CORE-MIB DEFINITIONS ::= BEGIN

IMPORTS ;

--------------

-- from SMI --

--------------

-- the path to the root

internet OBJECT IDENTIFIER ::= { iso(1) org(3) dod(6) 1 }

directory OBJECT IDENTIFIER ::= { internet 1 }

mgmt OBJECT IDENTIFIER ::= { internet 2 }

experimental OBJECT IDENTIFIER ::= { internet 3 }

private OBJECT IDENTIFIER ::= { internet 4 }

enterprises OBJECT IDENTIFIER ::= { private 1 }

security OBJECT IDENTIFIER ::= { internet 5 }

snmpV2 OBJECT IDENTIFIER ::= { internet 6 }

-- transport domains

snmpDomains OBJECT IDENTIFIER ::= { snmpV2 1 }

-- transport proxies

snmpProxys OBJECT IDENTIFIER ::= { snmpV2 2 }

-- module identities

snmpModules OBJECT IDENTIFIER ::= { snmpV2 3 }

-----------------

-- from MIB-II --

-----------------

mib-2 OBJECT IDENTIFIER ::= { mgmt 1 }

-------------------

-- from RFC 1271 --

-------------------

EntryStatus ::= INTEGER

{ valid(1),

createRequest(2),

underCreation(3),

invalid(4)

}

-- The status of a table entry.

--

-- Setting this object to the value invalid(4) has the

-- effect of invalidating the corresponding entry.

-- That is, it effectively disassociates the mapping

-- identified with said entry.

-- It is an implementation-specific matter as to whether

-- the agent removes an invalidated entry from the table.

-- Accordingly, management stations must be prepared to

-- receive tabular information from agents that corresponds

-- to entries currently not in use. Proper

-- interpretation of such entries requires examination

-- of the relevant EntryStatus object.

--

-- An existing instance of this object cannot be set to

-- createRequest(2). This object may only be set to

-- createRequest(2) when this instance is created. When

-- this object is created, the agent may wish to create

-- supplemental object instances to complete a conceptual

-- row in this table. Immediately after completing the

-- create operation, the agent must set this object to

-- underCreation(3).

--

-- Entries shall exist in the underCreation(3) state until

-- the management station is finished configuring the

-- entry and sets this object to valid(1) or aborts,

-- setting this object to invalid(4). If the agent

-- determines that an entry has been in the

-- underCreation(3) state for an abnormally long time,

-- it may decide that the management station has

-- crashed. If the agent makes this decision,

-- it may set this object to invalid(4) to reclaim the

-- entry. A prudent agent will understand that the

-- management station may need to wait for human input

-- and will allow for that possibility in its

-- determination of this abnormally long period.

-------------------

-- from RFC 1316 --

-------------------

-------------------

-- from RFC 1443 --

-------------------

------------------------

-- from RFC 1065/1442 --

------------------------

Gauge32 ::= Gauge

Counter32 ::= Counter

Integer32 ::= INTEGER

-- application-wide types

NetworkAddress ::=

CHOICE {

internet

IpAddress

}

IpAddress ::=

[APPLICATION 0] -- in network-byte order

IMPLICIT OCTET STRING (SIZE (4))

Counter ::=

[APPLICATION 1]

IMPLICIT INTEGER (0..4294967295)

Counter64 ::=

[APPLICATION 1]

IMPLICIT INTEGER (0..18446744073709551615)

Gauge ::=

[APPLICATION 2]

IMPLICIT INTEGER (0..4294967295)

Unsigned32 ::=

[APPLICATION 2]

IMPLICIT INTEGER (0..4294967295)

TimeTicks ::=

[APPLICATION 3]

IMPLICIT INTEGER (0..4294967295)

Opaque ::=

[APPLICATION 4] -- arbitrary ASN.1 value,

IMPLICIT OCTET STRING -- "double-wrapped"

---------------------------------------------------

-- from RFC 1903: Textual Conventions for SNMPv2 --

---------------------------------------------------

DisplayString ::= TEXTUAL-CONVENTION

DISPLAY-HINT "255a"

STATUS current

DESCRIPTION

"Represents textual information taken from the NVT ASCII

character set, as defined in pages 4, 10-11 of RFC 854.

To summarize RFC 854, the NVT ASCII repertoire specifies:

- the use of character codes 0-127 (decimal)

- the graphics characters (32-126) are interpreted as

US ASCII

- NUL, LF, CR, BEL, BS, HT, VT and FF have the special

meanings specified in RFC 854

- the other 25 codes have no standard interpretation

- the sequence 'CR LF' means newline

- the sequence 'CR NUL' means carriage-return

- an 'LF' not preceded by a 'CR' means moving to the

same column on the next line.

- the sequence 'CR x' for any x other than LF or NUL is

illegal. (Note that this also means that a string may

end with either 'CR LF' or 'CR NUL', but not with CR.)

Any object defined using this syntax may not exceed 255

characters in length."

SYNTAX OCTET STRING (SIZE (0..255))

PhysAddress ::= TEXTUAL-CONVENTION

DISPLAY-HINT "1x:"

STATUS current

DESCRIPTION

"Represents media- or physical-level addresses."

SYNTAX OCTET STRING

MacAddress ::= TEXTUAL-CONVENTION

DISPLAY-HINT "1x:"

STATUS current

DESCRIPTION

"Represents an 802 MAC address represented in the

`canonical' order defined by IEEE 802.1a, i.e., as if it

were transmitted least significant bit first, even though

802.5 (in contrast to other 802.x protocols) requires MAC

addresses to be transmitted most significant bit first."

SYNTAX OCTET STRING (SIZE (6))

TruthValue ::= TEXTUAL-CONVENTION

STATUS current

DESCRIPTION

"Represents a boolean value."

SYNTAX INTEGER { true(1), false(2) }

TestAndIncr ::= TEXTUAL-CONVENTION

STATUS current

DESCRIPTION

"Represents integer-valued information used for atomic

operations. When the management protocol is used to specify

that an object instance having this syntax is to be

modified, the new value supplied via the management protocol

must precisely match the value presently held by the

instance. If not, the management protocol set operation

fails with an error of `inconsistentValue'. Otherwise, if

the current value is the maximum value of 2^31-1 (2147483647

decimal), then the value held by the instance is wrapped to

zero; otherwise, the value held by the instance is

incremented by one. (Note that regardless of whether the

management protocol set operation succeeds, the variable-

binding in the request and response PDUs are identical.)

The value of the ACCESS clause for objects having this

syntax is either `read-write' or `read-create'. When an

instance of a columnar object having this syntax is created,

any value may be supplied via the management protocol.

When the network management portion of the system is re-

initialized, the value of every object instance having this

syntax must either be incremented from its value prior to

the re-initialization, or (if the value prior to the re-

initialization is unknown) be set to a pseudo-randomly

generated value."

SYNTAX INTEGER (0..2147483647)

AutonomousType ::= TEXTUAL-CONVENTION

STATUS current

DESCRIPTION

"Represents an independently extensible type identification

value. It may, for example, indicate a particular sub-tree

with further MIB definitions, or define a particular type of

protocol or hardware."

SYNTAX OBJECT IDENTIFIER

InstancePointer ::= TEXTUAL-CONVENTION

STATUS obsolete

DESCRIPTION

"A pointer to either a specific instance of a MIB object or

a conceptual row of a MIB table in the managed device. In

the latter case, by convention, it is the name of the

particular instance of the first accessible columnar object

in the conceptual row.

The two uses of this textual convention are replaced by

VariablePointer and RowPointer, respectively."

SYNTAX OBJECT IDENTIFIER

VariablePointer ::= TEXTUAL-CONVENTION

STATUS current

DESCRIPTION

"A pointer to a specific object instance. For example,

sysContact.0 or ifInOctets.3."

SYNTAX OBJECT IDENTIFIER

RowPointer ::= TEXTUAL-CONVENTION

STATUS current

DESCRIPTION

"Represents a pointer to a conceptual row. The value is the

name of the instance of the first accessible columnar object

in the conceptual row.

For example, ifIndex.3 would point to the 3rd row in the

ifTable (note that if ifIndex were not-accessible, then

ifDescr.3 would be used instead)."

SYNTAX OBJECT IDENTIFIER

RowStatus ::= TEXTUAL-CONVENTION

STATUS current

DESCRIPTION

"The RowStatus textual convention is used to manage the

creation and deletion of conceptual rows, and is used as the

value of the SYNTAX clause for the status column of a

conceptual row (as described in Section 7.7.1 of [2].)

The status column has six defined values:

- `active', which indicates that the conceptual row is

available for use by the managed device;

- `notInService', which indicates that the conceptual

row exists in the agent, but is unavailable for use by

the managed device (see NOTE below);

- `notReady', which indicates that the conceptual row

exists in the agent, but is missing information

necessary in order to be available for use by the

managed device;

- `createAndGo', which is supplied by a management

station wishing to create a new instance of a

conceptual row and to have its status automatically set

to active, making it available for use by the managed

device;

- `createAndWait', which is supplied by a management

station wishing to create a new instance of a

conceptual row (but not make it available for use by

the managed device); and,

- `destroy', which is supplied by a management station

wishing to delete all of the instances associated with

an existing conceptual row.

Whereas five of the six values (all except `notReady') may

be specified in a management protocol set operation, only

three values will be returned in response to a management

protocol retrieval operation: `notReady', `notInService' or

`active'. That is, when queried, an existing conceptual row

has only three states: it is either available for use by

the managed device (the status column has value `active');

it is not available for use by the managed device, though

the agent has sufficient information to make it so (the

status column has value `notInService'); or, it is not

available for use by the managed device, and an attempt to

make it so would fail because the agent has insufficient

information (the state column has value `notReady').

NOTE WELL

This textual convention may be used for a MIB table,

irrespective of whether the values of that table's

conceptual rows are able to be modified while it is

active, or whether its conceptual rows must be taken

out of service in order to be modified. That is, it is

the responsibility of the DESCRIPTION clause of the

status column to specify whether the status column must

not be `active' in order for the value of some other

column of the same conceptual row to be modified. If

such a specification is made, affected columns may be

changed by an SNMP set PDU if the RowStatus would not

be equal to `active' either immediately before or after

processing the PDU. In other words, if the PDU also

contained a varbind that would change the RowStatus

value, the column in question may be changed if the

RowStatus was not equal to `active' as the PDU was

received, or if the varbind sets the status to a value

other than 'active'.

Also note that whenever any elements of a row exist, the

RowStatus column must also exist.

To summarize the effect of having a conceptual row with a

status column having a SYNTAX clause value of RowStatus,

consider the following state diagram:

STATE

+--------------+-----------+-------------+-------------

| A | B | C | D

| |status col.|status column|

|status column | is | is |status column

ACTION |does not exist| notReady | notInService| is active

--------------+--------------+-----------+-------------+-------------

set status |noError ->D|inconsist- |inconsistent-|inconsistent-

column to | or | entValue| Value| Value

createAndGo |inconsistent- | | |

| Value| | |

--------------+--------------+-----------+-------------+-------------

set status |noError see 1|inconsist- |inconsistent-|inconsistent-

column to | or | entValue| Value| Value

createAndWait |wrongValue | | |

--------------+--------------+-----------+-------------+-------------

set status |inconsistent- |inconsist- |noError |noError

column to | Value| entValue| |

active | | | |

| | or | |

| | | |

| |see 2 ->D| ->D| ->D

--------------+--------------+-----------+-------------+-------------

set status |inconsistent- |inconsist- |noError |noError ->C

column to | Value| entValue| |

notInService | | | |

| | or | | or

| | | |

| |see 3 ->C| ->C|wrongValue

--------------+--------------+-----------+-------------+-------------

set status |noError |noError |noError |noError

column to | | | |

destroy | ->A| ->A| ->A| ->A

--------------+--------------+-----------+-------------+-------------

set any other |see 4 |noError |noError |see 5

column to some| | | |

value | | see 1| ->C| ->D

--------------+--------------+-----------+-------------+-------------

(1) goto B or C, depending on information available to the

agent.

SNMPv2 Working Group Standards Track [Page 9]



RFC 1903 Textual Conventions for SNMPv2 January 1996

(2) if other variable bindings included in the same PDU,

provide values for all columns which are missing but

required, then return noError and goto D.

(3) if other variable bindings included in the same PDU,

provide values for all columns which are missing but

required, then return noError and goto C.

(4) at the discretion of the agent, the return value may be

either:

inconsistentName: because the agent does not choose to

create such an instance when the corresponding

RowStatus instance does not exist, or

inconsistentValue: if the supplied value is

inconsistent with the state of some other MIB object's

value, or

noError: because the agent chooses to create the

instance.

If noError is returned, then the instance of the status

column must also be created, and the new state is B or C,

depending on the information available to the agent. If

inconsistentName or inconsistentValue is returned, the row

remains in state A.

(5) depending on the MIB definition for the column/table,

either noError or inconsistentValue may be returned.

NOTE: Other processing of the set request may result in a

response other than noError being returned, e.g.,

wrongValue, noCreation, etc.

Conceptual Row Creation

There are four potential interactions when creating a

conceptual row: selecting an instance-identifier which is

not in use; creating the conceptual row; initializing any

objects for which the agent does not supply a default; and,

making the conceptual row available for use by the managed

device.

Interaction 1: Selecting an Instance-Identifier

The algorithm used to select an instance-identifier varies

for each conceptual row. In some cases, the instance-

identifier is semantically significant, e.g., the

destination address of a route, and a management station

selects the instance-identifier according to the semantics.

In other cases, the instance-identifier is used solely to

distinguish conceptual rows, and a management station

without specific knowledge of the conceptual row might

examine the instances present in order to determine an

unused instance-identifier. (This approach may be used, but

it is often highly sub-optimal; however, it is also a

questionable practice for a naive management station to

attempt conceptual row creation.)

Alternately, the MIB module which defines the conceptual row

might provide one or more objects which provide assistance

in determining an unused instance-identifier. For example,

if the conceptual row is indexed by an integer-value, then

an object having an integer-valued SYNTAX clause might be

defined for such a purpose, allowing a management station to

issue a management protocol retrieval operation. In order

to avoid unnecessary collisions between competing management

stations, `adjacent' retrievals of this object should be

different.

Finally, the management station could select a pseudo-random

number to use as the index. In the event that this index

was already in use and an inconsistentValue was returned in

response to the management protocol set operation, the

management station should simply select a new pseudo-random

number and retry the operation.

A MIB designer should choose between the two latter

algorithms based on the size of the table (and therefore the

efficiency of each algorithm). For tables in which a large

number of entries are expected, it is recommended that a MIB

object be defined that returns an acceptable index for

creation. For tables with small numbers of entries, it is

recommended that the latter pseudo-random index mechanism be

used.

Interaction 2: Creating the Conceptual Row

Once an unused instance-identifier has been selected, the

management station determines if it wishes to create and

activate the conceptual row in one transaction or in a

negotiated set of interactions.

Interaction 2a: Creating and Activating the Conceptual Row

The management station must first determine the column

requirements, i.e., it must determine those columns for

which it must or must not provide values. Depending on the

complexity of the table and the management station's

knowledge of the agent's capabilities, this determination

can be made locally by the management station. Alternately,

the management station issues a management protocol get

operation to examine all columns in the conceptual row that

it wishes to create. In response, for each column, there

are three possible outcomes:

- a value is returned, indicating that some other

management station has already created this conceptual

row. We return to interaction 1.

- the exception `noSuchInstance' is returned,

indicating that the agent implements the object-type

associated with this column, and that this column in at

least one conceptual row would be accessible in the MIB

view used by the retrieval were it to exist. For those

columns to which the agent provides read-create access,

the `noSuchInstance' exception tells the management

station that it should supply a value for this column

when the conceptual row is to be created.

- the exception `noSuchObject' is returned, indicating

that the agent does not implement the object-type

associated with this column or that there is no

conceptual row for which this column would be

accessible in the MIB view used by the retrieval. As

such, the management station can not issue any

management protocol set operations to create an

instance of this column.

Once the column requirements have been determined, a

management protocol set operation is accordingly issued.

This operation also sets the new instance of the status

column to `createAndGo'.

When the agent processes the set operation, it verifies that

it has sufficient information to make the conceptual row

available for use by the managed device. The information

available to the agent is provided by two sources: the

management protocol set operation which creates the

conceptual row, and, implementation-specific defaults

supplied by the agent (note that an agent must provide

implementation-specific defaults for at least those objects

which it implements as read-only). If there is sufficient

information available, then the conceptual row is created, a

`noError' response is returned, the status column is set to

`active', and no further interactions are necessary (i.e.,

interactions 3 and 4 are skipped). If there is insufficient

information, then the conceptual row is not created, and the

set operation fails with an error of `inconsistentValue'.

On this error, the management station can issue a management

protocol retrieval operation to determine if this was

because it failed to specify a value for a required column,

or, because the selected instance of the status column

already existed. In the latter case, we return to

interaction 1. In the former case, the management station

can re-issue the set operation with the additional

information, or begin interaction 2 again using

`createAndWait' in order to negotiate creation of the

conceptual row.

NOTE WELL

Regardless of the method used to determine the column

requirements, it is possible that the management

station might deem a column necessary when, in fact,

the agent will not allow that particular columnar

instance to be created or written. In this case, the

management protocol set operation will fail with an

error such as `noCreation' or `notWritable'. In this

case, the management station decides whether it needs

to be able to set a value for that particular columnar

instance. If not, the management station re-issues the

management protocol set operation, but without setting

a value for that particular columnar instance;

otherwise, the management station aborts the row

creation algorithm.

Interaction 2b: Negotiating the Creation of the Conceptual

Row

The management station issues a management protocol set

operation which sets the desired instance of the status

column to `createAndWait'. If the agent is unwilling to

process a request of this sort, the set operation fails with

an error of `wrongValue'. (As a consequence, such an agent

must be prepared to accept a single management protocol set

operation, i.e., interaction 2a above, containing all of the

columns indicated by its column requirements.) Otherwise,

the conceptual row is created, a `noError' response is

returned, and the status column is immediately set to either

`notInService' or `notReady', depending on whether it has

sufficient information to make the conceptual row available

for use by the managed device. If there is sufficient

information available, then the status column is set to

`notInService'; otherwise, if there is insufficient

information, then the status column is set to `notReady'.

Regardless, we proceed to interaction 3.

Interaction 3: Initializing non-defaulted Objects

The management station must now determine the column

requirements. It issues a management protocol get operation

to examine all columns in the created conceptual row. In

the response, for each column, there are three possible

outcomes:

- a value is returned, indicating that the agent

implements the object-type associated with this column

and had sufficient information to provide a value. For

those columns to which the agent provides read-create

access (and for which the agent allows their values to

be changed after their creation), a value return tells

the management station that it may issue additional

management protocol set operations, if it desires, in

order to change the value associated with this column.

- the exception `noSuchInstance' is returned,

indicating that the agent implements the object-type

associated with this column, and that this column in at

least one conceptual row would be accessible in the MIB

view used by the retrieval were it to exist. However,

the agent does not have sufficient information to

provide a value, and until a value is provided, the

conceptual row may not be made available for use by the

managed device. For those columns to which the agent

provides read-create access, the `noSuchInstance'

exception tells the management station that it must

issue additional management protocol set operations, in

order to provide a value associated with this column.

- the exception `noSuchObject' is returned, indicating

that the agent does not implement the object-type

associated with this column or that there is no

conceptual row for which this column would be

accessible in the MIB view used by the retrieval. As

such, the management station can not issue any

management protocol set operations to create an

instance of this column.

If the value associated with the status column is

`notReady', then the management station must first deal with

all `noSuchInstance' columns, if any. Having done so, the

value of the status column becomes `notInService', and we

proceed to interaction 4.

Interaction 4: Making the Conceptual Row Available

Once the management station is satisfied with the values

associated with the columns of the conceptual row, it issues

a management protocol set operation to set the status column

to `active'. If the agent has sufficient information to

make the conceptual row available for use by the managed

device, the management protocol set operation succeeds (a

`noError' response is returned). Otherwise, the management

protocol set operation fails with an error of

`inconsistentValue'.

NOTE WELL

A conceptual row having a status column with value

`notInService' or `notReady' is unavailable to the

managed device. As such, it is possible for the

managed device to create its own instances during the

time between the management protocol set operation

which sets the status column to `createAndWait' and the

management protocol set operation which sets the status

column to `active'. In this case, when the management

protocol set operation is issued to set the status

column to `active', the values held in the agent

supersede those used by the managed device.

If the management station is prevented from setting the

status column to `active' (e.g., due to management station

or network failure) the conceptual row will be left in the

`notInService' or `notReady' state, consuming resources

indefinitely. The agent must detect conceptual rows that

have been in either state for an abnormally long period of

time and remove them. It is the responsibility of the

DESCRIPTION clause of the status column to indicate what an

abnormally long period of time would be. This period of

time should be long enough to allow for human response time

(including `think time') between the creation of the

conceptual row and the setting of the status to `active'.

In the absense of such information in the DESCRIPTION

clause, it is suggested that this period be approximately 5

minutes in length. This removal action applies not only to

newly-created rows, but also to previously active rows which

are set to, and left in, the notInService state for a

prolonged period exceeding that which is considered normal

for such a conceptual row.

Conceptual Row Suspension

When a conceptual row is `active', the management station

may issue a management protocol set operation which sets the

instance of the status column to `notInService'. If the

agent is unwilling to do so, the set operation fails with an

error of `wrongValue'. Otherwise, the conceptual row is

taken out of service, and a `noError' response is returned.

It is the responsibility of the DESCRIPTION clause of the

status column to indicate under what circumstances the

status column should be taken out of service (e.g., in order

for the value of some other column of the same conceptual

row to be modified).

Conceptual Row Deletion

For deletion of conceptual rows, a management protocol set

operation is issued which sets the instance of the status

column to `destroy'. This request may be made regardless of

the current value of the status column (e.g., it is possible

to delete conceptual rows which are either `notReady',

`notInService' or `active'.) If the operation succeeds,

then all instances associated with the conceptual row are

immediately removed."

SYNTAX INTEGER {

-- the following two values are states:

-- these values may be read or written

active(1),

notInService(2),

-- the following value is a state:

-- this value may be read, but not written

notReady(3),

-- the following three values are

-- actions: these values may be written,

-- but are never read

createAndGo(4),

createAndWait(5),

destroy(6)

}

TimeStamp ::= TEXTUAL-CONVENTION

STATUS current

DESCRIPTION

"The value of the sysUpTime object at which a specific

occurrence happened. The specific occurrence must be

defined in the description of any object defined using this

type."

SYNTAX TimeTicks

TimeInterval ::= TEXTUAL-CONVENTION

STATUS current

DESCRIPTION

"A period of time, measured in units of 0.01 seconds."

SYNTAX INTEGER (0..2147483647)

DateAndTime ::= TEXTUAL-CONVENTION

DISPLAY-HINT "2d-1d-1d,1d:1d:1d.1d,1a1d:1d"

STATUS current

DESCRIPTION

"A date-time specification.

field octets contents range

----- ------ -------- -----

1 1-2 year 0..65536

2 3 month 1..12

3 4 day 1..31

4 5 hour 0..23

5 6 minutes 0..59

6 7 seconds 0..60

(use 60 for leap-second)

7 8 deci-seconds 0..9

8 9 direction from UTC '+' / '-'

9 10 hours from UTC 0..11

10 11 minutes from UTC 0..59

For example, Tuesday May 26, 1992 at 1:30:15 PM EDT would be

displayed as:

1992-5-26,13:30:15.0,-4:0

Note that if only local time is known, then timezone

information (fields 8-10) is not present."

SYNTAX OCTET STRING (SIZE (8 | 11))

StorageType ::= TEXTUAL-CONVENTION

STATUS current

DESCRIPTION

"Describes the memory realization of a conceptual row. A

row which is volatile(2) is lost upon reboot. A row which

is either nonVolatile(3), permanent(4) or readOnly(5), is

backed up by stable storage. A row which is permanent(4)

can be changed but not deleted. A row which is readOnly(5)

cannot be changed nor deleted.

If the value of an object with this syntax is either

permanent(4) or readOnly(5), it cannot be modified.

Conversely, if the value is either other(1), volatile(2) or

nonVolatile(3), it cannot be modified to be permanent(4) or

readOnly(5).

Every usage of this textual convention is required to

specify the columnar objects which a permanent(4) row must

at a minimum allow to be writable."

SYNTAX INTEGER {

other(1), -- eh?

volatile(2), -- e.g., in RAM

nonVolatile(3), -- e.g., in NVRAM

permanent(4), -- e.g., partially in ROM

readOnly(5) -- e.g., completely in ROM

}

TDomain ::= TEXTUAL-CONVENTION

STATUS current

DESCRIPTION

"Denotes a kind of transport service.

Some possible values, such as snmpUDPDomain, are defined in

'Transport Mappings for Version 2 of the Simple Network

Management Protocol (SNMPv2)'."

SYNTAX OBJECT IDENTIFIER

TAddress ::= TEXTUAL-CONVENTION

STATUS current

DESCRIPTION

"Denotes a transport service address.

For snmpUDPDomain, a TAddress is 6 octets long, the initial 4

octets containing the IP-address in network-byte order and the

last 2 containing the UDP port in network-byte order. Consult

'Transport Mappings for Version 2 of the Simple Network

Management Protocol (SNMPv2)' for further information on

snmpUDPDomain."

SYNTAX OCTET STRING (SIZE (1..255))

---------------------------------------------------

-- from RFC 2571: Textual Conventions for SNMPv3 --

---------------------------------------------------

SnmpEngineID ::= TEXTUAL-CONVENTION

STATUS current

DESCRIPTION "An SNMP engine's administratively-unique identifier.

Objects of this type are for identification, not for

addressing, even though it is possible that an

address may have been used in the generation of

a specific value.

The value for this object may not be all zeros or

all 'ff'H or the empty (zero length) string.

The initial value for this object may be configured

via an operator console entry or via an algorithmic

function. In the latter case, the following

example algorithm is recommended.

In cases where there are multiple engines on the

same system, the use of this algorithm is NOT

appropriate, as it would result in all of those

engines ending up with the same ID value.

1) The very first bit is used to indicate how the

rest of the data is composed.

0 - as defined by enterprise using former methods

that existed before SNMPv3. See item 2 below.

1 - as defined by this architecture, see item 3

below.

Note that this allows existing uses of the

engineID (also known as AgentID [RFC1910]) to

co-exist with any new uses.

2) The snmpEngineID has a length of 12 octets.

The first four octets are set to the binary

equivalent of the agent's SNMP management

private enterprise number as assigned by the

Internet Assigned Numbers Authority (IANA).

For example, if Acme Networks has been assigned

{ enterprises 696 }, the first four octets would

be assigned '000002b8'H.

The remaining eight octets are determined via

one or more enterprise-specific methods. Such

methods must be designed so as to maximize the

possibility that the value of this object will

be unique in the agent's administrative domain.

For example, it may be the IP address of the SNMP

entity, or the MAC address of one of the

interfaces, with each address suitably padded

with random octets. If multiple methods are

defined, then it is recommended that the first

octet indicate the method being used and the

remaining octets be a function of the method.

3) The length of the octet strings varies.

The first four octets are set to the binary

equivalent of the agent's SNMP management

private enterprise number as assigned by the

Internet Assigned Numbers Authority (IANA).

For example, if Acme Networks has been assigned

{ enterprises 696 }, the first four octets would

be assigned '000002b8'H.

The very first bit is set to 1. For example, the

above value for Acme Networks now changes to be

'800002b8'H.

The fifth octet indicates how the rest (6th and

following octets) are formatted. The values for

the fifth octet are:

0 - reserved, unused.

1 - IPv4 address (4 octets)

lowest non-special IP address

2 - IPv6 address (16 octets)

lowest non-special IP address

3 - MAC address (6 octets)

lowest IEEE MAC address, canonical

order

4 - Text, administratively assigned

Maximum remaining length 27

5 - Octets, administratively assigned

Maximum remaining length 27

6-127 - reserved, unused

127-255 - as defined by the enterprise

Maximum remaining length 27

"

SYNTAX OCTET STRING (SIZE(5..32))

SnmpSecurityModel ::= TEXTUAL-CONVENTION

STATUS current

DESCRIPTION "An identifier that uniquely identifies a

securityModel of the Security Subsystem within the

SNMP Management Architecture.

The values for securityModel are allocated as

follows:

- The zero value is reserved.

- Values between 1 and 255, inclusive, are reserved

for standards-track Security Models and are

managed by the Internet Assigned Numbers Authority

(IANA).

- Values greater than 255 are allocated to

enterprise-specific Security Models. An

enterprise-specific securityModel value is defined

to be:

enterpriseID * 256 + security model within

enterprise

For example, the fourth Security Model defined by

the enterprise whose enterpriseID is 1 would be

260.

This scheme for allocation of securityModel

values allows for a maximum of 255 standards-

based Security Models, and for a maximum of

255 Security Models per enterprise.

It is believed that the assignment of new

securityModel values will be rare in practice

because the larger the number of simultaneously

utilized Security Models, the larger the

chance that interoperability will suffer.

Consequently, it is believed that such a range

will be sufficient. In the unlikely event that

the standards committee finds this number to be

insufficient over time, an enterprise number

can be allocated to obtain an additional 255

possible values.

Note that the most significant bit must be zero;

hence, there are 23 bits allocated for various

organizations to design and define non-standard

securityModels. This limits the ability to

define new proprietary implementations of Security

Models to the first 8,388,608 enterprises.

It is worthwhile to note that, in its encoded

form, the securityModel value will normally

require only a single byte since, in practice,

the leftmost bits will be zero for most messages

and sign extension is suppressed by the encoding

rules.

As of this writing, there are several values

of securityModel defined for use with SNMP or

reserved for use with supporting MIB objects.

They are as follows:

0 reserved for 'any'

1 reserved for SNMPv1

2 reserved for SNMPv2c

3 User-Based Security Model (USM)

"

SYNTAX INTEGER(0 .. 2147483647)

SnmpMessageProcessingModel ::= TEXTUAL-CONVENTION

STATUS current

DESCRIPTION "An identifier that uniquely identifies a Message

Processing Model of the Message Processing

Subsystem within a SNMP Management Architecture.

The values for messageProcessingModel are

allocated as follows:

- Values between 0 and 255, inclusive, are

reserved for standards-track Message Processing

Models and are managed by the Internet Assigned

Numbers Authority (IANA).

- Values greater than 255 are allocated to

enterprise-specific Message Processing Models.

An enterprise messageProcessingModel value is

defined to be:

enterpriseID * 256 +

messageProcessingModel within enterprise

For example, the fourth Message Processing Model

defined by the enterprise whose enterpriseID

is 1 would be 260.

This scheme for allocating messageProcessingModel

values allows for a maximum of 255 standards-

based Message Processing Models, and for a

maximum of 255 Message Processing Models per

enterprise.

It is believed that the assignment of new

messageProcessingModel values will be rare

in practice because the larger the number of

simultaneously utilized Message Processing Models,

the larger the chance that interoperability

will suffer. It is believed that such a range

will be sufficient. In the unlikely event that

the standards committee finds this number to be

insufficient over time, an enterprise number

can be allocated to obtain an additional 256

possible values.

Note that the most significant bit must be zero;

hence, there are 23 bits allocated for various

organizations to design and define non-standard

messageProcessingModels. This limits the ability

to define new proprietary implementations of

Message Processing Models to the first 8,388,608

enterprises.

It is worthwhile to note that, in its encoded

form, the messageProcessingModel value will

normally require only a single byte since, in

practice, the leftmost bits will be zero for

most messages and sign extension is suppressed

by the encoding rules.

As of this writing, there are several values of

messageProcessingModel defined for use with SNMP.

They are as follows:

0 reserved for SNMPv1

1 reserved for SNMPv2c

2 reserved for SNMPv2u and SNMPv2*

3 reserved for SNMPv3

"

SYNTAX INTEGER(0 .. 2147483647)

SnmpSecurityLevel ::= TEXTUAL-CONVENTION

STATUS current

DESCRIPTION "A Level of Security at which SNMP messages can be

sent or with which operations are being processed;

in particular, one of:

noAuthNoPriv - without authentication and

without privacy,

authNoPriv - with authentication but

without privacy,

authPriv - with authentication and

with privacy.

These three values are ordered such that

noAuthNoPriv is less than authNoPriv and

authNoPriv is less than authPriv.

"

SYNTAX INTEGER { noAuthNoPriv(1),

authNoPriv(2),

authPriv(3)

}

SnmpAdminString ::= TEXTUAL-CONVENTION

DISPLAY-HINT "255a"

STATUS current

DESCRIPTION "An octet string containing administrative

information, preferably in human-readable form.

To facilitate internationalization, this

information is represented using the ISO/IEC

IS 10646-1 character set, encoded as an octet

string using the UTF-8 transformation format

described in [RFC2279].

Since additional code points are added by

amendments to the 10646 standard from time

to time, implementations must be prepared to

encounter any code point from 0x00000000 to

0x7fffffff. Byte sequences that do not

correspond to the valid UTF-8 encoding of a

code point or are outside this range are

prohibited.

The use of control codes should be avoided.

When it is necessary to represent a newline,

the control code sequence CR LF should be used.

The use of leading or trailing white space should

be avoided.

For code points not directly supported by user

interface hardware or software, an alternative

means of entry and display, such as hexadecimal,

may be provided.

For information encoded in 7-bit US-ASCII,

the UTF-8 encoding is identical to the

US-ASCII encoding.

UTF-8 may require multiple bytes to represent a

single character / code point; thus the length

of this object in octets may be different from

the number of characters encoded. Similarly,

size constraints refer to the number of encoded

octets, not the number of characters represented

by an encoding.

Note that when this TC is used for an object that

is used or envisioned to be used as an index, then

a SIZE restriction MUST be specified so that the

number of sub-identifiers for any object instance

does not exceed the limit of 128, as defined by

[RFC1905].

Note that the size of an SnmpAdminString object is

measured in octets, not characters.

"

SYNTAX DisplayString (SIZE (0..255))

---------------------------------------------------

-- from RFC 2574: Textual Conventions for SNMPv3 --

---------------------------------------------------

KeyChange ::= TEXTUAL-CONVENTION

STATUS current

DESCRIPTION

"Every definition of an object with this syntax must identify

a protocol P, a secret key K, and a hash algorithm H

that produces output of L octets.

The object's value is a manager-generated, partially-random

value which, when modified, causes the value of the secret

key K, to be modified via a one-way function.

The value of an instance of this object is the concatenation

of two components: first a 'random' component and then a

'delta' component.

The lengths of the random and delta components

are given by the corresponding value of the protocol P;

if P requires K to be a fixed length, the length of both the

random and delta components is that fixed length; if P

allows the length of K to be variable up to a particular

maximum length, the length of the random component is that

maximum length and the length of the delta component is any

length less than or equal to that maximum length.

For example, usmHMACMD5AuthProtocol requires K to be a fixed

length of 16 octets and L - of 16 octets.

usmHMACSHAAuthProtocol requires K to be a fixed length of

20 octets and L - of 20 octets. Other protocols may define

other sizes, as deemed appropriate.

When a requester wants to change the old key K to a new

key keyNew on a remote entity, the 'random' component is

obtained from either a true random generator, or from a

pseudorandom generator, and the 'delta' component is

computed as follows:

- a temporary variable is initialized to the existing value

of K;

- if the length of the keyNew is greater than L octets,

then:

- the random component is appended to the value of the

temporary variable, and the result is input to the

the hash algorithm H to produce a digest value, and

the temporary variable is set to this digest value;

- the value of the temporary variable is XOR-ed with

the first (next) L-octets (16 octets in case of MD5)

of the keyNew to produce the first (next) L-octets

(16 octets in case of MD5) of the 'delta' component.

- the above two steps are repeated until the unused

portion of the keyNew component is L octets or less,

- the random component is appended to the value of the

temporary variable, and the result is input to the

hash algorithm H to produce a digest value;

- this digest value, truncated if necessary to be the same

length as the unused portion of the keyNew, is XOR-ed

with the unused portion of the keyNew to produce the

(final portion of the) 'delta' component.

For example, using MD5 as the hash algorithm H:

iterations = (lenOfDelta - 1)/16; /* integer division */

temp = keyOld;

for (i = 0; i < iterations; i++) {

temp = MD5 (temp || random);

delta[i*16 .. (i*16)+15] =

temp XOR keyNew[i*16 .. (i*16)+15];

}

temp = MD5 (temp || random);

delta[i*16 .. lenOfDelta-1] =

temp XOR keyNew[i*16 .. lenOfDelta-1];

The 'random' and 'delta' components are then concatenated as

described above, and the resulting octet string is sent to

the recipient as the new value of an instance of this object.

At the receiver side, when an instance of this object is set

to a new value, then a new value of K is computed as follows:

- a temporary variable is initialized to the existing value

of K;

- if the length of the delta component is greater than L

octets, then:

- the random component is appended to the value of the

temporary variable, and the result is input to the

hash algorithm H to produce a digest value, and the

temporary variable is set to this digest value;

- the value of the temporary variable is XOR-ed with

the first (next) L-octets (16 octets in case of MD5)

of the delta component to produce the first (next)

L-octets (16 octets in case of MD5) of the new value

of K.

- the above two steps are repeated until the unused

portion of the delta component is L octets or less,

- the random component is appended to the value of the

temporary variable, and the result is input to the

hash algorithm H to produce a digest value;

- this digest value, truncated if necessary to be the same

length as the unused portion of the delta component, is

XOR-ed with the unused portion of the delta component to

produce the (final portion of the) new value of K.

For example, using MD5 as the hash algorithm H:

iterations = (lenOfDelta - 1)/16; /* integer division */

temp = keyOld;

for (i = 0; i < iterations; i++) {

temp = MD5 (temp || random);

keyNew[i*16 .. (i*16)+15] =

temp XOR delta[i*16 .. (i*16)+15];

}

temp = MD5 (temp || random);

keyNew[i*16 .. lenOfDelta-1] =

temp XOR delta[i*16 .. lenOfDelta-1];

The value of an object with this syntax, whenever it is

retrieved by the management protocol, is always the zero

length string.

Note that the keyOld and keyNew are the localized keys.

Note that it is probably wise that when an SNMP entity sends

a SetRequest to change a key, that it keeps a copy of the old

key until it has confirmed that the key change actually

succeeded.

"

SYNTAX OCTET STRING

-----------------

-- entreprises --

-----------------

sun OBJECT IDENTIFIER ::= { enterprises 42 }

messaging OBJECT IDENTIFIER ::= { sun products(2) 8 }

agents OBJECT IDENTIFIER ::= { messaging 1 }

private-mibs OBJECT IDENTIFIER ::= { messaging 2 }

snmpx400d OBJECT IDENTIFIER ::= { agents 1 }

snmpxapiad OBJECT IDENTIFIER ::= { agents 2 }

snmpx500d OBJECT IDENTIFIER ::= { agents 3 }

snmpimd OBJECT IDENTIFIER ::= { agents 4 }

snmpslapd OBJECT IDENTIFIER ::= { agents 5 }

END