Definitions of Managed Objects for Remote Ping, Traceroute, and Lookup Operations
obsoleted by
- rfc-4560 — Definitions of Managed Objects for Remote Ping, Traceroute, and Lookup Operations
Extracted elements (27)
ICMP-based traceroute SHOULD NOT be used because RFC 792 prohibits generating ICMP messages about ICMP messages, causing routers to silently discard TTL-expired responses to ICMP Echo requests and making intermediate hops invisible. UDP probes to an unused port are the RECOMMENDED method.
Non-ICMP ping methods (UDP echo port 7, SNMP query timing, TCP connect timing) may yield better responses than ICMP Echo because some routers do not honor Echo Requests or handle them at lower priority, potentially producing false round-trip time indications.
The pingCtlOwnerIndex and traceRouteCtlOwnerIndex fields are typed as SnmpAdminString so they can be mapped trivially to an SNMPv3 VACM securityName or groupName, enabling per-user row-level access control without separate per-user tables.
A traceroute operation can theoretically run for up to 42 hours and 30 minutes (traceRouteCtlTimeOut × traceRouteCtlProbesPerHop × traceRouteCtlMaxTtl at maximum values). The traceRouteCtlMaxFailures object (default 5) is provided to terminate operations early on repeated consecutive timeouts.
The pingCtlType and traceRouteCtlType objects allow a management application to report or select the probe implementation method. The compliance statement requires that pingIcmpEcho be the only mandatory supported pingCtlType value, and write access to this object is optional.
Using maximum parameter values (pingCtlTimeOut=60, pingCtlProbeCount=15), a single ping test can take up to 15 minutes; using defaults (3s timeout, 1 probe) yields a maximum of 3 seconds. Management applications should account for this range when setting timeouts.
A pingCtlEntry MUST be created with pingCtlRowStatus set to active(1) before the test is started via pingCtlAdminStatus. A value MUST be set for pingCtlTargetAddress prior to transitioning the entry to active(1) state.
After a single traceroute (or ping) test completes, the number of seconds defined by traceRouteCtlFrequency (or pingCtlFrequency) MUST elapse before the next test is started. A value of 0 disables repetition.
An implementation MUST start assigning pingProbeHistoryIndex values at 1 and wrap after exceeding the maximum value ('ffffffff'h). The oldest entry must be removed once the table reaches pingCtlMaxRows to accommodate new entries.
An implementation MUST start assigning traceRouteProbeHistoryIndex values at 1 and wrap after exceeding the maximum value ('ffffffff'h), removing oldest entries when the table reaches traceRouteCtlMaxRows.
An implementation SHOULD NOT retain SNMP-created entries in the lookupCtlTable and lookupResultsTable across reIPLs (Initial Program Loads), since management applications require consistent behavior regarding the persistence of table entries they create.
Entries MUST be stored in the lookupResultsTable in the order they are retrieved, with lookupResultsIndex values starting at 1 and increasing. The official host name returned by gethostbyaddr() MUST be assigned a lookupResultsIndex of 1.
It is RECOMMENDED that agent implementations impose a time limit on traceroute operations; an implementation that cannot process multiple concurrent traceroute operations SHOULD impose a shorter maximum allowed time period to prevent the operation from running for the theoretical maximum of 42+ hours.
The ping capability defined in this memo SHOULD be implemented using the ICMP Echo Facility. The management application using a remote ping capability must know which method is in use because different methods yield different response times.
Traceroute implementations SHOULD use UDP packets to a (hopefully) unused port and SHOULD NOT use ICMP Echo Request probes, which have a high probability of failure because routers commonly do not return TTL-expired messages in response to ICMP input.
DISMAN-NSLOOKUP-MIB provides remote DNS resolution: setting lookupCtlTargetAddressType to dns(16) invokes gethostbyname() to resolve a symbolic name to addresses; ipv4(1) or ipv6(2) invokes gethostbyaddr() to resolve a numeric address to symbolic names. Multiple results per query are stored in lookupResultsTable with sequential index values.
DISMAN-PING-MIB (OID mib-2 80) consists of pingMaxConcurrentRequests, pingCtlTable (test control with 23 columnar objects), pingResultsTable (per-test RTT aggregates), and pingProbeHistoryTable (ring-buffered per-probe results). Tests are started by setting pingCtlAdminStatus to enabled(1).
DISMAN-TRACEROUTE-MIB (OID mib-2 81) adds traceRouteHopsTable for storing the current path per traceRouteCtlEntry; hop entries are created only when traceRouteCtlCreateHopsEntries is true(1). The traceRouteCtlMaxFailures object terminates a traceroute after a configurable number of consecutive timeouts.
pingCtlDSField (Unsigned32, range 0–255) specifies the Differentiated Services field (TOS in IPv4, Traffic Class in IPv6) to set in probe packets; a value of 0 indicates the feature is unsupported. An equivalent traceRouteCtlDSField object exists in the traceroute MIB.
pingCtlTrapGeneration is a BITS object with three flags: probeFailure(0) generates pingProbeFailed after N successive failures (controlled by pingCtlTrapProbeFailureFilter), testFailure(1) generates pingTestFailed when total probe failures exceed pingCtlTrapTestFailureFilter, and testCompletion(2) generates pingTestCompleted at test end.
pingImplementationTypeDomains registers four standard ping implementation types: pingIcmpEcho(1), pingUdpEcho(2), pingSnmpQuery(3), pingTcpConnectionAttempt(4). Additional enterprise-specific types SHOULD be registered under enterprise OIDs, not beneath pingImplementationTypeDomains.
pingResultsTable stores per-test aggregate statistics: minimum, maximum, and average RTT (milliseconds), probe response count, sent probe count, RTT sum-of-squares (for standard deviation), and DateAndTime of last good probe. An entry is created when the test starts and removed when its pingCtlEntry is deleted.
The OperationResponseStatus textual convention (shared between ping and traceroute MIBs) encodes 11 probe result codes: responseReceived(1), unknown(2), internalError(3), requestTimedOut(4), unknownDestinationAddress(5), noRouteToTarget(6), interfaceInactiveToTarget(7), arpFailure(8), maxConcurrentLimitReached(9), unableToResolveDnsName(10), invalidHostAddress(11).
traceRouteCtlDontFragment (TruthValue) sets the Don't Fragment (DF) bit in probe IP headers, enabling manual PATH MTU testing via traceroute. traceRouteCtlInitialTtl allows skipping well-known initial hops by starting the TTL walk above 1.
DISMAN-PING-MIB is registered at mib-2 80 and DISMAN-TRACEROUTE-MIB at mib-2 81 under the SNMP MIB-2 subtree. These assignments place the DISMAN remote operations MIBs in the IETF-managed portion of the MIB-2 object tree.
The OwnerIndex (SnmpAdminString) pattern in all three MIBs, combined with SNMPv3 VACM vacmViewTreeFamilyTable configuration, restricts each management application's access to only its own table rows, preventing unauthorized modification or deletion of another application's ping, traceroute, or lookup entries.
These MIBs can be misused to generate excessive network traffic toward arbitrary hosts, constituting a form of denial-of-service attack. Sending probes too frequently can negatively affect target system performance; implementations MUST be managed with SNMPv3 authentication and access control to restrict who may initiate operations.