TCP Extended Statistics MIB
Extracted elements (28)
The connection index (tcpEStatsConnectIndex) is introduced because using the full 4-tuple to index per-connection tables makes rapid polling of multiple related objects cumbersome. The integer index allows a single walk to retrieve all statistics for one connection efficiently.
The Listener Table instruments connections using observable protocol events (SYNs received, segments, resource allocation) rather than implementation-specific state transitions, so that it generalizes across SYN-flood defenses that use alternate state transition diagrams or syn-cookies to encode SYN-RCVD state implicitly.
The MIB exposes actual TCP implementation estimators and state variables rather than precisely defined network-path metrics. This makes it more useful for understanding how a specific implementation interacts with the network but means objects may not be exactly comparable across different TCP implementations.
The MIB intentionally does not constrain TCP to use or exclude any particular estimator, heuristic, or algorithm. Because TCP standards routinely use SHOULD rather than MUST to allow room for improvement, a tight MIB specification would conflict with ongoing TCP evolution.
For SYN-flood defenses that use syn-cookies (encoding SYN-RCVD state cryptographically in the ISS), there is no explicit SYN-RCVD state, so tcpEStatsListenerCurBacklog MAY exclude connections in SYN-RECEIVED state and only count ESTABLISHED connections awaiting accept.
SACK negotiation is not symmetrical: tcpEStatsStackWillSendSACK and tcpEStatsStackWillUseSACK may have different negotiated values, reflecting that one side of a connection can send SACK options while the other does not.
This MIB clarifies RFC 4022 (TCP-MIB) such that the phrase 'soon after' in the discussion of tcpConnectionTable row deletion means 'after tcpEStatsConnTableLatency seconds'. This clarification only applies when TCP-ESTATS-MIB is implemented alongside TCP-MIB.
All MIB objects MUST have the same persistence properties as the underlying TCP implementation. On a reboot, all zero-based counters MUST be cleared, all dynamically created table rows MUST be deleted, and all read-write objects MUST be restored to their default values.
tcpEStatsPathPreCongSumCwnd and tcpEStatsPathPreCongSumRTT MUST each be updated every time tcpEStatsPerfCongSignals is incremented, so that their change divided by the change in CongSignals yields the average window and RTT just prior to a congestion signal.
tcpEStatsPerfCongSignals SHOULD be incremented in association with the Fast Retransmit algorithm to minimize spurious congestion indications due to out-of-order segments. Retransmission timeouts SHOULD also be included.
tcpEStatsPerfPipeSize SHOULD equal the 'pipe' variable as defined in RFC 3517 when that algorithm is implemented. If RFC 3517 is not implemented, the in-flight data octets SHOULD be estimated as SND.NXT minus SND.UNA adjusted by retransmit and dupack counts.
The RECOMMENDED algorithm for assigning tcpEStatsConnectIndex is to begin at 1, increment to an implementation-specific maximum, and then wrap back to 1 skipping values already in use, ensuring uniqueness across active connections.
The tcpEStatsConnTableLatency object SHOULD provide a configuration option to allow customization of the row-retention duration after a connection closes. A value of 0 causes entries to be removed as soon as the connection enters the closed state.
When TCP stops sending data for any reason that cannot be classified as Receiver Limited or Congestion Limited, it MUST be treated as Sender Limited. Retransmission timeouts SHOULD be counted in tcpEStatsPerfSndLimTimeCwnd rather than any other state timer.
tcpEStatsAppTable and tcpEStatsTuneTable provide application-level diagnostics (whether the application is limiting TCP by not consuming or producing data quickly enough) and per-connection tuning controls (overrides for common path problems), both activated by their respective control scalars.
tcpEStatsConnectIdTable augments tcpConnectionTable to provide tcpEStatsConnectIndex, a unique integer per connection used to index all five per-connection statistics tables, enabling rapid polling of multiple objects for one TCP connection without using the full 4-tuple.
tcpEStatsListenerTable augments tcpListenerTable (RFC 4022) with per-listener counters for SYNs received, connections initialized into the backlog, connections established, connections accepted, and connections dropped from the backlog, plus high-capacity 64-bit variants and current backlog gauges.
TcpEStatsNegotiated is a textual convention with three values: enabled(1) when the feature was successfully negotiated by both hosts, selfDisabled(2) when the local host refused or did not implement the feature, and peerDisabled(3) when the local host was willing but the remote host did not negotiate.
tcpEStatsPathTable provides per-connection path diagnostics including reordering episode counts, RTT samples (min/max/sum/count), RTO bounds, IP TTL and ToS fields, pre- and post-congestion RTT and cwnd accumulators, ECN signal counts, and receiver-side duplicate-ACK episode counters.
tcpEStatsPerfCongSignals counts all multiplicative downward congestion window adjustments from Fast Retransmit, ECN signals, and timeouts, making it the best single indicator of how the congestion window is being affected by network congestion across all AIMD mechanisms.
tcpEStatsPerfTable exposes core per-connection TCP performance state: segments and octets in/out, retransmissions, elapsed time, current MSS, pipe size, smoothed RTT, RTO, congestion window, slow-start threshold, receiver window sent/received, and the three-state SndLim transition and time counters.
tcpEStatsStackTable exposes negotiated TCP option state (MSS sent/received, window scale, timestamps, ECN, SACK send/use), current TCP connection state, Nagle status, slow-start and congestion-avoidance cwnd maxima, spurious retransmit detection counters, and retransmit/reassembly queue depth gauges.
Two notifications are defined: tcpEStatsEstablishNotification signals that a new connection has been accepted or established, and tcpEStatsCloseNotification signals that an existing connection has recently closed. Both are controlled by tcpEStatsControlNotify.
IANA assigned the TCP-ESTATS-MIB module the OID mib-2 156 (i.e., { mib-2 156 }), registering it under the standard MIB-2 subtree as defined by this document.
Accepting TCP connections before the ESTABLISHED state is explicitly noted as dangerous because it creates an easy opportunity for denial-of-service attacks using forged source IP addresses; SYN-flood defenses defer full resource allocation until liveness criteria are met.
Access to the TCP Extended Statistics MIB must be controlled using SNMP access control mechanisms, as the per-connection statistics expose detailed information about TCP behavior, congestion state, and active connections that could be exploited by adversaries to infer network topology or time attacks.
The tcpEStatsListenerTable is specifically designed to help diagnose SYN-flood denial-of-service attacks by exposing counters for SYNs received, backlog entries, connections dropped from the backlog, and connections successfully accepted, providing operators visibility into attack severity without requiring packet captures.
The SndLim three-state machine tracks what limits TCP throughput. States are: Receiver Limited (sender fills the announced receiver window), Congestion Limited (sender reaches cwnd or retransmission timeout), and Sender Limited (all other stops, including application or resource limits). Transition counts (SndLimTrans*) and cumulative durations (SndLimTime*) are recorded for each state.