Management Information Base for Data Over Cable Service Interface Specification (DOCSIS) Cable Modem Termination Systems for Subscriber Management
updated by
- rfc-9141 — Updating References to the IETF FTP Service
Extracted elements (27)
CMTS-based subscriber management duplicates CM-based filtering from RFC 2669 but is more secure because physical access to the CMTS is controlled by the network operator; a malicious user could tamper with cable modem software to disable its filtering policies, but cannot similarly subvert the CMTS.
docsSubMgtFilterGroupIndex is read-only despite being the table's sole value and its index, contrary to normal SMI practice. This is necessary because diffServClfrElementSpecific requires a RowPointer, and the table exists solely to provide referenced objects for that pointer; there is no writable content.
Rather than maintaining a separate filter list for each modem, the MIB assumes large numbers of modems share common filtering characteristics, so modems are grouped by filter group index. This avoids per-modem filter table explosion at the CMTS.
Separate upstream and downstream filter groups are defined for cable modem traffic versus subscriber host traffic, distinguished solely by MAC address match. This enables operators to apply different policies to modems (e.g., server-subnet-only access) versus their attached hosts.
The DiffServ MIB (RFC 3289) is reused for classification, counting, and drop functions rather than defining a standalone filter mechanism. Filter groups act as a logical sub-interface field prepended to each packet for first-pass classification, feeding into diffServMultiFieldClfrTable for second-pass IP/TCP/UDP criteria matching.
Implementations must include specific groups from the Differentiated Services MIB (RFC 3289): diffServMIBDataPathGroup, diffServMIBClfrGroup, diffServMIBClfrElementGroup, diffServMIBMultiFieldClfrGroup, diffServMIBActionGroup, diffServMIBAlgDropGroup, and diffServMIBCounterGroup.
The compliance statement restricts diffServAlgDropType to alwaysDrop(5) only; other drop-type values need not be supported for DOCSIS subscriber management use.
The compliance statement restricts RowStatus objects (diffServDataPathStatus, diffServClfrStatus, diffServClfrElementStatus, diffServAlgDropStatus) to active(1) on read and createAndGo(4)/destroy(6) on write; support for createAndWait and notInService is not required.
The compliance statements in this version of the MIB require support only for IPv4 addresses (InetAddressType ipv4(1), InetAddress SIZE(4)) because DOCSIS 1.0, 1.1, and 2.0 are not IPv6-capable. Future IPv6 support will require new compliance statements rather than changes to the MIB objects themselves.
Deployment of SNMP versions prior to SNMPv3 is NOT RECOMMENDED; SNMPv3 with cryptographic security SHOULD be deployed instead.
For network filtering of TCP traffic to be effective, implementors MUST follow the tiny-fragment and overlapping-fragment attack prevention recommendations in section 3.4 (admit fragments with offset >= 2, discard offset = 1 or offset = 0 with payload < 16 bytes, apply filter rules to offset = 0 packets).
If docsSubMgtCpeControlActive is true and the CMTS receives an IP packet from a CM whose source address is not in docsSubMgtCpeIpTable, and the table already has docsSubMgtCpeControlMaxCpeIp entries for that CM, the packet MUST be dropped.
It is RECOMMENDED that implementers support the full SNMPv3 framework including cryptographic mechanisms for authentication and privacy, as specified in RFC 3410 section 8.
The default scalar objects docsSubMgtCpeMaxIpDefault, docsSubMgtCpeActiveDefault, and docsSubMgtCpeLearnableDefault should be treated as nonvolatile; their values should persist across device resets.
docsSubMgtCmFilterTable AUGMENTs docsIfCmtsCmStatusEntry and holds four Integer32 filter group indices per modem: SubDownstream, SubUpstream, CmDownstream, and CmUpstream. A value of zero means use the default diffServClfrElementSpecific=zeroDotZero entry rather than a signaled filter group.
docsSubMgtCpeControlActive (TruthValue) globally enables or disables CMTS-based subscriber management for a modem. When false, no subscriber management filtering is applied at the CMTS. Defaults to docsSubMgtCpeActiveDefault (default value: false) if not signaled at DOCSIS registration.
docsSubMgtCpeControlLearnable (TruthValue) controls whether the CMTS may learn CPE IP addresses from upstream traffic and add them to docsSubMgtCpeIpTable. Learning is limited to docsSubMgtCpeControlMaxCpeIp minus provisioned entries. Defaults to docsSubMgtCpeLearnableDefault (default: true).
docsSubMgtCpeControlMaxCpeIp (Integer32, 0..2147483647, compliance-limited to 0..16) specifies the maximum simultaneous IP addresses permitted behind a cable modem. A value of zero drops all CPE traffic; if DOCSIS provisioning supplies more IP entries than this value, the object is raised to match that count.
docsSubMgtCpeControlTable AUGMENTs docsIfCmtsCmStatusTable and provides four writable objects controlling subscriber management per cable modem: maximum CPE IP count, active flag, learnable flag, and a reset trigger. Rows are created at modem registration and persist for the lifespan of the corresponding docsIfCmtsCmStatusEntry.
docsSubMgtCpeIpTable tracks known CPE IP addresses on a per-CM basis, indexed by docsIfCmtsCmStatusIndex and docsSubMgtCpeIpIndex. Each entry carries InetAddressType, InetAddress, and a TruthValue indicating whether the address was learned (vs. provisioned).
docsSubMgtFilterGroupTable provides read-only OID anchors (docsSubMgtFilterGroupIndex, Integer32 1..65535) that diffServClfrElementSpecific can point to. An entry exists only if referenced by the diffServClfrElementEntry; its index is unusually read-only because it is both the entry's key and its sole value.
The IANA-assigned OBJECT IDENTIFIER { mib-2 125 } is allocated to the docsSubMgt module (DOCS-IETF-SUBMGT-MIB) and recorded in the SMI Numbers registry.
docsSubMgtCpeIpAddr in docsSubMgtCpeIpTable is the most sensitive readable object because, although the table is intended to control address spoofing, it reveals the current subscriber address pool, which is itself valuable to would-be spoofers. Even GET access should be controlled and encryption considered.
Implementors MUST prevent the tiny fragment attack and overlapping fragment attack for TCP filtering: discard packets with fragment offset = 1, or offset = 0 with fragment payload length < 16 bytes; admit fragments with offset >= 2; apply filter rules only to offset = 0 packets.
MIB-based subscriber management limitations may be compromised if the cable modem's identity or registration process is spoofed. The DOCSIS RFI and BPI+ specifications define mechanisms for assuring modem identity that underpin the security model of this MIB.
Unauthorized SETs to filter assignment objects (docsSubMgtCmFilterSubDownstream/Upstream, docsSubMgtCmFilterCmDownstream/Upstream) could defeat operator-defined packet filtering and allow subscribers to bypass traffic restrictions.
Unauthorized SNMP SET operations on CPE control objects (docsSubMgtCpeControlActive, docsSubMgtCpeControlMaxCpeIp, docsSubMgtCpeControlLearnable, docsSubMgtCpeControlReset, and their defaults) would enable IP address spoofing by bypassing or relaxing CPE address enforcement.