Remote Network Monitoring Management Information Base
obsoleted by
- rfc-1757 — Remote Network Monitoring Management Information Base
updated by
- rfc-1513 — Token Ring Extensions to the Remote Network Monitoring MIB
Extracted elements (27)
Agents should validate row parameters at the time each individual object is set rather than deferring all validation to when EntryStatus is set to valid, because deferred validation cannot indicate which specific parameter caused the badValue error.
Default probe-initiated configuration entries have their owner object set to a string beginning with 'monitor'; indiscriminate modification of these entries by management stations is discouraged, and should occur only under direction of the probe administrator.
For delta-value alarms, the probe may improve precision by sampling twice per period and comparing the sum of the two most recent samples to the threshold, enabling detection of threshold crossings that span a sampling boundary. This requires no special configuration of the threshold value.
The hostTimeTable is provided alongside hostTable to enable fast bulk download: because its index runs 1..N sequentially, SNMP PDUs can be packed efficiently and multiple packets can be outstanding simultaneously, dramatically increasing transfer rates over MAC-address-indexed access.
The monitor should start the first history sample so that a new sample begins exactly at each clock hour. This makes reports more user-friendly and enables comparison of reports across probes with accurate time-of-day clocks.
The OwnerString textual convention is defined to facilitate resource sharing among multiple management stations by labeling each function with the identity of its initiator. It is explicitly noted that OwnerString affords resource contention resolution only among cooperating managers and realizes no access control against uncooperative parties.
The probe is designed for offline operation so that it continuously collects statistics and diagnostics even when communication with the management station is interrupted. This allows fault, performance, and configuration data to be accumulated and reported when connectivity is restored.
An agent may decide that a row that has been in the underCreation(3) state for an abnormally long time indicates a crashed management station, and may set the entry to invalid(4) to reclaim resources. A prudent agent will allow for the possibility that the management station is waiting for human input when determining this timeout.
Management stations must monitor hostControlLastDeleteTime; when a deletion is detected, all locally stored hostTimeCreationOrder-to-hostEntry associations must be invalidated and any in-progress download of hostTimeTable must be restarted, because deletion renumbers creation-order indexes.
When multiple management stations simultaneously attempt to create the same conceptual row, only the first will succeed; the others receive an error. Each control entry contains an EntryStatus object whose creation semantics serialize concurrent row-addition attempts.
All nine groups in this MIB are optional. If a remote monitoring device implements a group, it must implement all objects in that group. Implementations must also implement the system and interfaces groups of MIB-II.
During a set operation on alarmVariable, if the supplied variable name is not available in the selected MIB view, a badValue error must be returned. If the variable subsequently becomes unavailable, the probe must change the alarmEntry status to invalid(4).
Parameters in a control table entry may not be modified while the associated EntryStatus object equals valid(1); to change parameters, the management station must first set the entry to invalid(4), which causes deletion of the entry and all associated data entries.
The probe must not lower historyControlBucketsGranted except as a result of a modification to historyControlBucketsRequested. When the granted bucket count is reached, the oldest bucket must be deleted to make room for each new sample.
The probe must only grant write access to alarmVariable in those MIB views that have read access to all objects on the probe, because no SNMP access control mechanism can restrict the OID to objects within a particular view.
The Alarm Group (alarmTable, alarm 1) periodically samples an ASN.1 INTEGER-typed MIB variable and compares it against a rising threshold and a falling threshold. Sampling may be absoluteValue(1) or deltaValue(2); a hysteresis mechanism prevents repeated events until the opposite threshold is crossed.
The etherStatsTable (statistics 1) contains per-Ethernet-interface free-running counters including octets, packets, broadcast/multicast packets, CRC/align errors, undersize/oversize packets, fragments, jabbers, collisions, and packet-size distribution buckets from 64 to 1518 octets.
The Event Group (eventTable, event 1; logTable, event 2) controls generation and notification of events from the device. Events may be logged locally and used to send SNMP traps to management stations.
The Filter Group (filterTable, filter 1; channelTable, filter 2) allows packets to be matched by a filter equation; matched packets form a data stream that may be captured or may generate events.
The History Group consists of historyControlTable (history 1), which configures periodic sampling with parameters historyControlBucketsRequested (default 50), historyControlBucketsGranted, and historyControlInterval in seconds (1–3600, default 1800), and etherHistoryTable (history 2), which stores the resulting samples.
The Host Group provides host discovery via promiscuous capture of source and destination MAC addresses from good packets, storing statistics in hostControlTable (hosts 1), hostTable (hosts 2, indexed by MAC address), and hostTimeTable (hosts 3, indexed by creation order for efficient download).
The HostTopN Group (hostTopNControlTable, hosts 5; hostTopNTable) prepares ranked reports of the top N hosts by a selected rate-based statistic measured over a management-station-specified interval, and requires the Host Group to be implemented.
The Matrix Group stores per-conversation statistics between pairs of MAC addresses in matrixControlTable (matrix 1), matrixSDTable (source-to-destination, matrix 2), and matrixDSTable (destination-to-source, matrix 3).
The Packet Capture Group (bufferControlTable, capture 1; captureBufferTable, capture 2) captures packets after they flow through a channel; it requires the Filter Group to be implemented.
The RMON MIB is rooted at rmon OBJECT IDENTIFIER ::= { mib-2 16 } and is organized into nine functional groups: statistics, history, alarm, hosts, hostTopN, matrix, filter, capture, and event.
SNMP access control is expressed entirely in terms of MIB view membership, not object values. The OwnerString objects provide resource contention resolution only among cooperating managers and provide no access control function against uncooperative parties; a hostile management station can modify or delete entries owned by others.
The EntryStatus textual convention defines four states for table row lifecycle: valid(1), createRequest(2), underCreation(3), and invalid(4). A new row is created with createRequest, immediately transitions to underCreation, and must be set to valid(1) by the management station or invalid(4) to abort; the agent may also force invalid(4) if underCreation persists abnormally long.