::= { dot1dNotifications 1 }
topologyChange NOTIFICATION-TYPE
-- OBJECTS { }
STATUS current
DESCRIPTION
"A topologyChange trap is sent by a bridge when any of
its configured ports transitions from the Learning state
to the Forwarding state, or from the Forwarding state to
the Blocking state. The trap is not sent if a newRoot
trap is sent for the same transition. Implementation of
this trap is optional."
::= { dot1dNotifications 2 }
-- ---------------------------------------------------------- --
-- IEEE 802.1D MIB - Conformance Information
-- ---------------------------------------------------------- --
dot1dGroups OBJECT IDENTIFIER ::= { dot1dConformance 1 }
dot1dCompliances OBJECT IDENTIFIER ::= { dot1dConformance 2 }
-- ---------------------------------------------------------- --
-- units of conformance
-- ---------------------------------------------------------- --
-- ---------------------------------------------------------- --
-- the dot1dBase group
-- ---------------------------------------------------------- --
dot1dBaseBridgeGroup OBJECT-GROUP
OBJECTS {
dot1dBaseBridgeAddress,
dot1dBaseNumPorts,
dot1dBaseType
}
STATUS current
DESCRIPTION
"Bridge level information for this device."
::= { dot1dGroups 1 }
dot1dBasePortGroup OBJECT-GROUP
OBJECTS {
dot1dBasePort,
dot1dBasePortIfIndex,
dot1dBasePortCircuit,
dot1dBasePortDelayExceededDiscards,
dot1dBasePortMtuExceededDiscards
}
STATUS current
DESCRIPTION
"Information for each port on this device."
::= { dot1dGroups 2 }
-- ---------------------------------------------------------- --
-- the dot1dStp group
-- ---------------------------------------------------------- --
dot1dStpBridgeGroup OBJECT-GROUP
OBJECTS {
dot1dStpProtocolSpecification,
dot1dStpPriority,
dot1dStpTimeSinceTopologyChange,
dot1dStpTopChanges,
dot1dStpDesignatedRoot,
dot1dStpRootCost,
dot1dStpRootPort,
dot1dStpMaxAge,
dot1dStpHelloTime,
dot1dStpHoldTime,
dot1dStpForwardDelay,
dot1dStpBridgeMaxAge,
dot1dStpBridgeHelloTime,
dot1dStpBridgeForwardDelay
}
STATUS current
DESCRIPTION
"Bridge level Spanning Tree data for this device."
::= { dot1dGroups 3 }
dot1dStpPortGroup OBJECT-GROUP
OBJECTS {
dot1dStpPort,
dot1dStpPortPriority,
dot1dStpPortState,
dot1dStpPortEnable,
dot1dStpPortPathCost,
dot1dStpPortDesignatedRoot,
dot1dStpPortDesignatedCost,
dot1dStpPortDesignatedBridge,
dot1dStpPortDesignatedPort,
dot1dStpPortForwardTransitions
}
STATUS current
DESCRIPTION
"Spanning Tree data for each port on this device."
::= { dot1dGroups 4 }
dot1dStpPortGroup2 OBJECT-GROUP
OBJECTS {
dot1dStpPort,
dot1dStpPortPriority,
dot1dStpPortState,
dot1dStpPortEnable,
dot1dStpPortDesignatedRoot,
dot1dStpPortDesignatedCost,
dot1dStpPortDesignatedBridge,
dot1dStpPortDesignatedPort,
dot1dStpPortForwardTransitions,
dot1dStpPortPathCost32
}
STATUS current
DESCRIPTION
"Spanning Tree data for each port on this device."
::= { dot1dGroups 5 }
dot1dStpPortGroup3 OBJECT-GROUP
OBJECTS {
dot1dStpPortPathCost32
}
STATUS current
DESCRIPTION
"Spanning Tree data for devices supporting 32-bit
path costs."
::= { dot1dGroups 6 }
-- ---------------------------------------------------------- --
-- the dot1dTp group
-- ---------------------------------------------------------- --
dot1dTpBridgeGroup OBJECT-GROUP
OBJECTS {
dot1dTpLearnedEntryDiscards,
dot1dTpAgingTime
}
STATUS current
DESCRIPTION
"Bridge level Transparent Bridging data."
::= { dot1dGroups 7 }
dot1dTpFdbGroup OBJECT-GROUP
OBJECTS {
dot1dTpFdbAddress,
dot1dTpFdbPort,
dot1dTpFdbStatus
}
STATUS current
DESCRIPTION
"Filtering Database information for the Bridge."
::= { dot1dGroups 8 }
dot1dTpGroup OBJECT-GROUP
OBJECTS {
dot1dTpPort,
dot1dTpPortMaxInfo,
dot1dTpPortInFrames,
dot1dTpPortOutFrames,
dot1dTpPortInDiscards
}
STATUS current
DESCRIPTION
"Dynamic Filtering Database information for each port of
the Bridge."
::= { dot1dGroups 9 }
-- ---------------------------------------------------------- --
-- The Static (Destination-Address Filtering) Database
-- ---------------------------------------------------------- --
dot1dStaticGroup OBJECT-GROUP
OBJECTS {
dot1dStaticAddress,
dot1dStaticReceivePort,
dot1dStaticAllowedToGoTo,
dot1dStaticStatus
}
STATUS current
DESCRIPTION
"Static Filtering Database information for each port of
the Bridge."
::= { dot1dGroups 10 }
-- ---------------------------------------------------------- --
-- The Trap Notification Group
-- ---------------------------------------------------------- --
dot1dNotificationGroup NOTIFICATION-GROUP
NOTIFICATIONS {
newRoot,
topologyChange
}
STATUS current
DESCRIPTION
"Group of objects describing notifications (traps)."
::= { dot1dGroups 11 }
-- ---------------------------------------------------------- --
-- compliance statements
-- ---------------------------------------------------------- --
bridgeCompliance1493 MODULE-COMPLIANCE
STATUS current
DESCRIPTION
"The compliance statement for device support of bridging
services, as per RFC1493."
MODULE
MANDATORY-GROUPS {
dot1dBaseBridgeGroup,
dot1dBasePortGroup
}
GROUP dot1dStpBridgeGroup
DESCRIPTION
"Implementation of this group is mandatory for bridges
that support the Spanning Tree Protocol."
GROUP dot1dStpPortGroup
DESCRIPTION
"Implementation of this group is mandatory for bridges
that support the Spanning Tree Protocol."
GROUP dot1dTpBridgeGroup
DESCRIPTION
"Implementation of this group is mandatory for bridges
that support the transparent bridging mode. A
transparent or SRT bridge will implement this group."
GROUP dot1dTpFdbGroup
DESCRIPTION
"Implementation of this group is mandatory for bridges
that support the transparent bridging mode. A
transparent or SRT bridge will implement this group."
GROUP dot1dTpGroup
DESCRIPTION
"Implementation of this group is mandatory for bridges
that support the transparent bridging mode. A
transparent or SRT bridge will implement this group."
GROUP dot1dStaticGroup
DESCRIPTION
"Implementation of this group is optional."
GROUP dot1dNotificationGroup
DESCRIPTION
"Implementation of this group is optional."
::= { dot1dCompliances 1 }
bridgeCompliance4188 MODULE-COMPLIANCE
STATUS current
DESCRIPTION
"The compliance statement for device support of bridging
services. This supports 32-bit Path Cost values and the
more restricted bridge and port priorities, as per IEEE
802.1t.
Full support for the 802.1D management objects requires that
the SNMPv2-MIB [RFC3418] objects sysDescr, and sysUpTime, as
well as the IF-MIB [RFC2863] objects ifIndex, ifType,
ifDescr, ifPhysAddress, and ifLastChange are implemented."
MODULE
MANDATORY-GROUPS {
dot1dBaseBridgeGroup,
dot1dBasePortGroup
}
GROUP dot1dStpBridgeGroup
DESCRIPTION
"Implementation of this group is mandatory for
bridges that support the Spanning Tree Protocol."
OBJECT dot1dStpPriority
SYNTAX Integer32 (0|4096|8192|12288|16384|20480|24576
|28672|32768|36864|40960|45056|49152
|53248|57344|61440)
DESCRIPTION
"The possible values defined by IEEE 802.1t."
GROUP dot1dStpPortGroup2
DESCRIPTION
"Implementation of this group is mandatory for
bridges that support the Spanning Tree Protocol."
GROUP dot1dStpPortGroup3
DESCRIPTION
"Implementation of this group is mandatory for bridges
that support the Spanning Tree Protocol and 32-bit path
costs. In particular, this includes devices supporting
IEEE 802.1t and IEEE 802.1w."
OBJECT dot1dStpPortPriority
SYNTAX Integer32 (0|16|32|48|64|80|96|112|128
|144|160|176|192|208|224|240)
DESCRIPTION
"The possible values defined by IEEE 802.1t."
GROUP dot1dTpBridgeGroup
DESCRIPTION
"Implementation of this group is mandatory for
bridges that support the transparent bridging
mode. A transparent or SRT bridge will implement
this group."
GROUP dot1dTpFdbGroup
DESCRIPTION
"Implementation of this group is mandatory for
bridges that support the transparent bridging
mode. A transparent or SRT bridge will implement
this group."
GROUP dot1dTpGroup
DESCRIPTION
"Implementation of this group is mandatory for
bridges that support the transparent bridging
mode. A transparent or SRT bridge will implement
this group."
GROUP dot1dStaticGroup
DESCRIPTION
"Implementation of this group is optional."
GROUP dot1dNotificationGroup
DESCRIPTION
"Implementation of this group is optional."
::= { dot1dCompliances 2 }
END
5. IANA Considerations
The MIB module in this document uses the following IANA-assigned
OBJECT IDENTIFIER values that are recorded in the SMI Numbers
registry:
Descriptor OBJECT IDENTIFIER value
---------- -----------------------
dot1dBridge { mib-2 17 }
6. Security Considerations
There are a number of management objects defined in this MIB module
that have a MAX-ACCESS clause of read-write and/or read-create. Such
objects may be considered sensitive or vulnerable in some network
environments. The support for SET operations in a non-secure
environment without proper protection can have a negative effect on
network operations.
Some of the readable objects in this MIB module (i.e., objects with a
MAX-ACCESS other than not-accessible) may be considered sensitive or
vulnerable in some network environments. It is thus important to
control even GET and/or NOTIFY access to these objects and possibly
to even encrypt the values of these objects when sending them over
the network via SNMP.
These are the tables and objects and their sensitivity/vulnerability:
o The writable objects dot1dStpPriority, dot1dStpBridgeMaxAge,
dot1dStpBridgeHelloTime, dot1dStpBridgeForwardDelay,
dot1dStpPortPriority, dot1dStpPortEnable, dot1dStpPortPathCost,
and dot1dStpPortPathCost32 influence the spanning tree protocol.
Unauthorized write access to these objects can cause the spanning
tree protocol to compute other default topologies or it can change
the speed in which the spanning tree protocol reacts to failures.
o The writable object dot1dTpAgingTime controls how fast
dynamically-learned forwarding information is aged out. Setting
this object to a large value may simplify forwarding table
overflow attacks.
o The writable dot1dStaticTable provides a filtering mechanism
controlling to which ports frames originating from a specific
source may be forwarded. Write access to this table can be used
to turn provisioned filtering off or to add filters to prevent
rightful use of the network.
o The readable objects defined in the BRIDGE-MIB module provide
information about the topology of a bridged network and the
attached active stations. The addresses listed in the
dot1dTpFdbTable usually reveal information about the manufacturer
of the MAC hardware, which can be useful information for mounting
other specific attacks.
o The two notifications newRoot and topologyChange are emitted
during spanning tree computation and may trigger management
systems to inspect the status of bridges and to recompute internal
topology information. Hence, forged notifications may cause
management systems to perform unnecessary computations and to
generate additional SNMP traffic directed to the bridges in a
network. Therefore, forged notifications may be part of a denial
of service attack.
SNMP versions prior to SNMPv3 did not include adequate security.
Even if the network itself is secure (for example by using IPSec),
even then, there is no control as to who on the secure network is
allowed to access and GET/SET (read/change/create/delete) the objects
in this MIB module.
It is RECOMMENDED that implementers consider the security features as
provided by the SNMPv3 framework (see [RFC3410], section 8),
including full support for the SNMPv3 cryptographic mechanisms (for
authentication and privacy).
Further, deployment of SNMP versions prior to SNMPv3 is NOT
RECOMMENDED. Instead, it is RECOMMENDED to deploy SNMPv3 and to
enable cryptographic security. It is then a customer/operator
responsibility to ensure that the SNMP entity giving access to an
instance of this MIB module is properly configured to give access to
the objects only to those principals (users) that have legitimate
rights to indeed GET or SET (change/create/delete) them.
7. Acknowledgements
The MIB module presented in this memo is a translation of the
BRIDGE-MIB defined in [RFC1493] to the SMIv2 syntax. The original
authors of the SMIv1 module were E. Decker, P. Langille, A.
Rijsinghani, and K. McCloghrie. Further acknowledgement is given to
the members of the original Bridge Working Group in [RFC1493].
This document was produced on behalf of the Bridge MIB Working Group
in the Operations and Management area of the Internet Engineering
Task Force. The editors wish to thank the members of the Bridge MIB
Working Group, especially Mike MacFadden, John Flick, and Bert
Visscher for their many comments and suggestions that improved this
effort. Juergen Schoenwaelder helped in finalizing the document for
publication.
8. Contact Information
The original version of this document was the result of significant
work by four major contributors:
E. Decker
P. Langille
A. Rijsinghan
Accton Technology Corporation
5 Mount Royal Ave
Marlboro, MA 01752
USA
K. McCloghrie
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134
USA
The conversion to the SMIv2 format is based on work done by the
following two contributors:
Kenyon C. Norseth
L-3 Communications
640 N. 2200 West
Salt Lake City, Utah 84116-0850
USA
E. Bell
3Com Europe Limited
3Com Centre, Boundary Way
Hemel Hempstead Herts. HP2 7YU
UK
9. Changes from RFC 1493
The following changes have been made from RFC 1493.
1. Translated the MIB definitions to use SMIv2. This includes the
introduction of conformance statements. ASN.1 type definitions
have been converted into textual-conventions and several UNITS
clauses were added.
2. The object dot1dStpPortPathCost32 was added to support IEEE
802.1t.
3. Permissible values for dot1dStpPriority and dot1dStpPortPriority
have been clarified for bridges supporting IEEE 802.1t or IEEE
802.1w.
4. Interpretation of dot1dStpTimeSinceTopologyChange has been
clarified for bridges supporting the rapid spanning tree protocol
(RSTP).
5. Updated the introductory boilerplate text, the security
considerations section, and the references to comply with the
current IETF standards and guidelines.
6. Updated references to point to newer IEEE 802.1d documents.
7. Additions and clarifications in various description clauses.
10. References
10.1 Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC2578] McCloghrie, K., Perkins, D., and J. Schoenwaelder,
"Structure of Management Information Version 2 (SMIv2)",
STD 58, RFC 2578, April 1999.
[RFC2579] McCloghrie, K., Perkins, D., and J. Schoenwaelder,
"Textual Conventions for SMIv2", STD 58, RFC 2579, April
1999.
[RFC2580] McCloghrie, K., Perkins, D., and J. Schoenwaelder,
"Conformance Statements for SMIv2", STD 58, RFC 2580,
April 1999.
[RFC3418] Presuhn, R., "Management Information Base (MIB) for the
Simple Network Management Protocol (SNMP)", STD 62, RFC
3418, December 2002.
[RFC2863] McCloghrie, K. and F. Kastenholz, "The Interfaces Group
MIB", RFC 2863, June 2000.
[IEEE8021D] IEEE Project 802 Local and Metropolitan Area Networks,
"ANSI/IEEE Standard 802.1D-1998 MAC Bridges", March 1998.
10.2 Informative References
[RFC3410] Case, J., Mundy, R., Partain, D., and B. Stewart,
"Introduction and Applicability Statements for Internet-
Standard Management Framework", RFC 3410, December 2002.
[RFC1493] Decker, E., Langille, P., Rijsinghani, A., and K.
McCloghrie, "Definitions of Managed Objects for Bridges",
RFC 1493, July 1993.
[RFC1525] Decker, E., McCloghrie, K., Langille, P., and A.
Rijsinghani, "Definitions of Managed Objects for Source
Routing Bridges", RFC 1525, September 1993.
Authors’ Addresses
Kenyon C. Norseth (editor)
L-3 Communications
640 N. 2200 West
Salt Lake City, Utah 84116-0850
USA
Phone: +1 801-594-2809
EMail: kenyon.c.norseth@L-3com.com
E. Bell (editor)
3Com Europe Limited
3Com Centre, Boundary Way
Hemel Hempstead Herts. HP2 7YU
UK
Phone: +44 1442 438025
EMail: elbell@ntlworld.com
Full Copyright Statement
Copyright (C) The Internet Society (2005).
This document is subject to the rights, licenses and restrictions
contained in BCP 78, and except as set forth therein, the authors
retain all their rights.
This document and the information contained herein are provided on an
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property
The IETF takes no position regarding the validity or scope of any
Intellectual Property Rights or other rights that might be claimed to
pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights
might or might not be available; nor does it represent that it has
made any independent effort to identify any such rights. Information
on the procedures with respect to rights in RFC documents can be
found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any
assurances of licenses to be made available, or the result of an
attempt made to obtain a general license or permission for the use of
such proprietary rights by implementers or users of this
specification can be obtained from the IETF on-line IPR repository at
http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary
rights that may cover technology that may be required to implement
this standard. Please address the information to the IETF at ietf-
ipr@ietf.org.
Acknowledgement
Funding for the RFC Editor function is currently provided by the
Internet Society.