DOCSIS Cable Device MIB Cable Device Management Information Base for DOCSIS compliant Cable Modems and Cable Modem Termination Systems
obsoleted by
- rfc-4639 — Cable Device Management Information Base for Data-Over-Cable Service Interface Specification (DOCSIS) Compliant Cable Modems and Cable Modem Termination Systems
Extracted elements (29)
Filter processing order is fixed by layer: inbound LLC filters are applied first, then special filters (IP spoofing and SNMP access), then inbound IP filters, then outbound IP filters, then outbound LLC filters. For cable modems doing only bridging, inbound and outbound IP filtering can be combined into a single table scan.
Sequential identical events are collapsed into a single docsDevEventTable row by incrementing docsDevEvCounts and updating docsDevEvLastTime rather than creating additional rows, to conserve log space while preserving occurrence frequency information.
SNMP-initiated software upgrade (docsDevSwAdminStatus = upgradeFromMgt) was included specifically to allow loading a temporary diagnostic image without modifying the provisioning database, so the device returns to its normal provisioned image after a subsequent reboot.
The docsDevCpe (IP anti-spoofing) group is kept separate from docsDevFilter and implemented only on the CM because it provides per-subscriber source-address enforcement at the origin point, which is not a CMTS function. The table can be auto-populated with the first N source IPs seen from CPE interfaces.
DOCSIS 1.0 requires Cable Modems to implement only SNMPv1 and process only IPv4 customer traffic; future versions of the DOCSIS standard are expected to require SNMPv3 and IPv6 support. Design choices in this MIB reflect the 1.0 constraints.
The docsDevNmAccessTable applies only to SNMPv1 and SNMPv2c traffic; SNMPv3 traffic is not subject to these filters and SNMPv3-only agents need not implement this table. An SMIv1 translation of this MIB is possible except that Counter64 objects cannot be translated.
Any CM MUST return a string descriptive of the current software load in docsDevSwCurrentVers. For a CMTS, this object SHOULD contain a human-readable vendor-specific designation of chassis or control-processor software, or an empty string if neither applies.
For docsDevSTPControl, a device need not implement all spanning-tree options, but noStFilterBpdu(2) (spanning tree inactive, BPDUs discarded) is required.
If docsDevFilterIpPolicyId is set to 0, docsDevFilterPolicyTable MUST NOT be consulted; a value of 0 in this field does not match policy group 0 in the policy table.
On a CMTS, docsDevFilterIpIfIndex MUST be specified to create a row in docsDevFilterIpTable; on a CM, the default is the customer-side (ethernet) interface.
The CM and CMTS MUST provide support for trap message throttling, supporting both rate-control methods (cease-until-reactivated and auto-resume-below-threshold) and threshold-based limiting configurable via docsDevEvThrottleAdminStatus, docsDevEvThrottleThreshold, and docsDevEvThrottleInterval.
The docsDevCpe group MUST NOT be implemented on the Cable Modem Termination System (CMTS); it is only implemented on Cable Modems (CM) to provide anti-spoofing control at the point of origin.
The last digit of the enterprise-specific trap OID must match docsDevEvId so that SNMPv1-capable NMS systems (which can only filter on enterprise + last-digit) can correlate event type to trap type.
Vendor-specific trap definitions MUST include the event reason encoded as a DisplayString; vendors SHOULD also provide time-of-day clocks in CMs to enable useful event timestamping.
When docsDevNmAccessCommunity is read, this object SHOULD return a zero-length string to avoid exposing community string values over the network.
docsDevEventTable logs network and device events with fields docsDevEvIndex (ordering integer), docsDevEvFirstTime and docsDevEvLastTime (DateAndTime), docsDevEvCounts (Counter32), docsDevEvLevel (emergency through debug), docsDevEvId (vendor-specific Unsigned32), and docsDevEvText (human-readable SnmpAdminString). Sequential duplicate events increment docsDevEvCounts rather than creating new rows.
docsDevFilterIpTable is an ordered IP classifier table where each row matches on source/destination address+mask, IP protocol (0–256, 256=any), source/destination port ranges, TOS/mask, interface, and direction. On match, the packet is discarded, accepted, or subjected to a policy group; docsDevFilterIpContinue allows scanning to continue for additional matches.
docsDevFilterLLCTable holds inbound LLC-layer filters applied to frames arriving from RF MAC or CPE interfaces, matching on Ethertype or 802.2 DSAP. The default action for unmatched L2 frames is controlled by docsDevFilterLLCUnmatchedAction (discard or accept).
docsDevFilterPolicyTable provides a level of indirection mapping a policy group ID to one or more policy actions (e.g., TOS rewrite via docsDevFilterTosTable or vendor-specific IPSEC/queue actions). All rows with the same docsDevFilterPolicyId are applied in index order. Policy ID 0 is reserved for packets matching no IP filter.
docsDevFilterTosTable enables TOS-bit manipulation on matched packets using a two-field operation: new_tos = (original_tos AND docsDevFilterTosAndMask) OR docsDevFilterTosOrMask, each field being a 1-octet value.
docsDevNmAccessTable provides row-based SNMP access control for SNMPv1 and SNMPv2c agents, keyed by IP address/mask and community string, with access levels of none, read, readWrite, roWithTraps, rwWithTraps, or trapsOnly. If the table is empty, access is unrestricted. This table does not exist on SNMPv3 agents.
docsDevServerBootState is a read-only object tracking the CM's initialization progress through states: operational, disabled, waitingForDhcpOffer, waitingForDhcpResponse, waitingForTimeServer, waitingForTftp, refusedByCmts, forwardingDenied, other, and unknown.
The docsDevSoftware group provides TFTP-based software upgrade control via docsDevSwServer (TFTP server IP), docsDevSwFilename (image path, max 64 octets), docsDevSwAdminStatus (upgrade trigger), docsDevSwOperStatus (upgrade result), and docsDevSwCurrentVers (running version string).
The MIB is structured into seven groups: docsDevBase (system extension), docsDevNmAccessGroup (SNMP access security), docsDevSoftware (firmware upgrades), docsDevServer (provisioning server state), docsDevEvent (event logging and traps), docsDevFilter (LLC and IP packet filtering), and docsDevCpe (CPE IP address anti-spoofing, CM-only).
The DOCS-CABLE-DEVICE-MIB module is assigned OID { mib-2 69 }, registering the top-level node for all DOCSIS Cable Device MIB objects under the standard MIB-II arc.
The docsDevCpeTable implements IP source-address spoofing prevention on Cable Modems: when enabled, any CPE-originated packet whose source address does not match an entry in the table is silently discarded before further processing, protecting the shared cable plant from address theft.
The docsDevNmAccessTable provides only a minimum level of SNMP access security for SNMPv1/v2c agents; it relies on IP address matching and community strings. SNMPv3 agents should use the User Security Model and view-based access control instead and need not implement this table.
CM initialization follows a sequential boot state machine: starts in waitingForDhcpOffer, transitions through waitingForDhcpResponse, waitingForTimeServer, and waitingForTftp upon receiving respective responses, reaching operational after successful CMTS Registration exchange; transitions to disabled if refused by configuration file, or refusedByCmts if Registration fails.
Software upgrade state is controlled by docsDevSwAdminStatus (upgradeFromMgt triggers TFTP download and reboot; allowProvisioningUpgrade defers to provisioning server on next boot; ignoreProvisioningUpgrade suppresses provisioning upgrades) and reflected in docsDevSwOperStatus (inProgress, completeFromProvisioning, completeFromMgt, failed, other).