Remote Network Monitoring Management Information Base
obsoleted by
- rfc-2819 — Remote Network Monitoring Management Information Base
obsoletes
- rfc-1271 — Remote Network Monitoring Management Information Base
Extracted elements (28)
A hysteresis mechanism limits alarm event generation: after a rising event fires, no further rising events occur until the value drops below alarmFallingThreshold; symmetrically for falling events. This prevents event floods when a monitored value oscillates near a threshold.
History sampling should begin so that a new sample starts at the top of each clock hour, enabling user-friendly reports and cross-probe comparisons. Probes are encouraged to create two default history entries per interface at initialization: one with a ~30-second interval and one with a ~30-minute interval.
Management stations are encouraged to scan a control table and share existing instances—especially monitor-owned rows—before creating new ones. Probe resources are scarce, and indiscriminate allocation is likely to cause resource shortages affecting all users of the probe.
OwnerString objects afford resource contention resolution only among cooperating managers; they provide no access control against uncooperative parties, because SNMP access control depends solely on MIB view membership and never on object values or the values of related objects.
Resources owned by the device or administrator carry OwnerString values starting with 'monitor' and are intended to be long-lived and shared by many users. Indiscriminate modification of monitor-owned configuration by management stations is discouraged; such modifications should occur only under administrator direction.
RMON is designed for offline operation: probes continuously collect statistics, detect threshold crossings, and log results even when disconnected from management stations, then notify the station when conditions warrant. This supports WAN/dialup links and fault-tolerant management across network failures.
Collision counts reported by etherStatsCollisions depend on probe placement: a repeater-port probe detects collisions when two or more stations transmit simultaneously, while a station-attached probe requires three or more. For 10BASE-T, both probe positions should report equal collision counts.
RMON defines jabbers as packets longer than 1518 octets with a bad FCS, which differs from IEEE 802.3 sections 8.2.1.5 and 10.3.1.4, where jabber is any packet transmission exceeding 20 ms (detection range 20-150 ms). Implementations must be aware of this definitional divergence.
Data source objects such as etherStatsDataSource and historyControlDataSource may not be modified if the associated status object is equal to valid(1); the entry must first be invalidated and recreated to change these parameters.
If a remote monitoring device implements a group, it must implement all objects in that group. All RMON groups are individually optional, but every implementation must also implement the system and interfaces groups of MIB-II.
If the variable named in an established alarmEntry is no longer available in the selected MIB view at any time, the probe must change the status of that alarmEntry to invalid(4).
The probe must not lower historyControlBucketsGranted except as a result of a modification to the associated historyControlBucketsRequested object. When bucket count decreases, enough of the oldest media-specific entries must be deleted so the count satisfies the new value.
The probe must only grant write access to alarmVariable in MIB views that have read access to all objects on the probe. Because SNMP access control cannot restrict which OID is named in alarmVariable, the alarm mechanism could otherwise be used to read objects outside a manager's authorized view.
When multiple management stations simultaneously attempt to create the same conceptual row, only the first will succeed; others receive an error. EntryStatus object creation is the atomic collision-detection point: if the object already exists, the creation attempt is rejected.
Wherever possible, the agent should validate row parameter objects when each individual object is set, rather than deferring all validation until entryStatus is set to valid. Deferred validation makes it impossible for the management station to identify which parameter caused a badValue error.
alarmStartupAlarm controls event generation when an alarm entry first becomes valid: risingAlarm(1), fallingAlarm(2), or risingOrFallingAlarm(3). This determines whether the first sample crossing a threshold triggers an immediate event.
alarmTable supports threshold monitoring with fields for alarmInterval (polling period in seconds), alarmVariable (OID of an INTEGER-typed MIB object), alarmSampleType (absoluteValue(1) or deltaValue(2)), alarmRisingThreshold, alarmFallingThreshold, and alarmRisingEventIndex/alarmFallingEventIndex referencing eventTable entries.
etherHistoryUtilization is an INTEGER (0..10000) representing mean physical layer network utilization in hundredths of a percent during each sampling interval, providing a derived efficiency metric stored per history bucket.
etherStatsOctets counts total octets including bad packets, excluding framing bits but including FCS octets. Ethernet utilization can be derived as: (Pkts*(9.6+6.4) + Octets*0.8) / (Interval*10000), yielding percent utilization on a 0-100 scale.
etherStatsTable contains free-running Counters for each monitored Ethernet interface: octets, total packets, broadcast/multicast packets, CRC/alignment errors, undersize/oversize packets, fragments, jabbers, collisions, and packet-size histograms covering ranges 64, 65-127, 128-255, 256-511, 512-1023, and 1024-1518 octets.
Good packets are error-free packets with valid frame length (64 to 1518 octets inclusive on Ethernet, per IEEE 802.3 section 3.2). Bad packets have valid preamble and SFD but contain a bad CRC or have invalid length (shorter than 64 or longer than 1518 octets).
historyControlTable configures periodic statistical sampling: historyControlBucketsRequested (INTEGER 1..65535, default 50) is the desired number of retained samples, historyControlBucketsGranted reflects actual allocated buckets, and historyControlInterval (INTEGER 1..3600 seconds, default 1800) is the sampling period.
OwnerString is a DisplayString textual convention (SIZE 0..127) that identifies the owner of a resource. It should contain one or more of: IP address, management station name, network manager's name, location, or phone number. Agent-owned entries use strings beginning with 'monitor'.
The filter group (filterTable and channelTable) allows packets to be matched by a filter equation; matched packets form a data stream that may be captured via the packet capture group (bufferControlTable and captureBufferTable) or may generate events via the event group.
The host group discovers hosts by tracking source and destination MAC addresses seen in good packets received promiscuously; it consists of hostControlTable, hostTable, and hostTimeTable. The hostTopN group extends this with rate-based top-N reporting over a configurable interval.
The RMON MIB is assigned OID { mib-2 16 }, with nine functional sub-groups: statistics(1), history(2), alarm(3), hosts(4), hostTopN(5), matrix(6), filter(7), capture(8), and event(9).
The alarmVariable mechanism poses an access-control risk: since SNMP access control is based solely on MIB view membership and not on object values, a manager could specify an OID outside its authorized view in alarmVariable to indirectly read unauthorized objects. The probe must restrict write access to alarmVariable to fully privileged views.
EntryStatus defines four row lifecycle states: valid(1), createRequest(2), underCreation(3), and invalid(4). A manager creates a row by setting status to createRequest(2); the agent immediately transitions it to underCreation(3). The manager then configures objects and sets status to valid(1) or aborts with invalid(4). An agent may invalidate a stale underCreation entry if the management station appears to have crashed.