Remote Network Monitoring Management Information Base Version 2 using SMIv2
obsoleted by
- rfc-4502 — Remote Network Monitoring Management Information Base Version 2
Extracted elements (29)
'Application Level' in RMON 2 does not mean OSI Layer 7 exclusively; it denotes any protocol above the MAC and network layers, including transport, session, presentation, and application-layer protocols. This broader definition enables tracking of TCP, UDP, DNS, and similar protocols.
Packets with link-level errors are excluded from all RMON 2 counters because decoding packet contents is meaningless when a link-level error is present. Packets with protocol-layer errors are counted for all protocols below the layer where the error was detected.
Rows with owner strings beginning with 'monitor' represent long-lived, probe- or administrator-owned configuration. These are the most trustworthy entries and should not be modified by management stations except under explicit administrator direction.
The OwnerString mechanism is provided for every management-station-initiated function to resolve resource conflicts among multiple managers. It enables an operator to identify the owning station, negotiate for resource release, or reclaim resources after a management station crash.
The protocol directory uses 'limited extensibility': a statically compiled probe that understands where a protocol's demultiplexing field is can be extended via SNMP to recognize new child identifiers (e.g., a new UDP port number) but cannot acquire entirely new protocol parsers at runtime.
The RowStatus textual convention (replacing RMON 1's EntryStatus) provides mutual exclusion during concurrent row creation: if two managers attempt to create the same conceptual row simultaneously, only the first SET succeeds and the others receive an error.
RMON 2 probes that also implement RMON 1 augment all RMON 1 tables with DroppedFrames and LastCreateTime, and extend filter/capture status bits: bit 6 for WAN direction, bit 7 for any physical-layer error, bit 8 for undersized packets, and bit 9 for oversized packets. These additions impose no requirements on RMON-only probes.
If a remote monitoring device implements a group, it must implement all objects in that group. For example, an agent implementing the network layer matrix group must implement both nlMatrixSDTable and nlMatrixDSTable.
If protocolDirStatus is not active(1), all associated entries in the nlHostTable, nlMatrixSDTable, nlMatrixDSTable, alHostTable, alMatrixSDTable, and alMatrixDSTable shall be deleted.
Implementations are strongly encouraged to support protocols higher than the network layer (at least for the protocol distribution group), even for implementations that do not support the application layer groups.
Implementations of this MIB must also implement the system and interfaces group of MIB-II. MIB-II may also mandate implementation of additional groups.
The agent must allow a row to be created with any unused index value if it has the resources to create a new row, since index values in the valid range are chosen by the manager.
The protocolDirLocalIndex value must remain constant across re-initializations. If a protocol is deleted and re-created, it must receive a new value not previously used since the last re-initialization, and must not be re-used until the next agent-restart.
Whenever protocolDirAddressMapConfig changes from supportedOn(3) to supportedOff(2), the probe shall delete all related entries in the addressMapTable. An entry with notSupported(1) shall not allow this object to be changed to any other value.
Whenever protocolDirHostConfig changes from supportedOn(3) to supportedOff(2), the probe shall delete all related entries in the nlHostTable and alHostTable.
Whenever protocolDirMatrixConfig changes from supportedOn(3) to supportedOff(2), the probe shall delete all related entries in the nlMatrixTables and alMatrixTables.
Wherever possible, the agent implementor should validate individual parameter objects when each is SET rather than deferring all validation to when rowStatus is set to active, so that the management station can identify which parameter was invalid.
The addressMapTable maps network-layer addresses to physical (MAC) addresses and the interface where they were last seen. The probe populates it from source MAC and network addresses in error-free packets for protocols with protocolDirAddressMapConfig set to supportedOn(3).
The DataSource textual convention (syntax OBJECT IDENTIFIER) identifies the monitored source interface by pointing to the ifIndex instance for that interface. All control tables use DataSource to bind a collection function to a specific interface.
The LastCreateTime textual convention (syntax TimeStamp) stores the sysUpTime value when an entry was last created or re-created. Management stations use it to detect entry deletion and re-creation between polls, which would otherwise cause an undetectable data discontinuity.
The nlHostTable collects per-network-address traffic statistics (inPkts, outPkts, inOctets, outOctets, outMacNonUnicastPkts, createTime) for all addresses appearing as source or destination in error-free packets. It is indexed by TimeFilter for incremental polling.
The protocolDirTable lists all protocols the probe can decode and count, covering network, transport, and higher-layer protocols. The agent should boot with this table preconfigured and may allow table-driven extension of protocols it statically understands ('limited extensibility').
The protocolDirType object uses two bits: 'extensible'(0) indicates child protocol entries can be user-created, and 'addressRecognitionCapable'(1) indicates the agent can decode network-layer addresses for this protocol and populate host and matrix tables accordingly.
The TimeFilter textual convention (syntax TimeTicks) is used as a table index to allow a management station to download only rows changed since a particular time. A row is considered changed if any object value changes or if the row is created or deleted; the table is purged if sysUpTime wraps.
The ZeroBasedCounter32 textual convention (syntax Gauge32) initializes to zero on entry creation and wraps at 2^32. It is used in tables with constantly changing index space and/or TimeFilter indexing, where a management station can treat the initial value as a delta since last poll.
Security considerations are addressed in Section 7. The RMON 2 MIB contains numerous read-write and read-create objects; unauthorized write access could allow an attacker to reconfigure probe monitoring functions, reassign data sources, delete collected data, or exhaust probe resources by creating excessive control entries.
The protocolDirID field is an OCTET STRING using a tree-structured algorithmic assignment that mirrors the protocol encapsulation hierarchy. SET requests for unrecognized protocolDirIDs are rejected with inconsistentName (SNMPv2) or badValue (SNMPv1).
The protocolDirParameters field is an OCTET STRING with exactly one octet per sub-identifier in protocolDirID, in matching order. Nodes with no defined parameters contribute a zero octet; inclusion of an octet for each node is mandatory even when the parameter definition is optional.
Variable-length network addresses (addressMapNetworkAddress, nlHostAddress) are encoded as an OCTET STRING consisting of a leading length octet followed by the address bytes in network byte order. For IPv4, this is 0x04 followed by the 4 address octets.