which the flow was observed and AdjacentAddress will be the
MAC address for that interface. This is the usual case.
If traffic is being metered inside a tunnel, AdjacentType will
be the peer type of the host at the end of the tunnel and
AdjacentAddress will be the peer address for that host."
::= { flowDataEntry 5 }
flowDataSourceAdjacentAddress OBJECT-TYPE
SYNTAX AdjacentAddress
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Address of the adjacent device on the path for the source
for this flow."
::= { flowDataEntry 6 }
flowDataSourceAdjacentMask OBJECT-TYPE
SYNTAX AdjacentAddress
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"1-bits in this mask indicate which bits must match when
comparing the adjacent source address for this flow."
::= { flowDataEntry 7 }
flowDataSourcePeerType OBJECT-TYPE
SYNTAX PeerType
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Peer address type of the source for this flow."
::= { flowDataEntry 8 }
flowDataSourcePeerAddress OBJECT-TYPE
SYNTAX PeerAddress
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Address of the peer device for the source of this flow."
::= { flowDataEntry 9 }
flowDataSourcePeerMask OBJECT-TYPE
SYNTAX PeerAddress
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"1-bits in this mask indicate which bits must match when
comparing the source peer address for this flow."
::= { flowDataEntry 10 }
flowDataSourceTransType OBJECT-TYPE
SYNTAX TransportType
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Transport address type of the source for this flow. The
value of this attribute will depend on the peer address type."
::= { flowDataEntry 11 }
flowDataSourceTransAddress OBJECT-TYPE
SYNTAX TransportAddress
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Transport address for the source of this flow."
::= { flowDataEntry 12 }
flowDataSourceTransMask OBJECT-TYPE
SYNTAX TransportAddress
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"1-bits in this mask indicate which bits must match when
comparing the transport source address for this flow."
::= { flowDataEntry 13 }
flowDataDestInterface OBJECT-TYPE
SYNTAX Integer32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Index of the interface associated with the dest address for
this flow. This value is one of the values contained in the
ifIndex field of the interfaces table."
::= { flowDataEntry 14 }
flowDataDestAdjacentType OBJECT-TYPE
SYNTAX AdjacentType
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Adjacent address type of the destination for this flow."
::= { flowDataEntry 15 }
flowDataDestAdjacentAddress OBJECT-TYPE
SYNTAX AdjacentAddress
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Address of the adjacent device on the path for the
destination for this flow."
::= { flowDataEntry 16 }
flowDataDestAdjacentMask OBJECT-TYPE
SYNTAX AdjacentAddress
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"1-bits in this mask indicate which bits must match when
comparing the adjacent destination address for this flow."
::= { flowDataEntry 17 }
flowDataDestPeerType OBJECT-TYPE
SYNTAX PeerType
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Peer address type of the destination for this flow."
::= { flowDataEntry 18 }
flowDataDestPeerAddress OBJECT-TYPE
SYNTAX PeerAddress
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Address of the peer device for the destination of this flow."
::= { flowDataEntry 19 }
flowDataDestPeerMask OBJECT-TYPE
SYNTAX PeerAddress
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"1-bits in this mask indicate which bits must match when
comparing the destination peer type for this flow."
::= { flowDataEntry 20 }
flowDataDestTransType OBJECT-TYPE
SYNTAX TransportType
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Transport address type of the destination for this flow. The
value of this attribute will depend on the peer address type."
::= { flowDataEntry 21 }
flowDataDestTransAddress OBJECT-TYPE
SYNTAX TransportAddress
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Transport address for the destination of this flow."
::= { flowDataEntry 22 }
flowDataDestTransMask OBJECT-TYPE
SYNTAX TransportAddress
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"1-bits in this mask indicate which bits must match when
comparing the transport destination address for this flow."
::= { flowDataEntry 23 }
flowDataPDUScale OBJECT-TYPE
SYNTAX Integer32 (0..255)
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The scale factor applied to this particular flow. Indicates
the number of bits the PDU counter values should be moved left
to obtain the actual values."
::= { flowDataEntry 24 }
flowDataOctetScale OBJECT-TYPE
SYNTAX Integer32 (0..255)
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The scale factor applied to this particular flow. Indicates
the number of bits the octet counter values should be moved
left to obtain the actual values."
::= { flowDataEntry 25 }
flowDataRuleSet OBJECT-TYPE
SYNTAX Integer32 (1..255)
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The RuleSet number of the RuleSet which created this flow.
Allows a manager to use GetNext or GetBulk requests to find
flows belonging to a particular RuleSet."
::= { flowDataEntry 26 }
flowDataToOctets OBJECT-TYPE
SYNTAX Counter64
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The count of octets flowing from source to destination
for this flow."
::= { flowDataEntry 27 }
flowDataToPDUs OBJECT-TYPE
SYNTAX Counter64
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The count of packets flowing from source to destination
for this flow."
::= { flowDataEntry 28 }
flowDataFromOctets OBJECT-TYPE
SYNTAX Counter64
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The count of octets flowing from destination to source
for this flow."
::= { flowDataEntry 29 }
flowDataFromPDUs OBJECT-TYPE
SYNTAX Counter64
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The count of packets flowing from destination to source
for this flow."
::= { flowDataEntry 30 }
flowDataFirstTime OBJECT-TYPE
SYNTAX TimeStamp
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The time at which this flow was first entered in the table"
::= { flowDataEntry 31 }
flowDataLastActiveTime OBJECT-TYPE
SYNTAX TimeStamp
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The last time this flow had activity, i.e. the time of
arrival of the most recent PDU belonging to this flow."
::= { flowDataEntry 32 }
flowDataSourceSubscriberID OBJECT-TYPE
SYNTAX OCTET STRING (SIZE (4..20))
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Subscriber ID associated with the source address for this
flow. A Subscriber ID is an unspecified text string, used
to ascribe traffic flows to individual users. At this time
the means by which a Subscriber ID may be associated with a
flow is unspecified."
::= { flowDataEntry 33 }
flowDataDestSubscriberID OBJECT-TYPE
SYNTAX OCTET STRING (SIZE (4..20))
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Subscriber ID associated with the destination address for
this flow. A Subscriber ID is an unspecified text string,
used to ascribe traffic flows to individual users. At this
time the means by which a Subscriber ID may be associated
with a flow is unspecified."
::= { flowDataEntry 34 }
flowDataSessionID OBJECT-TYPE
SYNTAX OCTET STRING (SIZE (4..10))
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Session ID for this flow. Such an ID might be allocated
by a network access server to distinguish a series of sessions
between the same pair of addresses, which would otherwise
appear to be parts of the same accounting flow."
::= { flowDataEntry 35 }
flowDataSourceClass OBJECT-TYPE
SYNTAX Integer32 (1..255)
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Source class for this flow. Determined by the rules, set by
a PushRule action when this flow was entered in the table."
::= { flowDataEntry 36 }
flowDataDestClass OBJECT-TYPE
SYNTAX Integer32 (1..255)
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Destination class for this flow. Determined by the rules, set
by a PushRule action when this flow was entered in the table."
::= { flowDataEntry 37 }
flowDataClass OBJECT-TYPE
SYNTAX Integer32 (1..255)
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Class for this flow. Determined by the rules, set by a
PushRule action when this flow was entered in the table."
::= { flowDataEntry 38 }
flowDataSourceKind OBJECT-TYPE
SYNTAX Integer32 (1..255)
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Source kind for this flow. Determined by the rules, set by
a PushRule action when this flow was entered in the table."
::= { flowDataEntry 39 }
flowDataDestKind OBJECT-TYPE
SYNTAX Integer32 (1..255)
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Destination kind for this flow. Determined by the rules, set
by a PushRule action when this flow was entered in the table."
::= { flowDataEntry 40 }
flowDataKind OBJECT-TYPE
SYNTAX Integer32 (1..255)
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Class for this flow. Determined by the rules, set by a
PushRule action when this flow was entered in the table."
::= { flowDataEntry 41 }
--
-- The Activity Column Table
--
flowColumnActivityTable OBJECT-TYPE
SYNTAX SEQUENCE OF FlowColumnActivityEntry
MAX-ACCESS not-accessible
STATUS deprecated
DESCRIPTION
"Index into the Flow Table. Allows a meter reader to retrieve
a list containing the flow table indexes of flows which were
last active at or after a given time, together with the values
of a specified attribute for each such flow."
::= { flowData 2 }
flowColumnActivityEntry OBJECT-TYPE
SYNTAX FlowColumnActivityEntry
MAX-ACCESS not-accessible
STATUS deprecated
DESCRIPTION
"The Column Activity Entry for a particular attribute,
activity time and flow."
INDEX { flowColumnActivityAttribute, flowColumnActivityTime,
flowColumnActivityIndex }
::= { flowColumnActivityTable 1 }
FlowColumnActivityEntry ::= SEQUENCE {
flowColumnActivityAttribute FlowAttributeNumber,
flowColumnActivityTime TimeFilter,
flowColumnActivityIndex Integer32,
flowColumnActivityData OCTET STRING
}
flowColumnActivityAttribute OBJECT-TYPE
SYNTAX FlowAttributeNumber
MAX-ACCESS read-only
STATUS deprecated
DESCRIPTION
"Specifies the attribute for which values are required from
active flows."
::= { flowColumnActivityEntry 1 }
flowColumnActivityTime OBJECT-TYPE
SYNTAX TimeFilter
MAX-ACCESS read-only
STATUS deprecated
DESCRIPTION
"This variable is a copy of flowDataLastActiveTime in the
flow data record identified by the flowColumnActivityIndex
value of this flowColumnActivityTable entry."
::= { flowColumnActivityEntry 2 }
flowColumnActivityIndex OBJECT-TYPE
SYNTAX Integer32 (1..2147483647)
MAX-ACCESS read-only
STATUS deprecated
DESCRIPTION
"Index of a flow table entry which was active at or after
a specified flowColumnActivityTime."
::= { flowColumnActivityEntry 3 }
flowColumnActivityData OBJECT-TYPE
SYNTAX OCTET STRING (SIZE (3..1000))
MAX-ACCESS read-only
STATUS deprecated
DESCRIPTION
"Collection of attribute data for flows active after
flowColumnActivityTime. Within the OCTET STRING is a
sequence of { flow index, attribute value } pairs, one for
each active flow. The end of the sequence is marked by a
flow index value of 0, indicating that there are no more
rows in this column.
The format of objects inside flowColumnFlowData is as follows.
All numbers are unsigned. Numbers and strings appear with
their high-order bytes leading. Numbers are fixed size, as
specified by their SYNTAX in the flow table (above), i.e. one
octet for flowAddressType and small constants, and four octets
for Counter and TimeStamp. Strings are variable-length, with
the length given in a single leading octet.
The following is an attempt at an ASN.1 definition of
flowColumnActivityData:
flowColumnActivityData ::= SEQUENCE flowRowItemEntry
flowRowItemEntry ::= SEQUENCE {
flowRowNumber Integer32 (1..65535),
-- 0 indicates the end of this column
flowDataValue flowDataType -- Choice depends on attribute
}
flowDataType ::= CHOICE {
flowByteValue Integer32 (1..255),
flowShortValue Integer32 (1..65535),
flowLongValue Integer32,
flowStringValue OCTET STRING -- Length (n) in first byte,
-- n+1 bytes total length, trailing zeroes truncated
}"
::= { flowColumnActivityEntry 4 }
--
-- The Data Package Table
--
flowDataPackageTable OBJECT-TYPE
SYNTAX SEQUENCE OF FlowDataPackageEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Index into the Flow Table. Allows a meter reader to retrieve
a sequence containing the values of a specified set of
attributes for a flow which came from a specified RuleSet and
which was last active at or after a given time."
::= { flowData 3 }
flowDataPackageEntry OBJECT-TYPE
SYNTAX FlowDataPackageEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The data package containing selected variables from
active rows in the flow table."
INDEX { flowPackageSelector,
flowPackageRuleSet, flowPackageTime, flowPackageIndex }
::= { flowDataPackageTable 1 }
FlowDataPackageEntry ::= SEQUENCE {
flowPackageSelector OCTET STRING,
flowPackageRuleSet Integer32,
flowPackageTime TimeFilter,
flowPackageIndex Integer32,
flowPackageData OCTET STRING
}
flowPackageSelector OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Specifies the attributes for which values are required from
an active flow. These are encoded as a sequence of octets
each containing a FlowAttribute number, preceded by an octet
giving the length of the sequence (not including the length
octet). For a flowPackageSelector to be valid, it must
contain at least one attribute."
::= { flowDataPackageEntry 1 }
flowPackageRuleSet OBJECT-TYPE
SYNTAX Integer32 (1..255)
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Specifies the index (in the flowRuleSetInfoTable) of the rule
set which produced the required flow."
::= { flowDataPackageEntry 2 }
flowPackageTime OBJECT-TYPE
SYNTAX TimeFilter
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"This variable is a copy of flowDataLastActiveTime in the
flow data record identified by the flowPackageIndex
value of this flowPackageTable entry."
::= { flowDataPackageEntry 3 }
flowPackageIndex OBJECT-TYPE
SYNTAX Integer32 (1..2147483647)
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Index of a flow table entry which was active at or after
a specified flowPackageTime."
::= { flowDataPackageEntry 4 }
flowPackageData OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"A collection of attribute values for a single flow, as
specified by this row's indexes. The attribute values are
contained within a BER-encoded sequence [ASN-1, ASN-BER],
in the order they appear in their flowPackageSelector.
For example, to retrieve a flowPackage containing values for
attributes 11, 18 and 29, for a flow in RuleSet 7, with flow
index 3447, one would GET the package whose Object Identifier
(OID) is
flowPackageData . 3.11.18.29 . 7. 0 . 3447
To get a package for the next such flow which had been
active since time 12345 one would GETNEXT the package whose
Object Identifier (OID) is
flowPackageData . 3.11.18.29 . 7. 12345 . 3447"
::= { flowDataPackageEntry 5 }
--
-- The Rule Table
--
-- This is an array of RuleSets; the 'running' ones are indicated
-- by the entries in the meter's flowManagerInfoTable. Several
-- RuleSets can be held in a meter so that the manager can change the
-- running RuleSets easily, for example with time of day. Note that
-- a manager may not change the rules in any RuleSet currently
-- referenced within the flowManagerInfoTable (either as 'current' or
-- 'standby')! See the 'Traffic Flow Measurement: Architecture'
-- document [RTFM-ARC] for details of rules and how they are used.
-- Space for a RuleSet is allocated by setting the value of
-- flowRuleInfoSize in the rule table's flowRuleSetInfoTable row.
-- Values for each row in the RuleSet (Selector, Mask, MatchedValue,
-- Action and Parameter) can then be set by the meter.
-- Although an individual rule within a RuleSet could be modified,
-- it is much safer to simply download a complete new RuleSet.
flowRuleTable OBJECT-TYPE
SYNTAX SEQUENCE OF FlowRuleEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Contains all the RuleSets which may be used by the meter."
::= { flowRules 1 }
flowRuleEntry OBJECT-TYPE
SYNTAX FlowRuleEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The rule record itself."
INDEX { flowRuleSet, flowRuleIndex }
::= { flowRuleTable 1 }
FlowRuleEntry ::= SEQUENCE {
flowRuleSet Integer32,
flowRuleIndex Integer32,
flowRuleSelector RuleAttributeNumber,
flowRuleMask RuleAddress,
flowRuleMatchedValue RuleAddress,
flowRuleAction ActionNumber,
flowRuleParameter Integer32
}
flowRuleSet OBJECT-TYPE
SYNTAX Integer32 (1..2147483647)
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Selects a RuleSet from the array of RuleSets."
::= { flowRuleEntry 1 }
flowRuleIndex OBJECT-TYPE
SYNTAX Integer32 (1..2147483647)
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The index into the Rule table. N.B: These values will
normally be consecutive, given the fall-through semantics
of processing the table."
::= { flowRuleEntry 2 }
flowRuleSelector OBJECT-TYPE
SYNTAX RuleAttributeNumber
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"Indicates the attribute to be matched.
null(0) is a special case; null rules always succeed.
matchingStoD(50) is set by the meter's Packet Matching Engine.
Its value is true(1) if the PME is attempting to match the
packet with its addresses in Source-to-Destination order (i.e.
as they appear in the packet), and false(2) otherwise.
Details of how packets are matched are given in the 'Traffic
Flow Measurement: Architecture' document [RTFM-ARC].
v1(51), v2(52), v3(53), v4(54) and v5(55) select meter
variables, each of which can hold the name (i.e. selector
value) of an address attribute. When one of these is used
as a selector, its value specifies the attribute to be
tested. Variable values are set by an Assign action."
::= { flowRuleEntry 3 }
flowRuleMask OBJECT-TYPE
SYNTAX RuleAddress
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The initial mask used to compute the desired value. If the
mask is zero the rule's test will always succeed."
::= { flowRuleEntry 4 }
flowRuleMatchedValue OBJECT-TYPE
SYNTAX RuleAddress
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The resulting value to be matched for equality.
Specifically, if the attribute chosen by the flowRuleSelector
logically ANDed with the mask specified by the flowRuleMask
equals the value specified in the flowRuleMatchedValue, then
continue processing the table entry based on the action
specified by the flowRuleAction entry. Otherwise, proceed to
the next entry in the rule table."
::= { flowRuleEntry 5 }
flowRuleAction OBJECT-TYPE
SYNTAX ActionNumber
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The action to be taken if this rule's test succeeds, or if
the meter's 'test' flag is off. Actions are opcodes for the
meter's Packet Matching Engine; details are given in the
'Traffic Flow Measurement: Architecture' document [RTFM-ARC]."
::= { flowRuleEntry 6 }
flowRuleParameter OBJECT-TYPE
SYNTAX Integer32 (1..65535)
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"A parameter value providing extra information for this rule's
action. Most of the actions use the parameter value to specify
which rule to execute after this rule's test has failed; details
are given in the 'Traffic Flow Measurement: Architecture'
document [RTFM-ARC]."
::= { flowRuleEntry 7 }
--
-- Traffic Flow Meter conformance statement
--
flowMIBCompliances
OBJECT IDENTIFIER ::= { flowMIBConformance 1 }
flowMIBGroups
OBJECT IDENTIFIER ::= { flowMIBConformance 2 }
flowControlGroup OBJECT-GROUP
OBJECTS {
flowRuleInfoSize, flowRuleInfoOwner,
flowRuleInfoTimeStamp, flowRuleInfoStatus,
flowRuleInfoName,
flowRuleInfoRulesReady,
flowRuleInfoFlowRecords,
flowInterfaceSampleRate,
flowInterfaceLostPackets,
flowReaderTimeout, flowReaderOwner,
flowReaderLastTime, flowReaderPreviousTime,
flowReaderStatus, flowReaderRuleSet,
flowManagerCurrentRuleSet, flowManagerStandbyRuleSet,
flowManagerHighWaterMark,
flowManagerCounterWrap,
flowManagerOwner, flowManagerTimeStamp,
flowManagerStatus, flowManagerRunningStandby,
flowFloodMark,
flowInactivityTimeout, flowActiveFlows,
flowMaxFlows, flowFloodMode }
STATUS deprecated
DESCRIPTION
"The control group defines objects which are used to control
an accounting meter."
::= {flowMIBGroups 1 }
flowDataTableGroup OBJECT-GROUP
OBJECTS {
-- flowDataIndex, <- INDEX, not-accessible
flowDataStatus,
flowDataSourceInterface,
flowDataSourceAdjacentType,
flowDataSourceAdjacentAddress, flowDataSourceAdjacentMask,
flowDataSourcePeerType,
flowDataSourcePeerAddress, flowDataSourcePeerMask,
flowDataSourceTransType,
flowDataSourceTransAddress, flowDataSourceTransMask,
flowDataDestInterface,
flowDataDestAdjacentType,
flowDataDestAdjacentAddress, flowDataDestAdjacentMask,
flowDataDestPeerType,
flowDataDestPeerAddress, flowDataDestPeerMask,
flowDataDestTransType,
flowDataDestTransAddress, flowDataDestTransMask,
-- flowDataRuleSet, <- INDEX, not-accessible
flowDataToOctets, flowDataToPDUs,
flowDataFromOctets, flowDataFromPDUs,
flowDataFirstTime, flowDataLastActiveTime,
flowDataSourceClass, flowDataDestClass, flowDataClass,
flowDataSourceKind, flowDataDestKind, flowDataKind
}
STATUS deprecated
DESCRIPTION
"The flow table group defines objects which provide the
structure for the flow table, including the creation time
and activity time indexes into it. In addition it defines
objects which provide a base set of flow attributes for the
adjacent, peer and transport layers, together with a flow's
counters and times. Finally it defines a flow's class and
kind attributes, which are set by rule actions."
::= {flowMIBGroups 2 }
flowDataScaleGroup OBJECT-GROUP
OBJECTS {
flowManagerCounterWrap,
flowDataPDUScale, flowDataOctetScale
}
STATUS deprecated
DESCRIPTION
"The flow scale group defines objects which specify scale
factors for counters."
::= {flowMIBGroups 3 }
flowDataSubscriberGroup OBJECT-GROUP
OBJECTS {
flowDataSourceSubscriberID, flowDataDestSubscriberID,
flowDataSessionID
}
STATUS current
DESCRIPTION
"The flow subscriber group defines objects which may be used
to identify the end point(s) of a flow."
::= {flowMIBGroups 4 }
flowDataColumnTableGroup OBJECT-GROUP
OBJECTS {
flowColumnActivityAttribute,
flowColumnActivityIndex,
flowColumnActivityTime,
flowColumnActivityData
}
STATUS deprecated
DESCRIPTION
"The flow column table group defines objects which can be used
to collect part of a column of attribute values from the flow
table."
::= {flowMIBGroups 5 }
flowDataPackageGroup OBJECT-GROUP
OBJECTS {
flowPackageData
}
STATUS current
DESCRIPTION
"The data package group defines objects which can be used
to collect a specified set of attribute values from a row of
the flow table."
::= {flowMIBGroups 6 }
flowRuleTableGroup OBJECT-GROUP
OBJECTS {
flowRuleSelector,
flowRuleMask, flowRuleMatchedValue,
flowRuleAction, flowRuleParameter
}
STATUS current
DESCRIPTION
"The rule table group defines objects which hold the set(s)
of rules specifying which traffic flows are to be accounted
for."
::= {flowMIBGroups 7 }
flowDataScaleGroup2 OBJECT-GROUP
OBJECTS {
-- flowManagerCounterWrap, <- Deprecated
flowDataPDUScale, flowDataOctetScale
}
STATUS current
DESCRIPTION
"The flow scale group defines objects which specify scale
factors for counters. This group replaces the earlier
version of flowDataScaleGroup above (now deprecated)."
::= {flowMIBGroups 8}
flowControlGroup2 OBJECT-GROUP
OBJECTS {
flowRuleInfoSize, flowRuleInfoOwner,
flowRuleInfoTimeStamp, flowRuleInfoStatus,
flowRuleInfoName,
-- flowRuleInfoRulesReady, <- Deprecated
flowRuleInfoFlowRecords,
flowInterfaceSampleRate,
flowInterfaceLostPackets,
flowReaderTimeout, flowReaderOwner,
flowReaderLastTime, flowReaderPreviousTime,
flowReaderStatus, flowReaderRuleSet,
flowManagerCurrentRuleSet, flowManagerStandbyRuleSet,
flowManagerHighWaterMark,
-- flowManagerCounterWrap, <- Moved to DataScaleGroup
flowManagerOwner, flowManagerTimeStamp,
flowManagerStatus, flowManagerRunningStandby,
flowFloodMark,
flowInactivityTimeout, flowActiveFlows,
flowMaxFlows, flowFloodMode }
STATUS current
DESCRIPTION
"The control group defines objects which are used to control
an accounting meter. It replaces the earlier version of
flowControlGroup above (now deprecated)."
::= {flowMIBGroups 9 }
flowMIBCompliance MODULE-COMPLIANCE
STATUS current
DESCRIPTION
"The compliance statement for a Traffic Flow Meter."
MODULE
MANDATORY-GROUPS {
flowControlGroup2,
flowDataTableGroup,
flowDataPackageGroup,
flowRuleTableGroup
}
::= { flowMIBCompliances 1 }
END
5 Security Considerations
5.1 SNMP Concerns
There are a number of management objects defined in this MIB that
have a MAX-ACCESS clause of read-write and/or read-create. Such
objects may be considered sensitive or vulnerable in some network
environments. The support for SET operations in a non-secure
environment without proper protection can have a negative effect on
network operations.
There are a number of managed objects in this MIB that may contain
sensitive information. These include all the objects in the Control
Group (since they control access to meter resources by Managers and
Meter Readers) and those in the Flow Table (since they hold the
collected traffic flow data).
It is thus important to control even GET access to these objects and
possibly to even encrypt the values of these object when sending them
over the network via SNMP. Not all versions of SNMP provide features
for such a secure environment.
SNMPv1 by itself is not a secure environment. Even if the network
itself is secure (for example by using IPSec), even then, there is no
control as to who on the secure network is allowed to access and
GET/SET (read/change/create/delete) the objects in this MIB.
It is recommended that the implementers consider the security
features as provided by the SNMPv3 framework. Specifically, the use
of the User-based Security Model [RFC2574] and the View-based Access
Control Model [RFC2575] is recommended.
It is then a customer/user responsibility to ensure that the SNMP
entity giving access to an instance of this MIB is properly
configured to give access to the objects only to those principals
(users) that have legitimate rights to indeed GET or SET
(change/create/delete) them.
5.2 Traffic Meter Concerns
This MIB describes how an RTFM traffic meter is controlled, and
provides a way for traffic flow data to be retrieved from it by a
meter reader. This is essentially an application using SNMP as a
method of communication between co-operating hosts; it does not - in
itself - have any inherent security risks.
Since, however, the traffic flow data can be extremely valuable for
network management purposes it is vital that sensible precautions be
taken to keep the meter and its data secure. In particular, an
attacker must not be permitted to write any of the meter's variables!
This requires that access to the meter for control purposes (e.g.
loading RuleSets and reading flow data) be restricted. Such
restriction could be achieved in many ways, for example:
- Physical Separation. Meter(s) and meter reader(s) could be
deployed so that control capabilities are kept within a separate
network, access to which is carefully controlled.
- Application-layer Security. A minimal level of security for SNMP
can be provided by using 'community' strings (which are essentially
clear-text passwords) with SNMPv2C [RFC1157]. Where stronger
security is needed, users should consider using the User-based
Security Model [RFC2574] and the View-based Access Control Model
[RFC2575].
- Lower-layer Security. Access to the meter can be protected using
encryption at the network layer. For example, one could run SNMP
to the meter through an encrypted TCP tunnel.
When implementing a meter it may be sensible to use separate network
interfaces for control and for metering. If this is done the control
network can be set up so that it doesn't carry any 'user' traffic,
and the metering interfaces can ignore any user attempts to take
control of the meter.
Users should also consider how they will address attempts to
circumvent a meter, i.e. to prevent it from measuring flows. Such
attempts are essentially denial-of-service attacks on the metering
interfaces. For example
- Port Scan attacks. The attacker sends packets to each of a very
large number of IP (Address : Port) pairs. Each of these packets
creates a new flow in the meter; if there are enough of them the
meter will recognise a 'flood' condition, and will probably stop
creating new flows. As a minimum, users (and implementors) should
ensure that meters can recover from flood conditions as soon as
possible after they occur.
- Counter Wrap attacks: The attacker sends enough packets to cause
the counters in a flow to wrap several times between meter
readings, thus causing the counts to be artificially low. The
change to using 64-bit counters in this MIB reduces this problem
significantly.
Users can reduce the severity of both the above attacks by ensuring
that their meters are read often enough to prevent them being
flooded. The resulting flow data will contain a record of the
attacking packets, which may well be useful in determining where any
attack came from.
6 IANA Considerations
The RTFM Architecture document [RTFM-ARC], has two sets of assigned
numbers: Opcodes for the PME (Pattern Matching Engine) and RTFM
Attribute numbers. All the assigned numbers used in the Meter MIB
appear in Textual Conventions. The numbers they use are derived as
follows:
The MIB's 'Type' textual conventions use names and numbers from the
Assigned Numbers RFC[ASG-NBR]:
MediumType Uses ifType Definitions
PeerType Uses Address Family Numbers
TransportType Uses Protocol Numbers
The MIB's 'AttributeNumber' textual conventions use RTFM Attribute
names and numbers from the RTFM Architecture document [RTFM-ARC], or
other numbers allocated according to that document's IANA
Considerations section:
FlowAttributeNumber Have values stored in a flow table row
RuleAttributeNumber May be tested in a rule
The MIB's ActionNumber textual convention uses RTFM PME Opcode names
and numbers from the RTFM Architecture document [RTFM-ARC], or other
numbers allocated according to that document's IANA Considerations
section.
7 Appendix A: Changes Introduced Since RFC2064
The first version of the Meter MIB was published as RFC2064 in
January 1997. The most significant changes since then are summarised
below.
- TEXTUAL CONVENTIONS: Greater use is made of textual conventions to
describe the various types of addresses used by the meter.
- PACKET MATCHING ATTRIBUTES: Computed attributes (e.g. FlowClass and
FlowKind) may now be tested. This allows one to use these
variables to store information during packet matching.
A new attribute, MatchingStoD, has been added. Its value is 1
while a packet is being matched with its adresses in 'wire'
(source-to-destination) order.
- FLOOD MODE: This is now a read-write variable. Setting it to
false(2) switches the meter out of flood mode and back to normal
operation.
- CONTROL TABLES: Several variables have been added to the RuleSet,
Reader and Manager tables to provide more effective control of the
meter's activities.
- FLOW TABLE: 64-bit counters are used for octet and PDU counts.
This reduces the problems caused by the wrap-around of 32-bit
counters in earlier versions.
flowDataRuleSet is now used as an index to the flow table. This
allows a meter reader to collect only those flow table rows created
by a specified RuleSet.
- DATA PACKAGES: This is a new table, allowing a meter reader to
retrieve values for a list of attributes from a flow as a single
object (a BER-encoded sequence [ASN-1, ASN-BER]). It provides an
efficient way to recover flow data, particularly when used with
SNMP GetBulk requests.
Earlier versions had a 'Column Activity Table'; using this it was
difficult to collect all data for a flow efficiently in a single
SNMP request.
8 Acknowledgements
An early draft of this document was produced under the auspices of
the IETF's Accounting Working Group with assistance from the SNMP
Working Group and the Security Area Advisory Group. Particular
thanks are due to Jim Barnes, Sig Handelman and Stephen Stibler for
their support and their assistance with checking early versions of
the MIB.
Stephen Stibler shared the development workload of producing the MIB
changes summarized in chapter 5 (above).
9 Intellectual Property Notice
The IETF takes no position regarding the validity or scope of any
intellectual property or other rights that might be claimed to
pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights
might or might not be available; neither does it represent that it
has made any effort to identify any such rights. Information on the
IETF's procedures with respect to rights in standards-track and
standards-related documentation can be found in BCP-11. Copies of
claims of rights made available for publication and any assurances of
licenses to be made available, or the result of an attempt made to
obtain a general license or permission for the use of such
proprietary rights by implementers or users of this specification can
be obtained from the IETF Secretariat."
The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary
rights which may cover technology that may be required to practice
this standard. Please address the information to the IETF Executive
Director.
10 References
[ACT-BKG] Mills, C., Hirsch, G. and G. Ruth, "Internet Accounting
Background", RFC1272, November 1991.
[ASG-NBR] Reynolds, J. and J. Postel, "Assigned Numbers", STD 2,
RFC1700, ISI, October 1994.
[ASN-1] Information processing systems - Open Systems
Interconnection - Specification of Abstract Syntax
Notation One (ASN.1), International Organization for
Standardization, International Standard 8824, December
1987.
[ASN-BER] Information processing systems - Open Systems
Interconnection - Specification of Basic Encoding Rules
for Abstract Notation One (ASN.1), International
Organization for Standardization, International Standard
8825, December 1987.
[ENET-OBJ] Kastenholz, F., "Definitions of Managed Objects for the
Ethernet-like Interface Types", RFC1643, July 1994.
[FDDI-MIB] Case, J. and A. Rijsinghani, "FDDI Management Information
Base", RFC1512, September 1993.
[IPPM-FRM] Paxson, V., Almes, G., Mahdavi, J. and M. Mathis,
"Framework for IP Performance Metrics", RFC2330, May
1998.
[MIB-II] McCloghrie, K. and M. Rose, "Management Information Base
for Network Management of TCP/IP-based internets: MIB-
II", STD 17, RFC1213, March 1991.
[RFC1155] Rose, M., and K. McCloghrie, "Structure and
Identification of Management Information for TCP/IP-based
Internets", STD 16, RFC1155, May 1990
[RFC1157] Case, J., Fedor, M., Schoffstall, M. and J. Davin,
"Simple Network Management Protocol", STD 15, RFC1157,
May 1990.
[RFC1212] Rose, M. and K. McCloghrie, "Concise MIB Definitions",
STD 16, RFC1212, March 1991.
[RFC1215] Rose, M., "A Convention for Defining Traps for use with
the SNMP", RFC1215, March 1991
[RFC1901] Case, J., McCloghrie, K., Rose, M. and S. Waldbusser,
"Introduction to Community-based SNMPv2", RFC1901,
January 1996.
[RFC1905] Case, J., McCloghrie, K., Rose, M. and S. Waldbusser,
"Protocol Operations for Version 2 of the Simple Network
Management Protocol (SNMPv2)", RFC1905, January 1996.
[RFC1906] Case, J., McCloghrie, K., Rose, M. and S. Waldbusser,
"Transport Mappings for Version 2 of the Simple Network
Management Protocol (SNMPv2)", RFC1906, January 1996.
[RFC1908] Case, J., McCloghrie, K., Rose, M. and S. Waldbusser,
"Coexistence between version 1 and version 2 of the
Internet-standard Network Management Framework", RFC
1908, January 1996.
[RFC2570] Case, J., Mundy, R., Partain, D. and B. Stewart,
"Introduction to Version 3 of the Internet-standard
Network Management Framework", RFC2570, April 1999.
[RFC2571] Harrington, D., Presuhn, R. and B. Wijnen, "An
Architecture for Describing SNMP Management Frameworks",
RFC2571, April 1999.
[RFC2572] Case, J., Harrington D., Presuhn R. and B. Wijnen,
"Message Processing and Dispatching for the Simple
Network Management Protocol (SNMP)", RFC2572, April
1999.
[RFC2573] Levi, D., Meyer, P. and B. Stewart, "SNMPv3
Applications", RFC2573, April 1999.
[RFC2574] Blumenthal, U. and B. Wijnen, "User-based Security Model
(USM) for version 3 of the Simple Network Management
Protocol (SNMPv3)", RFC2574, April 1999.
[RFC2575] Wijnen, B., Presuhn, R. and K. McCloghrie, "View-based
Access Control Model (VACM) for the Simple Network
Management Protocol (SNMP)", RFC2575, April 1999.
[RFC2578] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J.,
Rose, M. and S. Waldbusser, "Structure of Management
Information Version 2 (SMIv2)", STD 58, RFC2578, April
1999.
[RFC2579] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J.,
Rose, M. and S. Waldbusser, "Textual Conventions for
SMIv2", STD 58, RFC2579, April 1999.
[RFC2580] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J.,
Rose, M. and S. Waldbusser, "Conformance Statements for
SMIv2", STD 58, RFC2580, April 1999.
[RMON-MIB] Waldbusser, S., "Remote Network Monitoring Management
Information Base", RFC1757, February 1995.
[RMON2-MIB] Waldbusser, S., "Remote Network Monitoring Management
Information Base Version 2 using SMIv2", RFC2021,
January 1997.
[RTFM-ARC] Brownlee, N., Mills, C. and Ruth, G., "Traffic Flow
Measurement: Architecture", RFC722, October 1999.
[UTF-8] Yergeau, F., "UTF-8, a transformation format of ISO
10646", RFC2279, January 1998.
[V6-ADDR] Hinden, R. and S. Deering, "IP Version 6 Addressing
Architecture", RFC2373, July 1998.
11 Author's Address
Nevil Brownlee
Information Technology Systems & Services
The University of Auckland
Private Bag 92-019
Auckland, New Zealand
Phone: +64 9 373 7599 x8941
EMail: n.brownlee@auckland.ac.nz
12 Full Copyright Statement
Copyright (C) The Internet Society (1999). All Rights Reserved.
This document and translations of it may be copied and furnished to
others, and derivative works that comment on or otherwise explain it
or assist in its implementation may be prepared, copied, published
and distributed, in whole or in part, without restriction of any
kind, provided that the above copyright notice and this paragraph are
included on all such copies and derivative works. However, this
document itself may not be modified in any way, such as by removing
the copyright notice or references to the Internet Society or other
Internet organizations, except as needed for the purpose of
developing Internet standards in which case the procedures for
copyrights defined in the Internet Standards process must be
followed, or as required to translate it into languages other than
English.
The limited permissions granted above are perpetual and will not be
revoked by the Internet Society or its successors or assigns.
This document and the information contained herein is provided on an
"AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Acknowledgement
Funding for the RFCEditor function is currently provided by the
Internet Society.