Management Information Base for the User Datagram Protocol (UDP)
obsoletes
Extracted elements (18)
High-capacity Counter64 objects (udpHCInDatagrams, udpHCOutDatagrams) were added because a Counter32 will wrap in just over an hour at 1 million datagrams per second, making them mandatory for high-speed implementations.
IPV6-UDP-MIB (RFC 2454) was moved to Historic because the approach of having separate IP-version-specific tables is no longer followed. Scoped addresses are now represented using IPv4z and IPv6z types, eliminating the need for an explicit ifIndex in the table index.
The IPv4-only udpTable was deprecated because it only supports IPv4 and does not permit describing 'connected' UDP endpoints. The new udpEndpointTable is IP-version-neutral and supports both listening and connected endpoints, following the IETF approach of writing IP-version-neutral MIBs.
If the total number of octets or sub-identifiers in udpEndpointLocalAddress and udpEndpointRemoteAddress exceeds 111, OIDs of column instances will have more than 128 sub-identifiers and cannot be accessed using SNMPv1, SNMPv2c, or SNMPv3.
The deprecated udpMIBCompliance (for IPv4-only systems) is retained and agents are still encouraged to implement those objects in order to interoperate with the deployed base of managers, despite being superseded by udpMIBCompliance2.
Deployment of SNMP versions prior to SNMPv3 is NOT RECOMMENDED. It is RECOMMENDED to deploy SNMPv3 and enable cryptographic security for authentication and privacy.
The udpHCGroup (Counter64 high-capacity counters) is mandatory for systems that are capable of receiving or transmitting more than 1 million UDP datagrams per second.
The udpEndpointTable provides IP-version-independent access to all UDP endpoints, supporting both listening endpoints (wildcard remote) and connected endpoints (specific remote address/port), along with the OS process ID handling each endpoint.
udpEndpointInstance (Unsigned32, 1..0xffffffff) distinguishes among multiple processes connected to the same UDP endpoint, supporting SO_REUSEADDR and SO_REUSEPORT socket options.
udpEndpointLocalAddressType (InetAddressType) and udpEndpointLocalAddress (InetAddress) together represent the local endpoint address. A zero-length octet-string with unknown(0) type indicates willingness to accept both IPv4 and IPv6 datagrams.
udpEndpointProcess (Unsigned32) reports the system's process ID for the process associated with the UDP endpoint, expected to match HOST-RESOURCES-MIB::hrSWRunIndex or SYSAPPL-MIB::sysApplElmtRunIndex.
udpHCInDatagrams (Counter64) and udpHCOutDatagrams (Counter64) are high-capacity counters for devices that can receive or transmit more than 1 million UDP datagrams per second, added since RFC 2013.
udpInDatagrams (Counter32) counts total UDP datagrams delivered to UDP users. Discontinuities are indicated by sysUpTime discontinuities.
udpInErrors (Counter32) counts received UDP datagrams that could not be delivered for reasons other than the lack of an application at the destination port.
udpNoPorts (Counter32) counts received UDP datagrams for which there was no application at the destination port.
This MIB uses two IANA-assigned OBJECT IDENTIFIER values in the SMI Numbers registry: 'udp' at { mib-2 7 } and 'udpMIB' at { mib-2 50 }.
All managed objects in this MIB are read-only (no read-write or read-create), so there is no risk that an intruder can alter or create management objects via direct SNMP SET operations if the MIB is implemented correctly.
The indices of udpEndpointTable and udpTable expose open port information (udpEndpointLocalPort, udpLocalPort), enabling an attacker to identify open ports and likely successful attacks without running a port scanner. GET and NOTIFY access should be controlled and values encrypted when transmitted via SNMP.