RFC1782 [RFC1782] defines TFTP Option Extensions;
RFC1783 [RFC1783] defines the TFTP Blocksize Option;
RFC1784 [RFC1784] defines TFTP Timeout Interval and Transfer
Size Options."
::= { udp 69 }
gopher PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"Internet Gopher Protocol"
REFERENCE
"RFC1436 [RFC1436] defines the Gopher Protocol."
::= { tcp 70 }
netrjs-1 PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"Remote Job Service Protocol; (historical)."
REFERENCE
"RFC740 [RFC740] defines the NETRJS Protocol."
::= { tcp 71 }
netrjs-2 PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"Remote Job Service Protocol; (historical)."
REFERENCE
"RFC740 [RFC740] defines the NETRJS Protocol."
::= { tcp 72 }
netrjs-3 PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"Remote Job Service Protocol; (historical)."
REFERENCE
"RFC740 [RFC740] defines the NETRJS Protocol."
::= { tcp 73 }
netrjs-4 PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"Remote Job Service Protocol; (historical)."
REFERENCE
"RFC740 [RFC740] defines the NETRJS Protocol."
::= { tcp 74 }
priv-dialout PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"Pseudo-protocol reserved for any private dial out service."
REFERENCE
"[RFC1700]"
::= { tcp 75,
udp 75 }
priv-rje PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"Pseudo-protocol reserved for any private remote job entry
service."
REFERENCE
"[RFC1700]"
::= { tcp 77,
udp 77 }
finger PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"Finger User Information Protocol"
REFERENCE
"RFC1288 [RFC1288] defines the finger protocol."
::= { tcp 79 }
www-http PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"Hypertext Transfer Protocol"
REFERENCE
"RFC1945 [RFC1945] defines the Hypertext Transfer Protocol
(HTTP/1.0).
RFC2068 [RFC2068] defines the Hypertext Transfer Protocol
(HTTP/1.1).
RFC2069 [RFC2069] defines an Extension to HTTP: Digest Access
Authentication.
RFC2109 [RFC2109] defines the HTTP State Management Mechanism.
RFC2145 [RFC2145] defines the use and interpretation of HTTP
version numbers."
::= { tcp 80 }
priv-termlink PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"Pseudo-protocol reserved for any private terminal link
protocol."
REFERENCE
"[RFC1700]"
::= { tcp 87,
udp 87 }
kerberos PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"The Kerberos Network Authentication Service (V5)"
REFERENCE
"RFC1510 [RFC1510] defines the Kerberos protocol."
::= { udp 88 }
supdup PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"SUPDUP Display; (historical)"
REFERENCE
"RFC734 [RFC734] defines the SUPDUP Protocol."
::= { tcp 95 }
dixie PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"DIXIE Directory Service"
REFERENCE
"RFC1249 [RFC1249] defines the DIXIE Protocol."
::= { tcp 96,
udp 96 }
hostname PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"NIC Internet Hostname Server Protocol; (historical)"
REFERENCE
"RFC953 [RFC953] defines the Hostname Server Protocol."
::= { tcp 101 }
3com-tsmux PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"3COM-TSMUX"
REFERENCE
"3Com, Inc."
::= { tcp 106,
udp 106 }
rtelnet PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"Remote User Telnet Protocol; (historical)."
REFERENCE
"RFC818 [RFC818] defines the Remote User Telnet Service."
::= { tcp 107 }
pop2 PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"Post Office Protocol -- Version 2. Clients establish connections
with POP2 servers by using this destination port number.
Historical."
REFERENCE
"RFC937 [RFC937] defines Version 2 of the Post Office Protocol."
::= { tcp 109 }
pop3 PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"Post Office Protocol -- Version 3. Clients establish connections
with POP3 servers by using this destination port number."
REFERENCE
"RFC1725 [RFC1725] defines Version 3 of the Post Office
Protocol."
::= { tcp 110,
udp 110 } -- RFCdefines tcp use
sunrpc PROTOCOL-IDENTIFIER
PARAMETERS {
tracksSessions(1) -- learn port mapping of programs
}
ATTRIBUTES {
hasChildren(0) -- port mapper function numbers
}
DESCRIPTION
"SUN Remote Procedure Call Protocol. Port mapper function
requests are sent to this destination port."
CHILDREN
"Specific RPC functions are represented as children of the sunrpc
protocol. Each 'RPC function protocol' is identified by its
function number assignment. RPC function number assignments are
defined by different naming authorities, depending on the
function identifier value.
From [RFC1831]:
Program numbers are given out in groups of hexadecimal 20000000
(decimal 536870912) according to the following chart:
0 - 1fffffff defined by rpc@sun.com
20000000 - 3fffffff defined by user
40000000 - 5fffffff transient
60000000 - 7fffffff reserved
80000000 - 9fffffff reserved
a0000000 - bfffffff reserved
c0000000 - dfffffff reserved
e0000000 - ffffffff reserved
Children of 'sunrpc' are encoded as [ 0.0.0.111], the protocol
identifier component for 'sunrpc', followed by [ a.b.c.d ], where
a.b.c.d is the 32 bit binary RPC program number encoded in
network byte order. For example, a protocolDirID-fragment value
of:
0.0.0.111.0.1.134.163
defines the NFS function (and protocol).
Children are named as 'sunrpc' followed by the RPC function
number in base 10 format. For example, NFS would be named:
'sunrpc 100003'."
DECODING
"The first packet of many SUNRPC transactions is sent to the
port- mapper program, and therefore decoded statically by
monitoring RFCportmap requests [RFC1831]. Any subsequent packets
must be decoded and correctly identified by 'remembering' the
port assignments used in each RPC function call (as identified
according to the procedures in the RPC Specification Version 2
[RFC1831]).
In some cases the port mapping for a particular protocol is well
known and hard coded into the requesting client. In these cases
the client will not send portmap requests; instead it will send
the SUNRPC request directly to the well known port. These cases
are rare and are being eliminated over time. NFS is the most
significant SUNRPC program of this class. Such programs should
still be declared as children of SUNRPC as described under
CHILDREN above. How an implementation detects this behaviour and
handles it is beyond the scope of this document.
The 'tracksSessions(1)' PARAMETER bit is used to indicate whether
the probe can (and should) monitor portmapper activity to
correctly track SUNRPC connections."
REFERENCE
"RFC1831 [RFC1831] defines the Remote Procedure Call Protocol
Version 2. The authoritative list of RPC Functions is identified
by the URL:
ftp://ftp.isi.edu/in-notes/iana/assignments/sun-rpc-numbers"
::= { tcp 111,
udp 111 }
auth PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"Authentication Service; Identification Protocol."
REFERENCE
"RFC1413 [RFC1413] defines the Identification Protocol."
::= { tcp 113 }
sftp PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"Simple File Transfer Protocol; (historical)."
REFERENCE
"RFC913 [RFC913] defines the Simple File Transfer Protocol."
::= { tcp 115 }
uucp-path PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"UUCP Path Service"
REFERENCE
"RFC915 [RFC915] defines the Network Mail Path Service."
::= { tcp 117 }
nntp PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"Network News Transfer Protocol"
REFERENCE
"RFC977 [RFC977] defines the Network News Transfer Protocol."
::= { tcp 119 }
cfdptkt PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"CFDPTKT; Coherent File Distribution Protocol"
REFERENCE
"RFC1235 [RFC1235] defines the Coherent File Distribution
Protocol."
::= { udp 120 }
ntp PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"Network Time Protocol"
REFERENCE
"RFC1305 [RFC1305] defines version 3 of the Network Time
Protocol."
::= { udp 123 }
pwdgen PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"Password Generator Protocol"
REFERENCE
"RFC972 [RFC972] defines the Password Generator Protocol."
::= { tcp 129,
udp 129 }
cisco-fna PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"cisco FNATIVE"
REFERENCE
"Cisco Systems, Inc."
::= { tcp 130,
udp 130 }
cisco-tna PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"cisco TNATIVE"
REFERENCE
"Cisco Systems, Inc."
::= { tcp 131,
udp 131 }
cisco-sys PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"cisco SYSMAINT"
REFERENCE
"Cisco Systems, Inc."
::= { tcp 132,
udp 132 }
statsrv PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"Statistics Server; (historical)."
REFERENCE
"RFC996 [RFC996] defines the Statistics Server Protocol."
::= { tcp 133,
udp 133 }
-- defined as nbt-name in IPX section
-- netbios-ns 137/tcp NETBIOS Name Service
-- netbios-ns 137/udp NETBIOS Name Service
-- defined as nbt-data in IPX section
-- netbios-dgm 138/tcp NETBIOS Datagram Service
-- netbios-dgm 138/udp NETBIOS Datagram Service
-- defined as nbt-session in IPX section
-- netbios-ssn 139/tcp NETBIOS Session Service
-- netbios-ssn 139/udp NETBIOS Session Service
imap2 PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"Interactive Mail Access Protocol v2;
Internet Message Access Protocol v4 (IMAP4) also uses this
server port."
REFERENCE
"RFC1064 [RFC1064] defines Version 2 of the Interactive Mail
Access
Protocol.
RFC1730 [RFC1730] defines Version 4 of the Internet Message
Access
Protocol."
::= { tcp 143 }
iso-tp0 PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"ISO-IP0; ISO-TP0 bridge between TCP and X.25"
REFERENCE
"RFC1086 [RFC1086] defines the ISO-TP0 protocol."
::= { tcp 146,
udp 146 }
iso-ip PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"ISO-IP; Use of the Internet as a Subnetwork for Experimentation
with the OSI Network Layer"
REFERENCE
"RFC1070 [RFC1070] defines the ISO-IP Protocol."
::= { tcp 147,
udp 147 }
hems PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"HEMS; High Level Entity Management System; (historical)."
REFERENCE
"RFC1021 [RFC1021] defines HEMS."
::= { tcp 151 }
bftp PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"Background File Transfer Program"
REFERENCE
"RFC1068 [RFC1068] defines the Background File Transfer
Program."
::= { tcp 152 }
sgmp PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"Simple Gateway Monitoring Protocol; (historical)."
REFERENCE
"RFC1028 [RFC1028] defines the Simple Gateway Monitoring
Protocol."
::= { udp 153 }
pcmail-srv PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"PCMail Server; Distributed Mail System Protocol (DMSP)"
REFERENCE
"RFC1056 [RFC1056] defines the PCMAIL Protocol."
::= { tcp 158 }
sgmp-traps PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"Simple Gateway Monitoring Protocol Traps; (historical)."
REFERENCE
"RFC1028 [RFC1028] defines the Simple Gateway Monitoring
Protocol."
::= { udp 160 }
-- snmp and snmptrap found in the Protocol-Independent section
-- snmp 161/udp SNMP
-- snmptrap 162/udp SNMPTRAP
cmip-man PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"CMIP/TCP (CMOT) Manager; (historical)."
REFERENCE
"RFC1095 [RFC1095] defines the Common Management Information
Services and Protocol over TCP/IP."
::= { tcp 163,
udp 163 }
cmip-agent PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"CMIP/TCP (CMOT) Agent; (historical)."
REFERENCE
"RFC1095 [RFC1095] defines the Common Management Information
Services and Protocol over TCP/IP."
::= { tcp 164,
udp 164 }
xdmcp PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"X Display Manager Control Protocol"
REFERENCE
"X11 Consortium"
::= { udp 177 }
bgp PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"Border Gateway Protocol"
REFERENCE
"RFC1267 [RFC1267] defines version 3 of the Border Gateway
Protocol."
::= { tcp 179 }
remote-kis PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"Remote-Knowbot Information Service (KIS)"
REFERENCE
"RFC1739 [RFC1739] describes the KNOWBOT Protocol."
::= { tcp 185,
udp 185 }
kis PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"Knowbot Information Service (KIS)"
REFERENCE
"RFC1739 [RFC1739] describes the KNOWBOT Protocol."
::= { tcp 186,
udp 186 }
irc PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"Internet Relay Chat Protocol"
REFERENCE
"RFC1459 [RFC1459] defines the Internet Relay Chat Protocol."
::= { tcp 194,
udp 194 }
smux PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"SMUX; SNMP MUX Protocol and MIB; (historical)."
REFERENCE
"RFC1227 [RFC1227] defines the SMUX Protocol."
::= { tcp 199 }
--
-- AppleTalk applications are defined in the AppleTalk Stack section
--
-- at-rtmp 201/tcp AppleTalk Routing Maintenance
-- at-rtmp 201/udp AppleTalk Routing Maintenance
-- at-nbp 202/tcp AppleTalk Name Binding
-- at-nbp 202/udp AppleTalk Name Binding
-- at-3 203/tcp AppleTalk Unused
-- at-3 203/udp AppleTalk Unused
-- at-echo 204/tcp AppleTalk Echo
-- at-echo 204/udp AppleTalk Echo
-- at-5 205/tcp AppleTalk Unused
-- at-5 205/udp AppleTalk Unused
-- at-zis 206/tcp AppleTalk Zone Information
-- at-zis 206/udp AppleTalk Zone Information
-- at-7 207/tcp AppleTalk Unused
-- at-7 207/udp AppleTalk Unused
-- at-8 208/tcp AppleTalk Unused
-- at-8 208/udp AppleTalk Unused
z39-50 PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"ANSI Z39.50"
REFERENCE
"RFC1729 [RFC1729] describes the Z39.50 Protocol."
::= { tcp 210 }
ipx-tunnel PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"Tunneling IPX Traffic through IP Networks"
REFERENCE
"RFC1234 [RFC1234] defines the IPX Tunnel Protocol."
::= { udp 213 }
mpp PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"Netix Message Posting Protocol"
REFERENCE
"RFC1204 [RFC1204] defines the Message Posting Protocol."
::= { tcp 218 }
imap3 PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"Interactive Mail Access Protocol v3; (historical)."
REFERENCE
"RFC1203 [RFC1203] defines version 3 of the Interactive Mail
Access Protocol."
::= { tcp 220 }
ldap PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"Lightweight Directory Access Protocol"
REFERENCE
"RFC1777 [RFC1777] defines Lightweight Directory Access
Protocol; RFC1798 [RFC1798] defines Connection-less Lightweight
X.500 Directory Access Protocol"
::= { tcp 389, -- RFC1777
udp 389 } -- RFC1798
mobileip-agent PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"IP Mobility Support"
REFERENCE
"RFC2002 [RFC2002] defines the IP Mobility Support protocol."
::= { udp 434 }
https PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"Secure HTTP; HTTP over TLS/SSL"
REFERENCE
"Netscape; http://home.netscape.com/eng/ssl3/"
::= { tcp 443 }
smtps PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"SMTP protocol over TLS/SSL"
REFERENCE
"Netscape; http://home.netscape.com/eng/ssl3/"
::= { tcp 465 }
isakmp PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"Internet Security Association and Key Management Protocol
(ISAKMP)"
REFERENCE
"RFC2408 [RFC2408]"
::= { udp 500 }
login PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"BSD Rlogin; remote login a la telnet"
REFERENCE
"RFC1282 [RFC1282] defines the BSD Rlogin Protocol."
::= { tcp 513 }
syslog PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"syslog"
REFERENCE
"[RFC1700]"
::= { udp 514 }
uucp PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"Unix-to-Unix copy protocol"
REFERENCE
"[RFC1700]"
::= { tcp 540 }
doom PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"DOOM Game;"
REFERENCE
" Id Software"
::= { tcp 666 }
radius PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"Remote Authentication Dial In User Service (RADIUS)"
REFERENCE
"RFC2138 [RFC2138] defines the Radius protocol."
::= { udp 1812 }
radiusacct PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"RADIUS Accounting Protocol"
REFERENCE
"RFC2139 [RFC2139] defines the Radius Accounting protocol."
::= { udp 1813 }
--
-- Portmapper Functions; Children of sunrpc
--
portmapper PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"SUNRPC PORTMAPPER program. This is the SUNRPC program which is
used to locate the UDP/TCP ports on which other SUNRPC programs
can be found."
REFERENCE
"Appendix A of RFC1057 [RFC1057] describes the portmapper
operation."
::= { sunrpc 100000 }
nfs PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"Sun Network File System (NFS);"
DECODING
"NFS is a SUNRPC program which may or may not use the port mapper
SUNRPC program to connect clients and servers. In many cases the
NFS server program runs over UDP/TCP port 2049, but an
implementation is encouraged to perform further analysis before
assuming that a packet to/from this port is a SUNRPC/NFS packet.
Likewise an implementation is encouraged to track port mapper
activity to spot cases where it is used to locate the SUNRPC/NFS
program as this is more robust."
REFERENCE
"The NFS Version 3 Protocol Specification is defined in RFC1813
[RFC1813]."
::= {
sunrpc 100003 -- [0.1.134.163]
}
xwin PROTOCOL-IDENTIFIER
PARAMETERS {
tracksSessions(1)
}
ATTRIBUTES { }
DESCRIPTION
"X Windows Protocol"
DECODING
"The X Windows Protocol when run over UDP/TCP normally runs over
the well known port 6000. It can run over any port in the range
6000 to 6063, however. If the tracksSessions(1) parameter bit is
set the agent can and should detect such X Window sessions and
report them as the X protocol."
REFERENCE
"The X Windows Protocol is defined by TBD"
::= {
tcp 6000,
udp 6000
-- lat ?
}
3.1.2. Novell IPX Stack
ipx PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES {
hasChildren(0),
addressRecognitionCapable(1)
}
DESCRIPTION
"Novell IPX"
CHILDREN
"Children of IPX are defined by the 8 bit packet type field. The
value is encoded into an octet string as [ 0.0.0.a ], where 'a'
is the single octet of the packet type field.
Notice that in many implementations of IPX usage of the packet
type field is inconsistent with the specification and
implementations are encouraged to use other techniques to map
inconsistent values to the correct value (which in these cases is
typically the Packet Exchange Protocol). It is beyond the scope
of this document to describe these techniques in more detail.
Children of IPX are encoded as [ 0.0.0.a ], and named as 'ipx a'
where a is the packet type value. The novell echo protocol is
referred to as 'ipx nov-echo' OR 'ipx 2'."
ADDRESS-FORMAT
"4 bytes of Network number followed by the 6 bytes Host address
each in network byte order."
REFERENCE
"The IPX protocol is defined by the Novell Corporation
A complete description of IPX may be secured at the following
address:
Novell, Inc.
122 East 1700 South
P. O. Box 5900
Provo, Utah 84601 USA
800 526 5463
Novell Part # 883-000780-001"
::= {
ether2 0x8137, -- [0.0.129.55]
snap 0x8137, -- [0.0.129.55]
ianaAssigned 1, -- [0.0.0.1] (ipxOverRaw8023)
llc 224, -- [0.0.0.224]
802-1Q 0x8137, -- [0.0.129.55]
802-1Q 0x020000e0, -- 1Q-LLC [2.0.0.224]
802-1Q 0x05000001 -- 1Q-IANA [5.0.0.1]
-- (ipxOverRaw8023)
}
nov-rip PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"Novell Routing Information Protocol"
REFERENCE
"Novell Corporation"
::= {
ipx 0x01, -- when reached by IPX packet type
nov-pep 0x0453 -- when reached by IPX socket number
}
nov-echo PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"Novell Echo Protocol"
REFERENCE
"Novell Corporation"
::= { ipx 0x02 }
nov-error PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"Novell Error-handler Protocol"
REFERENCE
"Novell Corporation"
::= { ipx 0x03 }
nov-pep PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES {
hasChildren(0)
}
DESCRIPTION
"Novell Packet Exchange Protocol. This is really a null protocol
layer as all IPX packets contain the relevant fields for this
protocol. This protocol is defined so that socket-based decoding
has a point of attachment in the decode tree while still allowing
packet type based decoding also."
CHILDREN
"Children of PEP are defined by the 16 bit socket values. The
value is encoded into an octet string as [ 0.0.a.b ], where 'a'
and 'b' are the network byte order encodings of the MSB and LSB
of the socket value.
Each IPX/PEP packet contains two sockets, source and destination.
How these are mapped onto the single well-known socket value used
to identify its children is beyond the scope of this document."
REFERENCE
"Novell Corporation"
::= {
-- ipx 0x00 ** Many third party IPX's use this value always
ipx 0x04 -- Xerox assigned for PEP
-- ipx 0x11 ** Novell use this for PEP packets, often
}
nov-spx PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES {
hasChildren(0)
}
DESCRIPTION
"Novell Sequenced Packet Exchange Protocol. This protocol is an
extension of IPX/PEP as it shares a common header."
CHILDREN
"Children of SPX are defined by the 16 bit socket values. The
value is encoded into an octet string as [ 0.0.a.b ], where 'a'
and 'b' are the network byte order encodings of the MSB and LSB
of the socket value.
Each IPX/SPX packet contains two sockets, source and destination.
How these are mapped onto the single well-known socket value used
to identify its children is beyond the scope of this document."
REFERENCE
"Novell Corporation"
::= {
ipx 0x05 -- Xerox assigned for SPX
}
nov-sap PROTOCOL-IDENTIFIER
PARAMETERS {
tracksSessions(1)
}
ATTRIBUTES {
hasChildren(0)
}
DESCRIPTION
"Novell Service Advertising Protocol. This protocol binds
applications on a particular host to an IPX/PEP or IPX/SPX socket
number. Although it never truly acts as a transport protocol
itself it is used to establish sessions between clients and
servers and barring well-known sockets is the only reliable way
to determine the protocol running over a given socket on a given
machine."
CHILDREN
"Children of SAP are identified by a 16 bit service type. They
are encoded as [ 0.0.a.b ], where 'a' is the MSB and 'b' is the
LSB of the service type.
Children of SAP are named as 'nov-sap a' where 'a' is the service
type in hexadecimal notation. The novell NCP protocol is
referred to as 'nov-sap ncp' OR 'nov-sap 0x0004'."
DECODING
"The first packet of any session for a SAP based application
(almost all IPX/PEP and IPX/SPX based applications utilize SAP)
is sent to the SAP server(s) to map the service type into a port
number for the host(s) on which the SAP server(s) is(are)
running. These initial packets are SAP packets and not
application packets and must be decoded accordingly.
Having established the mapping, clients will then send
application packets to the newly discovered socket number. These
must be decoded by 'remembering' the socket assignments
transmitted in the SAP packets.
In some cases the port mapping for a particular protocol is well
known and SAP will always return the same socket number for that
application.
Such programs should still be declared as children of nov-sap as
described under CHILDREN above. How an implementation detects a
client which is bypassing the SAP server to contact a well-known
application is beyond the scope of this document.
The 'tracksSessions(1)' PARAMETER bit is used to indicate whether
the probe can (and should) monitor nov-sap activity to correctly
track SAP-based connections."
REFERENCE
"A list of SAP service types can be found at
ftp://ftp.isi.edu/in-notes/iana/assignments/novell-sap-
numbers"
::= { nov-pep 0x0452 }
ncp PROTOCOL-IDENTIFIER
PARAMETERS {
tracksSessions(1)
}
ATTRIBUTES {
hasChildren(0)
}
DESCRIPTION
"Netware Core Protocol"
CHILDREN
"Children of NCP are identified by the 8 bit command type field.
They are encoded as [ 0.0.0.a ] where 'a' is the command type
value.
Children of NCP are named as 'ncp a' where 'a' is the command
type in decimal notation. The NDS sub-protocol is referred to as
'ncp nds' OR 'ncp 104'."
DECODING
"Only the NCP request frames carry the command type field. How
the implementation infers the command type of a response frame is
an implementation specific matter and beyond the scope of this
document.
The tracksSessions(1) PARAMETERS bit indicates whether the probe
can (and should) perform command type inference."
REFERENCE
"Novell Corporation"
::= { nov-sap 0x0004,
nov-pep 0x0451 }
nds PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"The Netware Directory Services sub-protocol."
REFERENCE
"Novell Corporation"
::= { ncp 104 }
nov-diag PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"Novell's diagnostic Protocol"
REFERENCE
"Novell Corporation"
::= {
nov-sap 0x0017, -- [ed., this is the right one]
nov-pep 0x0456
}
nov-sec PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"Novell security - serialization - copy protection protocol."
REFERENCE
"Novell Corporation"
::= { nov-pep 0x0457 }
nov-watchdog PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"Novell watchdog protocol."
REFERENCE
"Novell Corporation"
::= { nov-pep 0x4004 }
nov-bcast PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"Novell broadcast protocol."
REFERENCE
"Novell Corporation"
::= { nov-pep 0x4005 }
3.1.3. The XEROX Protocol Stack
idp PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES {
hasChildren(0),
addressRecognitionCapable(1)
}
DESCRIPTION
"Xerox IDP"
CHILDREN
"Children of IDP are defined by the 8 bit value of the Packet
type field. The value is encoded into an octet string as [
0.0.0.a ], where 'a' is the value of the packet type field in
network byte order.
Children of IDP are encoded as [ 0.0.0.a ], and named as 'idp a'
where a is the packet type value. The XNS SPP protocol is
referred to as 'idp xns-spp' OR 'idp 2'."
ADDRESS-FORMAT
"4 bytes of Network number followed by the 6 bytes Host address
each in network byte order."
REFERENCE
"Xerox Corporation, Document XNSS 028112, 1981"
::= {
ether2 0x600, -- [ 0.0.6.0 ]
snap 0x600,
802-1Q 0x600 -- [ 0.0.6.0 ]
}
xns-rip PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"Routing Information Protocol."
REFERENCE
"Xerox Corporation"
::= { idp 1 }
xns-echo PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"XNS echo protocol."
REFERENCE
"Xerox Corporation"
::= { idp 2 }
xns-error PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"XNS error-handler protocol."
REFERENCE
"Xerox Corporation"
::= { idp 3 }
xns-pep PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES {
hasChildren(0)
}
DESCRIPTION
"XNS Packet Exchange Protocol."
CHILDREN
"Children of PEP are defined by the 16 bit socket values. The
value is encoded into an octet string as [ 0.0.a.b ], where 'a'
and 'b' are the network byte order encodings of the MSB and LSB
of the socket value.
Each XNS/PEP packet contains two sockets, source and destination.
How these are mapped onto the single well-known socket value used
to identify its children is beyond the scope of this document."
REFERENCE
"Xerox Corporation"
::= { idp 4 }
xns-spp PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES {
hasChildren(0)
}
DESCRIPTION
"Sequenced Packet Protocol."
CHILDREN
"Children of SPP are defined by the 16 bit socket values. The
value is encoded into an octet string as [ 0.0.a.b ], where 'a'
and 'b' are the network byte order encodings of the MSB and LSB
of the socket value.
Each XNS/SPP packet contains two sockets, source and destination.
How these are mapped onto the single well-known socket value used
to identify its children is beyond the scope of this document."
REFERENCE
"Xerox Corporation"
::= { idp 5 }
3.1.4. AppleTalk Protocol Stack
apple-oui PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"Pseudo-protocol which binds Apple's protocols to vsnap."
CHILDREN
"Children of apple-oui are identified by the ether2 type field
value that the child uses when encapsulated in ether2. The value
is encoded into an octet string as [ 0.0.a.b ], where 'a' and 'b'
are the MSB and LSB of the 16-bit ether type value in network
byte order."
REFERENCE
"AppleTalk Phase 2 Protocol Specification, document ADPA
#C0144LL/A."
::= {
vsnap 0x080007, -- [ 0.8.0.7 ]
802-1Q 0x04080007 -- 1Q-VSNAP [ 4.8.0.7 ]
}
aarp PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"AppleTalk Address Resolution Protocol."
REFERENCE
"AppleTalk Phase 2 Protocol Specification, document ADPA
#C0144LL/A."
::= {
ether2 0x80f3, -- [ 0.0.128.243 ]
snap 0x80f3,
apple-oui 0x80f3,
802-1Q 0x80f3 -- [ 0.0.128.243 ]
}
atalk PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES {
hasChildren(0),
addressRecognitionCapable(1)
}
DESCRIPTION
"AppleTalk Protocol."
CHILDREN
"Children of ATALK are defined by the 8 bit value of the DDP type
field. The value is encoded into an octet string as [ 0.0.0.a ],
where 'a' is the value of the DDP type field in network byte
order."
ADDRESS-FORMAT
"2 bytes of Network number followed by 1 byte of node id each in
network byte order."
REFERENCE
"AppleTalk Phase 2 Protocol Specification, document ADPA
#C0144LL/A."
::= {
ether2 0x809b, -- [ 0.0.128.155 ]
apple-oui 0x809b,
802-1Q 0x809b -- [ 0.0.128.155 ]
}
rtmp PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"AppleTalk Routing Table Maintenance Protocol."
REFERENCE
"Apple Computer"
::= {
atalk 0x01, -- responses
atalk 0x05 -- requests
}
aep PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"AppleTalk Echo Protocol."
REFERENCE
"Apple Computer"
::= { atalk 0x04 }
nbp PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"AppleTalk Name Binding Protocol."
DECODING
"In order to correctly identify the application protocol running
over atp NBP packets must be analyzed. The mechanism by which
this is achieved is beyond the scope of this document."
REFERENCE
"Apple Computer"
::= { atalk 0x02 }
zip PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"AppleTalk Zone Information Protocol."
REFERENCE
"Apple Computer"
::= {
atalk 0x06,
atp 3
}
atp PROTOCOL-IDENTIFIER
PARAMETERS {
tracksSessions(1)
}
ATTRIBUTES {
hasChildren(0)
}
DESCRIPTION
"AppleTalk Transaction Protocol."
CHILDREN
"Children of atp are identified by the following (32 bit)
enumeration:
1 asp (AppleTalk Session Protocol)
2 pap (Printer Access Protocol)
3 zip (Zone Information Protocol)
Children of atp are encoded as [ a.b.c.d ] where 'a', 'b', 'c'
and 'd' are the four octets of the enumerated value in network
order (i.e. 'a' is the MSB and 'd' is the LSB).
The ZIP protocol is referred to as 'atp zip' OR 'atp 3'."
DECODING
"An implementation is encouraged to examine both the socket
fields in the associated DDP header as well as the contents of
prior NBP packets in order to determine which (if any) child is
present. A full description of this algorithm is beyond the
scope of this document. The tracksSessions(1) PARAMETER
indicates whether the probe can (and should) perform this
analysis."
REFERENCE
"Apple Computer"
::= { atalk 0x03 }
adsp PROTOCOL-IDENTIFIER
PARAMETERS {
tracksSessions(1)
}
ATTRIBUTES {
hasChildren(0)
}
DESCRIPTION
"AppleTalk Data Stream Protocol."
CHILDREN
"Children of adsp are identified by enumeration. At this time
none are known."
DECODING
"An implementation is encouraged to examine the socket numbers in
the associated DDP header as well as the contents of prior NBP
packets in order to determine which (if any) child of ADSP is
present.
The mechanism by which this is achieved is beyond the scope of
this document.
The tracksSessions(1) PARAMETER indicates whether the probe can
(and should) perform this analysis."
REFERENCE
"Apple Computer"
::= { atalk 0x07 }
asp PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES {
hasChildren(0)
}
DESCRIPTION
"AppleTalk Session Protocol."
CHILDREN
"Children of asp are identified by the following (32 bit)
enumeration:
1 afp (AppleTalk Filing Protocol)
Children of asp are encoded as [ a.b.c.d ] where 'a', 'b', 'c'
and 'd' are the four octets of the enumerated value in network
order (i.e. 'a' is the MSB and 'd' is the LSB).
The AFP protocol is referred to as 'asp afp' OR 'asp 1'."
DECODING
"ASP is a helper layer to assist in building client/server
protocols. It cooperates with ATP to achieve this; the
mechanisms used when decoding ATP apply equally here (i.e.
checking DDP socket numbers and tracking NBP packets).
Hence the tracksSessions(1) PARAMETER of atp applies to this
protocol also."
REFERENCE
"Apple Computer"
::= { atp 1 }
afp PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"AppleTalk Filing Protocol."
REFERENCE
"Apple Computer"
::= { asp 1 }
pap PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"AppleTalk Printer Access Protocol."
REFERENCE
"Apple Computer"
::= { atp 2 }
3.1.5. Banyon Vines Protocol Stack
vtr PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES {
hasChildren(0)
}
DESCRIPTION
"Banyan Vines Token Ring Protocol Header."
CHILDREN
"Children of vines-tr are identified by the 8 bit packet type
field. Children are encoded as [ 0.0.0.a ] where 'a' is the
packet type value.
The vines-ip protocol is referred to as 'vines-tr vip' OR 'vines-
tr 0xba'."
REFERENCE
"See vip."
::= {
llc 0xBC, -- declared as any LLC, but really TR only.
802-1Q 0x020000BC -- 1Q-LLC [2.0.0.188]
}
vecho PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"Banyan Vines data link level echo protocol."
REFERENCE
"See vip."
::= {
ether2 0x0BAF, -- [0.0.11.175]
snap 0x0BAF,
-- vfrp 0x0BAF,
vtr 0xBB, -- [ed. yuck!]
802-1Q 0x0BAF -- [0.0.11.175]
}
vip PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES {
hasChildren(0),
addressRecognitionCapable(1)
}
DESCRIPTION
"Banyan Vines Internet Protocol."
CHILDREN
"Children of vip are selected by the one-byte 'protocol type'
field located at offset 5 in the vip header. The value is
encoded as [ 0.0.0.a ], where a is the 'protocol type.' For
example, a protocolDirId fragment of:
0.0.0.1.0.0.11.173.0.0.0.1
identifies an encapsulation of vipc (ether2.vip.vipc)."
ADDRESS-FORMAT
"vip packets have 6-byte source and destination addresses. The
destination address is located at offset 6 in the vip header, and
the source address at offset 12. These are encoded in network
byte order."
REFERENCE
"Vines Protocol Definition - part# 092093-001, order# 003673
BANYAN,
120 Flanders Road,
Westboro, MA 01581 USA"
::= {
ether2 0x0BAD,
snap 0x0BAD,
-- vfrp 0x0BAD,
vtr 0xBA, -- [ed. yuck!]
802-1Q 0x0BAD -- [0.0.11.173]
}
varp PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES { }
DESCRIPTION
"Banyan Vines Address Resolution Protocol."
REFERENCE
"BANYAN"
::= { vip 0x04 }
vipc PROTOCOL-IDENTIFIER
PARAMETERS { }
ATTRIBUTES {
hasChildren(0)
}
DESCRIPTION
"Banyan Vines Interprocess Communications Protocol."
CHILDREN
"Children of Vines IPC are identified by the packet type field at
offset 4 in the vipc header.
These are encoded as [ 0.0.0.a ] where 'a' is the packet type
value. Children of vipc are defined as 'vipc a' where 'a' is the
packet type value in hexadecimal notation.