TCP MIB: SNMPv2 Management Information Base for the Transmission Control Protocol using SMIv2
A dashboard for monitoring and managing TCP connections via SNMP.
McCloghrie, K., Ed., "SNMPv2 Management Information Base for the Transmission Control Protocol using SMIv2", RFC 2012, DOI 10.17487/RFC2012, November 1996, <https://www.rfc-editor.org/info/rfc2012>.
@misc{rfc2012,
series = {Request for Comments},
number = 2012,
howpublished = {RFC 2012},
publisher = {RFC Editor},
doi = {10.17487/RFC2012},
url = {https://www.rfc-editor.org/info/rfc2012},
author = {K. McCloghrie},
title = {{SNMPv2 Management Information Base for the Transmission Control Protocol using SMIv2}},
pagetotal = 10,
year = 1996,
month = nov,
} RFC text
Contents
Network Working Group K. McCloghrie, Editor
Request for Comments: 2012 Cisco Systems
Updates: 1213 November 1996
Category: Standards Track
SNMPv2 Management Information Base
for the Transmission Control Protocol using SMIv2
Status of this Memo
This document specifies an Internet standards track protocol for the
Internet community, and requests discussion and suggestions for
improvements. Please refer to the current edition of the "Internet
Official Protocol Standards" (STD 1) for the standardization state
and status of this protocol. Distribution of this memo is unlimited.
IESG Note:
The IP, UDP, and TCP MIB modules currently support only IPv4. These
three modules use the IpAddress type defined as an OCTET STRING of
length 4 to represent the IPv4 32-bit internet addresses. (See RFC
1902, SMI for SNMPv2.) They do not support the new 128-bit IPv6
internet addresses.
Table of Contents
1. Introduction ................................................ 1
2. Definitions ................................................. 2
2.1 The TCP Group .............................................. 3
2.2 Conformance Information .................................... 8
2.2.1 Compliance Statements .................................... 8
2.2.2 Units of Conformance ..................................... 9
3. Acknowledgements ............................................ 10
4. References .................................................. 10
5. Security Considerations ..................................... 10
6. Editor's Address ............................................ 10
1. Introduction
A management system contains: several (potentially many) nodes, each
with a processing entity, termed an agent, which has access to
management instrumentation; at least one management station; and, a
management protocol, used to convey management information between
the agents and management stations. Operations of the protocol are
carried out under an administrative framework which defines
authentication, authorization, access control, and privacy policies.
Management stations execute management applications which monitor and
control managed elements. Managed elements are devices such as
hosts, routers, terminal servers, etc., which are monitored and
controlled via access to their management information.
Management information is viewed as a collection of managed objects,
residing in a virtual information store, termed the Management
Information Base (MIB). Collections of related objects are defined
in MIB modules. These modules are written using a subset of OSI's
Abstract Syntax Notation One (ASN.1) [1], termed the Structure of
Management Information (SMI) [2].
This document is the MIB module which defines managed objects for
managing implementations of the Transmission Control Protocol (TCP)
[3].
The managed objects in this MIB module were originally defined using
the SNMPv1 framework as a part of MIB-II [4]. This document defines
the same objects for TCP using the SNMPv2 framework.
2. Definitions
TCP-MIB DEFINITIONS ::= BEGIN
IMPORTS
MODULE-IDENTITY, OBJECT-TYPE, Integer32, Gauge32,
Counter32, IpAddress, mib-2 FROM SNMPv2-SMI
MODULE-COMPLIANCE, OBJECT-GROUP FROM SNMPv2-CONF;
tcpMIB MODULE-IDENTITY
LAST-UPDATED "9411010000Z"
ORGANIZATION "IETF SNMPv2 Working Group"
CONTACT-INFO
" Keith McCloghrie
Postal: Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
US
Phone: +1 408 526 5260
Email: kzm@cisco.com"
DESCRIPTION
"The MIB module for managing TCP implementations."
REVISION "9103310000Z"
DESCRIPTION
"The initial revision of this MIB module was part of MIB-
II."
::= { mib-2 49 }
-- the TCP group
tcp OBJECT IDENTIFIER ::= { mib-2 6 }
tcpRtoAlgorithm OBJECT-TYPE
SYNTAX INTEGER {
other(1), -- none of the following
constant(2), -- a constant rto
rsre(3), -- MIL-STD-1778, Appendix B
vanj(4) -- Van Jacobson's algorithm [5]
}
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The algorithm used to determine the timeout value used for
retransmitting unacknowledged octets."
::= { tcp 1 }
tcpRtoMin OBJECT-TYPE
SYNTAX Integer32
UNITS "milliseconds"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The minimum value permitted by a TCP implementation for the
retransmission timeout, measured in milliseconds. More
refined semantics for objects of this type depend upon the
algorithm used to determine the retransmission timeout. In
particular, when the timeout algorithm is rsre(3), an object
of this type has the semantics of the LBOUND quantity
described in RFC 793."
::= { tcp 2 }
tcpRtoMax OBJECT-TYPE
SYNTAX Integer32
UNITS "milliseconds"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The maximum value permitted by a TCP implementation for the
retransmission timeout, measured in milliseconds. More
refined semantics for objects of this type depend upon the
algorithm used to determine the retransmission timeout. In
particular, when the timeout algorithm is rsre(3), an object
of this type has the semantics of the UBOUND quantity
described in RFC 793."
::= { tcp 3 }
tcpMaxConn OBJECT-TYPE
SYNTAX Integer32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The limit on the total number of TCP connections the entity
can support. In entities where the maximum number of
connections is dynamic, this object should contain the value
-1."
::= { tcp 4 }
tcpActiveOpens OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of times TCP connections have made a direct
transition to the SYN-SENT state from the CLOSED state."
::= { tcp 5 }
tcpPassiveOpens OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of times TCP connections have made a direct
transition to the SYN-RCVD state from the LISTEN state."
::= { tcp 6 }
tcpAttemptFails OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of times TCP connections have made a direct
transition to the CLOSED state from either the SYN-SENT
state or the SYN-RCVD state, plus the number of times TCP
connections have made a direct transition to the LISTEN
state from the SYN-RCVD state."
::= { tcp 7 }
tcpEstabResets OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of times TCP connections have made a direct
transition to the CLOSED state from either the ESTABLISHED
state or the CLOSE-WAIT state."
::= { tcp 8 }
tcpCurrEstab OBJECT-TYPE
SYNTAX Gauge32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of TCP connections for which the current state
is either ESTABLISHED or CLOSE- WAIT."
::= { tcp 9 }
tcpInSegs OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The total number of segments received, including those
received in error. This count includes segments received on
currently established connections."
::= { tcp 10 }
tcpOutSegs OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The total number of segments sent, including those on
current connections but excluding those containing only
retransmitted octets."
::= { tcp 11 }
tcpRetransSegs OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The total number of segments retransmitted - that is, the
number of TCP segments transmitted containing one or more
previously transmitted octets."
::= { tcp 12 }
-- the TCP Connection table
-- The TCP connection table contains information about this
-- entity's existing TCP connections.
tcpConnTable OBJECT-TYPE
SYNTAX SEQUENCE OF TcpConnEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A table containing TCP connection-specific information."
::= { tcp 13 }
tcpConnEntry OBJECT-TYPE
SYNTAX TcpConnEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A conceptual row of the tcpConnTable containing information
about a particular current TCP connection. Each row of this
table is transient, in that it ceases to exist when (or soon
after) the connection makes the transition to the CLOSED
state."
INDEX { tcpConnLocalAddress,
tcpConnLocalPort,
tcpConnRemAddress,
tcpConnRemPort }
::= { tcpConnTable 1 }
TcpConnEntry ::= SEQUENCE {
tcpConnState INTEGER,
tcpConnLocalAddress IpAddress,
tcpConnLocalPort INTEGER,
tcpConnRemAddress IpAddress,
tcpConnRemPort INTEGER
}
tcpConnState OBJECT-TYPE
SYNTAX INTEGER {
closed(1),
listen(2),
synSent(3),
synReceived(4),
established(5),
finWait1(6),
finWait2(7),
closeWait(8),
lastAck(9),
closing(10),
timeWait(11),
deleteTCB(12)
}
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The state of this TCP connection.
The only value which may be set by a management station is
deleteTCB(12). Accordingly, it is appropriate for an agent
to return a `badValue' response if a management station
attempts to set this object to any other value.
If a management station sets this object to the value
deleteTCB(12), then this has the effect of deleting the TCB
(as defined in RFC 793) of the corresponding connection on
the managed node, resulting in immediate termination of the
connection.
As an implementation-specific option, a RST segment may be
sent from the managed node to the other TCP endpoint (note
however that RST segments are not sent reliably)."
::= { tcpConnEntry 1 }
tcpConnLocalAddress OBJECT-TYPE
SYNTAX IpAddress
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The local IP address for this TCP connection. In the case
of a connection in the listen state which is willing to
accept connections for any IP interface associated with the
node, the value 0.0.0.0 is used."
::= { tcpConnEntry 2 }
tcpConnLocalPort OBJECT-TYPE
SYNTAX INTEGER (0..65535)
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The local port number for this TCP connection."
::= { tcpConnEntry 3 }
tcpConnRemAddress OBJECT-TYPE
SYNTAX IpAddress
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The remote IP address for this TCP connection."
::= { tcpConnEntry 4 }
tcpConnRemPort OBJECT-TYPE
SYNTAX INTEGER (0..65535)
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The remote port number for this TCP connection."
::= { tcpConnEntry 5 }
tcpInErrs OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The total number of segments received in error (e.g., bad
TCP checksums)."
::= { tcp 14 }
tcpOutRsts OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of TCP segments sent containing the RST flag."
::= { tcp 15 }
-- conformance information
tcpMIBConformance OBJECT IDENTIFIER ::= { tcpMIB 2 }
tcpMIBCompliances OBJECT IDENTIFIER ::= { tcpMIBConformance 1 }
tcpMIBGroups OBJECT IDENTIFIER ::= { tcpMIBConformance 2 }
-- compliance statements
tcpMIBCompliance MODULE-COMPLIANCE
STATUS current
DESCRIPTION
"The compliance statement for SNMPv2 entities which
implement TCP."
MODULE -- this module
MANDATORY-GROUPS { tcpGroup
}
::= { tcpMIBCompliances 1 }
-- units of conformance
tcpGroup OBJECT-GROUP
OBJECTS { tcpRtoAlgorithm, tcpRtoMin, tcpRtoMax,
tcpMaxConn, tcpActiveOpens,
tcpPassiveOpens, tcpAttemptFails,
tcpEstabResets, tcpCurrEstab, tcpInSegs,
tcpOutSegs, tcpRetransSegs, tcpConnState,
tcpConnLocalAddress, tcpConnLocalPort,
tcpConnRemAddress, tcpConnRemPort,
tcpInErrs, tcpOutRsts }
STATUS current
DESCRIPTION
"The tcp group of objects providing for management of TCP
entities."
::= { tcpMIBGroups 1 }
END
3. Acknowledgements
This document contains a modified subset of RFC 1213.
4. References
[1] Information processing systems - Open Systems Interconnection -
Specification of Abstract Syntax Notation One (ASN.1),
International Organization for Standardization. International
Standard 8824, (December, 1987).
[2] McCloghrie, K., Editor, "Structure of Management Information
for version 2 of the Simple Network Management Protocol
(SNMPv2)", RFC 1902, Cisco Systems, January 1996.
[3] Postel, J., "Transmission Control Protocol - DARPA Internet
Program Protocol Specification", STD 7, RFC 793, DARPA,
September 1981.
[4] McCloghrie, K., and M. Rose, "Management Information Base for
Network Management of TCP/IP-based internets: MIB-II", STD 17,
RFC 1213, March 1991.
[5] Jacobson, V., "Congestion Avoidance and Control", SIGCOMM 1988,
Stanford, California.
5. Security Considerations
Security issues are not discussed in this memo.
6. Editor's Address
Keith McCloghrie
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
US
Phone: +1 408 526 5260
EMail: kzm@cisco.com
AI ELI5
On this page
§1Introduction to the TCP MIB
Network management requires a standard way to monitor and control network devices. The Management Information Base (MIB) is a virtual database of managed objects that a device exposes via SNMP (Simple Network Management Protocol). A management station queries these objects to understand the device's state and can modify some objects to control behavior. This RFC defines the MIB module for managing TCP implementations, allowing administrators to monitor TCP behavior and settings on any device that supports SNMP. The managed objects in this module were originally defined using SNMPv1 as part of MIB-II. This RFC redefines them using SNMPv2 and the SMIv2 (Structure of Management Information version 2) notation, providing a cleaner and more extensible framework. Note that this MIB supports only IPv4 addresses (represented as 4-byte OCTET STRINGs); IPv6 support came later in RFC 4022.
A standard way to ask a computer 'How many TCP connections do you have right now?' or 'How many packets did you retransmit?' so managers can see what is happening with the network.
§2TCP Scalar Objects and Counters
The TCP MIB defines several scalar objects—single values that describe TCP's global behavior on a device. The tcpRtoAlgorithm object identifies which algorithm the device uses to compute retransmission timeouts (e.g., Van Jacobson's algorithm). tcpRtoMin and tcpRtoMax report the minimum and maximum retransmission timeout values in milliseconds, telling the manager how aggressively or conservatively the TCP implementation handles packet loss. tcpMaxConn reports the total number of TCP connections the entity can support (or -1 if dynamic). Beyond configuration, several counters track TCP activity: tcpActiveOpens counts transitions to SYN-SENT (when the local host initiates), tcpPassiveOpens counts transitions to SYN-RCVD (when the local host receives a connection request), tcpAttemptFails counts failed connection attempts, and tcpEstabResets counts connections abruptly reset from ESTABLISHED or CLOSE-WAIT. tcpCurrEstab is a gauge showing the current number of established or closing connections. tcpInSegs and tcpOutSegs are counters of all TCP segments received and sent, and tcpRetransSegs counts segments containing retransmitted octets.
Metrics like how many connections are open right now, how many are starting, how many failed, how many segments were sent and received, and how many had to be sent again.
§3The TCP Connection Table
Beyond global counters, the TCP MIB provides a table of all active TCP connections on the device: the tcpConnTable. Each row represents one connection and is indexed by four values: tcpConnLocalAddress (the local IPv4 address), tcpConnLocalPort (the local port), tcpConnRemAddress (the remote IPv4 address), and tcpConnRemPort (the remote port). For each connection, the table records tcpConnState, which can be one of twelve states: CLOSED, LISTEN, SYN-SENT, SYN-RCVD, ESTABLISHED, FIN-WAIT-1, FIN-WAIT-2, CLOSE-WAIT, LAST-ACK, CLOSING, TIME-WAIT, or deleteTCB. A management station can read the state of any connection and can set tcpConnState to deleteTCB to forcibly close the connection, causing the TCP layer to send a RST (reset) segment (though RST segments are not reliably delivered). Rows are transient: they exist only while the connection is open and disappear (shortly after) the connection closes. This allows a manager to monitor which hosts the device is communicating with and the status of each connection.
A list showing every open TCP connection: who you are talking to, which port on each end, and whether the connection is open, closing, waiting, or stuck.
§4SNMP Management and Modern Updates
RFC 2012 is a Proposed Standard that updates RFC 1213 (the SNMPv1 MIB-II). It provides an SNMPv2 formulation using SMIv2, offering clearer semantics and better extensibility. The RFC notes that this MIB supports only IPv4 addresses and cannot manage IPv6 TCP connections; IPv6 support was added in RFC 4022, which is the current TCP MIB standard. Network management systems use these objects to create dashboards, alert on anomalies (e.g., high retransmit rates), perform capacity planning, and troubleshoot connection issues. The combination of scalar counters and the connection table gives administrators visibility into both the overall health of TCP on a device and the details of individual connections.
A standard way for network management tools to spy on TCP. Originally for IPv4 only, but later updated to handle IPv6 too. Managers use it to watch for problems and understand what is happening on the network.