Management Information Base for the Transmission Control Protocol (TCP)
obsoletes
Extracted elements (21)
RFC 2452 (IPV6-TCP-MIB) was moved to Historic status because having separate IP-version-specific tables is no longer the IETF approach; implementation of RFC 2452 is no longer suggested in favor of the version-neutral tcpConnectionTable.
The original tcpConnTable was deprecated for two reasons: (1) it supports only IPv4, whereas the IETF now mandates IP-version-neutral MIBs using InetAddressType/InetAddress; (2) it mixes listening endpoints with active connections, which have different management access patterns, so splitting into tcpConnectionTable and tcpListenerTable enables addition of endpoint-specific objects.
The tcpConnectionProcess and tcpListenerProcess objects expose the OS-level process ID so that management applications can correlate TCP connections to running processes, a capability found valuable in operational environments.
OID { tcp 16 } was used for the ipv6TcpConnTable in the now-obsoleted RFC 2452; it MUST NOT be reused. The deprecated tcpMIBCompliance (IPv4-only) is retained to interoperate with deployed managers, even though tcpMIBCompliance2 is the current statement.
The tcpListenerTable represents an application accepting both IPv4 and IPv6 with InetAddressType unknown(0) and a zero-length address; an application accepting only one family uses '0.0.0.0' or '::' with the appropriate type. The address type reflects the actual communication protocol, not socket-level abstraction.
Implementors MUST NOT create tcpConnectionTable or tcpListenerTable index entries that result in OIDs with more than 128 subidentifiers, as such entries cannot be accessed via SNMPv1, SNMPv2c, or SNMPv3.
It is RECOMMENDED that implementers deploy SNMPv3 with full cryptographic mechanisms (authentication and privacy); deployment of SNMPv1 or SNMPv2c is NOT RECOMMENDED.
Only the value deleteTCB(12) may be written to tcpConnectionState (or tcpConnState); an agent MUST return badValue if a management station attempts to set any other value.
The tcpHCGroup (tcpHCInSegs, tcpHCOutSegs) is mandatory for systems capable of receiving or transmitting more than 1 million TCP segments per second, since a Counter32 wraps in just over an hour at that rate.
tcpHCInSegs and tcpHCOutSegs are Counter64 equivalents of tcpInSegs and tcpOutSegs, forming the tcpHCGroup for high-speed implementations.
tcpMaxConn reports the maximum number of TCP connections the entity supports; a value of -1 indicates a dynamic limit with no fixed maximum.
tcpRtoAlgorithm identifies the retransmission timeout algorithm in use: other(1), constant(2), rsre(3), vanj(4), or rfc2988(5). tcpRtoMin and tcpRtoMax give the minimum and maximum RTO values in milliseconds.
The deprecated tcpConnTable (IPv4-only) is retained for backward compatibility with deployed managers but has been superseded by tcpConnectionTable. It uses IpAddress rather than InetAddress and conflates listeners with active connections.
The tcp scalar group includes Counter32 statistics: tcpActiveOpens (SYN-SENT from CLOSED), tcpPassiveOpens (SYN-RCVD from LISTEN), tcpAttemptFails, tcpEstabResets, tcpInSegs, tcpOutSegs, tcpRetransSegs, tcpInErrs, and tcpOutRsts. Counter discontinuities are signaled via sysUpTime.
The tcpConnectionProcess and tcpListenerProcess objects are Unsigned32 values identifying the OS-level process handling a connection or listener, expected to match hrSWRunIndex (HOST-RESOURCES-MIB) or sysApplElmtRunIndex (SYSAPPL-MIB).
The tcpConnectionState object enumerates all TCP states (closed, listen, synSent, synReceived, established, finWait1, finWait2, closeWait, lastAck, closing, timeWait, deleteTCB) and is read-write; the only writable value is deleteTCB(12), which immediately terminates the connection.
The tcpConnectionTable provides IP-version-neutral access to status information for all active TCP connections, indexed by local/remote address type, address, and port. Each row is transient and ceases to exist when the connection transitions to the CLOSED state.
The tcpListenerTable provides access to information about TCP listening endpoints, separate from active connections. A listener willing to accept both IPv4 and IPv6 is represented by InetAddressType unknown(0) and a zero-length address string.
This document defines the TCP-MIB module (OID { mib-2 49 }) under the SNMP MIB-2 subtree, replacing and obsoleting RFC 2012 and RFC 2452. The module includes object groups tcpBaseGroup, tcpConnectionGroup, tcpListenerGroup, tcpHCGroup, and the deprecated tcpGroup.
The tcpConnectionState and tcpConnState objects are read-write, permitting arbitrary TCP connection termination via SNMP SET; unauthorized access constitutes a denial-of-service attack. The tcpConnectionTable and tcpListenerTable expose active connection details and open ports, enabling targeted attacks and privacy violations. SNMPv3 with cryptographic authentication and privacy is required to mitigate these risks.
tcpConnectionState models the full TCP state machine with states: closed(1), listen(2), synSent(3), synReceived(4), established(5), finWait1(6), finWait2(7), closeWait(8), lastAck(9), closing(10), timeWait(11), deleteTCB(12). The listen(2) state is included only for parallelism with the old table and should not appear in tcpConnectionTable; listeners belong in tcpListenerTable.