Convention for defining traps for use with the SNMP
RFC 1215

Network Working Group                                   M. Rose, Editor
Request for Comments: 1215            Performance Systems International
                                                             March 1991

                    A Convention for Defining Traps
                         for use with the SNMP

Status of this Memo

   This memo suggests a straight-forward approach towards defining traps
   used with the SNMP.  Readers should note that the use of traps in the
   Internet-standard network management framework is controversial.  As
   such, this memo is being put forward for information purposes.
   Network management practitioners who employ traps are encouraged to
   make use of this document.  Practitioners who do not employ traps can
   safely ignore this document.

   This memo provides information for the Internet community.  It does
   not specify any standard.  Distribution of this memo is unlimited.

Table of Contents

   1. Historical Perspective ................................    1
   2. Defining Traps ........................................    2
   2.1 Mapping of the TRAP-TYPE macro .......................    3
   2.1.1 Mapping of the ENTERPRISE clause ...................    3
   2.1.2 Mapping of the VARIABLES clause ....................    4
   2.1.3 Mapping of the DESCRIPTION clause ..................    4
   2.1.4 Mapping of the REFERENCE clause ....................    4
   2.1.5 Mapping of the TRAP-TYPE value .....................    4
   2.2 Usage Examples .......................................    5
   2.2.1 Enterprise-specific Trap ...........................    5
   2.2.2 Generic-Traps for use with the SNMP ................    5
   3. Acknowledgements ......................................    7
   4. References ............................................    9
   5. Security Considerations................................    9
   6. Author's Address.......................................    9

1.  Historical Perspective

   As reported in RFC 1052, IAB Recommendations for the Development of
   Internet Network Management Standards [1], a two-prong strategy for
   network management of TCP/IP-based internets was undertaken.  In the
   short-term, the Simple Network Management Protocol (SNMP), defined in
   RFC 1067, was to be used to manage nodes in the Internet community.
   In the long-term, the use of the OSI network management framework was
   be examined.  Two documents were produced to define the management

SNMP Working Group                                              [Page 1]
RFC 1215             Convention for Defining Traps            March 1991

   information: RFC 1065, which defined the Structure of Management
   Information (SMI), and RFC 1066, which defined the Management
   Information Base (MIB).  Both of these documents were designed so as
   to be compatible with both the SNMP and the OSI network management
   framework.

   This strategy was quite successful in the short-term: Internet-based
   network management technology was fielded, by both the research and
   commercial communities, within a few months.  As a result of this,
   portions of the Internet community became network manageable in a
   timely fashion.

   As reported in RFC 1109, Report of the Second Ad Hoc Network
   Management Review Group [2], the requirements of the SNMP and the OSI
   network management frameworks were more different than anticipated.
   As such, the requirement for compatibility between the SMI/MIB and
   both frameworks was suspended.  This action permitted the operational
   network management framework, based on the SNMP, to respond to new
   operational needs in the Internet community by producing MIB-II.

   In May of 1990, the core documents were elevated to "Standard
   Protocols" with "Recommended" status.  As such, the Internet-standard
   network management framework consists of: Structure and
   Identification of Management Information for TCP/IP-based internets,
   RFC 1155 [3], which describes how managed objects contained in the
   MIB are defined; Management Information Base for Network Management
   of TCP/IP-based internets, which describes the managed objects
   contained in the MIB, RFC 1156 [4]; and, the Simple Network
   Management Protocol, RFC 1157 [5], which defines the protocol used to
   manage these objects.

2.  Defining Traps

   Due to its initial requirement to be protocol-independent, the
   Internet-standard SMI does not provide a means for defining traps.
   Instead, the SNMP defines a few standardized traps and provides a
   means for management enterprises to transmit enterprise-specific
   traps.

   However, with the introduction of experimental MIBs, some of which
   have a need to define experiment-specific traps, a convenient means
   of defining traps is desirable.  The TRAP-TYPE macro is suggested for
   this purpose:

          IMPORTS
              ObjectName
                  FROM RFC1155-SMI;

SNMP Working Group                                              [Page 2]
RFC 1215             Convention for Defining Traps            March 1991

          TRAP-TYPE MACRO ::=
          BEGIN
              TYPE NOTATION ::= "ENTERPRISE" value
                                    (enterprise OBJECT IDENTIFIER)
                                VarPart
                                DescrPart
                                ReferPart
              VALUE NOTATION ::= value (VALUE INTEGER)

              VarPart ::=
                         "VARIABLES" "{" VarTypes "}"
                              | empty
              VarTypes ::=
                         VarType | VarTypes "," VarType
              VarType ::=
                         value (vartype ObjectName)

              DescrPart ::=
                         "DESCRIPTION" value (description DisplayString)
                              | empty

              ReferPart ::=
                         "REFERENCE" value (reference DisplayString)
                              | empty

          END

   It must be emphasized however, that the use of traps is STRONGLY
   discouraged in the Internet-standard Network Management Framework.
   The TRAP-TYPE macro is intended to allow concise definitions of
   existing traps, not to spur the definition of new traps.

2.1.  Mapping of the TRAP-TYPE macro

   It should be noted that the expansion of the TRAP-TYPE macro is
   something which conceptually happens during implementation and not
   during run-time.

2.1.1.  Mapping of the ENTERPRISE clause

   The ENTERPRISE clause, which must be present, defines the management
   enterprise under whose registration authority this trap is defined
   (for a discussion on delegation of registration authority, see the
   SMI [3]).  This value is placed inside the enterprise field of the
   SNMP Trap-PDU.

   By convention, if the value of the ENTERPRISE clause is

SNMP Working Group                                              [Page 3]
RFC 1215             Convention for Defining Traps            March 1991

                snmp   OBJECT IDENTIFIER ::= { mib-2 11 }

   as defined in MIB-II [7], then instead of using this value, the value
   of sysObjectID is placed in the enterprise field of the SNMP Trap-
   PDU.  This provides a simple means of using the TRAP-TYPE macro to
   represent the existing standard SNMP traps; it is not intended to
   provide a means to define additional standard SNMP traps.

2.1.2.  Mapping of the VARIABLES clause

   The VARIABLES clause, which need not be present, defines the ordered
   sequence of MIB objects which are contained within every instance of
   the trap type.  Each variable is placed, in order, inside the
   variable-bindings field of the SNMP Trap-PDU.  Note that at the
   option of the agent, additional variables may follow in the
   variable-bindings field.

   However, if the value of the ENTERPRISE clause is

               snmp   OBJECT IDENTIFIER ::= { mib-2 11 }

   as defined in MIB-II [7], then the introduction of additional
   variables must not result in the serialized SNMP Message being larger
   than 484 octets.

2.1.3.  Mapping of the DESCRIPTION clause

   The DESCRIPTION clause, which need not be present, contains a textual
   definition of the trap type.  Note that in order to conform to the
   ASN.1 syntax, the entire value of this clause must be enclosed in
   double quotation marks, although the value may be multi-line.

   Further, note that if the MIB module does not contain a textual
   description of the trap elsewhere then the DESCRIPTION clause must be
   present.

2.1.4.  Mapping of the REFERENCE clause

   The REFERENCE clause, which need not be present, contains a textual
   cross-reference to a trap, event, or alarm, defined in some other MIB
   module.  This is useful when de-osifying a MIB produced by some other
   organization.

2.1.5.  Mapping of the TRAP-TYPE value

   The value of an invocation of the TRAP-TYPE macro is the (integer)
   number which is uniquely assigned to the trap by the registration
   authority indicated by the ENTERPRISE clause.  This value is placed

SNMP Working Group                                              [Page 4]
RFC 1215             Convention for Defining Traps            March 1991

   inside the specific-trap field of the SNMP Trap-PDU, and the
   generic-trap field is set to "enterpriseSpecific(6)".

   By convention, if the value of the ENTERPRISE clause is

               snmp   OBJECT IDENTIFIER ::= { mib-2 11 }

   as defined in MIB-II [7], then the value of an invocation of the
   TRAP-TYPE macro is placed inside the generic-trap field of the SNMP
   Trap-PDU, and the specific-trap field is set to 0.  This provides a
   simple means of using the TRAP-TYPE macro to represent the existing
   standard SNMP traps; it is not intended to provide a means to define
   additional standard SNMP traps.

2.2.  Usage Examples

2.2.1.  Enterprise-specific Trap

   Consider a simple example of an enterprise-specific trap that is sent
   when a communication link failure is encountered:

          myEnterprise OBJECT IDENTIFIER ::= { enterprises 9999 }

          myLinkDown TRAP-TYPE
              ENTERPRISE  myEnterprise
              VARIABLES   { ifIndex }
              DESCRIPTION
                          "A myLinkDown trap signifies that the sending
                          SNMP application entity recognizes a failure
                          in one of the communications links represented
                          in the agent's configuration."
              ::= 2

2.2.2.  Generic-Traps for use with the SNMP

   Consider how the standard SNMP traps might be defined:

          coldStart TRAP-TYPE
              ENTERPRISE  snmp
              DESCRIPTION
                          "A coldStart trap signifies that the sending
                          protocol entity is reinitializing itself such
                          that the agent's configuration or the rotocol
                          entity implementation may be altered."
              ::= 0

          warmStart TRAP-TYPE
              ENTERPRISE  snmp

SNMP Working Group                                              [Page 5]
RFC 1215             Convention for Defining Traps            March 1991

              DESCRIPTION
                          "A warmStart trap signifies that the sending
                          protocol entity is reinitializing itself such
                          that neither the agent configuration nor the
                          protocol entity implementation is altered."
              ::= 1

          linkDown TRAP-TYPE
              ENTERPRISE  snmp
              VARIABLES   { ifIndex }
              DESCRIPTION
                          "A linkDown trap signifies that the sending
                          protocol entity recognizes a failure in one of
                          the communication links represented in the
                          agent's configuration."
              ::= 2

          linkUp TRAP-TYPE
              ENTERPRISE  snmp
              VARIABLES   { ifIndex }
              DESCRIPTION
                          "A linkUp trap signifies that the sending
                          protocol entity recognizes that one of the
                          communication links represented in the agent's
                          configuration has come up."
              ::= 3

          authenticationFailure TRAP-TYPE
              ENTERPRISE  snmp
              DESCRIPTION
                          "An authenticationFailure trap signifies that
                          the sending protocol entity is the addressee
                          of a protocol message that is not properly
                          authenticated.  While implementations of the
                          SNMP must be capable of generating this trap,
                          they must also be capable of suppressing the
                          emission of such traps via an implementation-
                          specific mechanism."
              ::= 4

SNMP Working Group                                              [Page 6]
RFC 1215             Convention for Defining Traps            March 1991

          egpNeighborLoss TRAP-TYPE
              ENTERPRISE  snmp
              VARIABLES   { egpNeighAddr }
              DESCRIPTION
                          "An egpNeighborLoss trap signifies that an EGP
                          neighbor for whom the sending protocol entity
                          was an EGP peer has been marked down and the
                          peer relationship no longer obtains."
              ::= 5

3.  Acknowledgements

   This document was produced by the SNMP Working Group:

               Anne Ambler, Spider
               Karl Auerbach, Sun
               Fred Baker, ACC
               Ken Brinkerhoff
               Ron Broersma, NOSC
               Jack Brown, US Army
               Theodore Brunner, Bellcore
               Jeffrey Buffum, HP
               John Burress, Wellfleet
               Jeffrey D. Case, University of Tennessee at Knoxville
               Chris Chiptasso, Spartacus
               Paul Ciarfella, DEC
               Bob Collet
               John Cook, Chipcom
               Tracy Cox, Bellcore
               James R. Davin, MIT-LCS
               Eric Decker, cisco
               Kurt Dobbins, Cabletron
               Nadya El-Afandi, Network Systems
               Gary Ellis, HP
               Fred Engle
               Mike Erlinger
               Mark S. Fedor, PSI
               Richard Fox, Synoptics
               Karen Frisa, CMU
               Chris Gunner, DEC
               Fred Harris, University of Tennessee at Knoxville
               Ken Hibbard, Xylogics
               Ole Jacobsen, Interop
               Ken Jones
               Satish Joshi, Synoptics
               Frank Kastenholz, Racal-Interlan
               Shimshon Kaufman, Spartacus
               Ken Key, University of Tennessee at Knoxville

SNMP Working Group                                              [Page 7]
RFC 1215             Convention for Defining Traps            March 1991

               Jim Kinder, Fibercom
               Alex Koifman, BBN
               Christopher Kolb, PSI
               Cheryl Krupczak, NCR
               Paul Langille, DEC
               Peter Lin, Vitalink
               John Lunny, TWG
               Carl Malamud
               Randy Mayhew, University of Tennessee at Knoxville
               Keith McCloghrie, Hughes LAN Systems
               Donna McMaster, David Systems
               Lynn Monsanto, Sun
               Dave Perkins, 3COM
               Jim Reinstedler, Ungerman Bass
               Anil Rijsinghani, DEC
               Kathy Rinehart, Arnold AFB
               Kary Robertson
               Marshall T. Rose, PSI (chair)
               L. Michael Sabo, NCSC
               Jon Saperia, DEC
               Greg Satz, cisco
               Martin Schoffstall, PSI
               John Seligson
               Steve Sherry, Xyplex
               Fei Shu, NEC
               Sam Sjogren, TGV
               Mark Sleeper, Sparta
               Lance Sprung
               Mike St.Johns
               Bob Stewart, Xyplex
               Emil Sturniold
               Kaj Tesink, Bellcore
               Dean Throop, Data General
               Bill Townsend, Xylogics
               Maurice Turcotte, Racal-Milgo
               Kannan Varadhou
               Sudhanshu Verma, HP
               Bill Versteeg, Network Research Corporation
               Warren Vik, Interactive Systems
               David Waitzman, BBN
               Steve Waldbusser, CMU
               Dan Wintringhan
               David Wood
               Wengyik Yeong, PSI
               Jeff Young, Cray Research

SNMP Working Group                                              [Page 8]
RFC 1215             Convention for Defining Traps            March 1991

4.  References

   [1] Cerf, V., "IAB Recommendations for the Development of Internet
       Network Management Standards", RFC 1052, NRI, April 1988.

   [2] Cerf, V., "Report of the Second Ad Hoc Network Management Review
       Group", RFC 1109, NRI, August 1989.

   [3] Rose M., and K. McCloghrie, "Structure and Identification of
       Management Information for TCP/IP-based internets", RFC 1155,
       Performance Systems International, Hughes LAN Systems, May 1990.

   [4] McCloghrie K., and M. Rose, "Management Information Base for
       Network Management of TCP/IP-based internets", RFC 1156, Hughes
       LAN Systems, Performance Systems International, May 1990.

   [5] Case, J., Fedor, M., Schoffstall, M., and J. Davin, "Simple
       Network Management Protocol", RFC 1157, SNMP Research,
       Performance Systems International, Performance Systems
       International, MIT Laboratory for Computer Science, May 1990.

   [6] Information processing systems - Open Systems Interconnection -
       Specification of Abstract Syntax Notation One (ASN.1),
       International Organization for Standardization International
       Standard 8824, December 1987.

   [7] Rose M., Editor, "Management Information Base for Network
       Management of TCP/IP-based internets: MIB-II", RFC 1213,
       Performance Systems International, March 1991.

5.  Security Considerations

   Security issues are not discussed in this memo.

6.  Author's Address

   Marshall T. Rose
   Performance Systems International
   5201 Great America Parkway
   Suite 3106
   Santa Clara, CA  95054

   Phone: +1 408 562 6222

   EMail: mrose@psi.com
   X.500:  rose, psi, us

SNMP Working Group                                              [Page 9]