Definitions of Managed Objects for Packet Sampling

For a detailed overview of the documents that describe the current Internet-Standard Management Framework, please refer to section 7 of RFC 3410. Managed objects are accessed via a virtual information store, termed the Management Information Base or MIB. MIB objects are generally accessed through the Simple Network Management Protocol (SNMP). Objects in the MIB are defined using the mechanisms defined in the Structure of Management Information (SMI). This memo specifies a MIB module that is compliant to the SMIv2, which is described in STD 58, RFC 2578, STD 58, RFC 2579 and STD 58,RFC 2580.

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119. This document is a product of the IP Flow Information eXport (IPFIX) working group. Work on this document was started in the Packet Sampling (PSAMP) Working Group (WG) and moved to the IPFIX WG when the PSAMP WG was concluded. Its purpose is to define managed objects for monitoring PSAMP Devices performing packet selection by Sampling and Filtering as described in . It is assumed that packet Sampling is performed according to the framework defined in . Managed objects in the PSAMP MIB module are defined as an extension of the IPFIX MIB and IPFIX SELECTOR MIB modules . Since the IPFIX MIB module is only for monitoring the same holds true for the PSAMP MIB module defined in this document. The definition of objects is in line with the PSAMP information model . Section gives an overview of the PSAMP documents, while section refers to the related IPFIX documents. Section describes the structure of the PSAMP MIB module and section contains the formal definition. Security issues are discussed in section .

: "A Framework for Packet Selection and Reporting" describes the PSAMP framework for network elements to select subsets of packets by statistical and other methods, and to export a stream of reports on the selected packets to a Collector. : "Sampling and Filtering Techniques for IP Packet Selection" describes the set of packet selection techniques supported by PSAMP. : "Packet Sampling (PSAMP) Protocol Specifications" specifies the export of packet information from a PSAMP Exporting Process to a PSAMP Collecting Process. : "Information Model for Packet Sampling Exports" defines an information and data model for PSAMP. This document: "Definitions of Managed Objects for Packet Sampling" describes the PSAMP Management Information Base.

The IPFIX protocol provides network administrators with access to IP Flow information. : The protocol document "Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of IP Traffic Flow Information" specifies how IPFIX Data Records and Templates are carried via a congestion-aware transport protocol from IPFIX Exporting Processes to IPFIX Collecting Processes. It also specifies the data types used in the PSAMP MIB module and their encoding. : The IPFIX MIB "Definitions of Managed Objects for IP Flow Information Export" is the basis for this document because it extends the IPFIX SELECTOR MIB module defined there.

The IPFIX MIB module defined in has the concept of a packet Selection Process containing a set of Selector function instances. Selection Processes and functions are referenced in the ipfixSelectionProcessTable of the IPFIX MIB module. The ipfixSelectionProcessTable identifies an instance of a Selector function by an OID. The OID points to an object that describes the Selector function. For simple Selector functions without parameters, the OID refers to an object which contains only one additional object indicating the current availability of the function. For functions which have one or more parameters the object has a subtree that in addition to an availability object contains a table with a conceptual column for each parameter. Entries (conceptual rows) in this table represent different combinations of parameter values for instances of the Selector function. The object ipfixSelectorFunctions in the IPFIX SELECTOR MIB module serves as the root for objects that describe instances of packet Selector functions. The IPFIX SELECTOR MIB module is a very small module which is defined in . The top level OIDs of the parameter trees located beneath ipfixSelectorFunctions are maintained by IANA. In the IPFIX SELECTOR MIB module as defined by the object ipfixSelectorFunctions contains just a single trivial packet Selector function called ipfixFuncSelectAll that selects every packet and has no parameter:

The PSAMP MIB module defined in this document registers additional toplevel OIDs for the parameter subtrees of its Selector functions in the IPFIX-SELECTOR-MIB Function subregistry according to the procedures defined in . It introduces six new subtrees beneath ipfixSelectorFunctions. Each of them describes a packet Selector function with one or more parameters. Naming and ordering of objects is fully in line with the guidelines given in section 6.1 of . All functions and their parameters are already listed in the overview of functions given by the table in section 8.2.1 of .

The PSAMP MIB module imports two textual conventions which define data types used in this MIB module from other MIB modules. The Unsigned64TC data type is imported from the APPLICATION MIB module and the Float64TC data type is imported from the FLOAT-TC-MIB module . Those data types are defined according to . Those data types are not an integral part of but are needed to define objects in this MIB module that conform to the Information Elements defined for those objects in . The Unsigned64TC textual convention describes an unsigned integer of 64 bits. It is imported from the APPLICATION MIB module. The Float64TC textual convention describes the format that is used for 64 bit floating point numbers.

In general, different packet Selector functions have different parameters. The PSAMP MIB module contains six objects with subtrees that provide information on parameters of function instances of different Selector functions. All objects are named and structured according to section 8.2.1 of :

Indexing of these functions in the PSAMP MIB module starts with index (2). The function ipfixFuncSelectAll with index (1) is already defined in the IPFIX SELECTOR MIB module as shown above. The object tree for each of these functions is described below. Semantics of all functions and their parameters are described in detail in . More information on the Selector Reports can also be found in section 6.5.2 of .

The first Selector function is systematic count-based Sampling. Its availability is indicated by object psampSampCountBasedAvail. The function has two parameters: psampSampCountBasedInterval and psampSampCountBasedSpace. Different combination of values of these parameters for different instances of the Selector function are represented by different conceptual rows in table psampSampCountBasedParamSetEntry:

The second Selector function is systematic time-based Sampling. The structure of the sub-tree for this function is similar to the psampSampCountBased sub-tree. Parameters are psampSampTimeBasedInterval and psampSampTimeBasedSpace. They appear to be the same as for count based Sampling, but their data types are different because they indicate time values instead of numbers of packets:

The third Selector function is random n-out-of-N Sampling. Parameters are psampSampRandOutOfNSize and psampSampRandOutOfNPopulation:

The fourth Selector function is uniform probabilistic Sampling. It has just a single parameter called psampSampUniProbProbability:

The fifth Selector function is property match Filtering. For this Selector function there is a broad variety of possible parameters that could be used. But as stated in section 8.2.1 of there are no agreed parameters specified and the sub-tree for this function only contains an object indicating the availability of this function. Parameters cannot be retrieved via the PSAMP MIB module:

The sixth Selector function is hash-based Filtering. The object psampFiltHashFunction is an enumeration that specifies the kind of hash function that is applied. These hash function have quite a number of parameters and the actual number may vary with the choice of the hash function applied. The common parameter set for all hash-based Filtering functions contains 7 parameters: psampFiltHashInitializerValue, psampFiltHashIpPayloadOffset, psampFiltHashIpPayloadSize, psampFiltHashSelectedRangeMin, psampFiltHashSelectedRangeMax, psampFiltHashOutputRangeMin, and psampFiltHashOutputRangeMax.

Further parameters depend on the applied hash function and are not specified within the PSAMP MIB module.

There are no management objects defined in this MIB module that have a MAX-ACCESS clause of read-write and/or read-create. So, if this MIB module is implemented correctly, then there is no risk that an intruder can alter or create any management objects of this MIB module via direct SNMP SET operations. All tables in this MIB module may be considered sensitive or vulnerable in some network environments because objects in the tables may reveal information about the network infrastructure and device configuration. It is thus important to control even GET and/or NOTIFY access to these objects and possibly to even encrypt the values of these objects when sending them over the network via SNMP. SNMP versions prior to SNMPv3 did not include adequate security. Even if the network itself is secure (for example by using IPsec), there is no control as to who on the secure network is allowed to access and GET/SET (read/change/create/delete) the objects in this MIB module. It is RECOMMENDED that implementers consider the security features provided by the SNMPv3 framework (see [RFC3410], section 8), including full support for the SNMPv3 cryptographic mechanisms (for authentication and privacy). Further, deployment of SNMP versions prior to SNMPv3 is NOT RECOMMENDED. Instead, it is RECOMMENDED to deploy SNMPv3 and to enable cryptographic security. It is then a customer/operator responsibility to ensure that the SNMP entity giving access to an instance of this MIB module is properly configured to give access to the objects only to those principals (users) who have legitimate rights to GET or SET (change/create/delete) them.

The MIB module in this document uses the following IANA-assigned OBJECT IDENTIFIER values recorded in the SMI Numbers registry:

Further on, IANA will register the following toplevel OIDs in the IPFIX-SELECTOR-MIB Functions sub-registry at http://www.iana.org/assignments/smi-numbers according to the procedures set forth in :

The prerequisites set forth for addition of these OIDs are to be verified based on the content of this document. Editor's Note (to be removed prior to publication): the IANA is requested to assign a value for "xxx" under the 'mib-2' subtree and to record the assignment in the SMI Numbers registry. When the assignment has been made, the RFC Editor is asked to replace "xxx" (here and in the MIB module) with the assigned value and to remove this note. The RFC editor is also asked to replace "yyyy" in this document and the MIB module by the number of the RFC when the assignment has been made.

This document is a product of the PSAMP and IPFIX working groups. The authors would like to thank the following persons: Paul Aitken for his detailed review, Dan Romascanu and the MIB doctors, and many more, for the technical reviews and feedback.