Cable Device Management Information Base for Data-Over-Cable Service Interface Specification (DOCSIS) Compliant Cable Modems and Cable Modem Termination Systems
obsoletes
- rfc-2669 — DOCSIS Cable Device MIB Cable Device Management Information Base for DOCSIS compliant Cable Modems and Cable Modem Termination Systems
updated by
- rfc-9141 — Updating References to the IETF FTP Service
Extracted elements (29)
A cable modem applies filters in a layered order: inbound LLC filters first, then special filters (IP spoofing and SNMP access), then IP inbound filters, then IP outbound filters, and finally LLC outbound filters. This ordering reflects the protocol layering model.
docsDevFilterIpTable and related IP filtering tables are deprecated in favor of the Data Path, Classifier, and Action tables from the Differentiated Services MIB (RFC 3289), in order to support IPv6 filtering and DSCP marking, which the legacy IPv4-only tables could not accommodate.
Most MIB tables (e.g., docsDevNmAccessTable, docsDevFilterLLCTable) are specified not to persist across reboots. Upon reboot, these tables are cleared and repopulated from the DOCSIS configuration file supplied by the cable operator, enabling cable modem portability across different operators.
The stdInterface(9) bit in docsDevEvReporting was added to support RFC 3413 (SNMP Notification MIB) and RFC 3014 (Notification Log MIB) as the event notification mechanism. When set, the agent ignores all other bits except local(0), syslog(2), and localVolatile(8), providing a clean migration path to standards-based notification infrastructure.
docsDevNmAccessTable is deprecated in favor of SNMP coexistence MIBs (RFC 3584), TARGET and NOTIFICATION MIBs (RFC 3413), and VACM MIBs (RFC 3415). The table applies only to SNMPv1/v2c traffic and MUST NOT be consulted for SNMPv3 traffic.
RFC 4639 obsoletes RFC 2669, adding deprecation of docsDevFilter and docsDevCpeGroup in favor of DiffServ MIB and InetAddress-based groups, adding SNMPv3/RFC 3584 coexistence support, and updating software download to support both TFTP and HTTP.
The compliance statements in this MIB version require support only for IPv4 addresses because DOCSIS 1.0, 1.1, and 2.0 are not IPv6 capable. Future DOCSIS 3.0 is expected to require IPv6, necessitating new compliance statements rather than changes to existing MIB objects.
docsDevEvControlTable entries MUST persist across reboots for CMTS devices and MUST NOT persist across reboots for CM devices.
docsDevNmAccessCommunity SHOULD return a zero-length string when read, to prevent community string disclosure via SNMP GET operations.
docsDevServerTimeAddress MUST report the Time server address from which the Time of Day reference was actually acquired (per DOCSIS RFI), not just the first address from DHCP option 4, during the period after time acquisition.
For a CMTS, docsDevSwCurrentVers SHOULD contain a human-readable representation of the vendor-specific software designation for the chassis or control processor. If neither is applicable, the value MUST be a zero-length string.
If docsDevSwServerAddressType is set to dns(16), attempting to set docsDevSwServerTransportProtocol to tftp(1) MUST result in an error. Conversely, if the transport protocol is tftp(1), attempting to set the address type to dns(16) MUST result in an error.
If the local(0) bit is set in docsDevEvReporting, entries in docsDevEventTable MUST persist across reboots, since it is useful to maintain a record of events across reboots for debugging purposes.
In docsDevNmAccessInterfaces, bits representing upstream and downstream channel interfaces MUST NOT be set to '1'. The object applies only to link-layer interfaces such as Ethernet and CATV MAC.
The CM and CMTS MUST provide support for notification message throttling, including both rate-based throttling (cease/resume based on message rate vs. threshold) and count-based limiting (cease when total count exceeds a threshold over a measurement interval).
The docsDevCpeGroup (IP spoofing filters via docsDevCpeTable and docsDevCpeInetTable) MUST NOT be implemented on the Cable Modem Termination System (CMTS); it is only for implementation on Cable Modems (CM).
When IP spoofing filters are active, the device MUST consult docsDevCpeTable for a packet's source address before consulting docsDevCpeInetTable, to prevent implementation ambiguity when both tables are populated.
docsDevEvReporting is a BITS object controlling per-priority event reporting: local(0) logs to non-volatile internal log, traps(1) sends SNMP trap, syslog(2) sends syslog message, localVolatile(8) logs to volatile internal log only, stdInterface(9) delegates to RFC 3413/RFC 3014 mechanisms.
docsDevEvThrottleAdminStatus controls notification transmission: unconstrained(1) sends without limit, maintainBelowThreshold(2) suppresses notifications above the rate threshold, stopAtThreshold(3) ceases transmission at threshold until reactivated by management, inhibited(4) suppresses all traps and syslog messages.
docsDevFilterIpTable (deprecated in favor of DiffServ MIB) is a classifier table where each row matches IP packets by source/destination address+mask, upper-layer protocol, port ranges, and ToS. Matched packets may be dropped, accepted, or subjected to a policy via docsDevFilterPolicyTable indirection.
docsDevFilterLLCTable contains inbound LLC (level-2) filters applied to frames entering the CM from either the RF MAC or CPE interfaces. Filters can be set to drop frames matching at least one entry or to accept frames matching at least one entry.
docsDevIgmpModeControl (added in RFC 4639) sets the IGMP mode to passive(1), where the CM/CMTS forwards IGMP based on subscriber-side multicast activity, or active(2), where the device terminates and initiates IGMP itself. Default is passive.
docsDevNmAccessTable (deprecated) controls SNMP access by network management stations via IP address/mask, community string, access type (none/read/readWrite/roWithTraps/rwWithTraps/trapsOnly), interface bitmap, and trap version. If the table is empty, access is unrestricted.
docsDevRole identifies the device as cm(1), cmtsActive(2), or cmtsBackup(3). For a CM, the role does not change during operation; for a CMTS, it may transition between cmtsActive and cmtsBackup. cmtsBackup is defined for completeness despite lacking current DOCSIS standard support.
docsDevServerBootState is a read-only object with 10 states tracking CM/CMTS provisioning progress: operational, disabled, waitingForDhcpOffer, waitingForDhcpResponse, waitingForTimeServer, waitingForTftp, refusedByCmts, forwardingDenied, other, unknown.
docsDevSwOperStatus reports the current software upgrade state: inProgress(1), completeFromProvisioning(2), completeFromMgt(3), failed(4), or other(5). No docsDevSw* objects may be modified while inProgress(1).
docsDevNmAccessTable provides only minimal SNMP access security via community strings and IP address matching, and is deprecated. Implementors should use SNMPv3 USM/VACM (RFC 3414, RFC 3415) or RFC 3584 coexistence MIBs for proper access control. Community strings read back as zero-length to avoid credential disclosure.
Several read-write and read-create objects in this MIB can affect device operation and security, including docsDevResetNow (can reset the device), docsDevSwAdminStatus and related software upgrade objects (can load arbitrary firmware), and docsDevFilterLLCTable/docsDevFilterIpTable entries (can alter traffic filtering policy). Operators are advised to use SNMPv3 with authentication and privacy.
docsDevSwAdminStatus controls software upgrade: upgradeFromMgt(1) triggers immediate TFTP/HTTP download and reboot; allowProvisioningUpgrade(2) accepts provisioning server version on next reboot; ignoreProvisioningUpgrade(3) disregards provisioning server upgrade info. On download interruption, the device loads the previous image and retries.