Network Working GroupS. WaldbusserRequest for Comments: 1271Carnegie ellon !ni"ersit# No"ember 1$$1 Remote Network onitoring anagement %nformation &aseStatus of t'is emo ('is memo is an e)tension to t'e SN* %&.('is R+C spe,ifies an %-& standards tra,k proto,ol for t'e %nternet ,ommunit#. and requests dis,ussion and suggestions for impro"ements.*lease refer to t'e ,urrent edition of t'e /%-& 0ffi,ial *roto,ol Standards/ for t'e standardi1ation state and status of t'is proto,ol.2istribution of t'is memo is unlimited.(able of Contents 1. -bstra,t ..............................................2 2. ('e Network anagement +ramework.......................2 3. 0b4e,ts ...............................................2 3.1 +ormat of 2efinitions ................................3 5. 0"er"iew ..............................................3 5.1 Remote Network anagement Goals ......................3 5.2 (e)tual Con"entions ..................................6 5.3 Stru,ture of %& .....................................6 5.3.1 ('e Statisti,s Group ...............................7 5.3.2 ('e 8istor# Group ..................................7 5.3.3 ('e -larm Group ....................................7 5.3.5 ('e 8ost Group .....................................7 5.3.6 ('e 8ost(opN Group .................................7 5.3.7 ('e atri) Group ...................................7 5.3.7 ('e +ilter Group ...................................7 5.3.9 ('e *a,ket Capture Group ...........................7 5.3.$ ('e :"ent Group ....................................7 6. Control of Remote Network onitoring 2e"i,es ..........7 6.1 Resour,e S'aring -mong ultiple anagement Stations ..9 6.2 Row -ddition -mong ultiple anagement Stations ......$ 7. 2efinitions ........................................... 1; 7. -,knowledgments ....................................... 9; 9. Referen,es ............................................ 9; Se,urit# Considerations................................... 91 -ut'orR+C 1271 Remote Network onitoring %& No"ember 1$$11.-bstra,t ('is memo defines a portion of t'e anagement %nformation &ase ?%&@ for use wit' network management proto,ols in (C*A%*Bbased internets. %n parti,ular. it defines ob4e,ts for managing remote network monitoring de"i,es.2.('e Network anagement +ramework ('e %nternetBstandard Network anagement +ramework ,onsists of t'ree ,omponents.('e# are:R+C 1166 w'i,' defines t'e S%. t'e me,'anisms used for des,ribingand naming ob4e,ts for t'e purpose of management.R+C 1212defines a more ,on,ise des,ription me,'anism. w'i,' is w'oll#,onsistent wit' t'e S%.R+C 1167 w'i,' defines %&B%. t'e ,ore set of managed ob4e,ts fort'e %nternet suite of proto,ols.R+C 1213. defines %&B%%. ane"olution of %&B% based on implementation e)perien,e and newoperational requirements.R+C 1167 w'i,' defines t'e SN*. t'e proto,ol used for networka,,ess to managed ob4e,ts. ('e +ramework permits new ob4e,ts to be defined for t'e purpose of e)perimentation and e"aluation.3.0b4e,ts anaged ob4e,ts are a,,essed "ia a "irtual information store. termed t'e anagement %nformation &ase or %&.0b4e,ts in t'e %& are defined using t'e subset of -bstra,t S#nta) Notation 0ne ?-SN.1@ =7> defined in t'e S%.%n parti,ular. ea,' ob4e,t 'as a name. a s#nta). and an en,oding.('e name is an ob4e,t identifier. an administrati"el# assigned name. w'i,' spe,ifies an ob4e,t t#pe.('e ob4e,t t#pe toget'er wit' an ob4e,t instan,e ser"es to uniquel# identif# a spe,ifi, instantiation of t'e ob4e,t.+or 'uman ,on"enien,e. we often use a te)tual string. termed t'e 0&C:C( 2:SCR%*(0R. to also refer to t'e ob4e,t t#pe. ('e s#nta) of an ob4e,t t#pe defines t'e abstra,t data stru,ture ,orresponding to t'at ob4e,t t#pe.('e -SN.1 language is used for t'is purpose.8owe"er. t'e S% =3> purposel# restri,ts t'e -SN.1 ,onstru,ts w'i,' ma# be used.('ese restri,tions are e)pli,itl# made for simpli,it#. ('e en,oding of an ob4e,t t#pe is simpl# 'ow t'at ob4e,t t#peRemote Network onitoring Working Group =*age 2>R+C 1271 Remote Network onitoring %& No"ember 1$$1 is represented using t'e ob4e,t t#pe. sub4e,t to t'e additional requirements imposed b# t'e SN*.3.1.+ormat of 2efinitions Se,tion 7 ,ontains t'e spe,ifi,ation of all ob4e,t t#pes ,ontained in t'is %& module.('e ob4e,t t#pes are defined using t'e ,on"entions defined in t'e S%. as amended b# t'e e)tensions spe,ified in =$.1;>.5.0"er"iew Remote network monitoring de"i,es are instruments t'at e)ist for t'e purpose of managing a network.0ften t'ese remote probes are standBalone de"i,es and de"ote signifi,ant internal resour,es for t'e sole purpose of managing a network.-n organi1ation ma# emplo# man# of t'ese de"i,es. one per network segment. to manage its internet.%n addition. t'ese de"i,es ma# be used for a network management ser"i,e pro"ider to a,,ess a ,lient network. often geograp'i,all# remote. W'ile man# of t'e ob4e,ts in t'is do,ument are suitable for t'e management of an# t#pe of network. t'ere are some w'i,' are spe,ifi, to managing :t'ernet networks.('e design of t'is %& allows similar ob4e,ts to be defined for ot'er network t#pes.%t is intended t'at future "ersions of t'is do,ument will define e)tensions for ot'er network t#pes su,' as (oken Ring and +22%.5.1.Remote Network anagement Goalso 0ffline 0peration('ere are sometimes ,onditions w'en a managementstation will not be in ,onstant ,onta,t wit' itsremote monitoring de"i,es.('is is sometimes b#design in an attempt to lower ,ommuni,ations ,osts?espe,iall# w'en ,ommuni,ating o"er a W-N ordialup link@. or b# a,,ident as network failuresaffe,t t'e ,ommuni,ations between t'e managementstation and t'e probe.+or t'is reason. t'is %& allows a probe to be,onfigured to perform diagnosti,s and to ,olle,tstatisti,s ,ontinuousl#. e"en w'en ,ommuni,ation wit't'e management station ma# not be possible orRemote Network onitoring Working Group =*age 3>R+C 1271 Remote Network onitoring %& No"ember 1$$1effi,ient.('e probe ma# t'en attempt to notif#t'e management station w'en an e),eptional ,onditiono,,urs.('us. e"en in ,ir,umstan,es w'ere,ommuni,ation between management station and probe isnot ,ontinuous. fault. performan,e. and ,onfigurationinformation ma# be ,ontinuousl# a,,umulated and,ommuni,ated to t'e management station ,on"enientl#and effi,ientl#.o *reempti"e onitoringGi"en t'e resour,es a"ailable on t'e monitor. itis potentiall# 'elpful for it ,ontinuousl# to rundiagnosti,s and to log network performan,e.('emonitor is alwa#s a"ailable at t'e onset of an#failure.%t ,an notif# t'e management station of t'efailure and ,an store 'istori,al statisti,alinformation about t'e failure.('is 'istori,alinformation ,an be pla#ed ba,k b# t'e managementstation in an attempt to perform furt'er diagnosisinto t'e ,ause of t'e problem.o *roblem 2ete,tion and Reporting('e monitor ,an be ,onfigured to re,ogni1e,onditions. most notabl# error ,onditions. and,ontinuousl# to ,'e,k for t'em.W'en one of t'ese,onditions o,,urs. t'e e"ent ma# be logged. andmanagement stations ma# be notified in a number ofwa#s.o Dalue -dded 2ata&e,ause a remote monitoring de"i,e represents anetwork resour,e dedi,ated e),lusi"el# to networkmanagement fun,tions. and be,ause it is lo,ateddire,tl# on t'e monitored portion of t'e network. t'eremote network monitoring de"i,e 'as t'e opportunit#to add signifi,ant "alue to t'e data it ,olle,ts.+or instan,e. b# 'ig'lig'ting t'ose 'osts on t'enetwork t'at generate t'e most traffi, or errors. t'eprobe ,an gi"e t'e management station pre,isel# t'einformation it needs to sol"e a ,lass of problems.o ultiple anagers-n organi1ation ma# 'a"e multiple management stationsfor different units of t'e organi1ation. for differentfun,tions ?e.g. engineering and operations@. and in anattempt to pro"ide disaster re,o"er#.&e,auseen"ironments wit' multiple management stations are,ommon. t'e remote network monitoring de"i,e 'as toRemote Network onitoring Working Group =*age 5>R+C 1271 Remote Network onitoring %& No"ember 1$$1deal wit' more t'an own management station.potentiall# using its resour,es ,on,urrentl#.5.2.(e)tual Con"entions (wo new data t#pes are introdu,ed as a te)tual ,on"ention in t'is %& do,ument.('ese te)tual ,on"entions en'an,e t'e readabilit# of t'e spe,ifi,ation and ,an ease ,omparison wit' ot'er spe,ifi,ations if appropriate.%t s'ould be noted t'at t'e introdu,tion of t'e t'ese te)tual ,on"entions 'as no effe,t on eit'er t'e s#nta) nor t'e semanti,s of an# managed ob4e,ts.('e use of t'ese is merel# an artifa,t of t'e e)planator# met'od used.0b4e,ts defined in terms of one of t'ese met'ods are alwa#s en,oded b# means of t'e rules t'at define t'e primiti"e t#pe.8en,e. no ,'anges to t'e S% or t'e SN* are ne,essar# to a,,ommodate t'ese te)tual ,on"entions w'i,' are adopted merel# for t'e ,on"enien,e of readers and writers in pursuit of t'e elusi"e goal of ,lear. ,on,ise. and unambiguous %& do,uments. ('e new data t#pes are: 0wnerString and :ntr#Status.5.3.Stru,ture of %& ('e ob4e,ts are arranged into t'e following groups:B statisti,sB 'istor#B alarmB 'ostB 'ost(opNB matri)B filterB pa,ket ,aptureB e"ent ('ese groups are t'e basi, unit of ,onforman,e.%f a remote monitoring de"i,e implements a group. t'en it must implement all ob4e,ts in t'at group.+or e)ample. a managed agent t'at implements t'e 'ost group must implement t'e 'ostControl(able. t'e 'ost(able and t'e 'ost(ime(able.Remote Network onitoring Working Group =*age 6>R+C 1271 Remote Network onitoring %& No"ember 1$$1 -ll groups in t'is %& are optional.%mplementations of t'is %& must also implement t'e s#stem and interfa,es group of %&B%% =7>. %&B%% ma# also mandate t'e implementation of additional groups. ('ese groups are defined to pro"ide a means of assigning ob4e,t identifiers. and to pro"ide a met'od for managed agents to know w'i,' ob4e,ts t'e# must implement.5.3.1.('e Statisti,s Group ('e statisti,s group ,ontains statisti,s measured b# t'e probe for ea,' monitored interfa,e on t'is de"i,e.('is group ,urrentl# ,onsists of t'e et'erStats(able but in t'e future will ,ontain tables for ot'er media t#pes in,luding (oken Ring and +22%.5.3.2.('e 8istor# Group ('e 'istor# group re,ords periodi, statisti,al samples from a network and stores t'em for later retrie"al.('is group ,urrentl# ,onsists of t'e 'istor#Control(able and t'e et'er8istor#(able.%n future "ersions of t'e %&. t'is group ma# ,ontain tables for ot'er media t#pes in,luding (oken Ring and +22%.5.3.3.('e -larm Group ('e alarm group periodi,all# takes statisti,al samples from "ariables in t'e probe and ,ompares t'em to pre"iousl# ,onfigured t'res'olds. %f t'e monitored "ariable ,rosses a t'res'old. an e"ent is generated. - '#steresis me,'anism is implemented to limit t'e generation of alarms.('is group ,onsists of t'e alarm(able and requires t'e implementation of t'e e"ent group.5.3.5.('e 8ost Group ('e 'ost group ,ontains statisti,s asso,iated wit' ea,' 'ost dis,o"ered on t'e network.('is group dis,o"ers 'osts on t'e network b# keeping a list of sour,e and destination -C -ddresses seen in good pa,kets promis,uousl# re,ei"ed from t'e network.('is group ,onsists of t'e 'ostControl(able. t'e 'ost(able. and t'e 'ost(ime(able.5.3.6.('e 8ost(opN Group ('e 'ost(opN group is used to prepare reports t'at des,ribe t'e 'osts t'at top a list ordered b# one of t'eir statisti,s.('e a"ailable statisti,s are samples of one of t'eir base statisti,s o"er an inter"al spe,ified b# t'e management station.('us. t'ese statisti,s are rate based.('e management station also sele,ts 'ow man# su,'Remote Network onitoring Working Group =*age 7>R+C 1271 Remote Network onitoring %& No"ember 1$$1 'osts are reported.('is group ,onsists of t'e 'ost(opNControl(able and t'e 'ost(opN(able. and requires t'e implementation of t'e 'ost group.5.3.7.('e atri) Group ('e matri) group stores statisti,s for ,on"ersations between sets of two addresses.-s t'e de"i,e dete,ts a new ,on"ersation. it ,reates a new entr# in its tables.('is group ,onsists of t'e matri)Control(able. t'e matri)S2(able and t'e matri)2S(able.5.3.7.('e +ilter Group ('e filter group allows pa,kets to be mat,'ed b# a filter equation. ('ese mat,'ed pa,kets form a data stream t'at ma# be ,aptured or ma# generate e"ents.('is group ,onsists of t'e filter(able and t'e ,'annel(able.5.3.9.('e *a,ket Capture Group ('e *a,ket Capture group allows pa,kets to be ,aptured after t'e# flow t'roug' a ,'annel.('is group ,onsists of t'e bufferControl(able and t'e ,apture&uffer(able. and requires t'e implementation of t'e filter group.5.3.$.('e :"ent Group ('e e"ent group ,ontrols t'e generation and notifi,ation of e"ents from t'is de"i,e.('is group ,onsists of t'e e"ent(able and t'e log(able.6.Control of Remote Network onitoring 2e"i,es 2ue to t'e ,omple) nature of t'e a"ailable fun,tions in t'ese de"i,es. t'e fun,tions often need user ,onfiguration.%n man# ,ases. t'e fun,tion requires parameters to be set up for a data ,olle,tion operation.('e operation ,an pro,eed onl# after t'ese parameters are full# set up. an# fun,tional groups in t'is %& 'a"e one or more tables in w'i,' to set up ,ontrol parameters. and one or more data tables in w'i,' to pla,e t'e results of t'e operation.('e ,ontrol tables are t#pi,all# readBwrite in nature. w'ile t'e data tables are t#pi,all# readBonl#. &e,ause t'e parameters in t'e ,ontrol table often des,ribe resulting data in t'e data table. man# of t'e parameters ,an be modified onl# w'en t'e ,ontrol entr# is in"alid.('us. t'e met'od for modif#ing t'ese parameters is to in"alidate t'e ,ontrol entr#. ,ausing its deletion and t'e deletion of an# asso,iated data entries. and t'enRemote Network onitoring Working Group =*age 7>R+C 1271 Remote Network onitoring %& No"ember 1$$1 ,reate a new ,ontrol entr# wit' t'e proper parameters.2eleting t'e ,ontrol entr# also gi"es a ,on"enient met'od for re,laiming t'e resour,es used b# t'e asso,iated data. Some ob4e,ts in t'is %& pro"ide a me,'anism to e)e,ute an a,tion on t'e remote monitoring de"i,e.('ese ob4e,ts ma# e)e,ute an a,tion as a result of a ,'ange in t'e state of t'e ob4e,t.+or t'ose ob4e,ts in t'is %&. a request to set an ob4e,t to t'e same "alue as it ,urrentl# 'olds would t'us ,ause no a,tion to o,,ur. (o fa,ilitate ,ontrol b# multiple managers. resour,es 'a"e to be s'ared among t'e managers.('ese resour,es are t#pi,all# t'e memor# and ,omputation resour,es t'at a fun,tion requires.6.1.Resour,e S'aring -mong ultiple anagement Stations W'en multiple management stations wis' to use fun,tions t'at ,ompete for a finite amount of resour,es on a de"i,e. a met'od to fa,ilitate t'is s'aring of resour,es is required.*otential ,onfli,ts in,lude:o (wo management stations wis' to simultaneousl# useresour,es t'at toget'er would e),eed t'e ,apabilit# oft'e de"i,e.o - management station uses a signifi,ant amount ofresour,es for a long period of time.o - management station uses resour,es and t'en ,ras'es.forgetting to free t'e resour,es so ot'ers ma#use t'em. - me,'anism is pro"ided for ea,' management station initiated fun,tion in t'is %& to a"oid t'ese ,onfli,ts and to 'elp resol"e t'em w'en t'e# o,,ur.:a,' fun,tion 'as a label identif#ing t'e initiator ?owner@ of t'e fun,tion.('is label is set b# t'e initiator to pro"ide for t'e following possibilities:o - management station ma# re,ogni1e resour,es it ownsand no longer needs.o - network operator ,an find t'e management station t'atowns t'e resour,e and negotiate for it to be freed.o - network operator ma# de,ide to unilaterall# freeresour,es anot'er network operator 'as reser"ed.o !pon initiali1ation. a management station ma# re,ogni1eresour,es it 'ad reser"ed in t'e past.Wit' t'isRemote Network onitoring Working Group =*age 9>R+C 1271 Remote Network onitoring %& No"ember 1$$1information it ma# free t'e resour,es if it no longerneeds t'em. anagement stations and probes s'ould support an# format of t'e owner string di,tated b# t'e lo,al poli,# of t'e organi1ation.%t is suggested t'at t'is name ,ontain one or more of t'e following: %* address. management station name. network managerR+C 1271 Remote Network onitoring %& No"ember 1$$1 badDalue error to be emitted.('us. w'ere"er possible. t'e implementor s'ould ,'oose t'e former as it will pro"ide more information to t'e management station. - problem ,an arise w'en multiple management stations attempt to set ,onfiguration information simultaneousl# using SN*.W'en t'is in"ol"es t'e addition of a new ,on,eptual row in t'e same ,ontrol table. t'e managers ma# ,ollide. attempting to ,reate t'e same entr#. (o guard against t'ese ,ollisions. ea,' su,' ,ontrol entr# ,ontains a status ob4e,t wit' spe,ial semanti,s t'at 'elp to arbitrate among t'e managers.%f an attempt is made wit' t'e row addition me,'anism to ,reate su,' a status ob4e,t and t'at ob4e,t alread# e)ists. an error is returned.W'en more t'an one manager simultaneousl# attempts to ,reate t'e same ,on,eptual row. onl# t'e first will su,,eed.('e ot'ers will re,ei"e an error.7.2efinitionsR+C1271B%& 2:+%N%(%0NS ::E &:G%N%*0R(SCounter+R0 R+C1166BS%2ispla#String+R0 R+C1169B%&mibB2+R0 R+C1213B%&0&C:C(B(F*:+R0 R+CB1212GBB('is %& module uses t'e e)tended 0&C:C(B(F*: ma,ro asBBdefined in =$>.BBRemote Network onitoring %&rmon0&C:C( %2:N(%+%:R ::E H mibB2 17 IBB te)tual ,on"entions0wnerString ::E 2ispla#StringBB ('is data t#pe is used to model an administrati"el#BB assigned name of t'e owner of a resour,e. ('isBB information is taken from t'e ND( -SC%% ,'ara,ter set.BB %t is suggested t'at t'is name ,ontain one or moreBB of t'e following:BB %* address. management station name. network managerR+C 1271 Remote Network onitoring %& No"ember 1$$1::E H et'erStats:ntr# 15 Iet'erStats*kts76to1270,tets 0&C:C(B(F*:SFN(-K Counter-CC:SS readBonl#S(-(!S mandator#2:SCR%*(%0N/('e total number of pa,kets ?in,luding errorpa,kets@ re,ei"ed t'at were between76 and 127 o,tets in lengt' in,lusi"e?e),luding framing bits but in,luding +CS o,tets@./::E H et'erStats:ntr# 16 Iet'erStats*kts129to2660,tets 0&C:C(B(F*:SFN(-K Counter-CC:SS readBonl#S(-(!S mandator#2:SCR%*(%0N/('e total number of pa,kets ?in,luding errorpa,kets@ re,ei"ed t'at were between129 and 266 o,tets in lengt' in,lusi"e?e),luding framing bits but in,luding +CS o,tets@./::E H et'erStats:ntr# 17 Iet'erStats*kts267to6110,tets 0&C:C(B(F*:SFN(-K Counter-CC:SS readBonl#S(-(!S mandator#2:SCR%*(%0N/('e total number of pa,kets ?in,luding errorpa,kets@ re,ei"ed t'at were between267 and 611 o,tets in lengt' in,lusi"e?e),luding framing bits but in,luding +CS o,tets@./::E H et'erStats:ntr# 17 Iet'erStats*kts612to1;230,tets 0&C:C(B(F*:SFN(-K Counter-CC:SS readBonl#S(-(!S mandator#2:SCR%*(%0N/('e total number of pa,kets ?in,luding errorpa,kets@ re,ei"ed t'at were between612 and 1;23 o,tets in lengt' in,lusi"e?e),luding framing bits but in,luding +CS o,tets@./::E H et'erStats:ntr# 19 IRemote Network onitoring Working Group=*age 17>R+C 1271 Remote Network onitoring %& No"ember 1$$1et'erStats*kts1;25to16190,tets 0&C:C(B(F*:SFN(-K Counter-CC:SS readBonl#S(-(!S mandator#2:SCR%*(%0N/('e total number of pa,kets ?in,luding errorpa,kets@ re,ei"ed t'at were between1;25 and 1619 o,tets in lengt' in,lusi"e?e),luding framing bits but in,luding +CS o,tets@./::E H et'erStats:ntr# 1$ Iet'erStats0wner 0&C:C(B(F*:SFN(-K 0wnerString-CC:SS readBwriteS(-(!S mandator#2:SCR%*(%0N/('e entit# t'at ,onfigured t'is entr# and ist'erefore using t'e resour,es assigned to it./::E H et'erStats:ntr# 2; Iet'erStatsStatus 0&C:C(B(F*:SFN(-K :ntr#Status-CC:SS readBwriteS(-(!S mandator#2:SCR%*(%0N/('e status of t'is et'erStats entr#./::E H et'erStats:ntr# 21 IBB ('e 8istor# GroupBB %mplementation of t'e 8istor# group is optional.BBBB ('e 'istor# group re,ords periodi, statisti,al samples fromBB a network and stores t'em for later retrie"al.('eBB 'istor#Control table stores ,onfiguration entries t'at ea,'BB define an interfa,e. polling period. and ot'er parameters.BB 0n,e samples are taken. t'eir data is stored in an entr#BB in a mediaBspe,ifi, table.:a,' su,' entr# defines oneBB sample. and is asso,iated wit' t'e 'istor#Control:ntr# t'atBB ,aused t'e sample to be taken.Currentl# t'e onl# mediaBBB spe,ifi, table defined is t'e et'er8istor#(able. forBB :t'ernet networks.BBBB %f t'e probe keeps tra,k of t'e time of da#. it s'ouldBB start t'e first sample of t'e 'istor# at a time su,' t'atBB w'en t'e ne)t 'our of t'e da# begins. a sample isBB started at t'at instant.('is tends to make moreRemote Network onitoring Working Group=*age 19>R+C 1271 Remote Network onitoring %& No"ember 1$$1BB userBfriendl# reports. and enables ,omparison of reportsBB from different probes t'at 'a"e relati"el# a,,urate timeBB of da#.BBBB ('e monitor is en,ouraged to add two 'istor# ,ontrol entriesBB per monitored interfa,e upon initiali1ation t'at des,ribeBB a s'ort term and a long term polling period.SuggestedBB parameters are 3; se,onds for t'e s'ort term pollingBB period and 3; minutes for t'e long term period.'istor#Control(able 0&C:C(B(F*:SFN(-K S:L!:NC: 0+ 8istor#Control:ntr#-CC:SS notBa,,essibleS(-(!S mandator#2:SCR%*(%0N/- list of 'istor# ,ontrol entries./::E H 'istor# 1 I'istor#Control:ntr# 0&C:C(B(F*:SFN(-K 8istor#Control:ntr#-CC:SS notBa,,essibleS(-(!S mandator#2:SCR%*(%0N/- list of parameters t'at set up a periodi,sampling of statisti,s./%N2:K H 'istor#Control%nde) I::E H 'istor#Control(able 1 I8istor#Control:ntr# ::E S:L!:NC: H'istor#Control%nde) %N(:G:R ?1..76636@.'istor#Control2ataSour,e0&C:C( %2:N(%+%:R.'istor#Control&u,ketsRequested%N(:G:R ?1..76636@.'istor#Control&u,ketsGranted%N(:G:R ?1..76636@.'istor#Control%nter"al%N(:G:R ?1..37;;@.'istor#Control0wner 0wnerString.'istor#ControlStatus%N(:G:RI'istor#Control%nde) 0&C:C(B(F*:SFN(-K %N(:G:R ?1..76636@-CC:SS readBonl#S(-(!S mandator#2:SCR%*(%0N/-n inde) t'at uniquel# identifies an entr# in t'e'istor#Control table.:a,' su,' entr# defines aset of samples at a parti,ular inter"al for aninterfa,e on t'e de"i,e./::E H 'istor#Control:ntr# 1 IRemote Network onitoring Working Group=*age 1$>R+C 1271 Remote Network onitoring %& No"ember 1$$1'istor#Control2ataSour,e 0&C:C(B(F*:SFN(-K 0&C:C( %2:N(%+%:R-CC:SS readBwriteS(-(!S mandator#2:SCR%*(%0N/('is ob4e,t identifies t'e sour,e of t'e data forw'i,' 'istori,al data was ,olle,ted andpla,ed in a mediaBspe,ifi, table on be'alf of t'is'istor#Control:ntr#.('is sour,e ,an be an#interfa,e on t'is de"i,e.%n order to identif#a parti,ular interfa,e. t'is ob4e,t s'all identif#t'e instan,e of t'e if%nde) ob4e,t. definedin =5.7>. for t'e desired interfa,e.+or e)ample.if an entr# were to re,ei"e data from interfa,e M1.t'is ob4e,t would be set to if%nde).1.('e statisti,s in t'is group refle,t all pa,ketson t'e lo,al network segment atta,'ed to t'eidentified interfa,e.('is ob4e,t ma# not be modified if t'e asso,iated'istor#ControlStatus ob4e,t is equal to "alid?1@./::E H 'istor#Control:ntr# 2 I'istor#Control&u,ketsRequested 0&C:C(B(F*:SFN(-K %N(:G:R ?1..76636@-CC:SS readBwriteS(-(!S mandator#2:SCR%*(%0N/('e requested number of dis,rete time inter"also"er w'i,' data is to be sa"ed in t'e part of t'emediaBspe,ifi, table asso,iated wit' t'is'istor#Control entr#.W'en t'is ob4e,t is ,reated or modified. t'e probes'ould set 'istor#Control&u,ketsGranted as ,losel# tot'is ob4e,t as is possible for t'e parti,ular probeimplementation and a"ailable resour,es./2:+D-N H 6; I::E H 'istor#Control:ntr# 3 I'istor#Control&u,ketsGranted 0&C:C(B(F*:SFN(-K %N(:G:R ?1..76636@-CC:SS readBonl#S(-(!S mandator#2:SCR%*(%0N/('e number of dis,rete sampling inter"also"er w'i,' data s'all be sa"ed in t'e part ofRemote Network onitoring Working Group=*age 2;>R+C 1271 Remote Network onitoring %& No"ember 1$$1t'e mediaBspe,ifi, table asso,iated wit' t'is'istor#Control entr#.W'en t'e asso,iated 'istor#Control&u,ketsRequestedob4e,t is ,reated or modified. t'e probes'ould set t'is ob4e,t as ,losel# to t'e requested"alue as is possible for t'e parti,ularprobe implementation and a"ailable resour,es.('eprobe must not lower t'is "alue e),ept as a resultof a modifi,ation to t'e asso,iated'istor#Control&u,ketsRequested ob4e,t.('ere will be times w'en t'e a,tual number ofbu,kets asso,iated wit' t'is entr# is less t'ant'e "alue of t'is ob4e,t.%n t'is ,ase. at t'eend of ea,' sampling inter"al. a new bu,ket willbe added to t'e mediaBspe,ifi, table.W'en t'e number of bu,kets rea,'es t'e "alue oft'is ob4e,t and a new bu,ket is to be added to t'emediaBspe,ifi, table. t'e oldest bu,ket asso,iatedwit' t'is 'istor#Control:ntr# s'all be deleted b#t'e agent so t'at t'e new bu,ket ,an be added.W'en t'e "alue of t'is ob4e,t ,'anges to a "alue lesst'an t'e ,urrent "alue. entries are deletedfrom t'e mediaBspe,ifi, table asso,iated wit' t'is'istor#Control:ntr#.:noug' of t'e oldest of t'eseentries s'all be deleted b# t'e agent so t'at t'eirnumber remains less t'an or equal to t'e new "alue oft'is ob4e,t.W'en t'e "alue of t'is ob4e,t ,'anges to a "aluegreater t'an t'e ,urrent "alue. t'e number ofasso,iated mediaBspe,ifi, entries ma# be allowedto grow./::E H 'istor#Control:ntr# 5 I'istor#Control%nter"al 0&C:C(B(F*:SFN(-K %N(:G:R ?1..37;;@-CC:SS readBwriteS(-(!S mandator#2:SCR%*(%0N/('e inter"al in se,onds o"er w'i,' t'e data issampled for ea,' bu,ket in t'e part of t'emediaBspe,ifi, table asso,iated wit' t'is'istor#Control entr#.('is inter"al ,anbe set to an# number of se,onds between 1 andRemote Network onitoring Working Group=*age 21>R+C 1271 Remote Network onitoring %& No"ember 1$$137;; ?1 'our@.&e,ause t'e ,ounters in a bu,ket ma# o"erflow at t'eirma)imum "alue wit' no indi,ation. a prudent managerwill take into a,,ount t'e possibilit# of o"erflowin an# of t'e asso,iated ,ounters.%t is importantto ,onsider t'e minimum time in w'i,' an# ,ounter,ould o"erflow on a parti,ular media t#pe and sett'e 'istor#Control%nter"al ob4e,t to a "alue lesst'an t'is inter"al.('is is t#pi,all# mostimportant for t'e R+C 1271 Remote Network onitoring %& No"ember 1$$1et'er8istor#!ndersi1e*kts 0&C:C(B(F*:SFN(-K Counter-CC:SS readBonl#S(-(!S mandator#2:SCR%*(%0N/('e number of pa,kets re,ei"ed during t'isinter"al t'at were less t'an 75 o,tets long?e),luding framing bits but in,luding +CSo,tets@ and were ot'erwise well formed./::E H et'er8istor#:ntr# 1; Iet'er8istor#0"ersi1e*kts 0&C:C(B(F*:SFN(-K Counter-CC:SS readBonl#S(-(!S mandator#2:SCR%*(%0N/('e number of pa,kets re,ei"ed during t'isinter"al t'at were longer t'an 1619 o,tets?e),luding framing bits but in,luding +CSo,tets@ but were ot'erwise well formed./::E H et'er8istor#:ntr# 11 Iet'er8istor#+ragments 0&C:C(B(F*:SFN(-K Counter-CC:SS readBonl#S(-(!S mandator#2:SCR%*(%0N/('e total number of pa,kets re,ei"ed during t'issampling inter"al t'at were not an integralnumber of o,tets in lengt' or t'at'ad a bad +rame C'e,k Sequen,e ?+CS@. andwere less t'an 75 o,tets in lengt' ?e),ludingframing bits but in,luding +CS o,tets@./::E H et'er8istor#:ntr# 12 Iet'er8istor#Cabbers 0&C:C(B(F*:SFN(-K Counter-CC:SS readBonl#S(-(!S mandator#2:SCR%*(%0N/('e number of pa,kets re,ei"ed during t'isinter"al t'at were longer t'an 1619 o,tets?e),luding framing bits but in,luding +CS o,tets@.and were not an integral number of o,tets inlengt' or 'ad a bad +rame C'e,k Sequen,e ?+CS@./::E H et'er8istor#:ntr# 13 IRemote Network onitoring Working Group=*age 27>R+C 1271 Remote Network onitoring %& No"ember 1$$1et'er8istor#Collisions 0&C:C(B(F*:SFN(-K Counter-CC:SS readBonl#S(-(!S mandator#2:SCR%*(%0N/('e best estimate of t'e total number of ,ollisionson t'is :t'ernet segment during t'is inter"al./::E H et'er8istor#:ntr# 15 Iet'er8istor#!tili1ation 0&C:C(B(F*:SFN(-K %N(:G:R ?;..1;;;;@-CC:SS readBonl#S(-(!S mandator#2:SCR%*(%0N/('e best estimate of t'e mean p'#si,al la#ernetwork utili1ation on t'is interfa,e during t'isinter"al. in 'undredt's of a per,ent./::E H et'er8istor#:ntr# 16 IBB ('e -larm GroupBB %mplementation of t'e -larm group is optional.BBBB ('e -larm Group requires t'e implementation of t'e :"entBB group.BBBB ('e -larm group periodi,all# takes statisti,al samples fromBB "ariables in t'e probe and ,ompares t'em to t'res'oldsBB t'at 'a"e been ,onfigured.('e alarm table storesBB ,onfiguration entries t'at ea,' define a "ariable.BB polling period. and t'res'old parameters.%f a sample isBB found to ,ross t'e t'res'old "alues. an e"ent isBB generated.0nl# "ariables t'at resol"e to an -SN.1BB primiti"e t#pe of %N(:G:R ?%N(:G:R. Counter.BB Gauge. or (ime(i,ks@ ma# be monitored in t'is wa#.BBBB ('is fun,tion 'as a '#steresis me,'anism to limit t'eBB generation of e"ents.('is me,'anism generates one e"entBB as a t'res'old is ,rossed in t'e appropriate dire,tion.BB No more e"ents are generated for t'at t'res'old until t'eBB opposite t'res'old is ,rossed.BBBB %n t'e ,ase of a sampling a deltaDalue. a probe ma#BB implement t'is me,'anism wit' more pre,ision if it takesBB a delta sample twi,e per period. ea,' time ,omparing t'eBB sum of t'e latest two samples to t'e t'res'old.('isBB allows t'e dete,tion of t'res'old ,rossingsRemote Network onitoring Working Group=*age 27>R+C 1271 Remote Network onitoring %& No"ember 1$$1BB t'at span t'e sampling boundar#.Note t'at t'is does notBB require an# spe,ial ,onfiguration of t'e t'res'old "alue.BB %t is suggested t'at probes implement t'is more pre,iseBB algorit'm.alarm(able 0&C:C(B(F*:SFN(-K S:L!:NC: 0+ -larm:ntr#-CC:SS notBa,,essibleS(-(!S mandator#2:SCR%*(%0N/- list of alarm entries./::E H alarm 1 Ialarm:ntr# 0&C:C(B(F*:SFN(-K -larm:ntr#-CC:SS notBa,,essibleS(-(!S mandator#2:SCR%*(%0N/- list of parameters t'at set up a periodi, ,'e,kingfor alarm ,onditions./%N2:K H alarm%nde) I::E H alarm(able 1 I-larm:ntr# ::E S:L!:NC: Halarm%nde)%N(:G:R ?1..76636@.alarm%nter"al %N(:G:R.alarmDariable 0&C:C( %2:N(%+%:R.alarmSample(#pe %N(:G:R.alarmDalue%N(:G:R.alarmStartup-larm %N(:G:R.alarmRising('res'old%N(:G:R.alarm+alling('res'old %N(:G:R.alarmRising:"ent%nde) %N(:G:R ?1..76636@.alarm+alling:"ent%nde)%N(:G:R ?1..76636@.alarm0wner0wnerString.alarmStatus %N(:G:RIalarm%nde) 0&C:C(B(F*:SFN(-K %N(:G:R ?1..76636@-CC:SS readBonl#S(-(!S mandator#2:SCR%*(%0N/-n inde) t'at uniquel# identifies an entr# in t'ealarm table.:a,' su,' entr# defines adiagnosti, sample at a parti,ular inter"alfor an ob4e,t on t'e de"i,e./::E H alarm:ntr# 1 IRemote Network onitoring Working Group=*age 29>R+C 1271 Remote Network onitoring %& No"ember 1$$1alarm%nter"al 0&C:C(B(F*:SFN(-K %N(:G:R-CC:SS readBwriteS(-(!S mandator#2:SCR%*(%0N/('e inter"al in se,onds o"er w'i,' t'e data issampled and ,ompared wit' t'e rising and fallingt'res'olds.W'en setting t'is "ariable. ,ares'ould be gi"en to ensure t'at t'e "ariable beingmonitored will not e),eed 2O31 B 1 and rollo"er t'e alarmDalue ob4e,t during t'e inter"al.('is ob4e,t ma# not be modified if t'e asso,iatedalarmStatus ob4e,t is equal to "alid?1@./::E H alarm:ntr# 2 IalarmDariable 0&C:C(B(F*:SFN(-K 0&C:C( %2:N(%+%:R-CC:SS readBwriteS(-(!S mandator#2:SCR%*(%0N/('e ob4e,t identifier of t'e parti,ular "ariable tobe sampled.0nl# "ariables t'at resol"e to an -SN.1primiti"e t#pe of %N(:G:R ?%N(:G:R. Counter. Gauge.or (ime(i,ks@ ma# be sampled.&e,ause SN* a,,ess ,ontrol is arti,ulated entirel#in terms of t'e ,ontents of %& "iews. no a,,ess,ontrol me,'anism e)ists t'at ,an restri,t t'e "alue oft'is ob4e,t to identif# onl# t'ose ob4e,ts t'at e)istin a parti,ular %& "iew.&e,ause t'ere is t'us noa,,eptable means of restri,ting t'e read a,,ess t'at,ould be obtained t'roug' t'e alarm me,'anism. t'eprobe must onl# grant write a,,ess to t'is ob4e,t int'ose "iews t'at 'a"e read a,,ess to all ob4e,ts ont'e probe.2uring a set operation. if t'e supplied "ariablename is not a"ailable in t'e sele,ted %& "iew. abadDalue error must be returned.%f at an# timet'e "ariable name of an establis'ed alarm:ntr# isno longer a"ailable in t'e sele,ted %& "iew. t'eprobe must ,'ange t'e status of t'is alarm:ntr#to in"alid?5@.('is ob4e,t ma# not be modified if t'e asso,iatedalarmStatus ob4e,t is equal to "alid?1@./::E H alarm:ntr# 3 IRemote Network onitoring Working Group=*age 2$>R+C 1271 Remote Network onitoring %& No"ember 1$$1alarmSample(#pe 0&C:C(B(F*:SFN(-K %N(:G:R HabsoluteDalue?1@.deltaDalue?2@I-CC:SS readBwriteS(-(!S mandator#2:SCR%*(%0N/('e met'od of sampling t'e sele,ted "ariable and,al,ulating t'e "alue to be ,ompared against t'et'res'olds.%f t'e "alue of t'is ob4e,t isabsoluteDalue?1@. t'e "alue of t'e sele,ted "ariablewill be ,ompared dire,tl# wit' t'e t'res'olds at t'eend of t'e sampling inter"al.%f t'e "alue of t'isob4e,t is deltaDalue?2@. t'e "alue of t'e sele,ted"ariable at t'e last sample will be subtra,ted fromt'e ,urrent "alue. and t'e differen,e ,ompared wit't'e t'res'olds.('is ob4e,t ma# not be modified if t'e asso,iatedalarmStatus ob4e,t is equal to "alid?1@./::E H alarm:ntr# 5 IalarmDalue 0&C:C(B(F*:SFN(-K %N(:G:R-CC:SS readBonl#S(-(!S mandator#2:SCR%*(%0N/('e "alue of t'e statisti, during t'e last samplingperiod.('e "alue during t'e ,urrent sampling periodis not made a"ailable until t'e period is ,ompleted./::E H alarm:ntr# 6 IalarmStartup-larm 0&C:C(B(F*:SFN(-K %N(:G:R Hrising-larm?1@.falling-larm?2@.rising0r+alling-larm?3@I-CC:SS readBwriteS(-(!S mandator#2:SCR%*(%0N/('e alarm t'at ma# be sent w'en t'is entr# is firstset to "alid.%f t'e first sample after t'is entr#be,omes "alid is greater t'an or equal to t'erising('res'old and alarmStartup-larm is equal torising-larm?1@ or rising0r+alling-larm?3@. t'en asingle rising alarm will be generated.%f t'e firstRemote Network onitoring Working Group=*age 3;>R+C 1271 Remote Network onitoring %& No"ember 1$$1sample after t'is entr# be,omes "alid is less t'anor equal to t'e falling('res'old andalarmStartup-larm is equal to falling-larm?2@ orrising0r+alling-larm?3@. t'en a single fallingalarm will be generated.('is ob4e,t ma# not be modified if t'e asso,iatedalarmStatus ob4e,t is equal to "alid?1@./::E H alarm:ntr# 7 IalarmRising('res'old 0&C:C(B(F*:SFN(-K %N(:G:R-CC:SS readBwriteS(-(!S mandator#2:SCR%*(%0N/- t'res'old for t'e sampled statisti,.W'en t'e,urrent sampled "alue is greater t'an or equal tot'is t'res'old. and t'e "alue at t'e last samplinginter"al was less t'an t'is t'res'old. a singlee"ent will be generated.- single e"ent will also be generated if t'e firstsample after t'is entr# be,omes "alid is greatert'an or equal to t'is t'res'old and t'e asso,iatedalarmStartup-larm is equal to rising-larm?1@ orrising0r+alling-larm?3@.-fter a rising e"ent is generated. anot'er su,' e"entwill not be generated until t'e sampled "aluefalls below t'is t'res'old and rea,'es t'ealarm+alling('res'old.('is ob4e,t ma# not be modified if t'e asso,iatedalarmStatus ob4e,t is equal to "alid?1@./::E H alarm:ntr# 7 Ialarm+alling('res'old 0&C:C(B(F*:SFN(-K %N(:G:R-CC:SS readBwriteS(-(!S mandator#2:SCR%*(%0N/- t'res'old for t'e sampled statisti,.W'en t'e,urrent sampled "alue is less t'an or equal tot'is t'res'old. and t'e "alue at t'e last samplinginter"al was greater t'an t'is t'res'old. a singlee"ent will be generated.- single e"ent will also be generated if t'e firstsample after t'is entr# be,omes "alid is less t'an orequal to t'is t'res'old and t'e asso,iatedRemote Network onitoring Working Group=*age 31>R+C 1271 Remote Network onitoring %& No"ember 1$$1alarmStartup-larm is equal to falling-larm?2@ orrising0r+alling-larm?3@.-fter a falling e"ent is generated. anot'er su,' e"entwill not be generated until t'e sampled "aluerises abo"e t'is t'res'old and rea,'es t'ealarmRising('res'old.('is ob4e,t ma# not be modified if t'e asso,iatedalarmStatus ob4e,t is equal to "alid?1@./::E H alarm:ntr# 9 IalarmRising:"ent%nde) 0&C:C(B(F*:SFN(-K %N(:G:R ?;..76636@-CC:SS readBwriteS(-(!S mandator#2:SCR%*(%0N/('e inde) of t'e e"ent:ntr# t'at isused w'en a rising t'res'old is ,rossed.('ee"ent:ntr# identified b# a parti,ular "alue oft'is inde) is t'e same as identified b# t'e same "alueof t'e e"ent%nde) ob4e,t.%f t'ere is no,orresponding entr# in t'e e"ent(able. t'enno asso,iation e)ists.%n parti,ular. if t'is "alueis 1ero. no asso,iated e"ent will be generated. as1ero is not a "alid e"ent inde).('is ob4e,t ma# not be modified if t'e asso,iatedalarmStatus ob4e,t is equal to "alid?1@./::E H alarm:ntr# $ Ialarm+alling:"ent%nde) 0&C:C(B(F*:SFN(-K %N(:G:R ?;..76636@-CC:SS readBwriteS(-(!S mandator#2:SCR%*(%0N/('e inde) of t'e e"ent:ntr# t'at isused w'en a falling t'res'old is ,rossed.('ee"ent:ntr# identified b# a parti,ular "alue oft'is inde) is t'e same as identified b# t'e same "alueof t'e e"ent%nde) ob4e,t.%f t'ere is no,orresponding entr# in t'e e"ent(able. t'enno asso,iation e)ists.%n parti,ular. if t'is "alueis 1ero. no asso,iated e"ent will be generated. as1ero is not a "alid e"ent inde).('is ob4e,t ma# not be modified if t'e asso,iatedalarmStatus ob4e,t is equal to "alid?1@./Remote Network onitoring Working Group=*age 32>R+C 1271 Remote Network onitoring %& No"ember 1$$1::E H alarm:ntr# 1; Ialarm0wner 0&C:C(B(F*:SFN(-K 0wnerString-CC:SS readBwriteS(-(!S mandator#2:SCR%*(%0N/('e entit# t'at ,onfigured t'is entr# and ist'erefore using t'e resour,es assigned to it./::E H alarm:ntr# 11 IalarmStatus 0&C:C(B(F*:SFN(-K :ntr#Status-CC:SS readBwriteS(-(!S mandator#2:SCR%*(%0N/('e status of t'is alarm entr#./::E H alarm:ntr# 12 IBB ('e 8ost GroupBB %mplementation of t'e 8ost group is optional.BBBB ('e 'ost group dis,o"ers new 'osts on t'e network b#BB keeping a list of sour,e and destination -C -ddresses seenBB in good pa,kets.+or ea,' of t'ese addresses. t'e 'ostBB group keeps a set of statisti,s.('e 'ostControl(ableBB ,ontrols w'i,' interfa,es t'is fun,tion is performed on.BB and ,ontains some information about t'e pro,ess.0nBB be'alf of ea,' 'ostControl:ntr#. data is ,olle,ted on anBB interfa,e and pla,ed bot' t'e 'ost(able and t'eBB 'ost(ime(able.%f t'e monitoring de"i,e finds itselfBB s'ort of resour,es. it ma# delete entries as needed.%tBB is suggested t'at t'e de"i,e delete t'e least re,entl#BB used entries first.BB ('e 'ost(able ,ontains entries for ea,' addressBB dis,o"ered on a parti,ular interfa,e.:a,' entr#BB ,ontains statisti,al data about t'at 'ost.('is tableBB is inde)ed b# t'e -C address of t'e 'ost. t'roug'BB w'i,' a random a,,ess ma# be a,'ie"ed.BB ('e 'ost(ime(able ,ontains data in t'e same format as t'eBB 'ost(able. and must ,ontain t'e same set of 'osts. but isBB inde)ed using 'ost(imeCreation0rder rat'er t'an 'ost-ddress.BB ('e 'ost(imeCreation0rder is an integer w'i,' refle,tsBB t'e relati"e order in w'i,' a parti,ular entr# wasRemote Network onitoring Working Group=*age 33>R+C 1271 Remote Network onitoring %& No"ember 1$$1BB dis,o"ered and t'us inserted into t'e table.-s t'isBB order. and t'us inde). is among t'ose entries ,urrentl#BB in t'e table. t'e inde) for a parti,ular entr# ma# ,'angeBB if an ?earlier@ entr# is deleted.('us t'e asso,iationBB between 'ost(imeCreation0rder and 'ost(ime:ntr# ma# beBB broken at an# time.BB ('e 'ost(ime(able 'as two important uses.('e first is t'eBB fast download of t'is potentiall# large table.&e,ause t'eBB inde) of t'is table runs from 1 to t'e si1e of t'e table.BB in,lusi"e. its "alues are predi,table.('is allows "er#BB effi,ient pa,king of "ariables into SN* *2!R+C 1271 Remote Network onitoring %& No"ember 1$$1'ostControl:ntr# 0&C:C(B(F*:SFN(-K 8ostControl:ntr#-CC:SS notBa,,essibleS(-(!S mandator#2:SCR%*(%0N/- list of parameters t'at set up t'e dis,o"er# of'osts on a parti,ular interfa,e and t'e ,olle,tionof statisti,s about t'ese 'osts./%N2:K H 'ostControl%nde) I::E H 'ostControl(able 1 I8ostControl:ntr# ::E S:L!:NC: H'ostControl%nde)%N(:G:R ?1..76636@.'ostControl2ataSour,e 0&C:C( %2:N(%+%:R.'ostControl(ableSi1e%N(:G:R.'ostControlNast2elete(ime (ime(i,ks.'ostControl0wner0wnerString.'ostControlStatus %N(:G:RI'ostControl%nde) 0&C:C(B(F*:SFN(-K %N(:G:R ?1..76636@-CC:SS readBonl#S(-(!S mandator#2:SCR%*(%0N/-n inde) t'at uniquel# identifies an entr# in t'e'ostControl table.:a,' su,' entr# definesa fun,tion t'at dis,o"ers 'osts on a parti,ularinterfa,e and pla,es statisti,s about t'em in t'e'ost(able and t'e 'ost(ime(able on be'alf of t'is'ostControl:ntr#./::E H 'ostControl:ntr# 1 I'ostControl2ataSour,e 0&C:C(B(F*:SFN(-K 0&C:C( %2:N(%+%:R-CC:SS readBwriteS(-(!S mandator#2:SCR%*(%0N/('is ob4e,t identifies t'e sour,e of t'e data fort'is instan,e of t'e 'ost fun,tion.('is sour,e,an be an# interfa,e on t'is de"i,e.%n orderto identif# a parti,ular interfa,e. t'is ob4e,t s'allidentif# t'e instan,e of t'e if%nde) ob4e,t. definedin =5.7>. for t'e desired interfa,e.+or e)ample.if an entr# were to re,ei"e data from interfa,e M1.t'is ob4e,t would be set to if%nde).1.('e statisti,s in t'is group refle,t all pa,ketsRemote Network onitoring Working Group=*age 36>R+C 1271 Remote Network onitoring %& No"ember 1$$1on t'e lo,al network segment atta,'ed to t'eidentified interfa,e.('is ob4e,t ma# not be modified if t'e asso,iated'ostControlStatus ob4e,t is equal to "alid?1@./::E H 'ostControl:ntr# 2 I'ostControl(ableSi1e 0&C:C(B(F*:SFN(-K %N(:G:R-CC:SS readBonl#S(-(!S mandator#2:SCR%*(%0N/('e number of 'ost:ntries in t'e 'ost(able and t'e'ost(ime(able asso,iated wit' t'is 'ostControl:ntr#./::E H 'ostControl:ntr# 3 I'ostControlNast2elete(ime 0&C:C(B(F*:SFN(-K (ime(i,ks-CC:SS readBonl#S(-(!S mandator#2:SCR%*(%0N/('e "alue of s#s!p(ime w'en t'e last entr#was deleted from t'e portion of t'e 'ost(ableasso,iated wit' t'is 'ostControl:ntr#.%f nodeletions 'a"e o,,urred. t'is "alue s'all be 1ero./::E H 'ostControl:ntr# 5 I'ostControl0wner 0&C:C(B(F*:SFN(-K 0wnerString-CC:SS readBwriteS(-(!S mandator#2:SCR%*(%0N/('e entit# t'at ,onfigured t'is entr# and ist'erefore using t'e resour,es assigned to it./::E H 'ostControl:ntr# 6 I'ostControlStatus 0&C:C(B(F*:SFN(-K :ntr#Status-CC:SS readBwriteS(-(!S mandator#2:SCR%*(%0N/('e status of t'is 'ostControl entr#.%f t'is ob4e,t is not equal to "alid?1@. allasso,iated entries in t'e 'ost(able.'ost(ime(able. and t'e 'ost(opN(able s'all bedeleted b# t'e agent./::E H 'ostControl:ntr# 7 IRemote Network onitoring Working Group=*age 37>R+C 1271 Remote Network onitoring %& No"ember 1$$1'ost(able 0&C:C(B(F*:SFN(-K S:L!:NC: 0+ 8ost:ntr#-CC:SS notBa,,essibleS(-(!S mandator#2:SCR%*(%0N/- list of 'ost entries./::E H 'osts 2 I'ost:ntr# 0&C:C(B(F*:SFN(-K 8ost:ntr#-CC:SS notBa,,essibleS(-(!S mandator#2:SCR%*(%0N/- ,olle,tion of statisti,s for a parti,ular 'ostt'at 'as been dis,o"ered on an interfa,e of t'isde"i,e./%N2:K H 'ost%nde). 'ost-ddress I::E H 'ost(able 1 I8ost:ntr# ::E S:L!:NC: H'ost-ddress 0C(:( S(R%NG.'ostCreation0rder %N(:G:R ?1..76636@.'ost%nde) %N(:G:R ?1..76636@.'ost%n*ktsCounter.'ost0ut*kts Counter.'ost%n0,tetsCounter.'ost0ut0,tets Counter.'ost0ut:rrors Counter.'ost0ut&road,ast*ktsCounter.'ost0utulti,ast*ktsCounterI'ost-ddress 0&C:C(B(F*:SFN(-K 0C(:( S(R%NG-CC:SS readBonl#S(-(!S mandator#2:SCR%*(%0N/('e p'#si,al address of t'is 'ost./::E H 'ost:ntr# 1 I'ostCreation0rder 0&C:C(B(F*:SFN(-K %N(:G:R ?1..76636@-CC:SS readBonl#S(-(!S mandator#2:SCR%*(%0N/-n inde) t'at defines t'e relati"e ordering oft'e ,reation time of 'osts ,aptured for aparti,ular 'ostControl:ntr#.('is inde) s'allRemote Network onitoring Working Group=*age 37>R+C 1271 Remote Network onitoring %& No"ember 1$$1be between 1 and N. w'ere N is t'e "alue oft'e asso,iated 'ostControl(ableSi1e.('e orderingof t'e inde)es is based on t'e order of ea,' entr#R+C 1271 Remote Network onitoring %& No"ember 1$$1/('e number of good pa,kets transmitted b# t'isaddress t'at were dire,ted to a multi,ast addresssin,e t'is 'ost was added to t'e 'ost(able.Note t'at t'is number does not in,lude pa,ketsdire,ted to t'e broad,ast address./::E H 'ost:ntr# 1; IBB 'ost (ime (able'ost(ime(able 0&C:C(B(F*:SFN(-K S:L!:NC: 0+ 8ost(ime:ntr#-CC:SS notBa,,essibleS(-(!S mandator#2:SCR%*(%0N/- list of timeBordered 'ost table entries./::E H 'osts 3 I'ost(ime:ntr# 0&C:C(B(F*:SFN(-K 8ost(ime:ntr#-CC:SS notBa,,essibleS(-(!S mandator#2:SCR%*(%0N/- ,olle,tion of statisti,s for a parti,ular 'ostt'at 'as been dis,o"ered on an interfa,e of t'isde"i,e.('is ,olle,tion in,ludes t'e relati"eordering of t'e ,reation time of t'is ob4e,t./%N2:K H 'ost(ime%nde). 'ost(imeCreation0rder I::E H 'ost(ime(able 1 I8ost(ime:ntr# ::E S:L!:NC: H'ost(ime-ddress0C(:( S(R%NG.'ost(imeCreation0rder%N(:G:R ?1..76636@.'ost(ime%nde)%N(:G:R ?1..76636@.'ost(ime%n*kts Counter.'ost(ime0ut*ktsCounter.'ost(ime%n0,tets Counter.'ost(ime0ut0,tetsCounter.'ost(ime0ut:rrorsCounter.'ost(ime0ut&road,ast*kts Counter.'ost(ime0utulti,ast*kts CounterI'ost(ime-ddress 0&C:C(B(F*:SFN(-K 0C(:( S(R%NG-CC:SS readBonl#S(-(!S mandator#2:SCR%*(%0NRemote Network onitoring Working Group=*age 5;>R+C 1271 Remote Network onitoring %& No"ember 1$$1/('e p'#si,al address of t'is 'ost./::E H 'ost(ime:ntr# 1 I'ost(imeCreation0rder 0&C:C(B(F*:SFN(-K %N(:G:R ?1..76636@-CC:SS readBonl#S(-(!S mandator#2:SCR%*(%0N/-n inde) t'at uniquel# identifies an entr# int'e 'ost(ime table among t'ose entries asso,iatedwit' t'e same 'ostControl:ntr#.('is inde) s'allbe between 1 and N. w'ere N is t'e "alue oft'e asso,iated 'ostControl(ableSi1e.('e orderingof t'e inde)es is based on t'e order of ea,' entr#R+C 1271 Remote Network onitoring %& No"ember 1$$1BB stati, for ea,' report after it 'as been prepared.'ost(opNControl(able 0&C:C(B(F*:SFN(-K S:L!:NC: 0+ 8ost(opNControl:ntr#-CC:SS notBa,,essibleS(-(!S mandator#2:SCR%*(%0N/- list of top N 'ost ,ontrol entries./::E H 'ost(opN 1 I'ost(opNControl:ntr# 0&C:C(B(F*:SFN(-K 8ost(opNControl:ntr#-CC:SS notBa,,essibleS(-(!S mandator#2:SCR%*(%0N/- set of parameters t'at ,ontrol t'e ,reation of areport of t'e top N 'osts a,,ording to se"eralmetri,s./%N2:K H 'ost(opNControl%nde) I::E H 'ost(opNControl(able 1 I8ost(opNControl:ntr# ::E S:L!:NC: H'ost(opNControl%nde)%N(:G:R ?1..76636@.'ost(opN8ost%nde) %N(:G:R ?1..76636@.'ost(opNRate&ase%N(:G:R.'ost(opN(imeRemaining %N(:G:R.'ost(opN2uration%N(:G:R.'ost(opNRequestedSi1e %N(:G:R.'ost(opNGrantedSi1e %N(:G:R.'ost(opNStart(ime (ime(i,ks.'ost(opN0wner 0wnerString.'ost(opNStatus%N(:G:RI'ost(opNControl%nde) 0&C:C(B(F*:SFN(-K %N(:G:R ?1..76636@-CC:SS readBonl#S(-(!S mandator#2:SCR%*(%0N/-n inde) t'at uniquel# identifies an entr#in t'e 'ost(opNControl table.:a,' su,'entr# defines one top N report prepared forone interfa,e./::E H 'ost(opNControl:ntr# 1 I'ost(opN8ost%nde) 0&C:C(B(F*:SFN(-K %N(:G:R ?1..76636@-CC:SS readBwriteRemote Network onitoring Working Group=*age 55>R+C 1271 Remote Network onitoring %& No"ember 1$$1S(-(!S mandator#2:SCR%*(%0N/('e 'ost table for w'i,' a top N report will beprepared on be'alf of t'is entr#.('e 'ost tableidentified b# a parti,ular "alue of t'is inde) isasso,iated wit' t'e same 'ost table as identifiedb# t'e same "alue of 'ost%nde).('is ob4e,t ma# not be modified if t'e asso,iated'ost(opNStatus ob4e,t is equal to "alid?1@./::E H 'ost(opNControl:ntr# 2 I'ost(opNRate&ase 0&C:C(B(F*:SFN(-K %N(:G:R H'ost(opN%n*kts?1@.'ost(opN0ut*kts?2@.'ost(opN%n0,tets?3@.'ost(opN0ut0,tets?5@.'ost(opN0ut:rrors?6@.'ost(opN0ut&road,ast*kts?7@.'ost(opN0utulti,ast*kts?7@I-CC:SS readBwriteS(-(!S mandator#2:SCR%*(%0N/('e "ariable for ea,' 'ost t'at t'e 'ost(opNRate"ariable is based upon.('is ob4e,t ma# not be modified if t'e asso,iated'ost(opNStatus ob4e,t is equal to "alid?1@./::E H 'ost(opNControl:ntr# 3 I'ost(opN(imeRemaining 0&C:C(B(F*:SFN(-K %N(:G:R-CC:SS readBwriteS(-(!S mandator#2:SCR%*(%0N/('e number of se,onds left in t'e report ,urrentl#being ,olle,ted.W'en t'is ob4e,t is modified b#t'e management station. a new ,olle,tion is started.possibl# aborting a ,urrentl# running report.('enew "alue is used as t'e requested duration of t'isreport. w'i,' is loaded into t'e asso,iated'ost(opN2uration ob4e,t.W'en t'is ob4e,t is set to a nonB1ero "alue. an#asso,iated 'ost(opN:ntries s'all be madeina,,essible b# t'e monitor.W'ile t'e "alue of t'isRemote Network onitoring Working Group=*age 56>R+C 1271 Remote Network onitoring %& No"ember 1$$1ob4e,t is nonB1ero. it de,rements b# one per se,onduntil it rea,'es 1ero.2uring t'is time. allasso,iated 'ost(opN:ntries s'all remainina,,essible.-t t'e time t'at t'is ob4e,tde,rements to 1ero. t'e report is madea,,essible in t'e 'ost(opN(able.('us. t'e 'ost(opNtable needs to be ,reated onl# at t'e end of t'e,olle,tion inter"al./2:+D-N H ; I::E H 'ost(opNControl:ntr# 5 I'ost(opN2uration 0&C:C(B(F*:SFN(-K %N(:G:R-CC:SS readBonl#S(-(!S mandator#2:SCR%*(%0N/('e number of se,onds t'at t'is report 'as ,olle,tedduring t'e last sampling inter"al. or if t'isreport is ,urrentl# being ,olle,ted. t'e numberof se,onds t'at t'is report is being ,olle,tedduring t'is sampling inter"al.W'en t'e asso,iated 'ost(opN(imeRemaining ob4e,t isset. t'is ob4e,t s'all be set b# t'e probe to t'esame "alue and s'all not be modified until t'e ne)ttime t'e 'ost(opN(imeRemaining is set.('is "alue s'all be 1ero if no reports 'a"e beenrequested for t'is 'ost(opNControl:ntr#./2:+D-N H ; I::E H 'ost(opNControl:ntr# 6 I'ost(opNRequestedSi1e 0&C:C(B(F*:SFN(-K %N(:G:R-CC:SS readBwriteS(-(!S mandator#2:SCR%*(%0N/('e ma)imum number of 'osts requested for t'e top Ntable.W'en t'is ob4e,t is ,reated or modified. t'e probes'ould set 'ost(opNGrantedSi1e as ,losel# to t'isob4e,t as is possible for t'e parti,ular probeimplementation and a"ailable resour,es./2:+D-N H 1; I::E H 'ost(opNControl:ntr# 7 IRemote Network onitoring Working Group=*age 57>R+C 1271 Remote Network onitoring %& No"ember 1$$1'ost(opNGrantedSi1e 0&C:C(B(F*:SFN(-K %N(:G:R-CC:SS readBonl#S(-(!S mandator#2:SCR%*(%0N/('e ma)imum number of 'osts in t'e top N table.W'en t'e asso,iated 'ost(opNRequestedSi1e ob4e,t is,reated or modified. t'e probe s'ould set t'isob4e,t as ,losel# to t'e requested "alue as ispossible for t'e parti,ular implementation anda"ailable resour,es. ('e probe must not lower t'is"alue e),ept as a result of a set to t'e asso,iated'ost(opNRequestedSi1e ob4e,t.8osts wit' t'e 'ig'est "alue of 'ost(opNRate s'all bepla,ed in t'is table in de,reasing order of t'is rateuntil t'ere is no more room or until t'ere are no more'osts./::E H 'ost(opNControl:ntr# 7 I'ost(opNStart(ime 0&C:C(B(F*:SFN(-K (ime(i,ks-CC:SS readBonl#S(-(!S mandator#2:SCR%*(%0N/('e "alue of s#s!p(ime w'en t'is top N report waslast started.%n ot'er words. t'is is t'e time t'att'e asso,iated 'ost(opN(imeRemaining ob4e,t wasmodified to start t'e requested report./::E H 'ost(opNControl:ntr# 9 I'ost(opN0wner 0&C:C(B(F*:SFN(-K 0wnerString-CC:SS readBwriteS(-(!S mandator#2:SCR%*(%0N/('e entit# t'at ,onfigured t'is entr# and ist'erefore using t'e resour,es assigned to it./::E H 'ost(opNControl:ntr# $ I'ost(opNStatus 0&C:C(B(F*:SFN(-K :ntr#Status-CC:SS readBwriteS(-(!S mandator#2:SCR%*(%0N/('e status of t'is 'ost(opNControl entr#.Remote Network onitoring Working Group=*age 57>R+C 1271 Remote Network onitoring %& No"ember 1$$1%f t'is ob4e,t is not equal to "alid?1@. allasso,iated 'ost(opN:ntries s'all be deleted b#t'e agent./::E H 'ost(opNControl:ntr# 1; I'ost(opN(able 0&C:C(B(F*:SFN(-K S:L!:NC: 0+ 8ost(opN:ntr#-CC:SS notBa,,essibleS(-(!S mandator#2:SCR%*(%0N/- list of top N 'ost entries./::E H 'ost(opN 2 I'ost(opN:ntr# 0&C:C(B(F*:SFN(-K 8ost(opN:ntr#-CC:SS notBa,,essibleS(-(!S mandator#2:SCR%*(%0N/- set of statisti,s for a 'ost t'at is part of atop N report./%N2:K H 'ost(opNReport. 'ost(opN%nde) I::E H 'ost(opN(able 1 I8ost(opN:ntr# ::E S:L!:NC: H'ost(opNReport%N(:G:R ?1..76636@.'ost(opN%nde) %N(:G:R ?1..76636@.'ost(opN-ddress 0C(:( S(R%NG.'ost(opNRate%N(:G:RI'ost(opNReport 0&C:C(B(F*:SFN(-K %N(:G:R ?1..76636@-CC:SS readBonl#S(-(!S mandator#2:SCR%*(%0N/('is ob4e,t identifies t'e top N report of w'i,'t'is entr# is a part.('e set of 'ostsidentified b# a parti,ular "alue of t'isob4e,t is part of t'e same report as identifiedb# t'e same "alue of t'e 'ost(opNControl%nde) ob4e,t./::E H 'ost(opN:ntr# 1 I'ost(opN%nde) 0&C:C(B(F*:SFN(-K %N(:G:R ?1..76636@-CC:SS readBonl#S(-(!S mandator#2:SCR%*(%0N/-n inde) t'at uniquel# identifies an entr# inRemote Network onitoring Working Group=*age 59>R+C 1271 Remote Network onitoring %& No"ember 1$$1t'e 'ost(opN table among t'ose in t'e same report.('is inde) is between 1 and N. w'ere N is t'enumber of entries in t'is table.%n,reasing "aluesof 'ost(opN%nde) s'all be assigned to entries wit'de,reasing "alues of 'ost(opNRate until inde) Nis assigned to t'e entr# wit' t'e lowest "alue of'ost(opNRate or t'ere are no more 'ost(opN:ntries./::E H 'ost(opN:ntr# 2 I'ost(opN-ddress 0&C:C(B(F*:SFN(-K 0C(:( S(R%NG-CC:SS readBonl#S(-(!S mandator#2:SCR%*(%0N/('e p'#si,al address of t'is 'ost./::E H 'ost(opN:ntr# 3 I'ost(opNRate 0&C:C(B(F*:SFN(-K %N(:G:R-CC:SS readBonl#S(-(!S mandator#2:SCR%*(%0N/('e amount of ,'ange in t'e sele,ted "ariableduring t'is sampling inter"al.('e sele,ted"ariable is t'is 'ostR+C 1271 Remote Network onitoring %& No"ember 1$$1S(-(!S mandator#2:SCR%*(%0N/('e status of t'is matri)Control entr#.%f t'is ob4e,t is not equal to "alid?1@. allasso,iated entries in t'e matri)S2(able and t'ematri)2S(able s'all be deleted b# t'e agent./::E H matri)Control:ntr# 7 Imatri)S2(able 0&C:C(B(F*:SFN(-K S:L!:NC: 0+ atri)S2:ntr#-CC:SS notBa,,essibleS(-(!S mandator#2:SCR%*(%0N/- list of traffi, matri) entries inde)ed b#sour,e and destination -C address./::E H matri) 2 Imatri)S2:ntr# 0&C:C(B(F*:SFN(-K atri)S2:ntr#-CC:SS notBa,,essibleS(-(!S mandator#2:SCR%*(%0N/- ,olle,tion of statisti,s for ,ommuni,ations betweentwo addresses on a parti,ular interfa,e./%N2:K H matri)S2%nde).matri)S2Sour,e-ddress. matri)S22est-ddress I::E H matri)S2(able 1 Iatri)S2:ntr# ::E S:L!:NC: Hmatri)S2Sour,e-ddress 0C(:( S(R%NG.matri)S22est-ddress 0C(:( S(R%NG.matri)S2%nde) %N(:G:R ?1..76636@.matri)S2*ktsCounter.matri)S20,tetsCounter.matri)S2:rrorsCounterImatri)S2Sour,e-ddress 0&C:C(B(F*:SFN(-K 0C(:( S(R%NG-CC:SS readBonl#S(-(!S mandator#2:SCR%*(%0N/('e sour,e p'#si,al address./::E H matri)S2:ntr# 1 IRemote Network onitoring Working Group=*age 62>R+C 1271 Remote Network onitoring %& No"ember 1$$1matri)S22est-ddress 0&C:C(B(F*:SFN(-K 0C(:( S(R%NG-CC:SS readBonl#S(-(!S mandator#2:SCR%*(%0N/('e destination p'#si,al address./::E H matri)S2:ntr# 2 Imatri)S2%nde) 0&C:C(B(F*:SFN(-K %N(:G:R ?1..76636@-CC:SS readBonl#S(-(!S mandator#2:SCR%*(%0N/('e set of ,olle,ted matri) statisti,s of w'i,'t'is entr# is a part.('e set of matri) statisti,sidentified b# a parti,ular "alue of t'is inde)is asso,iated wit' t'e same matri)Control:ntr#as identified b# t'e same "alue of matri)Control%nde)./::E H matri)S2:ntr# 3 Imatri)S2*kts 0&C:C(B(F*:SFN(-K Counter-CC:SS readBonl#S(-(!S mandator#2:SCR%*(%0N/('e number of pa,kets transmitted from t'e sour,eaddress to t'e destination address ?t'is numberin,ludes error pa,kets@./::E H matri)S2:ntr# 5 Imatri)S20,tets 0&C:C(B(F*:SFN(-K Counter-CC:SS readBonl#S(-(!S mandator#2:SCR%*(%0N/('e number of o,tets ?e),luding framing bits butin,luding +CS o,tets@ ,ontained in all pa,ketstransmitted from t'e sour,e address to t'edestination address./::E H matri)S2:ntr# 6 Imatri)S2:rrors 0&C:C(B(F*:SFN(-K Counter-CC:SS readBonl#S(-(!S mandator#2:SCR%*(%0N/('e number of error pa,kets transmitted fromt'e sour,e address to t'e destination address./Remote Network onitoring Working Group=*age 63>R+C 1271 Remote Network onitoring %& No"ember 1$$1::E H matri)S2:ntr# 7 IBB (raffi, matri) tables from destination to sour,ematri)2S(able 0&C:C(B(F*:SFN(-K S:L!:NC: 0+ atri)2S:ntr#-CC:SS notBa,,essibleS(-(!S mandator#2:SCR%*(%0N/- list of traffi, matri) entries inde)ed b#destination and sour,e -C address./::E H matri) 3 Imatri)2S:ntr# 0&C:C(B(F*:SFN(-K atri)2S:ntr#-CC:SS notBa,,essibleS(-(!S mandator#2:SCR%*(%0N/- ,olle,tion of statisti,s for ,ommuni,ations betweentwo address on a parti,ular interfa,e./%N2:K H matri)2S%nde).matri)2S2est-ddress. matri)2SSour,e-ddress I::E H matri)2S(able 1 Iatri)2S:ntr# ::E S:L!:NC: Hmatri)2SSour,e-ddress 0C(:( S(R%NG.matri)2S2est-ddress 0C(:( S(R%NG.matri)2S%nde) %N(:G:R ?1..76636@.matri)2S*ktsCounter.matri)2S0,tetsCounter.matri)2S:rrorsCounterImatri)2SSour,e-ddress 0&C:C(B(F*:SFN(-K 0C(:( S(R%NG-CC:SS readBonl#S(-(!S mandator#2:SCR%*(%0N/('e sour,e p'#si,al address./::E H matri)2S:ntr# 1 Imatri)2S2est-ddress 0&C:C(B(F*:SFN(-K 0C(:( S(R%NG-CC:SS readBonl#S(-(!S mandator#2:SCR%*(%0N/('e destination p'#si,al address./Remote Network onitoring Working Group=*age 65>R+C 1271 Remote Network onitoring %& No"ember 1$$1::E H matri)2S:ntr# 2 Imatri)2S%nde) 0&C:C(B(F*:SFN(-K %N(:G:R ?1..76636@-CC:SS readBonl#S(-(!S mandator#2:SCR%*(%0N/('e set of ,olle,ted matri) statisti,s of w'i,'t'is entr# is a part.('e set of matri) statisti,sidentified b# a parti,ular "alue of t'is inde)is asso,iated wit' t'e same matri)Control:ntr#as identified b# t'e same "alue of matri)Control%nde)./::E H matri)2S:ntr# 3 Imatri)2S*kts 0&C:C(B(F*:SFN(-K Counter-CC:SS readBonl#S(-(!S mandator#2:SCR%*(%0N/('e number of pa,kets transmitted from t'e sour,eaddress to t'e destination address ?t'is numberin,ludes error pa,kets@./::E H matri)2S:ntr# 5 Imatri)2S0,tets 0&C:C(B(F*:SFN(-K Counter-CC:SS readBonl#S(-(!S mandator#2:SCR%*(%0N/('e number of o,tets ?e),luding framing bitsbut in,luding +CS o,tets@ ,ontained in all pa,ketstransmitted from t'e sour,e address to t'edestination address./::E H matri)2S:ntr# 6 Imatri)2S:rrors 0&C:C(B(F*:SFN(-K Counter-CC:SS readBonl#S(-(!S mandator#2:SCR%*(%0N/('e number of error pa,kets transmitted fromt'e sour,e address to t'e destination address./::E H matri)2S:ntr# 7 IBB ('e +ilter GroupBB %mplementation of t'e +ilter group is optional.Remote Network onitoring Working Group=*age 66>R+C 1271 Remote Network onitoring %& No"ember 1$$1BBBB ('e +ilter group allows pa,kets to be ,aptured wit' anBB arbitrar# filter e)pression.- logi,al data andBB e"ent stream or /,'annel/ is formed b# t'e pa,ketsBB t'at mat,' t'e filter e)pression.BBBB ('is filter me,'anism allows t'e ,reation of an arbitrar#BB logi,al e)pression wit' w'i,' to filter pa,kets.:a,'BB filter asso,iated wit' a ,'annel is 0RR+C 1271 Remote Network onitoring %& No"ember 1$$1('is ob4e,t ma# not be modified if t'e asso,iated,'annelStatus ob4e,t is equal to "alid?1@./::E H ,'annel:ntr# 3 I,'annel2ataControl 0&C:C(B(F*:SFN(-K %N(:G:R Hon?1@.off?2@I-CC:SS readBwriteS(-(!S mandator#2:SCR%*(%0N/('is ob4e,t ,ontrols t'e flow of data t'roug' t'is,'annel.%f t'is ob4e,t is on?1@. data. status ande"ents flow t'roug' t'is ,'annel.%f t'is ob4e,t isoff?2@. data. status and e"ents will not flow t'roug't'is ,'annel./2:+D-N H off I::E H ,'annel:ntr# 5 I,'annel(urn0n:"ent%nde) 0&C:C(B(F*:SFN(-K %N(:G:R ?;..76636@-CC:SS readBwriteS(-(!S mandator#2:SCR%*(%0N/('e "alue of t'is ob4e,t identifies t'e e"entt'at is ,onfigured to turn t'e asso,iated,'annel2ataControl from off to on w'en t'e e"ent isgenerated.('e e"ent identified b# a parti,ular "alueof t'is ob4e,t is t'e same e"ent as identified b# t'esame "alue of t'e e"ent%nde) ob4e,t.%f t'ere is no,orresponding entr# in t'e e"ent(able. t'en noasso,iation e)ists.%n fa,t. if no e"ent is intendedfor t'is ,'annel. ,'annel(urn0n:"ent%nde) must beset to 1ero. a nonBe)istent e"ent inde).('is ob4e,t ma# not be modified if t'e asso,iated,'annelStatus ob4e,t is equal to "alid?1@./::E H ,'annel:ntr# 6 I,'annel(urn0ff:"ent%nde) 0&C:C(B(F*:SFN(-K %N(:G:R ?;..76636@-CC:SS readBwriteS(-(!S mandator#2:SCR%*(%0N/('e "alue of t'is ob4e,t identifies t'e e"entt'at is ,onfigured to turn t'e asso,iated,'annel2ataControl from on to off w'en t'e e"ent isRemote Network onitoring Working Group=*age 75>R+C 1271 Remote Network onitoring %& No"ember 1$$1generated.('e e"ent identified b# a parti,ular "alueof t'is ob4e,t is t'e same e"ent as identified b# t'esame "alue of t'e e"ent%nde) ob4e,t.%f t'ere is no,orresponding entr# in t'e e"ent(able. t'en noasso,iation e)ists.%n fa,t. if no e"ent is intendedfor t'is ,'annel. ,'annel(urn0ff:"ent%nde) must beset to 1ero. a nonBe)istent e"ent inde).('is ob4e,t ma# not be modified if t'e asso,iated,'annelStatus ob4e,t is equal to "alid?1@./::E H ,'annel:ntr# 7 I,'annel:"ent%nde) 0&C:C(B(F*:SFN(-K %N(:G:R ?;..76636@-CC:SS readBwriteS(-(!S mandator#2:SCR%*(%0N/('e "alue of t'is ob4e,t identifies t'e e"entt'at is ,onfigured to be generated w'en t'easso,iated ,'annel2ataControl is on and a pa,ketis mat,'ed.('e e"ent identified b# a parti,ular "alueof t'is ob4e,t is t'e same e"ent as identified b# t'esame "alue of t'e e"ent%nde) ob4e,t.%f t'ere is no,orresponding entr# in t'e e"ent(able. t'en noasso,iation e)ists.%n fa,t. if no e"ent is intendedfor t'is ,'annel. ,'annel:"ent%nde) must beset to 1ero. a nonBe)istent e"ent inde).('is ob4e,t ma# not be modified if t'e asso,iated,'annelStatus ob4e,t is equal to "alid?1@./::E H ,'annel:ntr# 7 I,'annel:"entStatus 0&C:C(B(F*:SFN(-K %N(:G:R He"entRead#?1@.e"ent+ired?2@.e"ent-lwa#sRead#?3@I-CC:SS readBwriteS(-(!S mandator#2:SCR%*(%0N/('e e"ent status of t'is ,'annel.%f t'is ,'annel is ,onfigured to generate e"entsw'en pa,kets are mat,'ed. a means of ,ontrollingt'e flow of t'ose e"ents is often needed.W'ent'is ob4e,t is equal to e"entRead#?1@. a singlee"ent ma# be generated. after w'i,' t'is ob4e,tRemote Network onitoring Working Group=*age 76>R+C 1271 Remote Network onitoring %& No"ember 1$$1will be set b# t'e probe to e"ent+ired?2@.W'ilein t'e e"ent+ired?2@ state. no e"ents will begenerated until t'e ob4e,t is modified toe"entRead#?1@ ?or e"ent-lwa#sRead#?3@@.('emanagement station ,an t'us easil# respond to anotifi,ation of an e"ent b# reBenabling t'is ob4e,t.%f t'e management station wis'es to disable t'isflow ,ontrol and allow e"ents to be generatedat will. t'is ob4e,t ma# be set toe"ent-lwa#sRead#?3@.2isabling t'e flow ,ontrolis dis,ouraged as it ,an result in 'ig' networktraffi, or ot'er performan,e problems./2:+D-N H e"entRead# I::E H ,'annel:ntr# 9 I,'annelat,'es 0&C:C(B(F*:SFN(-K Counter-CC:SS readBonl#S(-(!S mandator#2:SCR%*(%0N/('e number of times t'is ,'annel 'as mat,'ed a pa,ket.Note t'at t'is ob4e,t is updated e"en w'en,'annel2ataControl is set to off./::E H ,'annel:ntr# $ I,'annel2es,ription 0&C:C(B(F*:SFN(-K 2ispla#String ?S%J: ?;..127@@-CC:SS readBwriteS(-(!S mandator#2:SCR%*(%0N/- ,omment des,ribing t'is ,'annel./::E H ,'annel:ntr# 1; I,'annel0wner 0&C:C(B(F*:SFN(-K 0wnerString-CC:SS readBwriteS(-(!S mandator#2:SCR%*(%0N/('e entit# t'at ,onfigured t'is entr# and is t'ereforeusing t'e resour,es assigned to it./::E H ,'annel:ntr# 11 I,'annelStatus 0&C:C(B(F*:SFN(-K :ntr#Status-CC:SS readBwriteS(-(!S mandator#2:SCR%*(%0NRemote Network onitoring Working Group=*age 77>R+C 1271 Remote Network onitoring %& No"ember 1$$1/('e status of t'is ,'annel entr#./::E H ,'annel:ntr# 12 IBB ('e *a,ket Capture GroupBB %mplementation of t'e *a,ket Capture group is optional.BBBB ('e *a,ket Capture Group requires implementation of t'eBB +ilter Group.BBBB ('e *a,ket Capture group allows pa,kets to be ,apturedBB upon a filter mat,'.('e bufferControl(able ,ontrolsBB t'e ,aptured pa,kets output from a ,'annel t'at isBB asso,iated wit' it.('e ,aptured pa,kets are pla,edBB in entries in t'e ,apture&uffer(able.('ese entries areBB asso,iated wit' t'e bufferControl:ntr# on w'ose be'alf t'e#BB were stored.bufferControl(able 0&C:C(B(F*:SFN(-K S:L!:NC: 0+ &ufferControl:ntr#-CC:SS notBa,,essibleS(-(!S mandator#2:SCR%*(%0N/- list of buffers ,ontrol entries./::E H ,apture 1 IbufferControl:ntr# 0&C:C(B(F*:SFN(-K &ufferControl:ntr#-CC:SS notBa,,essibleS(-(!S mandator#2:SCR%*(%0N/- set of parameters t'at ,ontrol t'e ,olle,tion ofa stream of pa,kets t'at 'a"e mat,'ed filters./%N2:K H bufferControl%nde) I::E H bufferControl(able 1 I&ufferControl:ntr# ::E S:L!:NC: HbufferControl%nde)%N(:G:R ?1..76636@.bufferControlC'annel%nde) %N(:G:R ?1..76636@.bufferControl+ullStatus %N(:G:R.bufferControl+ull-,tion %N(:G:R.bufferControlCaptureSli,eSi1e %N(:G:R.bufferControl2ownloadSli,eSi1e%N(:G:R.bufferControl2ownload0ffset %N(:G:R.bufferControla)0,tetsRequested %N(:G:R.bufferControla)0,tetsGranted %N(:G:R.bufferControlCaptured*a,kets%N(:G:R.Remote Network onitoring Working Group=*age 77>R+C 1271 Remote Network onitoring %& No"ember 1$$1bufferControl(urn0n(ime (ime(i,ks.bufferControl0wner0wnerString.bufferControlStatus %N(:G:RIbufferControl%nde) 0&C:C(B(F*:SFN(-K %N(:G:R ?1..76636@-CC:SS readBonl#S(-(!S mandator#2:SCR%*(%0N/-n inde) t'at uniquel# identifies an entr#in t'e bufferControl table.('e "alue of t'isinde) s'all ne"er be 1ero.:a,' su,'entr# defines one set of pa,kets t'at is,aptured and ,ontrolled b# one or more filters./::E H bufferControl:ntr# 1 IbufferControlC'annel%nde) 0&C:C(B(F*:SFN(-K %N(:G:R ?1..76636@-CC:SS readBwriteS(-(!S mandator#2:SCR%*(%0N/-n inde) t'at identifies t'e ,'annel t'at is t'esour,e of pa,kets for t'is bufferControl table.('e ,'annel identified b# a parti,ular "alue of t'isinde) is t'e same as identified b# t'e same "alue oft'e ,'annel%nde) ob4e,t.('is ob4e,t ma# not be modified if t'e asso,iatedbufferControlStatus ob4e,t is equal to "alid?1@./::E H bufferControl:ntr# 2 IbufferControl+ullStatus 0&C:C(B(F*:SFN(-K %N(:G:R Hspa,e-"ailable?1@.full?2@I-CC:SS readBonl#S(-(!S mandator#2:SCR%*(%0N/('is ob4e,t s'ows w'et'er t'e buffer 'as room toa,,ept new pa,kets or if it is full.%f t'e status is spa,e-"ailable?1@. t'e buffer isa,,epting new pa,kets normall#.%f t'e status isfull?2@ and t'e asso,iated bufferControl+ull-,tionob4e,t is wrapW'en+ull. t'e buffer is a,,epting newpa,kets b# deleting enoug' of t'e oldest pa,ketsRemote Network onitoring Working Group=*age 79>R+C 1271 Remote Network onitoring %& No"ember 1$$1to make room for new ones as t'e# arri"e.0t'erwise.if t'e status is full?2@ and t'ebufferControl+ull-,tion ob4e,t is lo,kW'en+ull.t'en t'e buffer 'as stopped ,olle,ting pa,kets.W'en t'is ob4e,t is set to full?2@ t'e probe mustnot later set it to spa,e-"ailable?1@ e),ept in t'e,ase of a signifi,ant gain in resour,es su,' asan in,rease of bufferControl0,tetsGranted.%nparti,ular. t'e wrapBmode a,tion of deleting oldpa,kets to make room for newl# arri"ed pa,ketsmust not affe,t t'e "alue of t'is ob4e,t./::E H bufferControl:ntr# 3 IbufferControl+ull-,tion 0&C:C(B(F*:SFN(-K %N(:G:R Hlo,kW'en+ull?1@.wrapW'en+ull?2@BB +%+0I-CC:SS readBwriteS(-(!S mandator#2:SCR%*(%0N/Controls t'e a,tion of t'e buffer w'en itrea,'es t'e full status.W'en in t'e lo,kW'en+ull?1@state a pa,ket is added to t'e buffer t'atfills t'e buffer. t'e bufferControl+ullStatus willbe set to full?2@ and t'is buffer will stop ,apturingpa,kets./::E H bufferControl:ntr# 5 IbufferControlCaptureSli,eSi1e 0&C:C(B(F*:SFN(-K %N(:G:R-CC:SS readBwriteS(-(!S mandator#2:SCR%*(%0N/('e ma)imum number of o,tets of ea,' pa,kett'at will be sa"ed in t'is ,apture buffer.+or e)ample. if a 16;; o,tet pa,ket is re,ei"ed b#t'e probe and t'is ob4e,t is set to 6;;. t'en onl#6;; o,tets of t'e pa,ket will be stored in t'easso,iated ,apture buffer.%f t'is "ariable is setto ;. t'e ,apture buffer will sa"e as man# o,tetsas is possible.('is ob4e,t ma# not be modified if t'e asso,iatedbufferControlStatus ob4e,t is equal to "alid?1@./2:+D-N H 1;; I::E H bufferControl:ntr# 6 IRemote Network onitoring Working Group=*age 7$>R+C 1271 Remote Network onitoring %& No"ember 1$$1bufferControl2ownloadSli,eSi1e 0&C:C(B(F*:SFN(-K %N(:G:R-CC:SS readBwriteS(-(!S mandator#2:SCR%*(%0N/('e ma)imum number of o,tets of ea,' pa,ketin t'is ,apture buffer t'at will be returned inan SN* retrie"al of t'at pa,ket.+or e)ample.if 6;; o,tets of a pa,ket 'a"e been stored in t'easso,iated ,apture buffer. t'e asso,iatedbufferControl2ownload0ffset is ;. and t'isob4e,t is set to 1;;. t'en t'e ,apture&uffer*a,ketob4e,t t'at ,ontains t'e pa,ket will ,ontain onl#t'e first 1;; o,tets of t'e pa,ket.- prudent manager will take into a,,ount possibleinteroperabilit# or fragmentation problems t'at ma#o,,ur if t'e download sli,e si1e is set too large.%n parti,ular. ,onformant SN* implementations are notrequired to a,,ept messages w'ose lengt' e),eeds 595o,tets. alt'oug' t'e# are en,ouraged to support largerdatagrams w'ene"er feasible./2:+D-N H 1;; I::E H bufferControl:ntr# 7 IbufferControl2ownload0ffset 0&C:C(B(F*:SFN(-K %N(:G:R-CC:SS readBwriteS(-(!S mandator#2:SCR%*(%0N/('e offset of t'e first o,tet of ea,' pa,ketin t'is ,apture buffer t'at will be returned inan SN* retrie"al of t'at pa,ket.+or e)ample.if 6;; o,tets of a pa,ket 'a"e been stored in t'easso,iated ,apture buffer and t'is ob4e,t is set to1;;. t'en t'e ,apture&uffer*a,ket ob4e,t t'at,ontains t'e pa,ket will ,ontain b#tes starting1;; o,tets into t'e pa,ket./2:+D-N H ; I::E H bufferControl:ntr# 7 IbufferControla)0,tetsRequested 0&C:C(B(F*:SFN(-K %N(:G:R-CC:SS readBwriteS(-(!S mandator#2:SCR%*(%0N/('e requested ma)imum number of o,tets to besa"ed in t'is ,apture&uffer. in,luding an#Remote Network onitoring Working Group=*age 7;>R+C 1271 Remote Network onitoring %& No"ember 1$$1implementationBspe,ifi, o"er'ead. %f t'is "ariableis set to B1. t'e ,apture buffer will sa"e as man#o,tets as is possible.W'en t'is ob4e,t is ,reated or modified. t'e probes'ould set bufferControla)0,tetsGranted as ,losel#to t'is ob4e,t as is possible for t'e parti,ular probeimplementation and a"ailable resour,es.8owe"er. ift'e ob4e,t 'as t'e spe,ial "alue of B1. t'e probemust set bufferControla)0,tetsGranted to B1./2:+D-N H B1 I::E H bufferControl:ntr# 9 IbufferControla)0,tetsGranted 0&C:C(B(F*:SFN(-K %N(:G:R-CC:SS readBonl#S(-(!S mandator#2:SCR%*(%0N/('e ma)imum number of o,tets t'at ,an besa"ed in t'is ,apture&uffer. in,luding o"er'ead.%f t'is "ariable is B1. t'e ,apture buffer will sa"eas man# o,tets as possible.W'en t'e bufferControla)0,tetsRequested ob4e,t is,reated or modified. t'e probe s'ould set t'is ob4e,tas ,losel# to t'e requested "alue as is possible fort'e parti,ular probe implementation and a"ailableresour,es.8owe"er. if t'e request ob4e,t 'as t'espe,ial "alue of B1. t'e probe must set t'is ob4e,tto B1.('e probe must not lower t'is "alue e),eptas a result of a modifi,ation to t'e asso,iatedbufferControla)0,tetsRequested ob4e,t.W'en t'is ma)imum number of o,tets is rea,'edand a new pa,ket is to be added to t'is,apture buffer and t'e ,orrespondingbufferControl+ull-,tion is set to wrapW'en+ull?2@.enoug' of t'e oldest pa,kets asso,iated wit' t'is,apture buffer s'all be deleted b# t'e agent sot'at t'e new pa,ket ,an be added.%f t'e,orresponding bufferControl+ull-,tion is set tolo,kW'en+ull?1@. t'e new pa,ket s'all be dis,arded.%n eit'er ,ase. t'e probe must setbufferControl+ullStatus to full?2@.W'en t'e "alue of t'is ob4e,t ,'anges to a "alue lesst'an t'e ,urrent "alue. entries are deleted fromt'e ,apture&uffer(able asso,iated wit' t'isRemote Network onitoring Working Group=*age 71>R+C 1271 Remote Network onitoring %& No"ember 1$$1bufferControl:ntr#.:noug' of t'eoldest of t'ese ,apture&uffer:ntries s'all bedeleted b# t'e agent so t'at t'e number of o,tetsused remains less t'an or equal to t'e new "alue oft'is ob4e,t.W'en t'e "alue of t'is ob4e,t ,'anges to a "alue greatert'an t'e ,urrent "alue. t'e number of asso,iated,apture&uffer:ntries ma# be allowed to grow./::E H bufferControl:ntr# $ IbufferControlCaptured*a,kets 0&C:C(B(F*:SFN(-K %N(:G:R-CC:SS readBonl#S(-(!S mandator#2:SCR%*(%0N/('e number of pa,kets ,urrentl# in t'is ,apture&uffer./::E H bufferControl:ntr# 1; IbufferControl(urn0n(ime 0&C:C(B(F*:SFN(-K (ime(i,ks-CC:SS readBonl#S(-(!S mandator#2:SCR%*(%0N/('e "alue of s#s!p(ime w'en t'is ,apture buffer wasfirst turned on./::E H bufferControl:ntr# 11 IbufferControl0wner 0&C:C(B(F*:SFN(-K 0wnerString-CC:SS readBwriteS(-(!S mandator#2:SCR%*(%0N/('e entit# t'at ,onfigured t'is entr# and is t'ereforeusing t'e resour,es assigned to it./::E H bufferControl:ntr# 12 IbufferControlStatus 0&C:C(B(F*:SFN(-K :ntr#Status-CC:SS readBwriteS(-(!S mandator#2:SCR%*(%0N/('e status of t'is buffer Control :ntr#./::E H bufferControl:ntr# 13 I,apture&uffer(able 0&C:C(B(F*:SFN(-K S:L!:NC: 0+ Capture&uffer:ntr#-CC:SS notBa,,essibleRemote Network onitoring Working Group=*age 72>R+C 1271 Remote Network onitoring %& No"ember 1$$1S(-(!S mandator#2:SCR%*(%0N/- list of pa,kets ,aptured off of a ,'annel./::E H ,apture 2 I,apture&uffer:ntr# 0&C:C(B(F*:SFN(-K Capture&uffer:ntr#-CC:SS notBa,,essibleS(-(!S mandator#2:SCR%*(%0N/- pa,ket ,aptured off of an atta,'ed network./%N2:K H ,apture&ufferControl%nde). ,apture&uffer%nde) I::E H ,apture&uffer(able 1 ICapture&uffer:ntr# ::E S:L!:NC: H,apture&ufferControl%nde) %N(:G:R ?1..76636@.,apture&uffer%nde)%N(:G:R.,apture&uffer*a,ket%2 %N(:G:R.,apture&uffer*a,ket2ata 0C(:( S(R%NG.,apture&uffer*a,ketNengt' %N(:G:R.,apture&uffer*a,ket(ime %N(:G:R.,apture&uffer*a,ketStatus %N(:G:RI,apture&ufferControl%nde) 0&C:C(B(F*:SFN(-K %N(:G:R ?1..76636@-CC:SS readBonl#S(-(!S mandator#2:SCR%*(%0N/('e inde) of t'e bufferControl:ntr# wit' w'i,'t'is pa,ket is asso,iated./::E H ,apture&uffer:ntr# 1 I,apture&uffer%nde) 0&C:C(B(F*:SFN(-K %N(:G:R-CC:SS readBonl#S(-(!S mandator#2:SCR%*(%0N/-n inde) t'at uniquel# identifies an entr#in t'e ,apture&uffer table asso,iated wit' aparti,ular bufferControl:ntr#.('is inde) willstart at 1 and in,rease b# one for ea,' new pa,ketadded wit' t'e same ,apture&ufferControl%nde)./::E H ,apture&uffer:ntr# 2 I,apture&uffer*a,ket%2 0&C:C(B(F*:SFN(-K %N(:G:R-CC:SS readBonl#Remote Network onitoring Working Group=*age 73>R+C 1271 Remote Network onitoring %& No"ember 1$$1S(-(!S mandator#2:SCR%*(%0N/-n inde) t'at des,ribes t'e order of pa,ketst'at are re,ei"ed on a parti,ular interfa,e.('e pa,ket%2 of a pa,ket ,aptured on aninterfa,e is defined to be greater t'an t'epa,ket%2 Cerf. D.. /%-& Re,ommendations for t'e 2e"elopment of %nternet Network anagement Standards/. R+C 1;62. NR%. -pril 1$99. =2> Cerf. D.. /Report of t'e Se,ond -d 8o, Network anagement Re"iew Group/. R+C 11;$. NR%. -ugust 1$9$. =3> Rose .. and Q. ,Clog'rie. /Stru,ture and %dentifi,ation of anagement %nformation for (C*A%*Bbased internets/. R+C 1166. *erforman,e S#stems %nternational. 8ug'es N-N S#stems. a# 1$$;. =5> ,Clog'rie Q.. and . Rose. /anagement %nformation &ase for Network anagement of (C*A%*Bbased internets/. R+C 1167. 8ug'es N-N S#stems. *erforman,e S#stems %nternational. a# 1$$;.Remote Network onitoring Working Group=*age 9;>R+C 1271 Remote Network onitoring %& No"ember 1$$1 =6> Case. C.. +edor. .. S,'offstall. .. and C. 2a"in. /Simple Network anagement *roto,ol/. R+C 1167. SN* Resear,'. *erforman,e S#stems %nternational. *erforman,e S#stems %nternational. %( Naborator# for Computer S,ien,e. a# 1$$;. =7> ,Clog'rie Q.. and . Rose. :ditors. /anagement %nformation &ase for Network anagement of (C*A%*Bbased internets/. R+C 1213. *erforman,e S#stems %nternational. ar,' 1$$1. =7> %nformation pro,essing s#stems B 0pen S#stems %nter,onne,tion B Spe,ifi,ation of -bstra,t S#nta) Notation 0ne ?-SN.1@. %nternational 0rgani1ation for Standardi1ation. %nternational Standard 9925. 2e,ember 1$97. =9> %nformation pro,essing s#stems B 0pen S#stems %nter,onne,tion B Spe,ifi,ation of &asi, :n,oding Rules for -bstra,t Notation 0ne ?-SN.1@. %nternational 0rgani1ation for Standardi1ation. %nternational Standard 9926. 2e,ember 1$97. =$> Rose. .. and Q. ,Clog'rie. :ditors. /Con,ise %& 2efinitions/. R+C 1212. *erforman,e S#stems %nternational. 8ug'es N-N S#stems. ar,' 1$$1.=1;> Rose. .. :ditor. /- Con"ention for 2efining (raps for use wit' t'e SN*/. R+C 1216. *erforman,e S#stems %nternational. ar,' 1$$1.Se,urit# Considerations Se,urit# issues are not dis,ussed in t'is memo.-ut'or