Definitions of Managed Objects for Bridges
obsoletes
- rfc-1493 — Definitions of Managed Objects for Bridges
Extracted elements (26)
dot1dTpPortMaxInfo is defined separately from ifMtu because ifMtu is defined as the size usable by the inter-network layer, which differs from the MAC layer INFO field size when multiple encapsulation layers are used.
Several IEEE 802.1D management objects were intentionally excluded from the MIB because they duplicate objects in other MIBs: BridgeName=sysDescr, BridgeUpTime=sysUpTime, PortAddresses=ifPhysAddress, PortName=ifDescr, PortType=ifType. Transitory state objects (TopologyChange, TopologyChangeAcknowledged) were excluded as not useful for polling.
The MIB was kept minimal by applying six criteria: start with essential objects only, require fault or configuration management utility, consider evidence of actual use, limit total object count, exclude objects derivable from other MIBs, and avoid heavily instrumenting critical sections (one counter per critical section per layer).
dot1dStpTimeSinceTopologyChange has clarified semantics for RSTP: it reports the time since the tcWhile timer for any port on the bridge was nonzero, rather than the time since the last topology change detection in classic STP.
Full support for 802.1D management objects requires that SNMPv2-MIB objects sysDescr and sysUpTime, and IF-MIB objects ifIndex, ifType, ifDescr, ifPhysAddress, and ifLastChange are implemented alongside the BRIDGE-MIB.
The value of dot1dStaticAllowedToGoTo may exceed the SNMP minimum maximum message size of 484 bytes (for SNMP over UDP per RFC 3417). SNMP engines on bridges with large port counts must support appropriate maximum message sizes.
Deployment of SNMP versions prior to SNMPv3 is NOT RECOMMENDED. Implementers are RECOMMENDED to use SNMPv3 with full cryptographic mechanisms (authentication and privacy) to protect access to this MIB module.
Implementation of the dot1dBase subtree (dot1dBaseBridgeGroup and dot1dBasePortGroup) is mandatory for all bridges. STP, transparent bridging, and static filtering subtrees are conditionally mandatory based on the bridge's supported features.
New implementations SHOULD support dot1dStpPortPathCost32. If the port path cost exceeds the maximum value of dot1dStpPortPathCost (65535), that object should report 65535, and applications should try to read dot1dStpPortPathCost32.
Configurable STP bridge timer ranges: dot1dStpBridgeMaxAge (600..4000 centi-seconds), dot1dStpBridgeHelloTime (100..1000 centi-seconds), dot1dStpBridgeForwardDelay (400..3000 centi-seconds). All have 1-second granularity per 802.1D-1998; agents MAY return badValue for non-whole-second sets.
dot1dStpPortPathCost (Integer32, 1..65535) carries the 16-bit path cost for a port; if the actual cost exceeds 65535, this object reports 65535 and implementations SHOULD also support dot1dStpPortPathCost32 (Integer32, 1..200000000) for IEEE 802.1t 32-bit path costs.
The BRIDGE-MIB module defines five major subtrees under dot1dBridge (mib-2 17): dot1dBase (all bridges), dot1dStp (Spanning Tree Protocol), dot1dSr (source routing, defined in RFC 1525), dot1dTp (transparent bridging), and dot1dStatic (destination-address filtering).
The BridgeId textual convention defines an 8-octet Bridge Identifier used in the Spanning Tree Protocol: the first two octets (network byte order) contain a priority value, and the last six octets contain the MAC address that uniquely identifies the bridge.
The dot1dBase subtree is mandatory for all bridge implementations and includes dot1dBaseBridgeAddress (the bridge's unique MAC address), dot1dBaseNumPorts (number of ports), dot1dBaseType (unknown, transparent-only, sourceroute-only, or srt), and the dot1dBasePortTable.
The dot1dBasePortTable contains per-port entries indexed by port number (1..65535), with fields for ifIndex mapping, circuit OID (for disambiguating multiple ports sharing an ifIndex such as X.25 VCs), delay-exceeded discard counter, and MTU-exceeded discard counter.
The dot1dStaticTable provides destination-address filtering with entries keyed by (dot1dStaticAddress, dot1dStaticReceivePort). dot1dStaticAllowedToGoTo is a bitmap OCTET STRING (0..512 bytes) where each bit represents one port; bit=1 means the port is in the allowed forwarding set.
The dot1dStp subtree covers Spanning Tree Protocol state including protocol version (dot1dStpProtocolSpecification: unknown, decLb100, ieee8021d), bridge priority, designated root, root cost, root port, and the operational timers MaxAge, HelloTime, HoldTime, and ForwardDelay.
The dot1dTpFdbTable (Forwarding Database) contains unicast MAC address entries with three fields: dot1dTpFdbAddress (MAC), dot1dTpFdbPort (port number or 0 if unknown), and dot1dTpFdbStatus (other/invalid/learned/self/mgmt).
The Timeout textual convention represents STP timers in units of 1/100 seconds (hundredths of a second) in the MIB, while STP BPDUs encode these timers in units of 1/256 seconds. A specific conversion algorithm is defined: to convert to 1/256 units use floor((n*256)/100); to convert back use ceiling((b*100)/256).
Two SNMP notifications are defined: newRoot (sent when the bridge becomes the new STP root, after topology change timer expiration) and topologyChange (sent when a port transitions from Learning to Forwarding or Forwarding to Blocking, but not when newRoot is also sent). Both are optional to implement.
This document uses the IANA-assigned OBJECT IDENTIFIER dot1dBridge ::= { mib-2 17 }, recorded in the SMI Numbers registry.
Setting dot1dTpAgingTime to a large value may facilitate forwarding table overflow attacks; write access to dot1dStaticTable can disable provisioned filtering or add filters that block legitimate traffic.
The readable dot1dTpFdbTable reveals MAC addresses and thus hardware manufacturer information, enabling targeted attacks. Forged newRoot or topologyChange notifications may trigger unnecessary management computations and generate additional SNMP traffic, constituting a denial-of-service vector.
Writable STP objects (dot1dStpPriority, dot1dStpBridgeMaxAge, dot1dStpBridgeHelloTime, dot1dStpBridgeForwardDelay, dot1dStpPortPriority, dot1dStpPortEnable, dot1dStpPortPathCost, dot1dStpPortPathCost32) can be exploited to force suboptimal spanning tree topologies or slow failure recovery if unauthorized write access is obtained.
dot1dStpPortState defines six STP port states: disabled(1), blocking(2), listening(3), learning(4), forwarding(5), and broken(6). The bridge places a malfunctioning port in broken(6); administratively disabled ports report disabled(1).
dot1dStaticAllowedToGoTo is encoded as an OCTET STRING up to 512 bytes; the first octet covers ports 1-8, second covers ports 9-16, etc., with the most significant bit representing the lowest-numbered port in each octet. This allows representing up to 4096 ports.