managed Objects for Bridges with Traffic Classes, Multicast Filtering and Virtual LAN Extensions", RFC 2674, August 1999.
- [RFC2863] McCloghrie, K. and F. Kastenholz, "The Interfaces Group MIB", RFC 2863, June 2000.
- [RFC3418] Presuhn, R., "Management Information Base (MIB) for the Simple Network Management Protocol (SNMP)", STD 62, RFC 3418, December 2002.
- [802.1D] "Information technology - Telecommunications and information exchange between systems - Local and metropolitan area networks - Common specifications - Part 3: Media Access Control (MAC) Bridges: Revision. This is a revision of ISO/IEC 10038: 1993, 802.1j-1992 and 802.6k-1992. It incorporates P802.11c, P802.1p and P802.12e." ISO/IEC 15802-3: 1998.
- [802.1Q] ANSI/IEEE Standard 802.1Q, "IEEE Standards for Local and Metropolitan Area Networks: Virtual Bridged Local Area Networks", 2003.
- [802.1t] IEEE 802.1t-2001, "(Amendment to IEEE Standard 802.1D) IEEE Standard for Information technology - Telecommunications and information exchange between systems - Local and metropolitan area networks - Common specifications - Part 3: Media Access Control (MAC) Bridges: Technical and Editorial Corrections".
- [802.1u] IEEE 802.1u-2001, "(Amendment to IEEE Standard 802.1Q) IEEE Standard for Local and metropolitan area networks - Virtual Bridged Local Area Networks - Amendment 1: Technical and Editorial Corrections".
- [802.1v] IEEE 802.1v-2001, "(Amendment to IEEE Standard 802.1Q) IEEE Standards for Local and Metropolitan Area Networks: Virtual Bridged Local Area Networks--Amendment 2: VLAN Classification by Protocol and Port".
9. Informative References
- [RFC1493] Decker, E., Langille, P., Rijsinghani, A. and K. McCloghrie, "Definitions of Managed Objects for Bridges", RFC 1493, July 1993.
- [RFC4323] Patrick, M. and W. Murwin, "Data Over Cable System Interface Specification Quality of Service Management Information Base (DOCSIS-QOS MIB)", RFC 4323, January 2006.
- [RFC4149] Kalbfleisch, C., Cole, R., and D. Romascanu, "Definition of Managed Objects for Synthetic Sources for Performance Monitoring Algorithms", RFC 4149, August 2005.
- [RFC2613] Waterman, R., Lahaye, B., Romascanu, D., and S. Waldbusser, "Remote Network Monitoring MIB Extensions for Switched Networks Version 1.0", RFC 2613, June 1999.
- [RFC3318] Sahita, R., Hahn, S., Chan, K., and K. McCloghrie, "Framework Policy Information Base", RFC 3318, March 2003.
- [RFC3410] Case, J., Mundy, R., Partain, D., and B. Stewart, "Introduction and Applicability Statements for Internet-Standard Management Framework", RFC 3410, December 2002.
Appendix A. Email from Tony Jeffrey from IEEE
Here's the email, verbatim, because the details matter. Tony basically says 4095 is fine to use as a wildcard, and 802.1Q will be relaxed to allow it. He wants to know if the managed object definitions in Clause 12 need changing too, or if it's just the SNMP machinery's problem 🤔.
-----Original Message-----
From: Tony Jeffree [mailto:tony@jeffree.co.uk]
Sent: Friday, 6th of June 2003 17:16
To: Wijnen, Bert (Bert) [mailto:bwijnen@lucent.com]
Subject: RE: VLAn ID
Bert et al -
We have concluded that the use of 4095 as a wildcard is acceptable
to 802.1, and we will make any necessary changes to 802.1Q in due
course to relax the current stated restriction. However, we need
to know whether that is all that needs to be done to 802.1Q - i.e.,
is there any need to change our definitions of the managed objects
in the document (Clause 12) to reflect the interpretation of 4095
as a wildcard, or is this simply an issue for the SNMP machinery
to handle?
Regards,
TonyAuthors' Adresses
Meet the authors! 💖 Here are their contact details, kept exactly as written:
David Levi
Nortel Networks
4655 Great America Parkway
Santa Clara, CA 95054
USA
Phone: +1 865 686 0432
EMail: dlevi@nortel.com
David Harrington
Effective Software
50 Harding Rd.
Portsmouth, NH 03801
USA
Phone: +1 603 436 8634
EMail: ietfdbh@comcast.net
Vivian Ngai
Salt lake City, UT
USA
EMail: vivian_ngai@acm.org
Les Bell
Hemel Hempstead
Herts. HP2 7YU
UK
EMail: elbell@ntlworld.com
Andrew Smith
Beijing Harbour Networks
Jiuling Building
21 North Xisanhuan Ave.
Beijing, 100089
PRC
Fax: +1 415 345 1827
EMail: ah_smith@acm.org
Paul Langille
Newbridge Networks
5 Corporate Drive
Andover, MA 01810
USA
Phone: +1 978 691 4665
EMail: langille@newbridge.com
Anil Rijhsinghani
Accton Technology Corporation
5 Mount Royal Ave
Marlboro, MA 01752
USA
EMail: anil@accton.com
Keith McCloghrie
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
Phone: +1 408 526 5260
EMail: kzm@cisco.comFull Copyright Statement
Copyright (C) The Internet Society (2006). 📜
This document is subject to the rights, licenses and restrictions contained in BCP 78. Except as set forth there, the authors keep all their rights.
This document and the information in it are provided on an "AS IS" basis, and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED. That includes, but isn't limited to, any warranty that using the information won't infringe any rights, and any implied warranties of merchantability or fitness for a particular purpose.
Intellectual Property
The IETF takes no position on the validity or scope of any Intellectual Property Rights or other rights that might be claimed to apply to implementing or using the technology in this document. It also takes no position on whether any license under those rights might be available. It hasn't made any independent effort to identify such rights either. Info about the procedures for rights in RFC documents is in BCP 78 and BCP 79 📚.
Copies of IPR disclosures made to the IETF Secretariat, any assurances of licenses to be made available, or the results of an attempt to get a general license or permission to use such proprietary rights by implementers or users of this specification, can be found in the IETF online IPR repository at http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology needed to implement this standard. Send that info to the IETF at ietf-ipr@ietf.org ✨.
Acknowledgement
Funding for the RFC Editor function is provided by the IETF Administrative Support Activity (IASA). Thank you, IASA, for keeping the lights on 🌈💜.
📦 where this page comes from
- ietf: rfc4363 2006-01
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms