Traffic Flow Measurement: Meter MIB
obsoletes
- rfc-2064 — Traffic Flow Measurement: Meter MIB
Extracted elements (28)
Flow table indexes are stateless to allow multiple independent meter readers to work without synchronization. A snapshot approach would require reader synchronization; the stateless approach means two readers never return exactly the same counts, but discrepancies are acceptable over long collection intervals (e.g., 15-minute collections).
MIB views (RFC 2575) should be used to limit each manager's access to the meter's variables, effectively dividing the single physical meter into several virtual meters, one per independent manager, to prevent managers from interfering with each other's variables.
The flowDataPackageTable was added (replacing the deprecated flowColumnActivityTable) to allow a meter reader to retrieve all required attribute values in a single MIB object. Combined with SNMPv2 GetBulk, this dramatically reduces the number of protocol exchanges needed to upload flow data.
UTF8OwnerString was introduced to replace OwnerString (from RMON MIB) to facilitate internationalisation by using UTF-8 encoding (ISO/IEC IS 10646-1) rather than US-ASCII for administratively assigned owner names.
The RTFM Meter MIB was originally developed and tested using SNMPv1, then converted to SMIv2 following RFC 1908 guidelines. A MIB conforming to SMIv1 can be produced via appropriate translations, but Counter64 objects cannot be translated and will be omitted, losing machine-readable information.
A compliant Traffic Flow Meter MUST implement the mandatory groups: flowControlGroup2, flowDataTableGroup, flowDataPackageGroup, and flowRuleTableGroup, as specified in the flowMIBCompliance MODULE-COMPLIANCE statement.
A meter reader should write flowReaderLastTime as its first step in reading flow data; the meter sets this to its current Uptime and updates PreviousTime. Failure to write flowReaderLastTime may prevent the meter from recovering inactive flows until flowReaderTimeout is reached.
Once a RuleSet's flowRuleInfoStatus has been set to active(1), a manager may not change any of the other variables in the row nor the contents of the associated RuleSet; any attempt to do so should result in a notWritable(17) SNMP error-status.
ActionNumber defines 17 PME opcodes including ignore(1), noMatch(2), count(3), countPkt(4), return(5), gosub(6)/gosubAct(7), assign(8)/assignAct(9), goto(10)/gotoAct(11), pushRuleTo(12)/pushRuleToAct(13), pushPktTo(14)/pushPktToAct(15), popTo(16)/popToAct(17). These enable BASIC-style subroutines to reduce rule table size.
Each flow data record contains bidirectional counters (flowDataToOctets, flowDataToPDUs, flowDataFromOctets, flowDataFromPDUs as Counter64), timestamps (flowDataFirstTime, flowDataLastActiveTime), and layered address attributes for source and destination (adjacent, peer, and transport layers).
FlowAttributeNumber defines 41 attributes identifying flow data record fields, including address attributes (sourceInterface through destTransMask), counters (toOctets, toPDUs, fromOctets, fromPDUs), timestamps (firstTime, lastActiveTime), subscriber IDs, and computed attributes (sourceClass, destClass, flowClass, sourceKind, destKind, flowKind).
flowFloodMark (default 95%) is a percentage threshold; when the flow table exceeds this level the meter sets flowFloodMode to true(1) and takes action to avoid running out of resources. Values 0% or 100% disable the check.
flowInactivityTimeout (default 600 seconds) specifies when a flow becomes idle. An idle flow is not discarded until all registered meter readers for its RuleSet have collected its data.
flowInterfaceSampleRate specifies statistical sampling: set to N to count 1/Nth of packets on that interface; value 1 counts all packets; value 0 causes the interface to be ignored by the meter. The meter should introduce variance into sampling to avoid counting exactly every Nth packet.
The flowDataPackageTable (indexed by flowPackageSelector, flowPackageRuleSet, flowPackageTime, flowPackageIndex) provides a view allowing a meter reader to retrieve a specified set of attribute values for flows from a given RuleSet active since a given time, using a single MIB object per flow.
The flowDataTable is indexed by flowDataRuleSet, flowDataTimeMark (a TimeFilter from RMON2-MIB), and flowDataIndex. The TimeFilter allows GetNext/GetBulk to efficiently retrieve only flows that have changed since a specified meter Uptime value.
The flowManagerInfoTable controls meter tasks. Each row specifies a CurrentRuleSet, a StandbyRuleSet, and a HighWaterMark percentage. When flow table usage exceeds the HighWaterMark, the meter switches from CurrentRuleSet to StandbyRuleSet automatically.
The flowReaderInfoTable allows meter readers to register their intent to collect flow data. The meter will not recover a flow's memory until every registered meter reader for that flow's RuleSet has collected the flow's data.
The flowRuleSetInfoTable holds RuleSets available on the meter. A manager creates a row, sets flowRuleInfoSize and flowRuleInfoName, downloads rules, then sets flowRuleInfoStatus to active(1) to make the RuleSet ready to run. A running RuleSet cannot be modified.
The flowRuleTable stores RuleSets as arrays of rules, each with flowRuleSelector (attribute to match), flowRuleMask, flowRuleMatchedValue, flowRuleAction (PME opcode), and flowRuleParameter. Rule processing is fall-through; indexes are normally consecutive.
The RTFM Traffic Meter MIB is registered at mib-2 40 (flowMIB OBJECT IDENTIFIER ::= { mib-2 40 }) and organized into four parts: control (flowControl), data (flowData), rules (flowRules), and conformance statements (flowMIBConformance).
This document registers the FLOW-METER-MIB module under mib-2 40 (flowMIB OBJECT IDENTIFIER ::= { mib-2 40 }) within the IANA mib-2 namespace, with SMI Network Management MGMT Code 40.
Attackers must not be permitted to write any meter variables. Access restriction options include physical separation (separate control network), application-layer security (SNMPv2C community strings or SNMPv3 USM/VACM), and lower-layer security (e.g., encrypted TCP tunnel for SNMP). Separate network interfaces for control and metering are recommended.
Control Group objects (managing meter resources) and Flow Table objects (containing collected traffic data) may be sensitive. Even GET access should be controlled; SNMPv3 with the User-based Security Model (RFC 2574) and View-based Access Control Model (RFC 2575) is recommended. SNMPv1 alone is not a secure environment.
Port scan attacks (sending packets to a large number of address:port pairs) can flood the meter's flow table, triggering flood mode and potentially causing denial of service for legitimate flow measurement. Implementers should consider how to handle such flooding attacks on metering interfaces.
flowPackageData contains a BER-encoded sequence (per ASN.1 Basic Encoding Rules) of attribute values for a single flow, in the order specified by the flowPackageSelector. The selector is a length-prefixed sequence of FlowAttributeNumber octets.
PeerAddress is an OCTET STRING of SIZE(3..20) encoding network-layer addresses: IPv4 as 4 octets, IPv6 as 16 octets, IPX as 4-octet network + 6-octet host, AppleTalk as 2-octet network + 1-octet host, DECnet as 1-octet area (low-order 6 bits) + 2-octet host (low-order 10 bits).
TransportAddress is an OCTET STRING of SIZE(2) encoding a 2-octet UDP or TCP port number (or equivalent for other protocols). TransportType is an Integer32(1..255) using IP Protocol Numbers from Assigned Numbers.