Definitions of Managed Objects for Remote Ping, Traceroute, and Lookup Operations
obsoletes
- rfc-2925 — Definitions of Managed Objects for Remote Ping, Traceroute, and Lookup Operations
Extracted elements (26)
ICMP probes SHOULD NOT be used for traceroute because RFC 792 states no ICMP messages are sent about ICMP messages, causing many routers to not return TTL-expired ICMP responses to incoming ICMP Echo Requests, making intermediate hops invisible.
Non-ICMP ping methods (UDP echo port, SNMP query, TCP connect) are noted as often yielding better response rates than ICMP Echo, since some routers do not honor Echo Requests or handle them at lower priority, causing false RTT indications. The management application must know which method is in use because different methods yield different response times.
The pingCtlOwnerIndex (type SnmpAdminString) is used as an owner index to enable SNMPv3 VACM-based access control, allowing multiple users to create entries independently while keeping their entries identifiable and access-controllable via VACM's vacmViewTreeFamilyTable.
The lookup capability may return results inconsistent with a pure DNS lookup, as it uses host resolver functions (getaddrinfo/gethostbyname/getnameinfo/gethostbyaddr) that can be influenced by local lookup tables or other sources, depending on managed node configuration.
A remote ping test is started by setting pingCtlAdminStatus to enabled(1). The corresponding pingCtlEntry MUST have been created, and its pingCtlRowStatus set to active(1), prior to starting the test.
A value MUST be specified for pingCtlTargetAddress prior to acceptance of a transition to active(1) state via pingCtlRowStatus.
An implementation MUST start assigning pingProbeHistoryIndex values at 1 and wrap after exceeding the maximum possible value, as defined by the limit of this object ('ffffffff'h).
An implementation MUST start assigning traceRouteProbeHistoryIndex values at 1 and wrap after exceeding the maximum possible value ('ffffffff'h).
An implementation SHOULD NOT retain SNMP-created entries in the lookupResultsTable across reIPLs (Initial Program Loads) of its agent, since management applications need to see consistent behavior with respect to persistence of table entries.
If a reverse lookup (getnameinfo/gethostbyaddr) returns multiple host names and one is the 'official host name', that name MUST be assigned a lookupResultsIndex of 1. All returned entries MUST be stored in the order retrieved, with lookupResultsIndex values starting at 1.
It is RECOMMENDED that agent implementations impose a time limit for how long a traceroute operation is allowed to take. An implementation that cannot process multiple traceroute operations simultaneously SHOULD impose a shorter maximum allowed time period.
It is RECOMMENDED that the ping capability defined within this memo be implemented using the ICMP Echo Facility.
lookupResultsTable results SHOULD be results of a lookup function commonly used by applications at the managed node, which means results may be influenced by local lookup tables and are not necessarily consistent with a pure DNS lookup.
The corresponding traceRouteCtlEntry MUST have been created, and its traceRouteCtlRowStatus set to active(1), prior to starting a remote traceroute test.
Traceroute implementations SHOULD use UDP packets to a (hopefully) unused port. ICMP probes (ICMP Echo Request packets) SHOULD NOT be used, as many routers refuse to send ICMP TTL expired messages in response to incoming ICMP packets.
DISMAN-NSLOOKUP-MIB provides lookupCtlTable and lookupResultsTable. The value of lookupCtlTargetAddressType determines the lookup direction: dns(16) triggers forward lookup (name to address), while ipv4(1) or ipv6(2) triggers reverse lookup (address to name).
DISMAN-PING-MIB defines pingCtlTable (test configuration), pingResultsTable (aggregated results), and pingProbeHistoryTable (per-probe history). Tests are indexed by pingCtlOwnerIndex (SnmpAdminString, up to 32 octets) and pingCtlTestName (SnmpAdminString, up to 32 octets).
DISMAN-TRACEROUTE-MIB adds traceRouteHopsTable beyond the ping analog components, storing one entry per traceroute hop. Creation of hop entries is enabled by setting traceRouteCtlCreateHopsEntries to true(1).
OperationResponseStatus is a textual convention with 11 values: responseReceived(1), unknown(2), internalError(3), requestTimedOut(4), unknownDestinationAddress(5), noRouteToTarget(6), interfaceInactiveToTarget(7), arpFailure(8), maxConcurrentLimitReached(9), unableToResolveDnsName(10), invalidHostAddress(11).
pingCtlDSField (Unsigned32, 0–255) stores the Differentiated Services field value for the six most significant bits of the TOS octet (IPv4) or Traffic Class octet (IPv6) in probe packets. A value of 0 indicates the feature is unsupported.
pingCtlTrapGeneration is a BITS object with three flags: probeFailure(0) triggers pingProbeFailed notification (filtered by pingCtlTrapProbeFailureFilter, 0–15 consecutive failures), testFailure(1) triggers pingTestFailed, and testCompletion(2) triggers pingTestCompleted. Default is no bits set.
pingImplementationTypeDomains defines four registered OID-based implementation types: pingIcmpEcho, pingUdpEcho (port 7), pingSnmpQuery, and pingTcpConnectionAttempt. Additional types SHOULD be registered under enterprise-specific subtrees, not under pingImplementationTypeDomains.
This document (obsoleting RFC 2925) registers DISMAN-PING-MIB at mib-2 80, DISMAN-TRACEROUTE-MIB at mib-2 81, and DISMAN-NSLOOKUP-MIB at mib-2 82 under the IANA MIB-2 subtree.
Ping and traceroute operations can constitute a form of system attack when used excessively: sending requests too often can degrade target performance, and TCP port-connect probes to supposedly unused ports are unpredictable. SNMP write access to control tables must be secured using SNMPv3 or other access control mechanisms to prevent unauthorized initiation of probe operations.
The MIB objects defined can expose sensitive information such as network topology (via traceroute hops) and DNS resolution results. Implementations should use SNMPv3 with VACM to restrict read access to the results tables, in addition to restricting write access to control tables.
A ping test entry transitions through: notReady(3) → notInService(2) when pingCtlTargetAddress is set, then pingCtlAdminStatus enabled(1) starts the operation. pingResultsOperStatus reflects enabled(1)/disabled(2)/completed(3). Transitions in/out of active are blocked while pingResultsOperStatus is active(1), except destroy(6) which stops an active operation.