draft-ietf-snmpv3-update-proto-08.txt   rfc3416.txt 
INTERNET-DRAFT Editor of this version: Network Working Group Editor of this version:
Request for Comments: -PRO R. Presuhn Request for Comments: 3416 R. Presuhn
STD: XXX BMC Software, Inc. STD: 62 BMC Software, Inc.
Obsoletes: 1905 Authors of previous version: Obsoletes: 1905 Authors of previous version:
Category: Standards Track J. Case Category: Standards Track J. Case
SNMP Research, Inc. SNMP Research, Inc.
K. McCloghrie K. McCloghrie
Cisco Systems, Inc. Cisco Systems, Inc.
M. Rose M. Rose
Dover Beach Consulting, Inc. Dover Beach Consulting, Inc.
S. Waldbusser S. Waldbusser
International Network Services International Network Services
16 October 2001 December 2002
Version 2 of the Protocol Operations for Version 2 of the Protocol Operations for
the Simple Network Management Protocol the Simple Network Management Protocol (SNMP)
<draft-ietf-snmpv3-update-proto-08.txt>
Status of this Memo Status of this Memo
This document is an Internet-Draft and is in full conformance with This document specifies an Internet standards track protocol for the
all provisions of Section 10 of RFC2026. Internet-Drafts are working Internet community, and requests discussion and suggestions for
documents of the Internet Engineering Task Force (IETF), its areas, improvements. Please refer to the current edition of the "Internet
and its working groups. Note that other groups may also distribute Official Protocol Standards" (STD 1) for the standardization state
working documents as Internet-Drafts. and status of this protocol. Distribution of this memo is unlimited.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
The list of current Internet-Drafts can be accessed at
http://www.ietf.org/ietf/1id-abstracts.txt
The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html
Copyright Notice Copyright Notice
Copyright (C) The Internet Society (2001). All Rights Reserved. Copyright (C) The Internet Society (2002). All Rights Reserved.
Abstract Abstract
This document defines version 2 of the protocol operations for the This document defines version 2 of the protocol operations for the
Simple Network Management Protocol (SNMP). This document obsoletes Simple Network Management Protocol (SNMP). It defines the syntax and
RFC 1905. It defines the syntax and elements of procedure for elements of procedure for sending, receiving, and processing SNMP
sending, receiving, and processing SNMP PDUs. PDUs. This document obsoletes RFC 1905.
Table of Contents Table of Contents
1. Introduction ................................................ 3 1. Introduction ................................................ 3
2. Overview .................................................... 4 2. Overview .................................................... 4
2.1. Management Information .................................... 4 2.1. Management Information .................................... 4
2.2. Retransmission of Requests ................................ 4 2.2. Retransmission of Requests ................................ 4
2.3. Message Sizes ............................................. 4 2.3. Message Sizes ............................................. 4
2.4. Transport Mappings ........................................ 5 2.4. Transport Mappings ........................................ 5
2.5. SMIv2 Data Type Mappings .................................. 5 2.5. SMIv2 Data Type Mappings .................................. 6
3. Definitions ................................................. 6 3. Definitions ................................................. 6
4. Protocol Specification ...................................... 11 4. Protocol Specification ...................................... 9
4.1. Common Constructs ......................................... 11 4.1. Common Constructs ......................................... 9
4.2. PDU Processing ............................................ 11 4.2. PDU Processing ............................................ 10
4.2.1. The GetRequest-PDU ...................................... 12 4.2.1. The GetRequest-PDU ...................................... 10
4.2.2. The GetNextRequest-PDU .................................. 13 4.2.2. The GetNextRequest-PDU .................................. 11
4.2.2.1. Example of Table Traversal ............................ 14 4.2.2.1. Example of Table Traversal ............................ 12
4.2.3. The GetBulkRequest-PDU .................................. 16 4.2.3. The GetBulkRequest-PDU .................................. 14
4.2.3.1. Another Example of Table Traversal .................... 19 4.2.3.1. Another Example of Table Traversal .................... 17
4.2.4. The Response-PDU ........................................ 20 4.2.4. The Response-PDU ........................................ 18
4.2.5. The SetRequest-PDU ...................................... 21 4.2.5. The SetRequest-PDU ...................................... 19
4.2.6. The SNMPv2-Trap-PDU ..................................... 24 4.2.6. The SNMPv2-Trap-PDU ..................................... 22
4.2.7. The InformRequest-PDU ................................... 24 4.2.7. The InformRequest-PDU ................................... 23
5. Notice on Intellectual Property ............................. 25 5. Notice on Intellectual Property ............................. 24
6. Acknowledgments ............................................. 26 6. Acknowledgments ............................................. 24
7. Security Considerations ..................................... 27 7. Security Considerations ..................................... 26
8. References .................................................. 28 8. References .................................................. 26
9. Editor's Address ............................................ 30 8.1. Normative References ...................................... 26
10. Changes from RFC 1905 ...................................... 30 8.2. Informative References .................................... 27
11. Issues ..................................................... 32 9. Changes from RFC 1905 ....................................... 28
12. Full Copyright Statement ................................... 34 10. Editor's Address ........................................... 30
11. Full Copyright Statement ................................... 31
1. Introduction 1. Introduction
The SNMP Management Framework at the time of this writing consists of The SNMP Management Framework at the time of this writing consists of
five major components: five major components:
- An overall architecture, described in RFC -ARC [RFC-ARC]. - An overall architecture, described in STD 62, RFC 3411
[RFC3411].
- Mechanisms for describing and naming objects and events for - Mechanisms for describing and naming objects and events for the
the purpose of management. The first version of this purpose of management. The first version of this Structure of
Structure of Management Information (SMI) is called SMIv1 Management Information (SMI) is called SMIv1 and described in
and described in STD 16, RFC 1155 [RFC1155], STD 16, RFC STD 16, RFC 1155 [RFC1155], STD 16, RFC 1212 [RFC1212] and RFC
1212 [RFC1212] and RFC 1215 [RFC1215]. The second version, 1215 [RFC1215]. The second version, called SMIv2, is described
called SMIv2, is described in STD 58, RFC 2578 [RFC2578], in STD 58, RFC 2578 [RFC2578], STD 58, RFC 2579 [RFC2579] and
STD 58, RFC 2579 [RFC2579] and STD 58, RFC 2580 [RFC2580]. STD 58, RFC 2580 [RFC2580].
- Message protocols for transferring management information. - Message protocols for transferring management information. The
The first version of the SNMP message protocol is called first version of the SNMP message protocol is called SNMPv1 and
SNMPv1 and described in STD 15, RFC 1157 [RFC1157]. A described in STD 15, RFC 1157 [RFC1157]. A second version of
second version of the SNMP message protocol, which is not the SNMP message protocol, which is not an Internet standards
an Internet standards track protocol, is called SNMPv2c and track protocol, is called SNMPv2c and described in RFC 1901
described in RFC 1901 [RFC1901] and RFC -TMM [RFC-TMM]. [RFC1901] and STD 62, RFC 3417 [RFC3417]. The third version of
The third version of the message protocol is called SNMPv3 the message protocol is called SNMPv3 and described in STD 62,
and described in RFC -TMM [RFC-TMM], RFC -MPD [RFC-MPD] and RFC 3417 [RFC3417], RFC 3412 [RFC3412] and RFC 3414 [RFC3414].
RFC -USM [RFC-USM].
- Protocol operations for accessing management information. - Protocol operations for accessing management information. The
The first set of protocol operations and associated PDU first set of protocol operations and associated PDU formats is
formats is described in STD 15, RFC 1157 [RFC1157]. A described in STD 15, RFC 1157 [RFC1157]. A second set of
second set of protocol operations and associated PDU protocol operations and associated PDU formats is described in
formats is described in this document. this document.
- A set of fundamental applications described in RFC -APL - A set of fundamental applications described in STD 62, RFC 3413
[RFC-APL] and the view-based access control mechanism [RFC3413] and the view-based access control mechanism described
described in RFC -ACM [RFC-ACM]. in STD 62, RFC 3415 [RFC3415].
A more detailed introduction to the SNMP Management Framework at the A more detailed introduction to the SNMP Management Framework at the
time of this writing can be found in RFC 2570 [RFC2570]. time of this writing can be found in RFC 3410 [RFC3410].
Managed objects are accessed via a virtual information store, termed Managed objects are accessed via a virtual information store, termed
the Management Information Base or MIB. Objects in the MIB are the Management Information Base or MIB. Objects in the MIB are
defined using the mechanisms defined in the SMI. defined using the mechanisms defined in the SMI.
This document, Version 2 of the Protocol Operations for the Simple This document, Version 2 of the Protocol Operations for the Simple
Network Management Protocol, defines the operations of the protocol Network Management Protocol, defines the operations of the protocol
with respect to the sending and receiving of PDUs to be carried by with respect to the sending and receiving of PDUs to be carried by
the message protocol. the message protocol.
skipping to change at page 4, line 27 skipping to change at page 4, line 27
[RFC2578] or the textual conventions based on the SMI [RFC2579]. The [RFC2578] or the textual conventions based on the SMI [RFC2579]. The
term "variable binding" normally refers to the pairing of the name of term "variable binding" normally refers to the pairing of the name of
a variable and its associated value. However, if certain kinds of a variable and its associated value. However, if certain kinds of
exceptional conditions occur during processing of a retrieval exceptional conditions occur during processing of a retrieval
request, a variable binding will pair a name and an indication of request, a variable binding will pair a name and an indication of
that exception. that exception.
A variable-binding list is a simple list of variable bindings. A variable-binding list is a simple list of variable bindings.
The name of a variable is an OBJECT IDENTIFIER which is the The name of a variable is an OBJECT IDENTIFIER which is the
concatenation of the OBJECT IDENTIFIER of the corresponding concatenation of the OBJECT IDENTIFIER of the corresponding object-
object-type together with an OBJECT IDENTIFIER fragment identifying type together with an OBJECT IDENTIFIER fragment identifying the
the instance. The OBJECT IDENTIFIER of the corresponding object-type instance. The OBJECT IDENTIFIER of the corresponding object-type is
is called the OBJECT IDENTIFIER prefix of the variable. called the OBJECT IDENTIFIER prefix of the variable.
2.2. Retransmission of Requests 2.2. Retransmission of Requests
For all types of request in this protocol, the receiver is required For all types of request in this protocol, the receiver is required
under normal circumstances, to generate and transmit a response to under normal circumstances, to generate and transmit a response to
the originator of the request. Whether or not a request should be the originator of the request. Whether or not a request should be
retransmitted if no corresponding response is received in an retransmitted if no corresponding response is received in an
appropriate time interval, is at the discretion of the application appropriate time interval, is at the discretion of the application
originating the request. This will normally depend on the urgency of originating the request. This will normally depend on the urgency of
the request. However, such an application needs to act responsibly the request. However, such an application needs to act responsibly
in respect to the frequency and duration of re-transmissions. See in respect to the frequency and duration of re-transmissions. See
BCP 41 [RFC2914] for discussion of relevant congestion control BCP 41 [RFC2914] for discussion of relevant congestion control
principles. principles.
2.3. Message Sizes 2.3. Message Sizes
The maximum size of an SNMP message is limited to the minimum of: The maximum size of an SNMP message is limited to the minimum of:
(1) the maximum message size which the destination SNMP entity can (1) the maximum message size which the destination SNMP entity can
accept; and, accept; and,
(2) the maximum message size which the source SNMP entity can (2) the maximum message size which the source SNMP entity can
generate. generate.
The former may be known on a per-recipient basis; and in the absence The former may be known on a per-recipient basis; and in the absence
of such knowledge, is indicated by transport domain used when sending of such knowledge, is indicated by transport domain used when sending
the message. The latter is imposed by implementation-specific local the message. The latter is imposed by implementation-specific local
constraints. constraints.
Each transport mapping for the SNMP indicates the minimum message Each transport mapping for the SNMP indicates the minimum message
size which a SNMP implementation must be able to produce or consume. size which a SNMP implementation must be able to produce or consume.
Although implementations are encouraged to support larger values Although implementations are encouraged to support larger values
whenever possible, a conformant implementation must never generate whenever possible, a conformant implementation must never generate
skipping to change at page 5, line 44 skipping to change at page 5, line 46
accordingly, so as to reduce the risk of fragmentation. In accordingly, so as to reduce the risk of fragmentation. In
particular, under conditions of network stress, only small values particular, under conditions of network stress, only small values
should be used for max-repetitions. should be used for max-repetitions.
2.4. Transport Mappings 2.4. Transport Mappings
It is important to note that the exchange of SNMP messages requires It is important to note that the exchange of SNMP messages requires
only an unreliable datagram service, with every message being only an unreliable datagram service, with every message being
entirely and independently contained in a single transport datagram. entirely and independently contained in a single transport datagram.
Specific transport mappings and encoding rules are specified Specific transport mappings and encoding rules are specified
elsewhere [RFC-TMM]. However, the preferred mapping is the use of elsewhere [RFC3417]. However, the preferred mapping is the use of
the User Datagram Protocol [RFC768]. the User Datagram Protocol [RFC768].
2.5. SMIv2 Data Type Mappings 2.5. SMIv2 Data Type Mappings
The SMIv2 [RFC2578] defines 11 base types (INTEGER, OCTET STRING, The SMIv2 [RFC2578] defines 11 base types (INTEGER, OCTET STRING,
OBJECT IDENTIFIER, Integer32, IpAddress, Counter32, Gauge32, OBJECT IDENTIFIER, Integer32, IpAddress, Counter32, Gauge32,
Unsigned32, TimeTicks, Opaque, Counter64) and the BITS construct. The Unsigned32, TimeTicks, Opaque, Counter64) and the BITS construct.
SMIv2 base types are mapped to the corresponding selection type in The SMIv2 base types are mapped to the corresponding selection type
the SimpleSyntax and ApplicationSyntax choices of the ASN.1 SNMP in the SimpleSyntax and ApplicationSyntax choices of the ASN.1 SNMP
protocol definition. Note that the INTEGER and Integer32 SMIv2 base protocol definition. Note that the INTEGER and Integer32 SMIv2 base
types are mapped to the integer-value selection type of the types are mapped to the integer-value selection type of the
SimpleSyntax choice. Similarly, the Gauge32 and Unsigned32 SMIv2 base SimpleSyntax choice. Similarly, the Gauge32 and Unsigned32 SMIv2
types are mapped to the unsigned-integer-value selection type of the base types are mapped to the unsigned-integer-value selection type of
ApplicationSyntax choice. the ApplicationSyntax choice.
The SMIv2 BITS construct is mapped to the string-value selection type The SMIv2 BITS construct is mapped to the string-value selection type
of the SimpleSyntax choice. A BITS value is encoded as an OCTET of the SimpleSyntax choice. A BITS value is encoded as an OCTET
STRING, in which all the named bits in (the definition of) the STRING, in which all the named bits in (the definition of) the
bitstring, commencing with the first bit and proceeding to the last bitstring, commencing with the first bit and proceeding to the last
bit, are placed in bits 8 (high order bit) to 1 (low order bit) of bit, are placed in bits 8 (high order bit) to 1 (low order bit) of
the first octet, followed by bits 8 to 1 of each subsequent octet in the first octet, followed by bits 8 to 1 of each subsequent octet in
turn, followed by as many bits as are needed of the final subsequent turn, followed by as many bits as are needed of the final subsequent
octet, commencing with bit 8. Remaining bits, if any, of the final octet, commencing with bit 8. Remaining bits, if any, of the final
octet are set to zero on generation and ignored on receipt. octet are set to zero on generation and ignored on receipt.
3. Definitions 3. Definitions
The PDU syntax is defined using ASN.1 notation [ASN1].
SNMPv2-PDU DEFINITIONS ::= BEGIN SNMPv2-PDU DEFINITIONS ::= BEGIN
ObjectName ::= OBJECT IDENTIFIER ObjectName ::= OBJECT IDENTIFIER
ObjectSyntax ::= ObjectSyntax ::= CHOICE {
CHOICE { simple SimpleSyntax,
simple application-wide ApplicationSyntax }
SimpleSyntax,
application-wide
ApplicationSyntax
}
SimpleSyntax ::=
CHOICE {
integer-value
INTEGER (-2147483648..2147483647),
string-value
OCTET STRING (SIZE (0..65535)),
objectID-value
OBJECT IDENTIFIER
}
ApplicationSyntax ::=
CHOICE {
ipAddress-value
IpAddress,
counter-value
Counter32,
timeticks-value
TimeTicks,
arbitrary-value
Opaque,
big-counter-value SimpleSyntax ::= CHOICE {
Counter64, integer-value INTEGER (-2147483648..2147483647),
string-value OCTET STRING (SIZE (0..65535)),
objectID-value OBJECT IDENTIFIER }
unsigned-integer-value ApplicationSyntax ::= CHOICE {
Unsigned32 ipAddress-value IpAddress,
} counter-value Counter32,
timeticks-value TimeTicks,
arbitrary-value Opaque,
big-counter-value Counter64,
unsigned-integer-value Unsigned32 }
IpAddress ::= [APPLICATION 0] IMPLICIT OCTET STRING (SIZE (4)) IpAddress ::= [APPLICATION 0] IMPLICIT OCTET STRING (SIZE (4))
Counter32 ::= [APPLICATION 1] IMPLICIT INTEGER (0..4294967295) Counter32 ::= [APPLICATION 1] IMPLICIT INTEGER (0..4294967295)
Unsigned32 ::= [APPLICATION 2] IMPLICIT INTEGER (0..4294967295) Unsigned32 ::= [APPLICATION 2] IMPLICIT INTEGER (0..4294967295)
Gauge32 ::= Unsigned32 Gauge32 ::= Unsigned32
TimeTicks ::= [APPLICATION 3] IMPLICIT INTEGER (0..4294967295) TimeTicks ::= [APPLICATION 3] IMPLICIT INTEGER (0..4294967295)
Opaque ::= [APPLICATION 4] IMPLICIT OCTET STRING Opaque ::= [APPLICATION 4] IMPLICIT OCTET STRING
Counter64 ::= [APPLICATION 6] Counter64 ::= [APPLICATION 6]
IMPLICIT INTEGER (0..18446744073709551615) IMPLICIT INTEGER (0..18446744073709551615)
-- protocol data units -- protocol data units
PDUs ::= PDUs ::= CHOICE {
CHOICE { get-request GetRequest-PDU,
get-request get-next-request GetNextRequest-PDU,
GetRequest-PDU, get-bulk-request GetBulkRequest-PDU,
response Response-PDU,
get-next-request set-request SetRequest-PDU,
GetNextRequest-PDU, inform-request InformRequest-PDU,
snmpV2-trap SNMPv2-Trap-PDU,
get-bulk-request report Report-PDU }
GetBulkRequest-PDU,
response
Response-PDU,
set-request
SetRequest-PDU,
inform-request
InformRequest-PDU,
snmpV2-trap
SNMPv2-Trap-PDU,
report
Report-PDU
}
-- PDUs -- PDUs
GetRequest-PDU ::= GetRequest-PDU ::= [0] IMPLICIT PDU
[0]
IMPLICIT PDU
GetNextRequest-PDU ::= GetNextRequest-PDU ::= [1] IMPLICIT PDU
[1]
IMPLICIT PDU
Response-PDU ::= Response-PDU ::= [2] IMPLICIT PDU
[2]
IMPLICIT PDU
SetRequest-PDU ::= SetRequest-PDU ::= [3] IMPLICIT PDU
[3]
IMPLICIT PDU
-- [4] is obsolete -- [4] is obsolete
GetBulkRequest-PDU ::= GetBulkRequest-PDU ::= [5] IMPLICIT BulkPDU
[5]
IMPLICIT BulkPDU
InformRequest-PDU ::= InformRequest-PDU ::= [6] IMPLICIT PDU
[6]
IMPLICIT PDU
SNMPv2-Trap-PDU ::= SNMPv2-Trap-PDU ::= [7] IMPLICIT PDU
[7]
IMPLICIT PDU
-- Usage and precise semantics of Report-PDU are not defined -- Usage and precise semantics of Report-PDU are not defined
-- in this document. Any SNMP administrative framework making -- in this document. Any SNMP administrative framework making
-- use of this PDU must define its usage and semantics. -- use of this PDU must define its usage and semantics.
Report-PDU ::=
[8]
IMPLICIT PDU
max-bindings Report-PDU ::= [8] IMPLICIT PDU
INTEGER ::= 2147483647
PDU ::= max-bindings INTEGER ::= 2147483647
SEQUENCE {
request-id
INTEGER (-214783648..214783647),
error-status -- sometimes ignored PDU ::= SEQUENCE {
request-id INTEGER (-214783648..214783647),
error-status -- sometimes ignored
INTEGER { INTEGER {
noError(0), noError(0),
tooBig(1), tooBig(1),
noSuchName(2), -- for proxy compatibility noSuchName(2), -- for proxy compatibility
badValue(3), -- for proxy compatibility badValue(3), -- for proxy compatibility
readOnly(4), -- for proxy compatibility readOnly(4), -- for proxy compatibility
genErr(5), genErr(5),
noAccess(6), noAccess(6),
wrongType(7), wrongType(7),
wrongLength(8), wrongLength(8),
skipping to change at page 10, line 7 skipping to change at page 8, line 44
error-index -- sometimes ignored error-index -- sometimes ignored
INTEGER (0..max-bindings), INTEGER (0..max-bindings),
variable-bindings -- values are sometimes ignored variable-bindings -- values are sometimes ignored
VarBindList VarBindList
} }
BulkPDU ::= -- must be identical in BulkPDU ::= -- must be identical in
SEQUENCE { -- structure to PDU SEQUENCE { -- structure to PDU
request-id request-id INTEGER (-214783648..214783647),
INTEGER (-214783648..214783647), non-repeaters INTEGER (0..max-bindings),
max-repetitions INTEGER (0..max-bindings),
non-repeaters
INTEGER (0..max-bindings),
max-repetitions
INTEGER (0..max-bindings),
variable-bindings -- values are ignored variable-bindings -- values are ignored
VarBindList VarBindList
} }
-- variable binding -- variable binding
VarBind ::= SEQUENCE {
VarBind ::= name ObjectName,
SEQUENCE {
name
ObjectName,
CHOICE { CHOICE {
value value ObjectSyntax,
ObjectSyntax, unSpecified NULL, -- in retrieval requests
unSpecified -- in retrieval requests
NULL,
-- exceptions in responses -- exceptions in responses
noSuchObject[0] noSuchObject [0] IMPLICIT NULL,
IMPLICIT NULL, noSuchInstance [1] IMPLICIT NULL,
endOfMibView [2] IMPLICIT NULL
noSuchInstance[1]
IMPLICIT NULL,
endOfMibView[2]
IMPLICIT NULL
} }
} }
-- variable-binding list -- variable-binding list
VarBindList ::= VarBindList ::= SEQUENCE (SIZE (0..max-bindings)) OF VarBind
SEQUENCE (SIZE (0..max-bindings)) OF
VarBind
END END
4. Protocol Specification 4. Protocol Specification
4.1. Common Constructs 4.1. Common Constructs
The value of the request-id field in a Response-PDU takes the value The value of the request-id field in a Response-PDU takes the value
of the request-id field in the request PDU to which it is a response. of the request-id field in the request PDU to which it is a response.
By use of the request-id value, an application can distinguish the By use of the request-id value, an application can distinguish the
skipping to change at page 11, line 41 skipping to change at page 10, line 5
A non-zero value of the error-status field in a Response-PDU is used A non-zero value of the error-status field in a Response-PDU is used
to indicate that an error occurred to prevent the processing of the to indicate that an error occurred to prevent the processing of the
request. In these cases, a non-zero value of the Response-PDU's request. In these cases, a non-zero value of the Response-PDU's
error-index field provides additional information by identifying error-index field provides additional information by identifying
which variable binding in the list caused the error. A variable which variable binding in the list caused the error. A variable
binding is identified by its index value. The first variable binding binding is identified by its index value. The first variable binding
in a variable-binding list is index one, the second is index two, in a variable-binding list is index one, the second is index two,
etc. etc.
SNMP limits OBJECT IDENTIFIER values to a maximum of 128 SNMP limits OBJECT IDENTIFIER values to a maximum of 128 sub-
sub-identifiers, where each sub-identifier has a maximum value of identifiers, where each sub-identifier has a maximum value of
2**32-1. 2**32-1.
4.2. PDU Processing 4.2. PDU Processing
In the elements of procedure below, any field of a PDU which is not In the elements of procedure below, any field of a PDU which is not
referenced by the relevant procedure is ignored by the receiving SNMP referenced by the relevant procedure is ignored by the receiving SNMP
entity. However, all components of a PDU, including those whose entity. However, all components of a PDU, including those whose
values are ignored by the receiving SNMP entity, must have valid values are ignored by the receiving SNMP entity, must have valid
ASN.1 syntax and encoding. For example, some PDUs (e.g., the ASN.1 syntax and encoding. For example, some PDUs (e.g., the
GetRequest-PDU) are concerned only with the name of a variable and GetRequest-PDU) are concerned only with the name of a variable and
skipping to change at page 12, line 36 skipping to change at page 10, line 48
A GetRequest-PDU is generated and transmitted at the request of an A GetRequest-PDU is generated and transmitted at the request of an
application. application.
Upon receipt of a GetRequest-PDU, the receiving SNMP entity processes Upon receipt of a GetRequest-PDU, the receiving SNMP entity processes
each variable binding in the variable-binding list to produce a each variable binding in the variable-binding list to produce a
Response-PDU. All fields of the Response-PDU have the same values as Response-PDU. All fields of the Response-PDU have the same values as
the corresponding fields of the received request except as indicated the corresponding fields of the received request except as indicated
below. Each variable binding is processed as follows: below. Each variable binding is processed as follows:
(1) If the variable binding's name exactly matches the name of a (1) If the variable binding's name exactly matches the name of a
variable accessible by this request, then the variable binding's variable accessible by this request, then the variable
value field is set to the value of the named variable. binding's value field is set to the value of the named
variable.
(2) Otherwise, if the variable binding's name does not have an (2) Otherwise, if the variable binding's name does not have an
OBJECT IDENTIFIER prefix which exactly matches the OBJECT OBJECT IDENTIFIER prefix which exactly matches the OBJECT
IDENTIFIER prefix of any (potential) variable accessible by this IDENTIFIER prefix of any (potential) variable accessible by
request, then its value field is set to "noSuchObject". this request, then its value field is set to "noSuchObject".
(3) Otherwise, the variable binding's value field is set to (3) Otherwise, the variable binding's value field is set to
"noSuchInstance". "noSuchInstance".
If the processing of any variable binding fails for a reason other If the processing of any variable binding fails for a reason other
than listed above, then the Response-PDU is re-formatted with the than listed above, then the Response-PDU is re-formatted with the
same values in its request-id and variable-bindings fields as the same values in its request-id and variable-bindings fields as the
received GetRequest-PDU, with the value of its error-status field set received GetRequest-PDU, with the value of its error-status field set
to "genErr", and the value of its error-index field is set to the to "genErr", and the value of its error-index field is set to the
index of the failed variable binding. index of the failed variable binding.
Otherwise, the value of the Response-PDU's error-status field is set Otherwise, the value of the Response-PDU's error-status field is set
to "noError", and the value of its error-index field is zero. to "noError", and the value of its error-index field is zero.
The generated Response-PDU is then encapsulated into a message. If The generated Response-PDU is then encapsulated into a message. If
the size of the resultant message is less than or equal to both a the size of the resultant message is less than or equal to both a
local constraint and the maximum message size of the originator, it local constraint and the maximum message size of the originator, it
is transmitted to the originator of the GetRequest-PDU. is transmitted to the originator of the GetRequest-PDU.
Otherwise, an alternate Response-PDU is generated. This alternate Otherwise, an alternate Response-PDU is generated. This alternate
Response-PDU is formatted with the same value in its request-id field Response-PDU is formatted with the same value in its request-id field
as the received GetRequest-PDU, with the value of its error-status as the received GetRequest-PDU, with the value of its error-status
field set to "tooBig", the value of its error-index field set to field set to "tooBig", the value of its error-index field set to
zero, and an empty variable-bindings field. This alternate zero, and an empty variable-bindings field. This alternate
Response-PDU is then encapsulated into a message. If the size of the Response-PDU is then encapsulated into a message. If the size of the
resultant message is less than or equal to both a local constraint resultant message is less than or equal to both a local constraint
and the maximum message size of the originator, it is transmitted to and the maximum message size of the originator, it is transmitted to
the originator of the GetRequest-PDU. Otherwise, the snmpSilentDrops the originator of the GetRequest-PDU. Otherwise, the snmpSilentDrops
[RFC-MIB] counter is incremented and the resultant message is [RFC3418] counter is incremented and the resultant message is
discarded. discarded.
4.2.2. The GetNextRequest-PDU 4.2.2. The GetNextRequest-PDU
A GetNextRequest-PDU is generated and transmitted at the request of A GetNextRequest-PDU is generated and transmitted at the request of
an application. an application.
Upon receipt of a GetNextRequest-PDU, the receiving SNMP entity Upon receipt of a GetNextRequest-PDU, the receiving SNMP entity
processes each variable binding in the variable-binding list to processes each variable binding in the variable-binding list to
produce a Response-PDU. All fields of the Response-PDU have the same produce a Response-PDU. All fields of the Response-PDU have the same
values as the corresponding fields of the received request except as values as the corresponding fields of the received request except as
indicated below. Each variable binding is processed as follows: indicated below. Each variable binding is processed as follows:
(1) The variable is located which is in the lexicographically (1) The variable is located which is in the lexicographically
ordered list of the names of all variables which are accessible ordered list of the names of all variables which are
by this request and whose name is the first lexicographic accessible by this request and whose name is the first
successor of the variable binding's name in the incoming lexicographic successor of the variable binding's name in
GetNextRequest-PDU. The corresponding variable binding's name the incoming GetNextRequest-PDU. The corresponding variable
and value fields in the Response-PDU are set to the name and binding's name and value fields in the Response-PDU are set
value of the located variable. to the name and value of the located variable.
(2) If the requested variable binding's name does not (2) If the requested variable binding's name does not
lexicographically precede the name of any variable accessible by lexicographically precede the name of any variable
this request, i.e., there is no lexicographic successor, then accessible by this request, i.e., there is no lexicographic
the corresponding variable binding produced in the Response-PDU successor, then the corresponding variable binding produced
has its value field set to "endOfMibView", and its name field in the Response-PDU has its value field set to
set to the variable binding's name in the request. "endOfMibView", and its name field set to the variable
binding's name in the request.
If the processing of any variable binding fails for a reason other If the processing of any variable binding fails for a reason other
than listed above, then the Response-PDU is re-formatted with the than listed above, then the Response-PDU is re-formatted with the
same values in its request-id and variable-bindings fields as the same values in its request-id and variable-bindings fields as the
received GetNextRequest-PDU, with the value of its error-status field received GetNextRequest-PDU, with the value of its error-status field
set to "genErr", and the value of its error-index field is set to the set to "genErr", and the value of its error-index field is set to the
index of the failed variable binding. index of the failed variable binding.
Otherwise, the value of the Response-PDU's error-status field is set Otherwise, the value of the Response-PDU's error-status field is set
to "noError", and the value of its error-index field is zero. to "noError", and the value of its error-index field is zero.
The generated Response-PDU is then encapsulated into a message. If The generated Response-PDU is then encapsulated into a message. If
the size of the resultant message is less than or equal to both a the size of the resultant message is less than or equal to both a
local constraint and the maximum message size of the originator, it local constraint and the maximum message size of the originator, it
is transmitted to the originator of the GetNextRequest-PDU. is transmitted to the originator of the GetNextRequest-PDU.
Otherwise, an alternate Response-PDU is generated. This alternate Otherwise, an alternate Response-PDU is generated. This alternate
Response-PDU is formatted with the same values in its request-id Response-PDU is formatted with the same values in its request-id
field as the received GetNextRequest-PDU, with the value of its field as the received GetNextRequest-PDU, with the value of its
error-status field set to "tooBig", the value of its error-index error-status field set to "tooBig", the value of its error-index
field set to zero, and an empty variable-bindings field. This field set to zero, and an empty variable-bindings field. This
alternate Response-PDU is then encapsulated into a message. If the alternate Response-PDU is then encapsulated into a message. If the
size of the resultant message is less than or equal to both a local size of the resultant message is less than or equal to both a local
constraint and the maximum message size of the originator, it is constraint and the maximum message size of the originator, it is
transmitted to the originator of the GetNextRequest-PDU. Otherwise, transmitted to the originator of the GetNextRequest-PDU. Otherwise,
the snmpSilentDrops [RFC-MIB] counter is incremented and the the snmpSilentDrops [RFC3418] counter is incremented and the
resultant message is discarded. resultant message is discarded.
4.2.2.1. Example of Table Traversal 4.2.2.1. Example of Table Traversal
An important use of the GetNextRequest-PDU is the traversal of An important use of the GetNextRequest-PDU is the traversal of
conceptual tables of information within a MIB. The semantics of this conceptual tables of information within a MIB. The semantics of this
type of request, together with the method of identifying individual type of request, together with the method of identifying individual
instances of objects in the MIB, provides access to related objects instances of objects in the MIB, provides access to related objects
in the MIB as if they enjoyed a tabular organization. in the MIB as if they enjoyed a tabular organization.
In the protocol exchange sketched below, an application retrieves the In the protocol exchange sketched below, an application retrieves the
media-dependent physical address and the address-mapping type for media-dependent physical address and the address-mapping type for
each entry in the IP net-to-media Address Translation Table [RFC1213] each entry in the IP net-to-media Address Translation Table [RFC1213]
of a particular network element. It also retrieves the value of of a particular network element. It also retrieves the value of
sysUpTime [RFC-MIB], at which the mappings existed. Suppose that the sysUpTime [RFC3418], at which the mappings existed. Suppose that the
command responder's IP net-to-media table has three entries: command responder's IP net-to-media table has three entries:
Interface-Number Network-Address Physical-Address Type Interface-Number Network-Address Physical-Address Type
1 10.0.0.51 00:00:10:01:23:45 static 1 10.0.0.51 00:00:10:01:23:45 static
1 9.2.3.4 00:00:10:54:32:10 dynamic 1 9.2.3.4 00:00:10:54:32:10 dynamic
2 10.0.0.15 00:00:10:98:76:54 dynamic 2 10.0.0.15 00:00:10:98:76:54 dynamic
The SNMP entity supporting a command generator application begins by The SNMP entity supporting a command generator application begins by
sending a GetNextRequest-PDU containing the indicated OBJECT sending a GetNextRequest-PDU containing the indicated OBJECT
IDENTIFIER values as the requested variable names: IDENTIFIER values as the requested variable names:
GetNextRequest ( sysUpTime, GetNextRequest ( sysUpTime,
ipNetToMediaPhysAddress, ipNetToMediaPhysAddress,
ipNetToMediaType ) ipNetToMediaType )
The SNMP entity supporting a command responder application responds The SNMP entity supporting a command responder application responds
with a Response-PDU: with a Response-PDU:
Response (( sysUpTime.0 = "123456" ), Response (( sysUpTime.0 = "123456" ),
( ipNetToMediaPhysAddress.1.9.2.3.4 = ( ipNetToMediaPhysAddress.1.9.2.3.4 = "000010543210" ),
"000010543210" ),
( ipNetToMediaType.1.9.2.3.4 = "dynamic" )) ( ipNetToMediaType.1.9.2.3.4 = "dynamic" ))
The SNMP entity supporting the command generator application The SNMP entity supporting the command generator application
continues with: continues with:
GetNextRequest ( sysUpTime, GetNextRequest ( sysUpTime,
ipNetToMediaPhysAddress.1.9.2.3.4, ipNetToMediaPhysAddress.1.9.2.3.4,
ipNetToMediaType.1.9.2.3.4 ) ipNetToMediaType.1.9.2.3.4 )
The SNMP entity supporting the command responder application responds The SNMP entity supporting the command responder application responds
with: with:
Response (( sysUpTime.0 = "123461" ), Response (( sysUpTime.0 = "123461" ),
( ipNetToMediaPhysAddress.1.10.0.0.51 = ( ipNetToMediaPhysAddress.1.10.0.0.51 = "000010012345" ),
"000010012345" ),
( ipNetToMediaType.1.10.0.0.51 = "static" )) ( ipNetToMediaType.1.10.0.0.51 = "static" ))
The SNMP entity supporting the command generator application The SNMP entity supporting the command generator application
continues with: continues with:
GetNextRequest ( sysUpTime, GetNextRequest ( sysUpTime,
ipNetToMediaPhysAddress.1.10.0.0.51, ipNetToMediaPhysAddress.1.10.0.0.51,
ipNetToMediaType.1.10.0.0.51 ) ipNetToMediaType.1.10.0.0.51 )
The SNMP entity supporting the command responder application responds The SNMP entity supporting the command responder application responds
with: with:
Response (( sysUpTime.0 = "123466" ), Response (( sysUpTime.0 = "123466" ),
( ipNetToMediaPhysAddress.2.10.0.0.15 = ( ipNetToMediaPhysAddress.2.10.0.0.15 = "000010987654" ),
"000010987654" ),
( ipNetToMediaType.2.10.0.0.15 = "dynamic" )) ( ipNetToMediaType.2.10.0.0.15 = "dynamic" ))
The SNMP entity supporting the command generator application The SNMP entity supporting the command generator application
continues with: continues with:
GetNextRequest ( sysUpTime, GetNextRequest ( sysUpTime,
ipNetToMediaPhysAddress.2.10.0.0.15, ipNetToMediaPhysAddress.2.10.0.0.15,
ipNetToMediaType.2.10.0.0.15 ) ipNetToMediaType.2.10.0.0.15 )
As there are no further entries in the table, the SNMP entity As there are no further entries in the table, the SNMP entity
supporting the command responder application responds with the supporting the command responder application responds with the
variables that are next in the lexicographical ordering of the variables that are next in the lexicographical ordering of the
accessible object names, for example: accessible object names, for example:
Response (( sysUpTime.0 = "123471" ), Response (( sysUpTime.0 = "123471" ),
( ipNetToMediaNetAddress.1.9.2.3.4 = ( ipNetToMediaNetAddress.1.9.2.3.4 = "9.2.3.4" ),
"9.2.3.4" ),
( ipRoutingDiscards.0 = "2" )) ( ipRoutingDiscards.0 = "2" ))
Note how, having reached the end of the column for Note how, having reached the end of the column for
ipNetToMediaPhysAddress, the second variable binding from the command ipNetToMediaPhysAddress, the second variable binding from the command
responder application has now "wrapped" to the first row in the next responder application has now "wrapped" to the first row in the next
column. Furthermore, note how, having reached the end of the column. Furthermore, note how, having reached the end of the
ipNetToMediaTable for the third variable binding, the command ipNetToMediaTable for the third variable binding, the command
responder application has responded with the next available object, responder application has responded with the next available object,
which is outside that table. This response signals the end of the which is outside that table. This response signals the end of the
table to the command generator application. table to the command generator application.
skipping to change at page 16, line 46 skipping to change at page 14, line 52
not limited to, the efficient and rapid retrieval of large tables. not limited to, the efficient and rapid retrieval of large tables.
Upon receipt of a GetBulkRequest-PDU, the receiving SNMP entity Upon receipt of a GetBulkRequest-PDU, the receiving SNMP entity
processes each variable binding in the variable-binding list to processes each variable binding in the variable-binding list to
produce a Response-PDU with its request-id field having the same produce a Response-PDU with its request-id field having the same
value as in the request. value as in the request.
For the GetBulkRequest-PDU type, the successful processing of each For the GetBulkRequest-PDU type, the successful processing of each
variable binding in the request generates zero or more variable variable binding in the request generates zero or more variable
bindings in the Response-PDU. That is, the one-to-one mapping bindings in the Response-PDU. That is, the one-to-one mapping
between the variable bindings of the GetRequest-PDU, between the variable bindings of the GetRequest-PDU, GetNextRequest-
GetNextRequest-PDU, and SetRequest-PDU types and the resultant PDU, and SetRequest-PDU types and the resultant Response-PDUs does
Response-PDUs does not apply for the mapping between the variable not apply for the mapping between the variable bindings of a
bindings of a GetBulkRequest-PDU and the resultant Response-PDU. GetBulkRequest-PDU and the resultant Response-PDU.
The values of the non-repeaters and max-repetitions fields in the The values of the non-repeaters and max-repetitions fields in the
request specify the processing requested. One variable binding in request specify the processing requested. One variable binding in
the Response-PDU is requested for the first N variable bindings in the Response-PDU is requested for the first N variable bindings in
the request and M variable bindings are requested for each of the R the request and M variable bindings are requested for each of the R
remaining variable bindings in the request. Consequently, the total remaining variable bindings in the request. Consequently, the total
number of requested variable bindings communicated by the request is number of requested variable bindings communicated by the request is
given by N + (M * R), where N is the minimum of: a) the value of the given by N + (M * R), where N is the minimum of: a) the value of the
non-repeaters field in the request, and b) the number of variable non-repeaters field in the request, and b) the number of variable
bindings in the request; M is the value of the max-repetitions field bindings in the request; M is the value of the max-repetitions field
skipping to change at page 17, line 25 skipping to change at page 15, line 28
bindings in the request - N, and b) zero. bindings in the request - N, and b) zero.
The receiving SNMP entity produces a Response-PDU with up to the The receiving SNMP entity produces a Response-PDU with up to the
total number of requested variable bindings communicated by the total number of requested variable bindings communicated by the
request. The request-id shall have the same value as the received request. The request-id shall have the same value as the received
GetBulkRequest-PDU. GetBulkRequest-PDU.
If N is greater than zero, the first through the (N)-th variable If N is greater than zero, the first through the (N)-th variable
bindings of the Response-PDU are each produced as follows: bindings of the Response-PDU are each produced as follows:
(1) The variable is located which is in the lexicographically (1) The variable is located which is in the lexicographically
ordered list of the names of all variables which are accessible ordered list of the names of all variables which are accessible
by this request and whose name is the first lexicographic by this request and whose name is the first lexicographic
successor of the variable binding's name in the incoming successor of the variable binding's name in the incoming
GetBulkRequest-PDU. The corresponding variable binding's name GetBulkRequest-PDU. The corresponding variable binding's name
and value fields in the Response-PDU are set to the name and and value fields in the Response-PDU are set to the name and
value of the located variable. value of the located variable.
(2) If the requested variable binding's name does not (2) If the requested variable binding's name does not
lexicographically precede the name of any variable accessible by lexicographically precede the name of any variable accessible
this request, i.e., there is no lexicographic successor, then by this request, i.e., there is no lexicographic successor,
the corresponding variable binding produced in the Response-PDU then the corresponding variable binding produced in the
has its value field set to "endOfMibView", and its name field Response-PDU has its value field set to "endOfMibView", and its
set to the variable binding's name in the request. name field set to the variable binding's name in the request.
If M and R are non-zero, the (N + 1)-th and subsequent variable If M and R are non-zero, the (N + 1)-th and subsequent variable
bindings of the Response-PDU are each produced in a similar manner. bindings of the Response-PDU are each produced in a similar manner.
For each iteration i, such that i is greater than zero and less than For each iteration i, such that i is greater than zero and less than
or equal to M, and for each repeated variable, r, such that r is or equal to M, and for each repeated variable, r, such that r is
greater than zero and less than or equal to R, the (N + ( (i-1) * R ) greater than zero and less than or equal to R, the (N + ( (i-1) * R )
+ r)-th variable binding of the Response-PDU is produced as follows: + r)-th variable binding of the Response-PDU is produced as follows:
(1) The variable which is in the lexicographically ordered list of (1) The variable which is in the lexicographically ordered list of
the names of all variables which are accessible by this request the names of all variables which are accessible by this request
and whose name is the (i)-th lexicographic successor of the (N + and whose name is the (i)-th lexicographic successor of the (N
r)-th variable binding's name in the incoming GetBulkRequest-PDU + r)-th variable binding's name in the incoming
is located and the variable binding's name and value fields are GetBulkRequest-PDU is located and the variable binding's name
set to the name and value of the located variable. and value fields are set to the name and value of the located
variable.
(2) If there is no (i)-th lexicographic successor, then the (2) If there is no (i)-th lexicographic successor, then the
corresponding variable binding produced in the Response-PDU has corresponding variable binding produced in the Response-PDU has
its value field set to "endOfMibView", and its name field set to its value field set to "endOfMibView", and its name field set
either the last lexicographic successor, or if there are no to either the last lexicographic successor, or if there are no
lexicographic successors, to the (N + r)-th variable binding's lexicographic successors, to the (N + r)-th variable binding's
name in the request. name in the request.
While the maximum number of variable bindings in the Response-PDU is While the maximum number of variable bindings in the Response-PDU is
bounded by N + (M * R), the response may be generated with a lesser bounded by N + (M * R), the response may be generated with a lesser
number of variable bindings (possibly zero) for either of three number of variable bindings (possibly zero) for either of three
reasons. reasons.
(1) If the size of the message encapsulating the Response-PDU (1) If the size of the message encapsulating the Response-PDU
containing the requested number of variable bindings would be containing the requested number of variable bindings would be
greater than either a local constraint or the maximum message greater than either a local constraint or the maximum message
size of the originator, then the response is generated with a size of the originator, then the response is generated with a
lesser number of variable bindings. This lesser number is the lesser number of variable bindings. This lesser number is the
ordered set of variable bindings with some of the variable ordered set of variable bindings with some of the variable
bindings at the end of the set removed, such that the size of bindings at the end of the set removed, such that the size of
the message encapsulating the Response-PDU is approximately the message encapsulating the Response-PDU is approximately
equal to but no greater than either a local constraint or the equal to but no greater than either a local constraint or the
maximum message size of the originator. Note that the number of maximum message size of the originator. Note that the number
variable bindings removed has no relationship to the values of of variable bindings removed has no relationship to the values
N, M, or R. of N, M, or R.
(2) The response may also be generated with a lesser number of (2) The response may also be generated with a lesser number of
variable bindings if for some value of iteration i, such that i variable bindings if for some value of iteration i, such that i
is greater than zero and less than or equal to M, that all of is greater than zero and less than or equal to M, that all of
the generated variable bindings have the value field set to the generated variable bindings have the value field set to
"endOfMibView". In this case, the variable bindings may be "endOfMibView". In this case, the variable bindings may be
truncated after the (N + (i * R))-th variable binding. truncated after the (N + (i * R))-th variable binding.
(3) In the event that the processing of a request with many (3) In the event that the processing of a request with many
repetitions requires a significantly greater amount of repetitions requires a significantly greater amount of
processing time than a normal request, then a command responder processing time than a normal request, then a command responder
application may terminate the request with less than the full application may terminate the request with less than the full
number of repetitions, providing at least one repetition is number of repetitions, providing at least one repetition is
completed. completed.
If the processing of any variable binding fails for a reason other If the processing of any variable binding fails for a reason other
than listed above, then the Response-PDU is re-formatted with the than listed above, then the Response-PDU is re-formatted with the
same values in its request-id and variable-bindings fields as the same values in its request-id and variable-bindings fields as the
received GetBulkRequest-PDU, with the value of its error-status field received GetBulkRequest-PDU, with the value of its error-status field
set to "genErr", and the value of its error-index field is set to the set to "genErr", and the value of its error-index field is set to the
index of the variable binding in the original request which index of the variable binding in the original request which
corresponds to the failed variable binding. corresponds to the failed variable binding.
Otherwise, the value of the Response-PDU's error-status field is set Otherwise, the value of the Response-PDU's error-status field is set
to "noError", and the value of its error-index field to zero. to "noError", and the value of its error-index field to zero.
The generated Response-PDU (possibly with an empty variable-bindings The generated Response-PDU (possibly with an empty variable-bindings
field) is then encapsulated into a message. If the size of the field) is then encapsulated into a message. If the size of the
resultant message is less than or equal to both a local constraint resultant message is less than or equal to both a local constraint
and the maximum message size of the originator, it is transmitted to and the maximum message size of the originator, it is transmitted to
the originator of the GetBulkRequest-PDU. Otherwise, the the originator of the GetBulkRequest-PDU. Otherwise, the
snmpSilentDrops [RFC-MIB] counter is incremented and the resultant snmpSilentDrops [RFC3418] counter is incremented and the resultant
message is discarded. message is discarded.
4.2.3.1. Another Example of Table Traversal 4.2.3.1. Another Example of Table Traversal
This example demonstrates how the GetBulkRequest-PDU can be used as This example demonstrates how the GetBulkRequest-PDU can be used as
an alternative to the GetNextRequest-PDU. The same traversal of the an alternative to the GetNextRequest-PDU. The same traversal of the
IP net-to-media table as shown in Section 4.2.2.1 is achieved with IP net-to-media table as shown in Section 4.2.2.1 is achieved with
fewer exchanges. fewer exchanges.
The SNMP entity supporting the command generator application begins The SNMP entity supporting the command generator application begins
skipping to change at page 19, line 37 skipping to change at page 17, line 45
GetBulkRequest [ non-repeaters = 1, max-repetitions = 2 ] GetBulkRequest [ non-repeaters = 1, max-repetitions = 2 ]
( sysUpTime, ( sysUpTime,
ipNetToMediaPhysAddress, ipNetToMediaPhysAddress,
ipNetToMediaType ) ipNetToMediaType )
The SNMP entity supporting the command responder application responds The SNMP entity supporting the command responder application responds
with a Response-PDU: with a Response-PDU:
Response (( sysUpTime.0 = "123456" ), Response (( sysUpTime.0 = "123456" ),
( ipNetToMediaPhysAddress.1.9.2.3.4 = ( ipNetToMediaPhysAddress.1.9.2.3.4 = "000010543210" ),
"000010543210" ),
( ipNetToMediaType.1.9.2.3.4 = "dynamic" ), ( ipNetToMediaType.1.9.2.3.4 = "dynamic" ),
( ipNetToMediaPhysAddress.1.10.0.0.51 = ( ipNetToMediaPhysAddress.1.10.0.0.51 = "000010012345" ),
"000010012345" ),
( ipNetToMediaType.1.10.0.0.51 = "static" )) ( ipNetToMediaType.1.10.0.0.51 = "static" ))
The SNMP entity supporting the command generator application The SNMP entity supporting the command generator application
continues with: continues with:
GetBulkRequest [ non-repeaters = 1, max-repetitions = 2 ] GetBulkRequest [ non-repeaters = 1, max-repetitions = 2 ]
( sysUpTime, ( sysUpTime,
ipNetToMediaPhysAddress.1.10.0.0.51, ipNetToMediaPhysAddress.1.10.0.0.51,
ipNetToMediaType.1.10.0.0.51 ) ipNetToMediaType.1.10.0.0.51 )
The SNMP entity supporting the command responder application responds The SNMP entity supporting the command responder application responds
with: with:
Response (( sysUpTime.0 = "123466" ), Response (( sysUpTime.0 = "123466" ),
( ipNetToMediaPhysAddress.2.10.0.0.15 = ( ipNetToMediaPhysAddress.2.10.0.0.15 = "000010987654" ),
"000010987654" ), ( ipNetToMediaType.2.10.0.0.15 = "dynamic" ),
( ipNetToMediaType.2.10.0.0.15 = ( ipNetToMediaNetAddress.1.9.2.3.4 = "9.2.3.4" ),
"dynamic" ),
( ipNetToMediaNetAddress.1.9.2.3.4 =
"9.2.3.4" ),
( ipRoutingDiscards.0 = "2" )) ( ipRoutingDiscards.0 = "2" ))
Note how, as in the first example, the variable bindings in the Note how, as in the first example, the variable bindings in the
response indicate that the end of the table has been reached. The response indicate that the end of the table has been reached. The
fourth variable binding does so by returning information from the fourth variable binding does so by returning information from the
next available column; the fifth variable binding does so by next available column; the fifth variable binding does so by
returning information from the first available object returning information from the first available object
lexicographically following the table. This response signals the end lexicographically following the table. This response signals the end
of the table to the command generator application. of the table to the command generator application.
skipping to change at page 20, line 46 skipping to change at page 18, line 51
If both the error-status field and the error-index field of the If both the error-status field and the error-index field of the
Response-PDU are non-zero, then the value of the error-index field is Response-PDU are non-zero, then the value of the error-index field is
the index of the variable binding (in the variable-binding list of the index of the variable binding (in the variable-binding list of
the corresponding request) for which the request failed. The first the corresponding request) for which the request failed. The first
variable binding in a request's variable-binding list is index one, variable binding in a request's variable-binding list is index one,
the second is index two, etc. the second is index two, etc.
A compliant SNMP entity supporting a command generator application A compliant SNMP entity supporting a command generator application
must be able to properly receive and handle a Response-PDU with an must be able to properly receive and handle a Response-PDU with an
error-status field equal to "noSuchName", "badValue", or "readOnly". error-status field equal to "noSuchName", "badValue", or "readOnly".
(See sections 1.3 and 4.3 of [RFC-COEX].) (See sections 1.3 and 4.3 of [RFC2576].)
Upon receipt of a Response-PDU, the receiving SNMP entity presents Upon receipt of a Response-PDU, the receiving SNMP entity presents
its contents to the application which generated the request with the its contents to the application which generated the request with the
same request-id value. For more details, see [RFC-MPD]. same request-id value. For more details, see [RFC3412].
4.2.5. The SetRequest-PDU 4.2.5. The SetRequest-PDU
A SetRequest-PDU is generated and transmitted at the request of an A SetRequest-PDU is generated and transmitted at the request of an
application. application.
Upon receipt of a SetRequest-PDU, the receiving SNMP entity Upon receipt of a SetRequest-PDU, the receiving SNMP entity
determines the size of a message encapsulating a Response-PDU having determines the size of a message encapsulating a Response-PDU having
the same values in its request-id and variable-bindings fields as the the same values in its request-id and variable-bindings fields as the
received SetRequest-PDU, and the largest possible sizes of the received SetRequest-PDU, and the largest possible sizes of the
skipping to change at page 21, line 27 skipping to change at page 19, line 30
transmitted to the originator of the SetRequest-PDU, and processing transmitted to the originator of the SetRequest-PDU, and processing
of the SetRequest-PDU terminates immediately thereafter. This of the SetRequest-PDU terminates immediately thereafter. This
alternate Response-PDU is formatted with the same values in its alternate Response-PDU is formatted with the same values in its
request-id field as the received SetRequest-PDU, with the value of request-id field as the received SetRequest-PDU, with the value of
its error-status field set to "tooBig", the value of its error-index its error-status field set to "tooBig", the value of its error-index
field set to zero, and an empty variable-bindings field. This field set to zero, and an empty variable-bindings field. This
alternate Response-PDU is then encapsulated into a message. If the alternate Response-PDU is then encapsulated into a message. If the
size of the resultant message is less than or equal to both a local size of the resultant message is less than or equal to both a local
constraint and the maximum message size of the originator, it is constraint and the maximum message size of the originator, it is
transmitted to the originator of the SetRequest-PDU. Otherwise, the transmitted to the originator of the SetRequest-PDU. Otherwise, the
snmpSilentDrops [RFC-MIB] counter is incremented and the resultant snmpSilentDrops [RFC3418] counter is incremented and the resultant
message is discarded. Regardless, processing of the SetRequest-PDU message is discarded. Regardless, processing of the SetRequest-PDU
terminates. terminates.
Otherwise, the receiving SNMP entity processes each variable binding Otherwise, the receiving SNMP entity processes each variable binding
in the variable-binding list to produce a Response-PDU. All fields in the variable-binding list to produce a Response-PDU. All fields
of the Response-PDU have the same values as the corresponding fields of the Response-PDU have the same values as the corresponding fields
of the received request except as indicated below. of the received request except as indicated below.
The variable bindings are conceptually processed as a two phase The variable bindings are conceptually processed as a two phase
operation. In the first phase, each variable binding is validated; operation. In the first phase, each variable binding is validated;
if all validations are successful, then each variable is altered in if all validations are successful, then each variable is altered in
the second phase. Of course, implementors are at liberty to the second phase. Of course, implementors are at liberty to
implement either the first, or second, or both, of these conceptual implement either the first, or second, or both, of these conceptual
phases as multiple implementation phases. Indeed, such multiple phases as multiple implementation phases. Indeed, such multiple
implementation phases may be necessary in some cases to ensure implementation phases may be necessary in some cases to ensure
consistency. consistency.
The following validations are performed in the first phase on each The following validations are performed in the first phase on each
variable binding until they are all successful, or until one fails: variable binding until they are all successful, or until one fails:
(1) If the variable binding's name specifies an existing or (1) If the variable binding's name specifies an existing or non-
non-existent variable to which this request is/would be denied existent variable to which this request is/would be denied
access because it is/would not be in the appropriate MIB view, access because it is/would not be in the appropriate MIB view,
then the value of the Response-PDU's error-status field is set then the value of the Response-PDU's error-status field is set
to "noAccess", and the value of its error-index field is set to to "noAccess", and the value of its error-index field is set to
the index of the failed variable binding. the index of the failed variable binding.
(2) Otherwise, if there are no variables which share the same OBJECT (2) Otherwise, if there are no variables which share the same
IDENTIFIER prefix as the variable binding's name, and which are OBJECT IDENTIFIER prefix as the variable binding's name, and
able to be created or modified no matter what new value is which are able to be created or modified no matter what new
specified, then the value of the Response-PDU's error-status value is specified, then the value of the Response-PDU's
field is set to "notWritable", and the value of its error-index error-status field is set to "notWritable", and the value of
field is set to the index of the failed variable binding. its error-index field is set to the index of the failed
variable binding.
(3) Otherwise, if the variable binding's value field specifies, (3) Otherwise, if the variable binding's value field specifies,
according to the ASN.1 language, a type which is inconsistent according to the ASN.1 language, a type which is inconsistent
with that required for all variables which share the same OBJECT with that required for all variables which share the same
IDENTIFIER prefix as the variable binding's name, then the value OBJECT IDENTIFIER prefix as the variable binding's name, then
of the Response-PDU's error-status field is set to "wrongType", the value of the Response-PDU's error-status field is set to
and the value of its error-index field is set to the index of "wrongType", and the value of its error-index field is set to
the failed variable binding. the index of the failed variable binding.
(4) Otherwise, if the variable binding's value field specifies, (4) Otherwise, if the variable binding's value field specifies,
according to the ASN.1 language, a length which is inconsistent according to the ASN.1 language, a length which is inconsistent
with that required for all variables which share the same OBJECT with that required for all variables which share the same
IDENTIFIER prefix as the variable binding's name, then the value OBJECT IDENTIFIER prefix as the variable binding's name, then
of the Response-PDU's error-status field is set to the value of the Response-PDU's error-status field is set to
"wrongLength", and the value of its error-index field is set to "wrongLength", and the value of its error-index field is set to
the index of the failed variable binding. the index of the failed variable binding.
(5) Otherwise, if the variable binding's value field contains an (5) Otherwise, if the variable binding's value field contains an
ASN.1 encoding which is inconsistent with that field's ASN.1 ASN.1 encoding which is inconsistent with that field's ASN.1
tag, then the value of the Response-PDU's error-status field is tag, then the value of the Response-PDU's error-status field is
set to "wrongEncoding", and the value of its error-index field set to "wrongEncoding", and the value of its error-index field
is set to the index of the failed variable binding. (Note that is set to the index of the failed variable binding. (Note that
not all implementation strategies will generate this error.) not all implementation strategies will generate this error.)
(6) Otherwise, if the variable binding's value field specifies a (6) Otherwise, if the variable binding's value field specifies a
value which could under no circumstances be assigned to the value which could under no circumstances be assigned to the
variable, then the value of the Response-PDU's error-status variable, then the value of the Response-PDU's error-status
field is set to "wrongValue", and the value of its error-index field is set to "wrongValue", and the value of its error-index
field is set to the index of the failed variable binding. field is set to the index of the failed variable binding.
(7) Otherwise, if the variable binding's name specifies a variable (7) Otherwise, if the variable binding's name specifies a variable
which does not exist and could not ever be created (even though which does not exist and could not ever be created (even though
some variables sharing the same OBJECT IDENTIFIER prefix might some variables sharing the same OBJECT IDENTIFIER prefix might
under some circumstances be able to be created), then the value under some circumstances be able to be created), then the value
of the Response-PDU's error-status field is set to "noCreation", of the Response-PDU's error-status field is set to
and the value of its error-index field is set to the index of "noCreation", and the value of its error-index field is set to
the failed variable binding. the index of the failed variable binding.
(8) Otherwise, if the variable binding's name specifies a variable (8) Otherwise, if the variable binding's name specifies a variable
which does not exist but can not be created under the present which does not exist but can not be created under the present
circumstances (even though it could be created under other circumstances (even though it could be created under other
circumstances), then the value of the Response-PDU's circumstances), then the value of the Response-PDU's error-
error-status field is set to "inconsistentName", and the value status field is set to "inconsistentName", and the value of its
of its error-index field is set to the index of the failed error-index field is set to the index of the failed variable
variable binding. binding.
(9) Otherwise, if the variable binding's name specifies a variable (9) Otherwise, if the variable binding's name specifies a variable
which exists but can not be modified no matter what new value is which exists but can not be modified no matter what new value
specified, then the value of the Response-PDU's error-status is specified, then the value of the Response-PDU's error-status
field is set to "notWritable", and the value of its error-index field is set to "notWritable", and the value of its error-index
field is set to the index of the failed variable binding. field is set to the index of the failed variable binding.
(10) Otherwise, if the variable binding's value field specifies a (10) Otherwise, if the variable binding's value field specifies a
value that could under other circumstances be held by the value that could under other circumstances be held by the
variable, but is presently inconsistent or otherwise unable to variable, but is presently inconsistent or otherwise unable to
be assigned to the variable, then the value of the be assigned to the variable, then the value of the Response-
Response-PDU's error-status field is set to "inconsistentValue", PDU's error-status field is set to "inconsistentValue", and the
and the value of its error-index field is set to the index of value of its error-index field is set to the index of the
the failed variable binding. failed variable binding.
(11) When, during the above steps, the assignment of the value (11) When, during the above steps, the assignment of the value
specified by the variable binding's value field to the specified specified by the variable binding's value field to the
variable requires the allocation of a resource which is specified variable requires the allocation of a resource which
presently unavailable, then the value of the Response-PDU's is presently unavailable, then the value of the Response-PDU's
error-status field is set to "resourceUnavailable", and the error-status field is set to "resourceUnavailable", and the
value of its error-index field is set to the index of the failed value of its error-index field is set to the index of the
variable binding. failed variable binding.
(12) If the processing of the variable binding fails for a reason (12) If the processing of the variable binding fails for a reason
other than listed above, then the value of the Response-PDU's other than listed above, then the value of the Response-PDU's
error-status field is set to "genErr", and the value of its error-status field is set to "genErr", and the value of its
error-index field is set to the index of the failed variable error-index field is set to the index of the failed variable
binding. binding.
(13) Otherwise, the validation of the variable binding succeeds. (13) Otherwise, the validation of the variable binding succeeds.
At the end of the first phase, if the validation of all variable At the end of the first phase, if the validation of all variable
bindings succeeded, then the value of the Response-PDU's error-status bindings succeeded, then the value of the Response-PDU's error-status
field is set to "noError" and the value of its error-index field is field is set to "noError" and the value of its error-index field is
zero, and processing continues as follows. zero, and processing continues as follows.
For each variable binding in the request, the named variable is For each variable binding in the request, the named variable is
created if necessary, and the specified value is assigned to it. created if necessary, and the specified value is assigned to it.
Each of these variable assignments occurs as if simultaneously with Each of these variable assignments occurs as if simultaneously with
respect to all other assignments specified in the same request. respect to all other assignments specified in the same request.
skipping to change at page 24, line 25 skipping to change at page 22, line 38
take all possible measures to avoid use of either "commitFailed" or take all possible measures to avoid use of either "commitFailed" or
"undoFailed" - these two error-status codes are not to be taken as "undoFailed" - these two error-status codes are not to be taken as
license to take the easy way out in an implementation. license to take the easy way out in an implementation.
Finally, the generated Response-PDU is encapsulated into a message, Finally, the generated Response-PDU is encapsulated into a message,
and transmitted to the originator of the SetRequest-PDU. and transmitted to the originator of the SetRequest-PDU.
4.2.6. The SNMPv2-Trap-PDU 4.2.6. The SNMPv2-Trap-PDU
An SNMPv2-Trap-PDU is generated and transmitted by an SNMP entity on An SNMPv2-Trap-PDU is generated and transmitted by an SNMP entity on
behalf of a notification originator application. The SNMPv2-Trap-PDU behalf of a notification originator application. The SNMPv2-Trap-PDU
is often used to notify a notification receiver application at a is often used to notify a notification receiver application at a
logically remote SNMP entity that an event has occurred or that a logically remote SNMP entity that an event has occurred or that a
condition is present. There is no confirmation associated with this condition is present. There is no confirmation associated with this
notification delivery mechanism. notification delivery mechanism.
The destination(s) to which an SNMPv2-Trap-PDU is sent is determined The destination(s) to which an SNMPv2-Trap-PDU is sent is determined
in an implementation-dependent fashion by the SNMP entity. The first in an implementation-dependent fashion by the SNMP entity. The first
two variable bindings in the variable binding list of an two variable bindings in the variable binding list of an SNMPv2-
SNMPv2-Trap-PDU are sysUpTime.0 [RFC-MIB] and snmpTrapOID.0 [RFC-MIB] Trap-PDU are sysUpTime.0 [RFC3418] and snmpTrapOID.0 [RFC3418]
respectively. If the OBJECTS clause is present in the invocation of respectively. If the OBJECTS clause is present in the invocation of
the corresponding NOTIFICATION-TYPE macro, then each corresponding the corresponding NOTIFICATION-TYPE macro, then each corresponding
variable, as instantiated by this notification, is copied, in order, variable, as instantiated by this notification, is copied, in order,
to the variable-bindings field. If any additional variables are to the variable-bindings field. If any additional variables are
being included (at the option of the generating SNMP entity), then being included (at the option of the generating SNMP entity), then
each is copied to the variable-bindings field. each is copied to the variable-bindings field.
4.2.7. The InformRequest-PDU 4.2.7. The InformRequest-PDU
An InformRequest-PDU is generated and transmitted by an SNMP entity An InformRequest-PDU is generated and transmitted by an SNMP entity
on behalf of a notification originator application. The on behalf of a notification originator application. The
InformRequest-PDU is often used to notify a notification receiver InformRequest-PDU is often used to notify a notification receiver
application that an event has occurred or that a condition is application that an event has occurred or that a condition is
present. This is a confirmed notification delivery mechanism, present. This is a confirmed notification delivery mechanism,
although there is, of course, no guarantee of delivery. although there is, of course, no guarantee of delivery.
The destination(s) to which an InformRequest-PDU is sent is specified The destination(s) to which an InformRequest-PDU is sent is specified
by the notification originator application. The first two variable by the notification originator application. The first two variable
bindings in the variable binding list of an InformRequest-PDU are bindings in the variable binding list of an InformRequest-PDU are
sysUpTime.0 [RFC-MIB] and snmpTrapOID.0 [RFC-MIB] respectively. If sysUpTime.0 [RFC3418] and snmpTrapOID.0 [RFC3418] respectively. If
the OBJECTS clause is present in the invocation of the corresponding the OBJECTS clause is present in the invocation of the corresponding
NOTIFICATION-TYPE macro, then each corresponding variable, as NOTIFICATION-TYPE macro, then each corresponding variable, as
instantiated by this notification, is copied, in order, to the instantiated by this notification, is copied, in order, to the
variable-bindings field. If any additional variables are being variable-bindings field. If any additional variables are being
included (at the option of the generating SNMP entity), then each is included (at the option of the generating SNMP entity), then each is
copied to the variable-bindings field. copied to the variable-bindings field.
Upon receipt of an InformRequest-PDU, the receiving SNMP entity Upon receipt of an InformRequest-PDU, the receiving SNMP entity
determines the size of a message encapsulating a Response-PDU with determines the size of a message encapsulating a Response-PDU with
the same values in its request-id, error-status, error-index and the same values in its request-id, error-status, error-index and
skipping to change at page 25, line 29 skipping to change at page 23, line 44
Response-PDU is generated, transmitted to the originator of the Response-PDU is generated, transmitted to the originator of the
InformRequest-PDU, and processing of the InformRequest-PDU terminates InformRequest-PDU, and processing of the InformRequest-PDU terminates
immediately thereafter. This alternate Response-PDU is formatted immediately thereafter. This alternate Response-PDU is formatted
with the same values in its request-id field as the received with the same values in its request-id field as the received
InformRequest-PDU, with the value of its error-status field set to InformRequest-PDU, with the value of its error-status field set to
"tooBig", the value of its error-index field set to zero, and an "tooBig", the value of its error-index field set to zero, and an
empty variable-bindings field. This alternate Response-PDU is then empty variable-bindings field. This alternate Response-PDU is then
encapsulated into a message. If the size of the resultant message is encapsulated into a message. If the size of the resultant message is
less than or equal to both a local constraint and the maximum message less than or equal to both a local constraint and the maximum message
size of the originator, it is transmitted to the originator of the size of the originator, it is transmitted to the originator of the
InformRequest-PDU. Otherwise, the snmpSilentDrops [RFC-MIB] counter InformRequest-PDU. Otherwise, the snmpSilentDrops [RFC3418] counter
is incremented and the resultant message is discarded. Regardless, is incremented and the resultant message is discarded. Regardless,
processing of the InformRequest-PDU terminates. processing of the InformRequest-PDU terminates.
Otherwise, the receiving SNMP entity: Otherwise, the receiving SNMP entity:
(1) presents its contents to the appropriate application; (1) presents its contents to the appropriate application;
(2) generates a Response-PDU with the same values in its request-id
(2) generates a Response-PDU with the same values in its request-id and variable-bindings fields as the received InformRequest-PDU,
and variable-bindings fields as the received InformRequest-PDU, with the value of its error-status field set to "noError" and
with the value of its error-status field set to "noError" and the value of its error-index field set to zero; and
the value of its error-index field set to zero; and
(3) transmits the generated Response-PDU to the originator of the (3) transmits the generated Response-PDU to the originator of the
InformRequest-PDU. InformRequest-PDU.
5. Notice on Intellectual Property 5. Notice on Intellectual Property
The IETF takes no position regarding the validity or scope of any The IETF takes no position regarding the validity or scope of any
intellectual property or other rights that might be claimed to intellectual property or other rights that might be claimed to
pertain to the implementation or use of the technology described in pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights this document or the extent to which any license under such rights
might or might not be available; neither does it represent that it might or might not be available; neither does it represent that it
has made any effort to identify any such rights. Information on the has made any effort to identify any such rights. Information on the
IETF's procedures with respect to rights in standards-track and IETF's procedures with respect to rights in standards-track and
skipping to change at page 26, line 24 skipping to change at page 24, line 39
copyrights, patents or patent applications, or other proprietary copyrights, patents or patent applications, or other proprietary
rights which may cover technology that may be required to practice rights which may cover technology that may be required to practice
this standard. Please address the information to the IETF Executive this standard. Please address the information to the IETF Executive
Director. Director.
6. Acknowledgments 6. Acknowledgments
This document is the product of the SNMPv3 Working Group. Some This document is the product of the SNMPv3 Working Group. Some
special thanks are in order to the following Working Group members: special thanks are in order to the following Working Group members:
Randy Bush Randy Bush
Jeffrey D. Case Jeffrey D. Case
Mike Daniele Mike Daniele
Rob Frye Rob Frye
Lauren Heintz Lauren Heintz
Keith McCloghrie Keith McCloghrie
Russ Mundy Russ Mundy
David T. Perkins David T. Perkins
Randy Presuhn Randy Presuhn
Aleksey Romanov Aleksey Romanov
Juergen Schoenwaelder Juergen Schoenwaelder
Bert Wijnen Bert Wijnen
This version of the document, edited by Randy Presuhn, was initially This version of the document, edited by Randy Presuhn, was initially
based on the work of a design team whose members were: based on the work of a design team whose members were:
Jeffrey D. Case Jeffrey D. Case
Keith McCloghrie Keith McCloghrie
David T. Perkins David T. Perkins
Randy Presuhn Randy Presuhn
Juergen Schoenwaelder Juergen Schoenwaelder
The previous versions of this document, edited by Keith McCloghrie, The previous versions of this document, edited by Keith McCloghrie,
was the result of significant work by four major contributors: was the result of significant work by four major contributors:
Jeffrey D. Case Jeffrey D. Case
Keith McCloghrie Keith McCloghrie
Marshall T. Rose Marshall T. Rose
Steven Waldbusser Steven Waldbusser
Additionally, the contributions of the SNMPv2 Working Group to the Additionally, the contributions of the SNMPv2 Working Group to the
previous versions are also acknowledged. In particular, a special previous versions are also acknowledged. In particular, a special
thanks is extended for the contributions of: thanks is extended for the contributions of:
Alexander I. Alten Alexander I. Alten
Dave Arneson Dave Arneson
Uri Blumenthal Uri Blumenthal
Doug Book Doug Book
Kim Curran Kim Curran
Jim Galvin Jim Galvin
Maria Greene Maria Greene
Iain Hanson Iain Hanson
Dave Harrington Dave Harrington
Nguyen Hien Nguyen Hien
Jeff Johnson Jeff Johnson
Michael Kornegay Michael Kornegay
Deirdre Kostick Deirdre Kostick
David Levi David Levi
Daniel Mahoney Daniel Mahoney
Bob Natale Bob Natale
Brian O'Keefe Brian O'Keefe
Andrew Pearson Andrew Pearson
Dave Perkins Dave Perkins
Randy Presuhn Randy Presuhn
Aleksey Romanov Aleksey Romanov
Shawn Routhier Shawn Routhier
Jon Saperia Jon Saperia
Juergen Schoenwaelder Juergen Schoenwaelder
Bob Stewart Bob Stewart
Kaj Tesink Kaj Tesink
Glenn Waters Glenn Waters
Bert Wijnen Bert Wijnen
7. Security Considerations 7. Security Considerations
The protocol defined in this document by itself does not provide a The protocol defined in this document by itself does not provide a
secure environment. Even if the network itself is secure (for secure environment. Even if the network itself is secure (for
example by using IPSec), there is no control as to who on the secure example by using IPSec), there is no control as to who on the secure
network is allowed access to management information. network is allowed access to management information.
It is recommended that the implementors consider the security It is recommended that the implementors consider the security
features as provided by the SNMPv3 framework. Specifically, the use features as provided by the SNMPv3 framework. Specifically, the use
of the User-based Security Model RFC -USM [RFC-USM] and the of the User-based Security Model STD 62, RFC 3414 [RFC3414] and the
View-based Access Control Model RFC -ACM [RFC-ACM] is recommended. View-based Access Control Model STD 62, RFC 3415 [RFC3415] is
recommended.
It is then a customer/user responsibility to ensure that the SNMP It is then a customer/user responsibility to ensure that the SNMP
entity is properly configured so that: entity is properly configured so that:
- only those principals (users) having legitimate rights can - only those principals (users) having legitimate rights can
access or modify the values of any MIB objects supported by access or modify the values of any MIB objects supported by
that entity; that entity;
- the occurrence of particular events on the entity will be - the occurrence of particular events on the entity will be
communicated appropriately; communicated appropriately;
- the entity responds appropriately and with due credence to - the entity responds appropriately and with due credence to
events and information that have been communicated to it. events and information that have been communicated to it.
8. References 8. References
[ASN1] Information processing systems - Open Systems 8.1. Normative References
Interconnection - Specification of Abstract Syntax Notation
One (ASN.1), International Organization for
Standardization. International Standard 8824, December
1987.
[FRAG] Kent, C., and J. Mogul, "Fragmentation Considered Harmful,"
Proceedings, ACM SIGCOMM '87, Stowe, VT, August 1987.
[RFC768] Postel, J., "User Datagram Protocol", STD 6, RFC 768, [RFC768] Postel, J., "User Datagram Protocol", STD 6, RFC 768,
USC/Information Sciences Institute, August 1980. August 1980.
[RFC1155] Rose, M., and K. McCloghrie, "Structure and Identification [RFC2578] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J.,
of Management Information for TCP/IP-based Internets", STD Rose, M. and S. Waldbusser, "Structure of Management
16, RFC 1155, May 1990. Information Version 2 (SMIv2)", STD 58, RFC 2578, April
1999.
[RFC1157] Case, J., Fedor, M., Schoffstall, M., and J. Davin, "Simple [RFC2579] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J.,
Network Management Protocol", STD 15, RFC 1157, May 1990. Rose, M. and S. Waldbusser, "Textual Conventions for
SMIv2", STD 58, RFC 2579, April 1999.
[RFC1212] Rose, M., and K. McCloghrie, "Concise MIB Definitions", STD [RFC2580] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J.,
16, RFC 1212, March 1991. Rose, M. and S. Waldbusser, "Conformance Statements for
SMIv2", STD 58, RFC 2580, April 1999.
[RFC1215] Rose, M., "A Convention for Defining Traps for use with the [RFC3411] Harrington, D., Presuhn, R. and B. Wijnen, "An
SNMP", RFC 1215, March 1991. Architecture for Describing Simple Network Management
Protocol (SNMP) Management Frameworks", STD 62, RFC 3411,
December 2002.
[RFC1213] McCloghrie, K., and M. Rose, Editors, "Management [RFC3412] Case, J., Harrington, D., Presuhn, R. and B. Wijnen,
Information Base for Network Management of TCP/IP-based "Message Processing and Dispatching for the Simple
internets: MIB-II", STD 17, RFC 1213, March 1991. Network Management Protocol (SNMP)", STD 62, RFC 3412,
December 2002.
[RFC1901] Case, J., McCloghrie, K., Rose, M., and S. Waldbusser, [RFC3413] Levi, D., Meyer, P. and B. Stewart, "Simple Network
"Introduction to Community-based SNMPv2", RFC 1901, January Management Protocol (SNMP) Applications", STD 62, RFC
1996. 3413, December 2002.
[RFC2570] Case, J., Mundy, R., Partain, D., and B. Stewart, [RFC3414] Blumenthal, U. and B. Wijnen, "The User-Based Security
"Introduction to Version 3 of the Internet-standard Network Model (USM) for Version 3 of the Simple Network
Management Framework", RFC 2570, April 1999. Management Protocol (SNMPv3)", STD 62, RFC 3414, December
2002.
[RFC2578] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J., [RFC3415] Wijnen, B., Presuhn, R. and K. McCloghrie, "View-based
Rose, M., and S. Waldbusser, "Structure of Management Access Control Model (VACM) for the Simple Network
Information Version 2 (SMIv2)", STD 58, RFC 2578, April Management Protocol (SNMP)", STD 62, RFC 3415, December
1999. 2002.
[RFC2579] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J., [RFC3417] Presuhn, R., Case, J., McCloghrie, K., Rose, M. and S.
Rose, M., and S. Waldbusser, "Textual Conventions for Waldbusser, "Transport Mappings for the Simple Network
SMIv2", STD 58, RFC 2579, April 1999. Management Protocol", STD 62, RFC 3417, December 2002.
[RFC2580] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J., [RFC3418] Presuhn, R., Case, J., McCloghrie, K., Rose, M. and S.
Rose, M., and S. Waldbusser, "Conformance Statements for Waldbusser, "Management Information Base (MIB) for the
SMIv2", STD 58, RFC 2580, April 1999. Simple Network Management Protocol (SNMP)", STD 62, RFC
3418, December 2002.
[RFC-TMM] Presuhn, R., Case, J., McCloghrie, K., Rose, M., and S. [ASN1] Information processing systems - Open Systems
Waldbusser, "Transport Mappings for the Simple Network Interconnection - Specification of Abstract Syntax
Management Protocol", Notation One (ASN.1), International Organization for
<draft-ietf-snmpv3-update-transmap-08.txt>, October 2001. Standardization. International Standard 8824, December
1987.
[RFC2863] McCloghrie, K., and F. Kastenholz, "The Interfaces Group 8.2. Informative References
MIB", RFC 2863, June 2000.
[RFC2914] Floyd, S., "Congestion Control Principles", BCP 41, RFC [FRAG] Kent, C. and J. Mogul, "Fragmentation Considered
2914, September 2000. Harmful," Proceedings, ACM SIGCOMM '87, Stowe, VT, August
1987.
[RFC-MIB] Presuhn, R., Case, J., McCloghrie, K., Rose, M., and S. [RFC1155] Rose, M. and K. McCloghrie, "Structure and Identification
Waldbusser, "Management Information Base for the Simple of Management Information for TCP/IP-based Internets",
Network Management Protocol", STD 16, RFC 1155, May 1990.
<draft-ietf-snmpv3-update-mib-07.txt>, October 2001.
[RFC-ARC] Harrington, D., Presuhn, R. and B. Wijnen, "An Architecture [RFC1157] Case, J., Fedor, M., Schoffstall, M. and J. Davin,
for describing SNMP Management Frameworks", "Simple Network Management Protocol", STD 15, RFC 1157,
<draft-ietf-snmpv3-arch-v2-02.txt>, October 2001. May 1990.
[RFC-MPD] Case, J., Harrington, D., Presuhn, R. and B. Wijnen, [RFC1212] Rose, M. and K. McCloghrie, "Concise MIB Definitions",
"Message Processing and Dispatching for the Simple Network STD 16, RFC 1212, March 1991.
Management Protocol (SNMP)",
<draft-ietf-snmpv3-mpd-v2-02.txt>, October 2001.
[RFC-APL] Levi, D., Meyer, P. and B. Stewart, "SNMP Applications", [RFC1213] McCloghrie, K. and M. Rose, Editors, "Management
<draft-ietf-snmpv3-appl-v3-01.txt>, October 2001. Information Base for Network Management of TCP/IP-based
internets: MIB-II", STD 17, RFC 1213, March 1991.
[RFC-USM] Blumenthal, U. and B. Wijnen, "The User-Based Security [RFC1215] Rose, M., "A Convention for Defining Traps for use with
Model for Version 3 of the Simple Network Management the SNMP", RFC 1215, March 1991.
Protocol (SNMPv3)",
<draft-ietf-snmpv3-usm-v2-rfc2574bis-01.txt>, October 2001.
[RFC-ACM] Wijnen, B., Presuhn, R. and K. McCloghrie, "View-based [RFC1901] Case, J., McCloghrie, K., Rose, M. and S. Waldbusser,
Access Control Model for the Simple Network Management "Introduction to Community-based SNMPv2", RFC 1901,
Protocol (SNMP)", <draft-ietf-snmpv3-vacm-v2-01.txt>, January 1996.
October 2001.
[RFC-COEX]Frye, R., Levi, D., Routhier, S., and B. Wijnen, [RFC2576] Frye, R., Levi, D., Routhier, S. and B. Wijnen,
"Coexistence between Version 1, Version 2, and Version 3 of "Coexistence between Version 1, Version 2, and Version 3
the Internet-standard Network Management Framework", of the Internet-Standard Network Management Framework",
<draft-ietf-snmpv3-coex-v2-01.txt>, October 2001. RFC 2576, March 2000.
9. Editor's Address [RFC2863] McCloghrie, K. and F. Kastenholz, "The Interfaces Group
MIB", RFC 2863, June 2000.
Randy Presuhn [RFC2914] Floyd, S., "Congestion Control Principles", BCP 41, RFC
BMC Software, Inc. 2914, September 2000.
2141 North First Street
San Jose, CA 95131
USA
Phone: +1 408 546 1006 [RFC3410] Case, J., Mundy, R., Partain, D. and B. Stewart,
EMail: randy_presuhn@bmc.com "Introduction and Applicability Statements for Internet-
Standard Management Framework", RFC 3410, December 2002.
10. Changes from RFC 1905 9. Changes from RFC 1905
These are the changes from RFC 1905: These are the changes from RFC 1905:
- Corrected spelling error in copyright statement; - Corrected spelling error in copyright statement;
- Updated copyright date;
- Updated with new editor's name and contact information;
- Added notice on intellectual property;
- Cosmetic fixes to layout and typography;
- Added table of contents;
- Title changed;
- Updated document headers and footers;
- Deleted the old clause 2.3, entitled "Access to Management
Information";
- Changed the way in which request-id was defined, though
with the same ultimate syntax and semantics, to avoid
coupling with SMI. This does not affect the protocol in
any way;
- Replaced the word "exception" with the word "error" in the
old clause 4.1. This does not affect the protocol in any
way;
- Deleted the first two paragraphs of the old clause 4.2;
- Clarified the maximum number of variable bindings that an
implementation must support in a PDU. This does not affect
the protocol in any way;
- Replaced occurrences of "SNMPv2 application" with
"application";
- Deleted three sentences in old clause 4.2.3 describing the
handling of an impossible situation. This does not affect
the protocol in any way;
- Clarified the use of the SNMPv2-Trap-Pdu in the old clause
4.2.6. This does not affect the protocol in any way;
- Aligned description of the use of the InformRequest-Pdu in
old clause 4.2.7 with the architecture. This does not
affect the protocol in any way;
- Updated references;
- Re-wrote introduction clause;
- Replaced manager/agent/SNMPv2 entity terminology with
terminology from RFC 2571. This does not affect the
protocol in any way;
- Eliminated IMPORTS from the SMI, replaced with equivalent
in-line ASN.1. This does not affect the protocol in any
way;
- Added notes calling attention to two different
manifestations of reaching the end of a table in the table
walk examples;
- Added content to security considerations clause;
- Updated ASN.1 comment on use of Report-PDU. This does not
affect the protocol in any way;
- Updated acknowledgements section;
Included information on handling of BITS;
Deleted spurious comma in ASN.1 definition of PDUs;
Added abstract;
Made handling of additional variable bindings in informs
consistent with that for traps. This was a correction of
an editorial oversight, and reflects implementation
practice;
Added reference to RFC 2914.
11. Issues
This clause will be deleted when this material is published as an
RFC. The issue labels are the same as those used in the on-line
issues list at
ftp://amethyst.bmc.com/pub/snmpv3/Update567/rfc1905/index.html
1905-1 Done; table of contents added.
1905-2 Done; new title put in.
1905-3 Done; new introduction clause put in.
1905-4 Done; handled as part of 1905-3.
1905-5 Done; clause deleted.
1905-6 Done; clause deleted, terminology changed throughout
the document.
1905-7 Done; resolution was "no change".
1905-8 Done; deleted the old clause 2.3.
1905-9 Done; resolution was "no change".
1905-10 Done; resolution was "no change". - Updated copyright date;
1905-11 Done; resolution was "no change". - Updated with new editor's name and contact information;
1905-12 Done; incorporated suggested text, fixed minor ASN.1 - Added notice on intellectual property;
problem. - Cosmetic fixes to layout and typography;
1905-13 Done; resolution was to change form (but not ultimate - Added table of contents;
syntax or semantics) of definition of request-id
element.
1905-14 Done; resolution was "no change". - Title changed;
1905-15 Done; ASN.1 comments lined up. - Updated document headers and footers;
1905-16 Done; resolution was "no change". - Deleted the old clause 2.3, entitled "Access to Management
Information";
1905-17 Done; changed "exception" to "error" in second - Changed the way in which request-id was defined, though with
paragraph of old clause 4.1. the same ultimate syntax and semantics, to avoid coupling with
SMI. This does not affect the protocol in any way;
1905-18 Done; deleted first two paragraphs of old clause 4.2. - Replaced the word "exception" with the word "error" in the old
clause 4.1. This does not affect the protocol in any way;
1905-19 Done; resolution was "no change". - Deleted the first two paragraphs of the old clause 4.2;
1905-20 Done; replaced occurrences of "SNMPv2 application" - Clarified the maximum number of variable bindings that an
with "application". implementation must support in a PDU. This does not affect the
protocol in any way;
1905-21 Done; though as a side-effect of issue 1905-6's - Replaced occurrences of "SNMPv2 application" with
resolution. "application";
1905-22 Done; clarifying notes added. - Deleted three sentences in old clause 4.2.3 describing the
handling of an impossible situation. This does not affect the
protocol in any way;
1905-23 Done; deleted offending sentences. - Clarified the use of the SNMPv2-Trap-Pdu in the old clause
4.2.6. This does not affect the protocol in any way;
1905-24 Done; resolution was "no change". - Aligned description of the use of the InformRequest-Pdu in old
clause 4.2.7 with the architecture. This does not affect the
protocol in any way;
1905-25 Done; added note to example. - Updated references;
1905-26 Done; resolution was "no change". - Re-wrote introduction clause;
1905-27 Done; resolution was "no change". - Replaced manager/agent/SNMPv2 entity terminology with
terminology from RFC 2571. This does not affect the protocol
in any way;
1905-28 Done; replaced first paragraph of old clause 4.2.6. - Eliminated IMPORTS from the SMI, replaced with equivalent in-
line ASN.1. This does not affect the protocol in any way;
1905-29 Done; replaced first paragraph of old clause 4.2.7. - Added notes calling attention to two different manifestations
of reaching the end of a table in the table walk examples;
1905-30 Done; added content to security considerations clause. - Added content to security considerations clause;
1905-31 Done; references updated; acknowledgments updated. - Updated ASN.1 comment on use of Report-PDU. This does not
affect the protocol in any way;
1905-32 Done; added clarifying text. - Updated acknowledgments section;
1905-33 Done; IPR and copyright material updated. - Included information on handling of BITS;
1905-34 Done; headers and footers updated appropriately. - Deleted spurious comma in ASN.1 definition of PDUs;
1905-35 Done; resolution was "no change". - Added abstract;
1905-36 Done; though original resolution was "no change", this - Made handling of additional variable bindings in informs
was effectively superseded by the resolution to consistent with that for traps. This was a correction of an
1905-12. editorial oversight, and reflects implementation practice;
1905-37 Done; resolution was "no change". - Added reference to RFC 2914.
1905-38 Done; added abstract. 10. Editor's Address
1905-39 Done; clarified text on maximum PDU size. Randy Presuhn
BMC Software, Inc.
2141 North First Street
San Jose, CA 95131
USA
1905-40 Open; should trap and inform procedures match for Phone: +1 408 546 1006
added varbinds? EMail: randy_presuhn@bmc.com
12. Full Copyright Statement 11. Full Copyright Statement
Copyright (C) The Internet Society (2001). All Rights Reserved. Copyright (C) The Internet Society (2002). All Rights Reserved.
This document and translations of it may be copied and furnished to This document and translations of it may be copied and furnished to
others, and derivative works that comment on or otherwise explain it others, and derivative works that comment on or otherwise explain it
or assist in its implementation may be prepared, copied, published or assist in its implementation may be prepared, copied, published
and distributed, in whole or in part, without restriction of any and distributed, in whole or in part, without restriction of any
kind, provided that the above copyright notice and this paragraph are kind, provided that the above copyright notice and this paragraph are
included on all such copies and derivative works. However, this included on all such copies and derivative works. However, this
document itself may not be modified in any way, such as by removing document itself may not be modified in any way, such as by removing
the copyright notice or references to the Internet Society or other the copyright notice or references to the Internet Society or other
Internet organizations, except as needed for the purpose of Internet organizations, except as needed for the purpose of
skipping to change at line 1591 skipping to change at page 31, line 32
The limited permissions granted above are perpetual and will not be The limited permissions granted above are perpetual and will not be
revoked by the Internet Society or its successors or assigns. revoked by the Internet Society or its successors or assigns.
This document and the information contained herein is provided on an This document and the information contained herein is provided on an
"AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Acknowledgement
Funding for the RFC Editor function is currently provided by the
Internet Society.
 End of changes. 163 change blocks. 
701 lines changed or deleted 514 lines changed or added

This html diff was produced by rfcdiff 1.41. The latest version is available from http://tools.ietf.org/tools/rfcdiff/