Remote Network Monitoring MIB Protocol Identifier Reference Extensions
updates
- rfc-2895 — Remote Network Monitoring MIB Protocol Identifier Reference
Extracted elements (25)
An application verb is defined as a transaction type, not a single PDU opcode, because a single verb (e.g., SNMP Get) may involve multiple PDU types (Get-PDU and Response-PDU) and may span multiple protocol directory entries (e.g., ftp and ftp-data).
Because some application verb strings exceed 4 octets in length, an integer mapping must be provided for each string verb name. The 24-bit enumeration space (up to 16,777,215 verbs) was chosen to fit within the 3 available octets of the verb layer while reserving one octet for future use.
For packet capture filtered at the verb layer, the decision to include a packet may need to be deferred until the packet can be conclusively attributed to a verb. A probe may need to pre-buffer packets pending arrival of later packets that determine verb classification.
For stateful protocols such as SNMP over UDP, a probe cannot distinguish a Response-PDU for a Get-PDU from one for a Getnext-PDU without maintaining request/response correlation state. Similarly, TCP stream reassembly may be required to identify verbs when command data spans multiple packets.
This memo updates but does not obsolete RFC 2895. The <piDefinition> syntax from RFC 2895 is unchanged; only <piFile> is extended to allow <piVerbDefinition> entries alongside existing <piDefinition> entries.
An agent MUST implement all applicable protocolDirTable MIB objects on behalf of each supported application verb.
The agent MUST assign an appropriate protocolDirLocalIndex value for each application verb according to the encoding rules in RFC 2021 and RFC 2895.
The agent MUST convey the <verbName> value in the protocolDirDescr object, encoded as the parent application's protocolDirDescr appended with a dot character followed by the exact verbName text.
The agent MUST set the protocolDirAddressMapConfig object for each application verb to the value 'notSupported(1)'.
The agent MUST set the protocolDirType object for each application verb to the value representing the empty bit set ({}).
The connect(0) verb enumeration value (zero) MUST NOT be redefined in a verb identifier macro verb list. The verb name 'connect' itself is not reserved and MAY be redefined.
The DESCRIPTION clause MUST be present in all verb-identifier macro declarations.
The first octet of the verb layer in protocolDirID is reserved for future use and MUST be set to zero.
The <parentProtoName> value MUST be the value of a protocol identifier defined as specified for <protoName> in RFC 2895 section 3.2.4, and MUST specify a <protoName> defined in the same <piFile>.
The verb list clause MUST be present and MUST contain at least one verb. Up to 16,777,215 (2^24 - 1) verbs MAY be specified.
Verb names MUST be unique for a particular parent application. The <verbEnum> field MUST also be unique for all verbs associated with a particular parent application.
When multiple verb types are present in a single packet, the agent MUST choose exactly one verb type and one protocol directory entry in order to properly count the packet without double-counting.
An application verb (also called simply 'verb') is a transaction type defined for a particular application protocol, potentially involving several PDU types. It is not equivalent to a sub-command or opcode within a single packet. A special 'connect(0)' verb is implicitly defined for every application protocol to capture connection/session setup and tear-down traffic.
The protocolDirHostConfig and protocolDirMatrixConfig objects for application verbs MUST be set according to each verb's monitoring capabilities. The agent MAY mirror the parent application's configuration values and MAY transition from 'supportedOn(2)' to 'supportedOff(3)' when the parent does so.
The VERB-IDENTIFIER macro is a new construct in the PI language for associating string verb names with integer enumerations for a specific parent application. It extends the Protocol Identifier Reference (RFC 2895) grammar with a new keyword VERB-IDENTIFIER and an associated <piVerbDefinition> production.
At the time of publication, no application protocol verbs defined by this document require IANA registration. A future version may define verb assignments within the 'ianaAssigned' protocol identifier subtree of RFC 2895.
This document defines algorithms for representing application verbs in RMON Protocol Identifiers and does not itself introduce new security risks. However, MIB collections using verb-level Protocol Identifiers may expose which application protocol verbs are in use on a network, requiring additional protection considerations by MIB designers.
The protocolDirID for an application verb is formed by appending the 4-octet verb layer [0.a.b.c] to the parent application's protocolDirID, where 'a' is the high-order byte, 'b' the middle, and 'c' the low-order byte of the verbEnum. The special value '0.0.0.0' is reserved for the implicit connect(0) verb.
The protocolDirParameters OCTET STRING for a verb is the parent application's protocolDirParameters value appended with one octet containing the value zero. This octet is not functionally used but is required to conform to RFC 2895 encoding rules.
The verb layer is a 4-octet field within the protocolDirID INDEX: the first octet is reserved and MUST be set to zero; the remaining three octets encode the <verbEnum> as a 24-bit unsigned integer in network byte order, ranging from 0x000000 (connect(0)) to 0xFFFFFF.