INTERNET-DRAFT DOCSIS Subscriber Management MIB December 1999
Management Information Base
for DOCSIS Cable Modem Termination Systems
for Subscriber Management
draft-ietf-ipcdn-subscriber-mib-00.txt
Mon Dec 8 10:32:00 EST 1999
Wilson Sawyer
Arris Interactive
wsawyer@ieee.org
Michael StJohns
@Home Network
stjohns@corp.home.net
Status of this Memo
This document is an Internet-Draft and is in full conformance with
all provisions of Section 10 of RFC2026. Internet-Drafts are working
documents of the Internet Engineering Task Force (IETF), its areas,
and its working groups. Note that other groups may also distribute
working documents as Internet-Drafts.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
The list of current Internet-Drafts can be accessed at:
http://www.ietf.org/ietf/1id-abstracts.txt
The list of Internet-Draft Shadow Directories can be accessed at:
http://www.ietf.org/shadow.html.
Abstract
This memo defines an experimental portion of the Management
Information Base (MIB) for use with network management protocols in
the Internet community. In particular, it defines a set of managed
objects for SNMP-based management of DOCSIS-compliant[16] Cable Modem
Termination Systems. These managed objects facilitate protection of
the cable network from misuse by subscribers.
This memo specifies a MIB module in a manner that is compliant to the
SNMP SMIv2 [5][6][7]. The set of objects are consistent with the
SNMP framework and existing SNMP standards.
This memo is a product of the IPCDN working group within the Internet
Engineering Task Force. Comments are solicited and should be
addressed to the working group's mailing list at ipcdn@terayon.com
and/or the authors.
Expires June 2000 [Page 1]
INTERNET-DRAFT DOCSIS Subscriber Management MIB December 1999
Table of Contents
1. The SNMP Network Management Framework..............................2
2. Overview...........................................................3
2.1. Structure of the MIB.............................................3
2.2. Management requirements..........................................4
2.2.1. Interaction with DOCSIS provisioning for CPE address control...4
2.2.2. Interaction with DOCSIS provisioning for filtering.............4
2.2.3. Row Existence of docsSubMgtTcpUdpFilterTable...................4
3. Definitions........................................................5
4. Acknowledgments...................................................17
5. References........................................................17
6. Security Considerations...........................................18
7. Author's Addresses................................................19
1. The SNMP Network Management Framework
The SNMP Management Framework presently consists of five major
components:
o An overall architecture, described in RFC 2571 [1].
o Mechanisms for describing and naming objects and events for the
purpose of management. The first version of this Structure of
Management Information (SMI) is called SMIv1 and described in STD
16, RFC 1155 [2], STD 16, RFC 1212 [3] and RFC 1215 [4]. The
second version, called SMIv2, is described in STD 58, RFC 2578
[5], STD 58, RFC 2579 [6] and STD 58, RFC 2580 [7].
o Message protocols for transferring management information. The
first version of the SNMP message protocol is called SNMPv1 and
described in RFC 1157 [8]. A second version of the SNMP message
protocol, which is not an Internet standards track protocol, is
called SNMPv2c and described in RFC 1901 [9] and RFC 1906 [10].
The third version of the message protocol is called SNMPv3 and
described in RFC 1906 [10], RFC 2572 [11] and RFC 2574 [12].
o Protocol operations for accessing management information. The
first set of protocol operations and associated PDU formats is
described in STD 15, RFC 1157 [8]. A second set of protocol
operations and associated PDU formats is described in RFC 1905
[13].
o A set of fundamental applications described in RFC 2573 [14] and
the view-based access control mechanism described in RFC 2575
[15].
Managed objects are accessed via a virtual information store, termed
the Management Information Base or MIB. Objects in the MIB are
defined using the mechanisms defined in the SMI.
This memo specifies a MIB module that is compliant to the SMIv2. A
MIB conforming to the SMIv1 can be produced through the appropriate
Expires June 2000 [Page 2]
INTERNET-DRAFT DOCSIS Subscriber Management MIB December 1999
translations. The resulting translated MIB MUST be semantically
equivalent, except where objects or events are omitted because no
translation is possible (use of Counter64). Some machine readable
information in SMIv2 will be converted into textual descriptions in
SMIv1 during the translation process. However, this loss of machine
readable information is not considered to change the semantics of the
MIB.
2. Overview
This MIB provides a set of objects required for the management of
DOCSIS Cable Modem Termination Systems (CMTS). The specification is
derived in part from the operational model described in the DOCSIS
Radio Frequency Interface Specification [16]. These managed objects
facilitate protection of the cable network from misuse by
subscribers.
Much of this MIB duplicates capabilities found in the DOCSIS Cable
Device MIB [17]. While it is expected that the Cable Device MIB will
be used to prevent unwanted traffic from entering the cable network,
it is also possible that a malicious user might tamper with cable
modem software, disabling its filtering policies. This MIB provides a
more secure mechanism, since physical access to the CMTS is
controlled by the network operator.
In particular, this MIB provides two capabilities: first, to limit
the IP addresses behind a modem, and, second, to provide protocol
filtering to and from a modem. The first duplicates the capabilities
of the docsDevCpe group [17]. This provides for either learned or
provisioned subscriber premises host IP addresses behind a cable
modem.
The filtering capability is similar to that provided in docsDevFilter
[17]. Rather than maintaining a separate list of filters for each
modem at the CMTS, however, it is assumed that large numbers of
modems will share filtering characteristics. Therefore, modems are
grouped so as to share common filter lists.
2.1. Structure of the MIB
This MIB is structured in five tables:
o The docsSubMgtCpeControlTable controls the acceptance of
subscriber host addresses behind a cable modem.
o The docsSubMgtCpeIpTable monitors the subscriber host addresses
which the CMTS believes to exist behind the cable modem.
o The docsSubMgtPktFilterTable specifies filtering criteria which
can be applied to packets destined to or originating from a
cable modem.
o The docsSubMgtTcpUdpFilterTable augments
Expires June 2000 [Page 3]
INTERNET-DRAFT DOCSIS Subscriber Management MIB December 1999
docsSubMgtPktFilterTable with optional TCP or UDP port filtering
criteria.
o The docsSubMgtCmFilterTable binds a cable modem to an ordered
list of filters from docsSubMgtPktFilterTable.
The docsSubMgtCpeControlTable, docsSubMgtCpeIpTable, and
docsSubMgtCmFilterTable augment the docsIfCmtsCmStatusTable from
[18]. As such, each entry in these tables is bound to a registered
cable modem, as perceived by the CMTS.
The docsSubMgtPktFilterTable is a two-dimensional: the outer
dimension is the group to which a cable modem may be bound. The inner
dimension is the ordering of filter criteria within each group. Any
number of modems may be bound to the same group.
2.2. Management requirements
2.2.1. Interaction with DOCSIS provisioning for CPE address control
Rows in docsSubMgtCpeControlTable are created by the CMTS for each
modem as a result of the DOCSIS registration process. The DOCSIS
registration attributes may include items semantically equivalent to
those in the DocsDevCpe branch of the DOCSIS Cable Device MIB [17]:
o docsDevCpeEnroll
o docsDevCpeIpMax
o docsDevCpeIp
Successful DOCSIS registration shall have the effect of setting the
corresponding fields in the docsSubMgtCpeControlTable and the
docsSubMgtCpeIpTable. If not present, the default at registration
shall be to set docsSubMgtCpeControlActive to false.
2.2.2. Interaction with DOCSIS provisioning for filtering
Rows in docsSubMgtCmFilterTable are created by the CMTS for each
modem as a result of the DOCSIS registration process. The DOCSIS
registration attributes may include two indices: one identifying the
upstream filter group and one identifying the downstream filter
group. Successful registration shall have the effect of setting
docsSubMgtCmFilterDownstream and docsSubMgtCmFilterUpstream for that
modem (just as if set through the SNMP protocol). If the DOCSIS
attributes are not present, the effect shall be to set the modem's
filter groups to the values of docsSubMgtCmFilterUpDefault and
docsSubMgtCmFilterDownDefault.
2.2.3. Row Existence of docsSubMgtTcpUdpFilterTable
The docsSubMgtTcpUdpFilterTable exists apart from the
docsSubMgtPktFilterTable because its filtering criteria is expected
to be applied to a minority of modems relative to
docsSubMgtPktFilterTable. It is separate in order to emphasize this
Expires June 2000 [Page 4]
INTERNET-DRAFT DOCSIS Subscriber Management MIB December 1999
expectation to both CMTS vendors and network operators. The rules for
row creation are:
o Row creation in docsSubMgtTcpUdpFilterTable is disallowed unless
the corresponding row in docsSubMgtPktFilterTable already
exists.
o Deletion of the row in docsSubMgtPktFilterTable deletes the
corresponding row in docsSubMgtTcpUdpFilterTable.
o Row creation for docsSubMgtPktFilterTable does not create the
corresponding row in docsSubMgtTcpUdpFilterTable.
o Row deletion of docsSubMgtTcpUdpFilterTable does not delete the
corresponding row in docsSubMgtPktFilterTable.
3. Definitions
DOCS-SUBMGT-MIB DEFINITIONS ::= BEGIN
IMPORTS
MODULE-IDENTITY,
OBJECT-TYPE,
Counter32,
Integer32,
experimental
FROM SNMPv2-SMI
TEXTUAL-CONVENTION,
RowStatus,
TruthValue
FROM SNMPv2-TC
OBJECT-GROUP,
MODULE-COMPLIANCE
FROM SNMPv2-CONF
docsIfCmtsCmStatusIndex,
docsIfCmtsCmStatusEntry
FROM DOCS-IF-MIB; -- RFC2670
docsSubMgt MODULE-IDENTITY
LAST-UPDATED "9912080000Z" -- December 8, 1999
ORGANIZATION "IETF IPCDN Working Group"
CONTACT-INFO
" Wilson Sawyer
Postal: Arris Interactive
6 Riverside Drive
Andover, MA 01810
U.S.A.
Phone: +1 978 946 4711
E-mail: wsawyer@ieee.org"
DESCRIPTION
"This is the CMTS centric subscriber management MIB for
DOCSIS compliant CMTS. This will be rooted in experimental
Expires June 2000 [Page 5]
INTERNET-DRAFT DOCSIS Subscriber Management MIB December 1999
space with a future transition to be incorporated into the
cable device MIB."
::= { experimental 9999 } -- bogus
-- RFC Editor to assign
-- ::= { mib-2 xx }
docsSubMgtObjects OBJECT IDENTIFIER ::= { docsSubMgt 1 }
IpV4orV6Addr ::= TEXTUAL-CONVENTION
STATUS current
DESCRIPTION
"An IP V4 or V6 address expressed as an octet string. The
zero length string is equal to both 0.0.0.0 and the IPv6 :0
address."
SYNTAX OCTET STRING (SIZE (0 | 4 | 16))
docsSubMgtCpeControlTable OBJECT-TYPE
SYNTAX SEQUENCE OF DocsSubMgtCpeControlEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"This table extends the docsIfCmtsCmStatusTable and adds 4
objects which reflect the state of subscriber management on a
particular CM."
::= { docsSubMgtObjects 1 }
docsSubMgtCpeControlEntry OBJECT-TYPE
SYNTAX DocsSubMgtCpeControlEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A row in the docsSubMgtCpeControlTable. All the values
are either set from the system default, or are set from objects
included in the DOCSIS registration request sent upstream to
the CMTS from the CM."
AUGMENTS { docsIfCmtsCmStatusEntry }
::= {docsSubMgtCpeControlTable 1 }
DocsSubMgtCpeControlEntry ::= SEQUENCE
{
docsSubMgtCpeControlMaxCpeIp Integer32,
docsSubMgtCpeControlActive TruthValue,
docsSubMgtCpeControlLearnable TruthValue,
docsSubMgtCpeControlReset TruthValue
}
docsSubMgtCpeControlMaxCpeIp OBJECT-TYPE
SYNTAX Integer32(0..16)
Expires June 2000 [Page 6]
INTERNET-DRAFT DOCSIS Subscriber Management MIB December 1999
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The nominal number of IP addresses permitted behind the CM
related to this entry. If this is set to zero, all CPE traffic
from the CM is dropped. If the provisioning object specifies
more CPE IP addresses for this modem than the value of this
object, then this object is set to the count of the number of
rows in docsSubMgtCpeIpTable that have the same
docsIfCmtsCmStatusIndex value. (E.g. if the CM has 5 IP
addresses specified for it, this value is 5)."
::= { docsSubMgtCpeControlEntry 1 }
docsSubMgtCpeControlActive OBJECT-TYPE
SYNTAX TruthValue
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"If this is set to true, CMTS based CPE control is active and
all the actions required by the various filter tables and
controls apply at the CMTS. If this is set to false, no
subscriber management filtering is done at the CMTS (but other
filters may apply)."
::= { docsSubMgtCpeControlEntry 2 }
docsSubMgtCpeControlLearnable OBJECT-TYPE
SYNTAX TruthValue
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"If this is set to true, up to MaxCpeIp addresses are learned
related to this CM. Those IP addresses are added (by internal
process) to the docsSubMgtCpeIpTable."
::= { docsSubMgtCpeControlEntry 3 }
docsSubMgtCpeControlReset OBJECT-TYPE
SYNTAX TruthValue
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"This object always returns false on read. If this object is
set to true, the rows with 'learned' addresses in
docsSubMgtCpeIpTable for this CM are deleted from that table."
::= { docsSubMgtCpeControlEntry 4 }
-- There may be a requirement to add here a CM IP address to support
-- SNMP only pass through for the management address.
docsSubMgtCpeIpTable OBJECT-TYPE
SYNTAX SEQUENCE OF DocsSubMgtCpeIpEntry
MAX-ACCESS not-accessible
STATUS current
Expires June 2000 [Page 7]
INTERNET-DRAFT DOCSIS Subscriber Management MIB December 1999
DESCRIPTION
"A table of CPE IP addresses known on a per CM basis."
::= { docsSubMgtObjects 2 }
docsSubMgtCpeIpEntry OBJECT-TYPE
SYNTAX DocsSubMgtCpeIpEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"An entry in the docsSubMgtCpeIpTable. The first index is
the specific modem we're referring to, the second index is the
specific CPE IP entry."
INDEX { docsIfCmtsCmStatusIndex,
docsSubMgtCpeIpIndex }
::= {docsSubMgtCpeIpTable 1 }
DocsSubMgtCpeIpEntry ::= SEQUENCE
{
docsSubMgtCpeIpIndex Integer32,
docsSubMgtCpeIpAddr IpV4orV6Addr,
docsSubMgtCpeIpLearned TruthValue
}
docsSubMgtCpeIpIndex OBJECT-TYPE
SYNTAX Integer32
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The index of this CPE IP address relative to the indexed CM.
An entry is created either through the included CPE IP addresses
in the provisioning object, or via learning. If a CMTS receives
an IP packet from a CM that contains a source IP address which
does not match one of the docsSubMgtCpeIpAddr entries for this
CM, one of two things occurs. If the number of entries is less
than docsSubMgtCpeControlMaxCpeIp, the source address is added to
the table and the packet is forwarded. If the number of entries
equals the docsSubMgtCpeControlMaxCpeIp, AND
docsSubMgtCpeControlActive is true, then the packet is dropped.
Otherwise the packet is forwarded. "
::= { docsSubMgtCpeIpEntry 1 }
docsSubMgtCpeIpAddr OBJECT-TYPE
SYNTAX IpV4orV6Addr
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The IP address either set from provisioning or learned via
wiretapping."
::= { docsSubMgtCpeIpEntry 2 }
docsSubMgtCpeIpLearned OBJECT-TYPE
SYNTAX TruthValue
Expires June 2000 [Page 8]
INTERNET-DRAFT DOCSIS Subscriber Management MIB December 1999
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"If true, this entry was learned from IP packets sent
upstream rather than from the provisioning objects."
::= { docsSubMgtCpeIpEntry 3 }
-- The generic packet filter table. Note that this just defines the
-- match criteria. The docsSubMgtCmFilterTable links this table to
-- the specific modems.
docsSubMgtPktFilterTable OBJECT-TYPE
SYNTAX SEQUENCE OF DocsSubMgtPktFilterEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A table of filter or classifier criteria. This table
consists of no more than 30 groups of no more than 20
classifiers. Classifiers are assigned by group to the individual
CMs. That assignment is made via the configuration objects sent
upstream from the CM to the CMTS during registration."
::= { docsSubMgtObjects 3 }
docsSubMgtPktFilterEntry OBJECT-TYPE
SYNTAX DocsSubMgtPktFilterEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"An entry in the docsSubMgtPktFilterTable."
INDEX { docsSubMgtPktFilterGroup,
docsSubMgtPktFilterIndex }
::= {docsSubMgtPktFilterTable 1 }
DocsSubMgtPktFilterEntry ::= SEQUENCE
{
docsSubMgtPktFilterGroup Integer32,
docsSubMgtPktFilterIndex Integer32,
docsSubMgtPktFilterSrcAddr IpV4orV6Addr,
docsSubMgtPktFilterSrcMask Integer32,
docsSubMgtPktFilterDstAddr IpV4orV6Addr,
docsSubMgtPktFilterDstMask Integer32,
docsSubMgtPktFilterUlp Integer32,
docsSubMgtPktFilterTosValue OCTET STRING,
docsSubMgtPktFilterTosMask OCTET STRING,
docsSubMgtPktFilterAction INTEGER,
docsSubMgtPktFilterMatches Counter32,
docsSubMgtPktFilterStatus RowStatus
}
docsSubMgtPktFilterGroup OBJECT-TYPE
Expires June 2000 [Page 9]
INTERNET-DRAFT DOCSIS Subscriber Management MIB December 1999
SYNTAX Integer32(1..30)
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Identifies the group of modems to which this ordered list
of filters applies."
::= { docsSubMgtPktFilterEntry 1 }
docsSubMgtPktFilterIndex OBJECT-TYPE
SYNTAX Integer32
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"An index which describes the ordering of a set of filter
specifications within the group. Filters are applied in index
order."
::= { docsSubMgtPktFilterEntry 2 }
docsSubMgtPktFilterSrcAddr OBJECT-TYPE
SYNTAX IpV4orV6Addr
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The source IP address to match in the packet to be
classified. By default, this is the all-zero's IP v4 and v6
address."
DEFVAL { ''h }
::= { docsSubMgtPktFilterEntry 3 }
docsSubMgtPktFilterSrcMask OBJECT-TYPE
SYNTAX Integer32 (0..128)
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The number of leftmost bits in the source IP mask to match
against the packet to be classified. This, taken with the
SrcAddr specifies a matching criteria. By default, the pair
specifies a filter which matches all source addresses. For IPv4
addresses, the range is constrained to 0..32."
DEFVAL { 0 }
::= { docsSubMgtPktFilterEntry 4 }
docsSubMgtPktFilterDstAddr OBJECT-TYPE
SYNTAX IpV4orV6Addr
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The destination IP address to match in the packet to be
classified. By default, this is the all-zero's IP v4 and v6
address."
DEFVAL { ''h }
::= { docsSubMgtPktFilterEntry 5 }
Expires June 2000 [Page 10]
INTERNET-DRAFT DOCSIS Subscriber Management MIB December 1999
docsSubMgtPktFilterDstMask OBJECT-TYPE
SYNTAX Integer32 (0..128)
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The number of leftmost bits in the destination IP mask to
match against the packet to be classified. This, taken with the
DstAddr specifies a matching criteria. By default, the pair
specifies a filter which matches all destination addresses. For
IPv4 addresses, the range is constrained to 0..32."
DEFVAL { 0 }
::= { docsSubMgtPktFilterEntry 6 }
docsSubMgtPktFilterUlp OBJECT-TYPE
SYNTAX Integer32 (0..256)
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"Upper level protocol to match. If this value is 256,
matches ALL ULP values. Otherwise, this matches the specific
protocol value. Note that if the packet ULP is either 6 (tcp) or
17 (udp), then docsSubMgtPktTcpUdpFilterTable must also be
consulted (if its entry exists) to see if this entry matches.
Obviously, if this value is neither tcp, udp nor 256, then that
table need not be matched against."
DEFVAL { 256 }
::= { docsSubMgtPktFilterEntry 7 }
docsSubMgtPktFilterTosValue OBJECT-TYPE
SYNTAX OCTET STRING (SIZE(1))
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The TOS value to match in the IP packet."
DEFVAL { '0'h }
::= { docsSubMgtPktFilterEntry 8 }
docsSubMgtPktFilterTosMask OBJECT-TYPE
SYNTAX OCTET STRING(SIZE(1))
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The mask to apply against the TOS value to be matched in the
IP packet. The default for both these objects taken together
matches all TOS values."
DEFVAL { '0'h }
::= { docsSubMgtPktFilterEntry 9 }
docsSubMgtPktFilterAction OBJECT-TYPE
SYNTAX INTEGER
{
accept(1),
drop(2)
Expires June 2000 [Page 11]
INTERNET-DRAFT DOCSIS Subscriber Management MIB December 1999
}
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The action to take upon this filter matching. Accept means
to accept the packet for further processing. Drop means to drop
the packet."
DEFVAL { accept }
::= { docsSubMgtPktFilterEntry 10 }
docsSubMgtPktFilterMatches OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"This object counts the number of times this specific rule
has been matched. This is incremented any time this rule is
encountered and all components match. It is only incremented for
the first (lowest-indexed) filter matching a packet."
::= { docsSubMgtPktFilterEntry 11 }
docsSubMgtPktFilterStatus OBJECT-TYPE
SYNTAX RowStatus
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"Standard rowStatus object for creating this row. Any object
in this row which is writable may be changed at any time while
the row is active."
::= { docsSubMgtPktFilterEntry 12 }
docsSubMgtTcpUdpFilterTable OBJECT-TYPE
SYNTAX SEQUENCE OF DocsSubMgtTcpUdpFilterEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"This is an adjunct to docsSubMgtPktFilterTable. It provides
optional filtering based on elements in TCP or UDP headers.
This table is separate from docsSubMgtPktFilterTable only
because it is expected to be used more rarely. This table
is not consulted unless the upper-layer protocol is TCP,
UDP, or 'any'."
::= { docsSubMgtObjects 4 }
docsSubMgtTcpUdpFilterEntry OBJECT-TYPE
SYNTAX DocsSubMgtTcpUdpFilterEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Defines filtering criteria for TCP and UDP headers."
INDEX { docsSubMgtPktFilterGroup, docsSubMgtPktFilterIndex }
::= {docsSubMgtTcpUdpFilterTable 1 }
Expires June 2000 [Page 12]
INTERNET-DRAFT DOCSIS Subscriber Management MIB December 1999
DocsSubMgtTcpUdpFilterEntry ::= SEQUENCE
{
docsSubMgtTcpUdpSrcPort Integer32,
docsSubMgtTcpUdpDstPort Integer32,
docsSubMgtTcpFlagValues BITS,
docsSubMgtTcpFlagMask BITS,
docsSubMgtTcpUdpStatus RowStatus
}
docsSubMgtTcpUdpSrcPort OBJECT-TYPE
SYNTAX Integer32(0..65536)
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The source port to match. 65536 matches any value in the
TCP or UDP source port field."
DEFVAL { 65536 }
::= { docsSubMgtTcpUdpFilterEntry 1 }
docsSubMgtTcpUdpDstPort OBJECT-TYPE
SYNTAX Integer32(0..65536)
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The destination port to match. 65536 matches any value in
the TCP or UDP destination port field."
DEFVAL { 65536 }
::= { docsSubMgtTcpUdpFilterEntry 2 }
docsSubMgtTcpFlagValues OBJECT-TYPE
SYNTAX BITS
{
urgent(0),
ack(1),
push(2),
reset(3),
syn(4),
fin(5)
}
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"The value of the flags of interest. The value of this
object MUST always be a subset (proper or otherwise) of
docsSubMgtTcpFlagMask. An attempt to violate this constraint
returns an inconsistentValue error for an SNMPv2 or v3 agent
and a badValue error for an SNMPv1 agent."
DEFVAL { {} }
::= { docsSubMgtTcpUdpFilterEntry 3 }
docsSubMgtTcpFlagMask OBJECT-TYPE
Expires June 2000 [Page 13]
INTERNET-DRAFT DOCSIS Subscriber Management MIB December 1999
SYNTAX BITS
{
urgent(0),
ack(1),
push(2),
reset(3),
syn(4),
fin(5)
}
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"This bit set indicates the flags of interest in the TCP
header for the packet to be matched. For example to match all
packets where the urgent bit is set, but that are not either syn
or fin, the value of docsSubMgtTcpFlagValues would be { urgent },
and the value of this object would be { urgent, syn, fin }"
DEFVAL { {} }
::= { docsSubMgtTcpUdpFilterEntry 4 }
docsSubMgtTcpUdpStatus OBJECT-TYPE
SYNTAX RowStatus
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"Standard row object for this table. Any object in the
conceptual row may be modified regardless of whether this row is
active or not."
::= { docsSubMgtTcpUdpFilterEntry 5 }
docsSubMgtCmFilterTable OBJECT-TYPE
SYNTAX SEQUENCE OF DocsSubMgtCmFilterEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Binds filter groups to modems. This table identifies for
each modem the upstream and downstream filter groups that apply
to packets for that modem. Zero is used as a distinguished value
to mean no filter group."
::= { docsSubMgtObjects 5 }
docsSubMgtCmFilterEntry OBJECT-TYPE
SYNTAX DocsSubMgtCmFilterEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Binds a filter group to each direction of traffic for a
modem."
AUGMENTS { docsIfCmtsCmStatusEntry }
::= {docsSubMgtCmFilterTable 1 }
Expires June 2000 [Page 14]
INTERNET-DRAFT DOCSIS Subscriber Management MIB December 1999
DocsSubMgtCmFilterEntry ::= SEQUENCE
{
docsSubMgtCmFilterDownstream Integer32,
docsSubMgtCmFilterUpstream Integer32
}
docsSubMgtCmFilterDownstream OBJECT-TYPE
SYNTAX Integer32
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The filter group applied to traffic destined for the
referenced CM. This is set upon row creation to either the
default (docsSubMgtCmFilterDownDefault), or to the value in the
provisioning object sent upstream from the CM to the CMTS during
registration."
::= { docsSubMgtCmFilterEntry 1 }
docsSubMgtCmFilterUpstream OBJECT-TYPE
SYNTAX Integer32
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The filter group applied to traffic originating from the
referenced CM. This is set upon row creation to either the
default (docsSubMgtCmFilterUpDefault), or to the value in the
provisioning object sent upstream from the CM to the CMTS."
::= { docsSubMgtCmFilterEntry 2 }
docsSubMgtCmFilterDownDefault OBJECT-TYPE
SYNTAX Integer32
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"Upon a row creation in docsSubMgtCmFilterTable,
docsSubMgtCmFilterDownstream is set to this value if no
provisioning object is present to override it. This object is
persistent across CMTS reboots. Upon initial CMTS
initialization, this defaults to 0."
::= { docsSubMgtObjects 6 }
docsSubMgtCmFilterUpDefault OBJECT-TYPE
SYNTAX Integer32
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"Upon a row creation in docsSubMgtCmFilterTable,
docsSubMgtCmFilterUpstream is set to this value if no
provisioning object is present to override it. This object is
persistent across CMTS reboots. Upon initial CMTS
initialization, this defaults to 0."
::= { docsSubMgtObjects 7 }
Expires June 2000 [Page 15]
INTERNET-DRAFT DOCSIS Subscriber Management MIB December 1999
docsSubMgtNotification OBJECT IDENTIFIER ::= { docsSubMgt 2 }
docsSubMgtConformance OBJECT IDENTIFIER ::= { docsSubMgt 3 }
docsSubMgtCompliances OBJECT IDENTIFIER ::=
{ docsSubMgtConformance 1 }
docsSubMgtGroups OBJECT IDENTIFIER ::=
{ docsSubMgtConformance 2 }
docsSubMgtBasicCompliance MODULE-COMPLIANCE
STATUS current
DESCRIPTION
"The compliance statement for CMTS devices that implement
CMTS centric subscriber management."
MODULE
MANDATORY-GROUPS {
docsSubMgtGroup
}
::= { docsSubMgtCompliances 1 }
docsSubMgtGroup OBJECT-GROUP
OBJECTS {
docsSubMgtCpeControlMaxCpeIp,
docsSubMgtCpeControlActive,
docsSubMgtCpeControlLearnable,
docsSubMgtCpeControlReset,
docsSubMgtCpeIpAddr,
docsSubMgtCpeIpLearned,
docsSubMgtPktFilterSrcAddr,
docsSubMgtPktFilterSrcMask,
docsSubMgtPktFilterDstAddr,
docsSubMgtPktFilterDstMask,
docsSubMgtPktFilterUlp,
docsSubMgtPktFilterTosValue,
docsSubMgtPktFilterTosMask,
docsSubMgtPktFilterAction,
docsSubMgtPktFilterMatches,
docsSubMgtPktFilterStatus,
docsSubMgtTcpUdpSrcPort,
docsSubMgtTcpUdpDstPort,
docsSubMgtTcpFlagValues,
docsSubMgtTcpFlagMask,
docsSubMgtTcpUdpStatus,
docsSubMgtCmFilterDownstream,
docsSubMgtCmFilterUpstream,
docsSubMgtCmFilterDownDefault,
docsSubMgtCmFilterUpDefault
}
STATUS current
DESCRIPTION
Expires June 2000 [Page 16]
INTERNET-DRAFT DOCSIS Subscriber Management MIB December 1999
"The objects use to managed host-based cable modems
via a set of CMTS enforced controls."
::= { docsSubMgtGroups 1 }
END
4. Acknowledgments
Thanks to Guenter Roeck and Julie McGray for reviewing early drafts.
5. References
[1] Harrington, D., Presuhn, R. and B. Wijnen, "An Architecture
for Describing SNMP Management Frameworks", RFC 2571, April
1999.
[2] Rose, M. and K. McCloghrie, "Structure and Identification of
Management Information for TCP/IP-based Internets", STD 16, RFC
1155, May 1990.
[3] Rose, M. and K. McCloghrie, "Concise MIB Definitions", STD 16,
RFC 1212, March 1991.
[4] Rose, M., "A Convention for Defining Traps for use with the
SNMP", RFC 1215, March 1991.
[5] McCloghrie, K., Perkins, D. and J. Schoenwaelder, "Structure of
Management Information for Version 2 (SMIv2)", STD 58, RFC 2578,
April 1999.
[6] McCloghrie, K., Perkins, D. and J. Schoenwaelder, "Textual
Conventions for SMIv2", STD 58, RFC 2579, April 1999.
[7] McCloghrie, K., Perkins, D. and J. Schoenwaelder, "Conformance
Statements for SMIv2", STD 58, RFC 2580, April 1999.
[8] Case, J., Fedor, M., Schoffstall, M. and J. Davin, "Simple
Management Protocol", STD 15, RFC 1157, May 1990.
[9] Case, J., McCloghrie, K., Rose, M. and S. Waldbusser,
"Introduction to Community-based SNMPv2", RFC 1901, January
1996.
[10] Case, J., McCloghrie, K., Rose, M. and S. Waldbusser, "Transport
Mappings for Version 2 of the Simple Network Management Protocol
(SNMPv2)", RFC 1906, January 1996.
[11] Case, J., Harrington D., Presuhn R. and B. Wijnen, "Message
Processing and Dispatching for the Simple Network Management
Protocol (SNMP)", RFC 2572, April 1999.
[12] Blumenthal, U. and B. Wijnen, "User-based Security Model (USM)
for version 3 of the Simple Network Management Protocol
Expires June 2000 [Page 17]
INTERNET-DRAFT DOCSIS Subscriber Management MIB December 1999
(SNMPv3)", RFC 2574, April 1999.
[13] Case, J., McCloghrie, K., Rose, M. and S. Waldbusser, "Protocol
Operations for Version 2 of the Simple Network Management
Protocol (SNMPv2)", RFC 1905, January 1996.
[14] Levi, D., Meyer, P. and B. Stewart, "SNMP Applications", RFC
2573, April 1999.
[15] Wijnen, B., Presuhn, R. and K. McCloghrie, "View-based Access
Control Model (VACM) for the Simple Network Management Protocol
(SNMP)", RFC 2575, April 1999.
[16] "Data-Over-Cable Service Interface Specifications: Cable Modem
Radio Frequency Interface Specification SP-RFI-I04-980724",
DOCSIS, July 1998, available at
http://www.cablemodem.com/.
[17] StJohns, M. , "Cable Device Management Information Base for
DOCSIS Compliant Cable Modems and Cable Modem Termination
Systems", RFC2669, August 1999.
[18] StJohns, M. , "Radio Frequency (RF) Interface Management
Information Base for MCNS/DOCSIS compliant RF interfaces",
RFC2670, August 1999.
[19] "Data-Over-Cable Service Interface Specifications: Baseline
Privacy Interface Specification SP-BPI-I02-990319",
DOCSIS, March 1999, available at
http://www.cablemodem.com/.
[20] "Data-Over-Cable Service Interface Specifications: Baseline
Privacy Plus Interface Specification SP-BPI+-I03-991105",
DOCSIS, November 1999, available at
http://www.cablemodem.com/.
6. Security Considerations
This MIB is intended to limit certain kinds of network behavior by
subscriber hosts attached to cable modems, including, for example, IP
spoofing. These limitations may be compromised, however, if the cable
modem's identity or registration process is spoofed. The DOCSIS RFI
and privacy specifications [16], [19], and [20] define a number of
mechanisms for assuring modem identity.
There are a number of management objects defined in this MIB that
have a MAX-ACCESS clause of read-write and/or read-create. Such
objects may be considered sensitive or vulnerable in some network
environments. The support for SET operations in a non-secure
environment without proper protection can have a negative effect on
network operations.
SNMPv1 by itself is not a secure environment. Even if the network
Expires June 2000 [Page 18]
INTERNET-DRAFT DOCSIS Subscriber Management MIB December 1999
itself is secure (for example by using IPSec), even then, there is no
control as to who on the secure network is allowed to access and
GET/SET (read/change/create/delete) the objects in this MIB.
It is recommended that the implementers consider the security
features as provided by the SNMPv3 framework. Specifically, the use
of the User-based Security Model RFC 2574 [12] and the View- based
Access Control Model RFC 2575 [15] is recommended.
It is then a customer/user responsibility to ensure that the SNMP
entity giving access to an instance of this MIB, is properly
configured to give access to the objects only to those principals
(users) that have legitimate rights to indeed GET or SET
(change/create/delete) them.
7. Author's Addresses
Wilson Sawyer
Arris Interactive
6 Riverside Drive
Andover, MA 01810
USA
Phone: +1 978 946 4711
Email: wsawyer@ieee.org
Michael StJohns
@Home Network
425 Broadway
Redwood City, CA 94063
Phone: +1 650 569 5368
EMail: stjohns@corp.home.net
Expires June 2000 [Page 19]
