CISCO-NBAR-PROTOCOL-DISCOVERY-MIB

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

This object is used to enable or disable Protocol Discovery on an interface. If set to 'true' - Protocol Discovery is enabled on this Interface. If set to 'false' - Protocol Discovery is disabled on this Interface.

TimeTicks

The value of sysUpTime at the time Protocol Discovery was last enabled on an interface. If the interface does not have Protocol Discovery enabled this value is zero.

CiscoPdProtocolIndexAn object which represents a unique identifier for a protocol or application which NBAR currently recognizes. The value of this object is defined in the cnpdSupportedProtocolsTable. (1..1024) · Unsigned32

An object which represents a unique identifier for a protocol or application which NBAR currently recognizes. This object is an index into the SupportedProtocolsTable where details of the protocol can be found.

CiscoPdProtocolNameName of an application or protocol, which NBAR is capable of recognizing. For example: ftp, vdolive and citrix. SIZE (1..255) · OCTET STRING

Name of the application or protocol, a unique textual string, assigned in the cnpdSupportedProtocolsTable.

Counter32 · packets

The packet count of inbound packets as determined by Protocol Discovery.

Counter32 · packets

The packet count of outbound packets as determined by Protocol Discovery.

Counter32 · bytes

The byte count of inbound octets as determined by Protocol Discovery.

Counter32 · bytes

The byte count of outbound octets as determined by Protocol Discovery.

Counter64 (0..18446744073709551615) · packets

The packet count of inbound packets as determined by Protocol Discovery. This is the 64-bit (High Capacity) version of cnpdAllStatsInPkts.

Counter64 (0..18446744073709551615) · packets

The packet count of outbound packets as determined by Protocol Discovery. This is the 64-bit (High Capacity) version of cnpdAllStatsOutPkts.

Counter64 (0..18446744073709551615) · bytes

The byte count of inbound octets as determined by Protocol Discovery. This is the 64-bit (High Capacity) version of cnpdAllStatsInBytes.

Counter64 (0..18446744073709551615) · bytes

The byte count of outbound octets as determined by Protocol Discovery. This is the 64-bit (High Capacity) version of cnpdAllStatsOutBytes.

Unsigned32 (1..4294967295) · kilo bits per second

The inbound bit rate as determined by Protocol Discovery.

Unsigned32 (1..4294967295) · kilo bits per second

The outbound bit rate as determined by Protocol Discovery.

Unsigned32 (1..50)

A monotonically increasing integer which uniquely identifies a cnpdTopNConfigEntry in the cnpdTopNConfigTable.

InterfaceIndexA unique value, greater than zero, for each interface or interface sub-layer in the managed system. It is recommended that values are assigned contiguously starting from 1. The value for each interface sub-layer must remain constant at least from one re-initialization of the entity's network management system to the next re-initialization. (1..2147483647) · Integer32 · hint d

This object allows the management station to select the interface, which Protocol Discovery is running on, to be used to create this cnpdTopNConfigEntry.

CiscoPdDataType1 = bitRateIn2 = bitRateOut3 = bitRateSum4 = byteCountIn5 = byteCountOut6 = byteCountSum7 = packetCountIn8 = packetCountOut9 = packetCountSumThese are the data types which NBAR can measure a particular protocol by. bitRateIn(1) - incoming bitrate. bitRateOut(2) - outgoing bitrate. bitRateSum(3) - sum of incoming and outgoing bitrate. byteCountIn(4) - incoming bytecount. byteCountOut(5) - outgoing bytecount. byteCountSum(6) - sum of incoming and outgoing bytecount. packetCountIn(7) - incoming packetcount. packetCountOut(8) - outgoing packetcount. packetCountSum(9) - sum of incoming and outgoing packetcount. UNITS: bitrate - unit is kilo bits per second bytecount - unit is bytes packetcount - unit is packets · Integer32

This object allows the management station to select the statistic used to base the order of the top-n table on. For example: a cnpdTopNConfigStatsSelect of bitRateSum means order this table based on each applications/protocols combined in and out bitrate.

Unsigned32 (1..2048) · seconds

If the cnpdTopNConfigStatsSelect is bitRateIn, bitRateOut or bitRateSum, then this value is the interval in seconds that the bitrate is sampled. This has no effect if the cnpdTopNConfigStatsSelect is byte or packet based. When this object is modified by the management station, a new sample period is started regardless of whether the original cnpdTopNConfigSampleTime was finished.

Unsigned32 (1..500)

The requested size of the associated cnpdTopNStatsTable entry. For example a cnpdTopNConfigRequestedSize of 20 indicates the management station wants to create an associated cnpdTopNStatsTable entry of 20 protocol/application's

Unsigned32 (1..500)

The actual size of the associated cnpdTopNStatsTable entry. The reason this may differ from cnpdTopNConfigRequestedSize is because a management station may request a number of protocols that is greater than the number of protocols actually found by Protocol Discovery.

TimeTicks

The value of sysUpTime when the associated cnpdTopNStatsTable entry was created.

RowStatus1 = active2 = notInService3 = notReady4 = createAndGo5 = createAndWait6 = destroyThe RowStatus textual convention is used to manage the creation and deletion of conceptual rows, and is used as the value of the SYNTAX clause for the status column of a conceptual row (as described in Section 7.7.1 of [2].) The status column has six defined values: - `active', which indicates that the conceptual row is available for use by the managed device; - `notInService', which indicates that the conceptual row exists in the agent, but is unavailable for use by the managed device (see NOTE below); 'notInService' has no implication regarding the internal consistency of the row, availability of resources, or consistency with the current state of the managed device; - `notReady', which indicates that the conceptual row exists in the agent, but is missing information necessary in order to be available for use by the managed device (i.e., one or more required columns in the conceptual row have not been instanciated); - `createAndGo', which is supplied by a management station wishing to create a new instance of a conceptual row and to have its status automatically set to active, making it available for use by the managed device; - `createAndWait', which is supplied by a management station wishing to create a new instance of a conceptual row (but not make it available for use by the managed device); and, - `destroy', which is supplied by a management station wishing to delete all of the instances associated with an existing conceptual row. Whereas five of the six values (all except `notReady') may be specified in a management protocol set operation, only three values will be returned in response to a management protocol retrieval operation: `notReady', `notInService' or `active'. That is, when queried, an existing conceptual row has only three states: it is either available for use by the managed device (the status column has value `active'); it is not available for use by the managed device, though the agent has sufficient information to attempt to make it so (the status column has value `notInService'); or, it is not available for use by the managed device, and an attempt to make it so would fail because the agent has insufficient information (the state column has value `notReady'). NOTE WELL This textual convention may be used for a MIB table, irrespective of whether the values of that table's conceptual rows are able to be modified while it is active, or whether its conceptual rows must be taken out of service in order to be modified. That is, it is the responsibility of the DESCRIPTION clause of the status column to specify whether the status column must not be `active' in order for the value of some other column of the same conceptual row to be modified. If such a specification is made, affected columns may be changed by an SNMP set PDU if the RowStatus would not be equal to `active' either immediately before or after processing the PDU. In other words, if the PDU also contained a varbind that would change the RowStatus value, the column in question may be changed if the RowStatus was not equal to `active' as the PDU was received, or if the varbind sets the status to a value other than 'active'. Also note that whenever any elements of a row exist, the RowStatus column must also exist. To summarize the effect of having a conceptual row with a status column having a SYNTAX clause value of RowStatus, consider the following state diagram: STATE +--------------+-----------+-------------+------------- | A | B | C | D | |status col.|status column| |status column | is | is |status column ACTION |does not exist| notReady | notInService| is active --------------+--------------+-----------+-------------+------------- set status |noError ->D|inconsist- |inconsistent-|inconsistent- column to | or | entValue| Value| Value createAndGo |inconsistent- | | | | Value| | | --------------+--------------+-----------+-------------+------------- set status |noError see 1|inconsist- |inconsistent-|inconsistent- column to | or | entValue| Value| Value createAndWait |wrongValue | | | --------------+--------------+-----------+-------------+------------- set status |inconsistent- |inconsist- |noError |noError column to | Value| entValue| | active | | | | | | or | | | | | | | |see 2 ->D|see 8 ->D| ->D --------------+--------------+-----------+-------------+------------- set status |inconsistent- |inconsist- |noError |noError ->C column to | Value| entValue| | notInService | | | | | | or | | or | | | | | |see 3 ->C| ->C|see 6 --------------+--------------+-----------+-------------+------------- set status |noError |noError |noError |noError ->A column to | | | | or destroy | ->A| ->A| ->A|see 7 --------------+--------------+-----------+-------------+------------- set any other |see 4 |noError |noError |see 5 column to some| | | | value | | see 1| ->C| ->D --------------+--------------+-----------+-------------+------------- (1) goto B or C, depending on information available to the agent. (2) if other variable bindings included in the same PDU, provide values for all columns which are missing but required, and all columns have acceptable values, then return noError and goto D. (3) if other variable bindings included in the same PDU, provide legal values for all columns which are missing but required, then return noError and goto C. (4) at the discretion of the agent, the return value may be either: inconsistentName: because the agent does not choose to create such an instance when the corresponding RowStatus instance does not exist, or inconsistentValue: if the supplied value is inconsistent with the state of some other MIB object's value, or noError: because the agent chooses to create the instance. If noError is returned, then the instance of the status column must also be created, and the new state is B or C, depending on the information available to the agent. If inconsistentName or inconsistentValue is returned, the row remains in state A. (5) depending on the MIB definition for the column/table, either noError or inconsistentValue may be returned. (6) the return value can indicate one of the following errors: wrongValue: because the agent does not support notInService (e.g., an agent which does not support createAndWait), or inconsistentValue: because the agent is unable to take the row out of service at this time, perhaps because it is in use and cannot be de-activated. (7) the return value can indicate the following error: inconsistentValue: because the agent is unable to remove the row at this time, perhaps because it is in use and cannot be de-activated. (8) the transition to D can fail, e.g., if the values of the conceptual row are inconsistent, then the error code would be inconsistentValue. NOTE: Other processing of (this and other varbinds of) the set request may result in a response other than noError being returned, e.g., wrongValue, noCreation, etc. Conceptual Row Creation There are four potential interactions when creating a conceptual row: selecting an instance-identifier which is not in use; creating the conceptual row; initializing any objects for which the agent does not supply a default; and, making the conceptual row available for use by the managed device. Interaction 1: Selecting an Instance-Identifier The algorithm used to select an instance-identifier varies for each conceptual row. In some cases, the instance- identifier is semantically significant, e.g., the destination address of a route, and a management station selects the instance-identifier according to the semantics. In other cases, the instance-identifier is used solely to distinguish conceptual rows, and a management station without specific knowledge of the conceptual row might examine the instances present in order to determine an unused instance-identifier. (This approach may be used, but it is often highly sub-optimal; however, it is also a questionable practice for a naive management station to attempt conceptual row creation.) Alternately, the MIB module which defines the conceptual row might provide one or more objects which provide assistance in determining an unused instance-identifier. For example, if the conceptual row is indexed by an integer-value, then an object having an integer-valued SYNTAX clause might be defined for such a purpose, allowing a management station to issue a management protocol retrieval operation. In order to avoid unnecessary collisions between competing management stations, `adjacent' retrievals of this object should be different. Finally, the management station could select a pseudo-random number to use as the index. In the event that this index was already in use and an inconsistentValue was returned in response to the management protocol set operation, the management station should simply select a new pseudo-random number and retry the operation. A MIB designer should choose between the two latter algorithms based on the size of the table (and therefore the efficiency of each algorithm). For tables in which a large number of entries are expected, it is recommended that a MIB object be defined that returns an acceptable index for creation. For tables with small numbers of entries, it is recommended that the latter pseudo-random index mechanism be used. Interaction 2: Creating the Conceptual Row Once an unused instance-identifier has been selected, the management station determines if it wishes to create and activate the conceptual row in one transaction or in a negotiated set of interactions. Interaction 2a: Creating and Activating the Conceptual Row The management station must first determine the column requirements, i.e., it must determine those columns for which it must or must not provide values. Depending on the complexity of the table and the management station's knowledge of the agent's capabilities, this determination can be made locally by the management station. Alternately, the management station issues a management protocol get operation to examine all columns in the conceptual row that it wishes to create. In response, for each column, there are three possible outcomes: - a value is returned, indicating that some other management station has already created this conceptual row. We return to interaction 1. - the exception `noSuchInstance' is returned, indicating that the agent implements the object-type associated with this column, and that this column in at least one conceptual row would be accessible in the MIB view used by the retrieval were it to exist. For those columns to which the agent provides read-create access, the `noSuchInstance' exception tells the management station that it should supply a value for this column when the conceptual row is to be created. - the exception `noSuchObject' is returned, indicating that the agent does not implement the object-type associated with this column or that there is no conceptual row for which this column would be accessible in the MIB view used by the retrieval. As such, the management station can not issue any management protocol set operations to create an instance of this column. Once the column requirements have been determined, a management protocol set operation is accordingly issued. This operation also sets the new instance of the status column to `createAndGo'. When the agent processes the set operation, it verifies that it has sufficient information to make the conceptual row available for use by the managed device. The information available to the agent is provided by two sources: the management protocol set operation which creates the conceptual row, and, implementation-specific defaults supplied by the agent (note that an agent must provide implementation-specific defaults for at least those objects which it implements as read-only). If there is sufficient information available, then the conceptual row is created, a `noError' response is returned, the status column is set to `active', and no further interactions are necessary (i.e., interactions 3 and 4 are skipped). If there is insufficient information, then the conceptual row is not created, and the set operation fails with an error of `inconsistentValue'. On this error, the management station can issue a management protocol retrieval operation to determine if this was because it failed to specify a value for a required column, or, because the selected instance of the status column already existed. In the latter case, we return to interaction 1. In the former case, the management station can re-issue the set operation with the additional information, or begin interaction 2 again using `createAndWait' in order to negotiate creation of the conceptual row. NOTE WELL Regardless of the method used to determine the column requirements, it is possible that the management station might deem a column necessary when, in fact, the agent will not allow that particular columnar instance to be created or written. In this case, the management protocol set operation will fail with an error such as `noCreation' or `notWritable'. In this case, the management station decides whether it needs to be able to set a value for that particular columnar instance. If not, the management station re-issues the management protocol set operation, but without setting a value for that particular columnar instance; otherwise, the management station aborts the row creation algorithm. Interaction 2b: Negotiating the Creation of the Conceptual Row The management station issues a management protocol set operation which sets the desired instance of the status column to `createAndWait'. If the agent is unwilling to process a request of this sort, the set operation fails with an error of `wrongValue'. (As a consequence, such an agent must be prepared to accept a single management protocol set operation, i.e., interaction 2a above, containing all of the columns indicated by its column requirements.) Otherwise, the conceptual row is created, a `noError' response is returned, and the status column is immediately set to either `notInService' or `notReady', depending on whether it has sufficient information to (attempt to) make the conceptual row available for use by the managed device. If there is sufficient information available, then the status column is set to `notInService'; otherwise, if there is insufficient information, then the status column is set to `notReady'. Regardless, we proceed to interaction 3. Interaction 3: Initializing non-defaulted Objects The management station must now determine the column requirements. It issues a management protocol get operation to examine all columns in the created conceptual row. In the response, for each column, there are three possible outcomes: - a value is returned, indicating that the agent implements the object-type associated with this column and had sufficient information to provide a value. For those columns to which the agent provides read-create access (and for which the agent allows their values to be changed after their creation), a value return tells the management station that it may issue additional management protocol set operations, if it desires, in order to change the value associated with this column. - the exception `noSuchInstance' is returned, indicating that the agent implements the object-type associated with this column, and that this column in at least one conceptual row would be accessible in the MIB view used by the retrieval were it to exist. However, the agent does not have sufficient information to provide a value, and until a value is provided, the conceptual row may not be made available for use by the managed device. For those columns to which the agent provides read-create access, the `noSuchInstance' exception tells the management station that it must issue additional management protocol set operations, in order to provide a value associated with this column. - the exception `noSuchObject' is returned, indicating that the agent does not implement the object-type associated with this column or that there is no conceptual row for which this column would be accessible in the MIB view used by the retrieval. As such, the management station can not issue any management protocol set operations to create an instance of this column. If the value associated with the status column is `notReady', then the management station must first deal with all `noSuchInstance' columns, if any. Having done so, the value of the status column becomes `notInService', and we proceed to interaction 4. Interaction 4: Making the Conceptual Row Available Once the management station is satisfied with the values associated with the columns of the conceptual row, it issues a management protocol set operation to set the status column to `active'. If the agent has sufficient information to make the conceptual row available for use by the managed device, the management protocol set operation succeeds (a `noError' response is returned). Otherwise, the management protocol set operation fails with an error of `inconsistentValue'. NOTE WELL A conceptual row having a status column with value `notInService' or `notReady' is unavailable to the managed device. As such, it is possible for the managed device to create its own instances during the time between the management protocol set operation which sets the status column to `createAndWait' and the management protocol set operation which sets the status column to `active'. In this case, when the management protocol set operation is issued to set the status column to `active', the values held in the agent supersede those used by the managed device. If the management station is prevented from setting the status column to `active' (e.g., due to management station or network failure) the conceptual row will be left in the `notInService' or `notReady' state, consuming resources indefinitely. The agent must detect conceptual rows that have been in either state for an abnormally long period of time and remove them. It is the responsibility of the DESCRIPTION clause of the status column to indicate what an abnormally long period of time would be. This period of time should be long enough to allow for human response time (including `think time') between the creation of the conceptual row and the setting of the status to `active'. In the absence of such information in the DESCRIPTION clause, it is suggested that this period be approximately 5 minutes in length. This removal action applies not only to newly-created rows, but also to previously active rows which are set to, and left in, the notInService state for a prolonged period exceeding that which is considered normal for such a conceptual row. Conceptual Row Suspension When a conceptual row is `active', the management station may issue a management protocol set operation which sets the instance of the status column to `notInService'. If the agent is unwilling to do so, the set operation fails with an error of `wrongValue' or `inconsistentValue'. Otherwise, the conceptual row is taken out of service, and a `noError' response is returned. It is the responsibility of the DESCRIPTION clause of the status column to indicate under what circumstances the status column should be taken out of service (e.g., in order for the value of some other column of the same conceptual row to be modified). Conceptual Row Deletion For deletion of conceptual rows, a management protocol set operation is issued which sets the instance of the status column to `destroy'. This request may be made regardless of the current value of the status column (e.g., it is possible to delete conceptual rows which are either `notReady', `notInService' or `active'.) If the operation succeeds, then all instances associated with the conceptual row are immediately removed. · Integer32

This object is used to create or delete the row entry in cnpdTopNConfigTable. When creating a row entry the management station is required to specify a value for cnpdTopNConfigIfIndex only. 'notReady' means that a row exists but either it has no valid IfIndex or it has not been set to createAndGo or active. 'active' means that a createAndGo or active has been issued, AND a valid ifIndex exists. Therefore if a row is 'active' it means a TopNStats entry has been generated. If you set an 'active' row to createAndWait it will get the status 'notReady'. If you set any row to 'notReady' - it will go to the 'notReadystate'. If you set any row to 'notInService' - it will go to the 'notInService' state and the corresponding TopNStatsEntry will be deleted. The same TopNConfig entry can be re-used without changes by setting it to 'active'. The corresponding TopStatsTable entry will be regenerated. This can be used by the NMS to poll a particular TopNConfig Entry. Changes to an existing TopNConfig entry can be made by setting the status to 'createAndWait' and changing the necessary objects. Setting it to 'createAndGo' or 'active' will cause the corresponding TopNStats entry to be regenerated.

Unsigned32 (1..500)

A monotonically increasing integer which uniquely identifies a cnpdTopNStatsEntry in the cnpdTopNStatsTable.

CiscoPdProtocolNameName of an application or protocol, which NBAR is capable of recognizing. For example: ftp, vdolive and citrix. SIZE (1..255) · OCTET STRING

Name of the application or protocol, a unique textual string, assigned in the cnpdSupportedProtocolsTable.

Counter32

The amount of change in the selected statistic during this sampling interval. The selected statistic is the cnpdTopNConfigStatsSelect from the associated cnpdTopNConfigStatsEntry.

Counter64 (0..18446744073709551615)

The amount of change in the selected statistic during this sampling interval. The selected statistic is the cnpdTopNConfigStatsSelect from the associated cnpdTopNConfigStatsEntry. This is the 64-bit (High Capacity) version of cnpdTopNStatsRate.

Unsigned32 (1..100)

A monotonically increasing integer which uniquely identifies an entry in the cnpdThresholdConfigTable.

InterfaceIndexA unique value, greater than zero, for each interface or interface sub-layer in the managed system. It is recommended that values are assigned contiguously starting from 1. The value for each interface sub-layer must remain constant at least from one re-initialization of the entity's network management system to the next re-initialization. (1..2147483647) · Integer32 · hint d

This object allows the management station to select the interface, which Protocol Discovery is running on, to be used to create this cnpdThresholdConfigTable entry.

Unsigned32 (1..2048) · seconds

The interval in seconds over which the data is sampled and compared with cnpdThresholdConfigRising and cnpdThresholdConfigFalling thresholds.

INTEGER1 = absoluteValue2 = deltaValue · Integer32

The method of sampling the selected statistic and calculating the value to be compared against cnpdThresholdConfigRising or cnpdThresholdConfigFalling thresholds. If the value of this object is absoluteValue(1), the value at the end of the sampling interval cnpdThresholdConfigInterval, will be compared with the cnpdThresholdConfigRising and cnpdThresholdConfigFalling thresholds. In this mode, when cnpdThresholdConfigStatsSelect is byte or packet based, a maximum of two cnpdThresholdHistory entries will be created per application, as these byte and packet counts monotonically increase from zero. If the value of this object is deltaValue(2), the difference between the samples at the beginning and end of the cnpdThresholdConfigInterval will be compared with the cnpdThresholdConfigRising and cnpdThresholdConfigFalling thresholds. Because the difference in the previous and current samples are compared over the sample period cnpdThresholdConfigInterval, this mode provides more granularity to the thresholds because the NMS is now provided with the gradient or change in the cnpdThresholdConfigStatsSelect. Note that even though the sample value is monotonically increasing for byte and packet counts, cnpdThresholdConfigSampleType set to deltaValue, can generate falling cnpdThresholdHistory entries, because the gradient can be lower than the cnpdThresholdConfigFalling value.

CiscoPdProtocolIndexAn object which represents a unique identifier for a protocol or application which NBAR currently recognizes. The value of this object is defined in the cnpdSupportedProtocolsTable. (1..1024) · Unsigned32

The application or protocol which the management station wishes to configure a threshold on. This object is an index into the SupportedProtocolsTable where details of the protocol can be found. If cnpdThresholdConfigProtocolAny is set to TRUE this value will be ignored. If it is set to FALSE, then cnpdThresholdConfigProtocol will be the only protocol that is checked to see if it has breached the threshold.

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

If set to 'true' - this threshold is configured to check for any protocol which meets the threshold criteria. This means that multiple protocols can generate ThresholdHistoryTable entries. Each protocol is subject to the hysterisis mechanism. If set to 'false' - this threshold is configured to check for the protocol which meets the threshold criteria referred to by cnpdThresholdConfigProtocol.

CiscoPdDataType1 = bitRateIn2 = bitRateOut3 = bitRateSum4 = byteCountIn5 = byteCountOut6 = byteCountSum7 = packetCountIn8 = packetCountOut9 = packetCountSumThese are the data types which NBAR can measure a particular protocol by. bitRateIn(1) - incoming bitrate. bitRateOut(2) - outgoing bitrate. bitRateSum(3) - sum of incoming and outgoing bitrate. byteCountIn(4) - incoming bytecount. byteCountOut(5) - outgoing bytecount. byteCountSum(6) - sum of incoming and outgoing bytecount. packetCountIn(7) - incoming packetcount. packetCountOut(8) - outgoing packetcount. packetCountSum(9) - sum of incoming and outgoing packetcount. UNITS: bitrate - unit is kilo bits per second bytecount - unit is bytes packetcount - unit is packets · Integer32

This object allows the management station to select the statistic used to base the threshold on. For example a cnpdThresholdConfigStatsSelect of bitRateSum means cnpdThresholdConfigRising and cnpdThresholdConfigFalling are values based on the combined value of in and out bitrates.

INTEGER1 = rising2 = falling3 = risingOrFalling · Integer32

This controls the type of notification that is sent when this threshold entry is first enabled. Because there is no previous sampling history, choosing one of these options determines the type of notification generated - Rising or Falling. If the first sample after this entry is enabled is greater than or equal to cnpdThresholdConfigRising and this object is equal to rising(1) or risingOrFalling(3), then a single rising notification will be generated. If the first sample after this entry is enabled is less than or equal to cnpdThresholdConfigFalling and this object is equal to falling(2) or risingOrFalling(3), then a single falling notification will be generated.

Unsigned32 (1..4294967295)

This is the threshold object which the managment station sets to determine if it gets breached. It indicates the statistic being sampled was rising. When the current sample is greater than or equal to this object, and the value at the last sampling interval was less than this object (in other words the value is rising), an entry in the cnpdThresholdHistoryTable will be created. After a rising event is generated, another such event will not be generated until the sampled value falls below this threshold and reaches the cnpdThresholdConfigFalling value. This ensures that samples which are taken after a cnpdThresholdConfigRising threshold event has been created, do not create further thresholds and therefore notifications, until the cnpdThresholdConfigFalling threshold has been met. Thus a very short cnpdThresholdConfigInterval can be chosen without risk of multiple notifications for the same threshold breach condition.

Unsigned32 (1..4294967295)

This is the threshold object which the management station sets to determine if it gets breached. It indicates the statistic being sampled was falling. When current sample is less than or equal to this object, and the value at the last sampling interval was greater than this object (in other words the value is falling), an entry in the cnpdThresholdHistoryTable will be created. After a falling event is generated, another such event will not be generated until the sampled value rises above this object and reaches the cnpdThresholdConfigRising value.

RowStatus1 = active2 = notInService3 = notReady4 = createAndGo5 = createAndWait6 = destroyThe RowStatus textual convention is used to manage the creation and deletion of conceptual rows, and is used as the value of the SYNTAX clause for the status column of a conceptual row (as described in Section 7.7.1 of [2].) The status column has six defined values: - `active', which indicates that the conceptual row is available for use by the managed device; - `notInService', which indicates that the conceptual row exists in the agent, but is unavailable for use by the managed device (see NOTE below); 'notInService' has no implication regarding the internal consistency of the row, availability of resources, or consistency with the current state of the managed device; - `notReady', which indicates that the conceptual row exists in the agent, but is missing information necessary in order to be available for use by the managed device (i.e., one or more required columns in the conceptual row have not been instanciated); - `createAndGo', which is supplied by a management station wishing to create a new instance of a conceptual row and to have its status automatically set to active, making it available for use by the managed device; - `createAndWait', which is supplied by a management station wishing to create a new instance of a conceptual row (but not make it available for use by the managed device); and, - `destroy', which is supplied by a management station wishing to delete all of the instances associated with an existing conceptual row. Whereas five of the six values (all except `notReady') may be specified in a management protocol set operation, only three values will be returned in response to a management protocol retrieval operation: `notReady', `notInService' or `active'. That is, when queried, an existing conceptual row has only three states: it is either available for use by the managed device (the status column has value `active'); it is not available for use by the managed device, though the agent has sufficient information to attempt to make it so (the status column has value `notInService'); or, it is not available for use by the managed device, and an attempt to make it so would fail because the agent has insufficient information (the state column has value `notReady'). NOTE WELL This textual convention may be used for a MIB table, irrespective of whether the values of that table's conceptual rows are able to be modified while it is active, or whether its conceptual rows must be taken out of service in order to be modified. That is, it is the responsibility of the DESCRIPTION clause of the status column to specify whether the status column must not be `active' in order for the value of some other column of the same conceptual row to be modified. If such a specification is made, affected columns may be changed by an SNMP set PDU if the RowStatus would not be equal to `active' either immediately before or after processing the PDU. In other words, if the PDU also contained a varbind that would change the RowStatus value, the column in question may be changed if the RowStatus was not equal to `active' as the PDU was received, or if the varbind sets the status to a value other than 'active'. Also note that whenever any elements of a row exist, the RowStatus column must also exist. To summarize the effect of having a conceptual row with a status column having a SYNTAX clause value of RowStatus, consider the following state diagram: STATE +--------------+-----------+-------------+------------- | A | B | C | D | |status col.|status column| |status column | is | is |status column ACTION |does not exist| notReady | notInService| is active --------------+--------------+-----------+-------------+------------- set status |noError ->D|inconsist- |inconsistent-|inconsistent- column to | or | entValue| Value| Value createAndGo |inconsistent- | | | | Value| | | --------------+--------------+-----------+-------------+------------- set status |noError see 1|inconsist- |inconsistent-|inconsistent- column to | or | entValue| Value| Value createAndWait |wrongValue | | | --------------+--------------+-----------+-------------+------------- set status |inconsistent- |inconsist- |noError |noError column to | Value| entValue| | active | | | | | | or | | | | | | | |see 2 ->D|see 8 ->D| ->D --------------+--------------+-----------+-------------+------------- set status |inconsistent- |inconsist- |noError |noError ->C column to | Value| entValue| | notInService | | | | | | or | | or | | | | | |see 3 ->C| ->C|see 6 --------------+--------------+-----------+-------------+------------- set status |noError |noError |noError |noError ->A column to | | | | or destroy | ->A| ->A| ->A|see 7 --------------+--------------+-----------+-------------+------------- set any other |see 4 |noError |noError |see 5 column to some| | | | value | | see 1| ->C| ->D --------------+--------------+-----------+-------------+------------- (1) goto B or C, depending on information available to the agent. (2) if other variable bindings included in the same PDU, provide values for all columns which are missing but required, and all columns have acceptable values, then return noError and goto D. (3) if other variable bindings included in the same PDU, provide legal values for all columns which are missing but required, then return noError and goto C. (4) at the discretion of the agent, the return value may be either: inconsistentName: because the agent does not choose to create such an instance when the corresponding RowStatus instance does not exist, or inconsistentValue: if the supplied value is inconsistent with the state of some other MIB object's value, or noError: because the agent chooses to create the instance. If noError is returned, then the instance of the status column must also be created, and the new state is B or C, depending on the information available to the agent. If inconsistentName or inconsistentValue is returned, the row remains in state A. (5) depending on the MIB definition for the column/table, either noError or inconsistentValue may be returned. (6) the return value can indicate one of the following errors: wrongValue: because the agent does not support notInService (e.g., an agent which does not support createAndWait), or inconsistentValue: because the agent is unable to take the row out of service at this time, perhaps because it is in use and cannot be de-activated. (7) the return value can indicate the following error: inconsistentValue: because the agent is unable to remove the row at this time, perhaps because it is in use and cannot be de-activated. (8) the transition to D can fail, e.g., if the values of the conceptual row are inconsistent, then the error code would be inconsistentValue. NOTE: Other processing of (this and other varbinds of) the set request may result in a response other than noError being returned, e.g., wrongValue, noCreation, etc. Conceptual Row Creation There are four potential interactions when creating a conceptual row: selecting an instance-identifier which is not in use; creating the conceptual row; initializing any objects for which the agent does not supply a default; and, making the conceptual row available for use by the managed device. Interaction 1: Selecting an Instance-Identifier The algorithm used to select an instance-identifier varies for each conceptual row. In some cases, the instance- identifier is semantically significant, e.g., the destination address of a route, and a management station selects the instance-identifier according to the semantics. In other cases, the instance-identifier is used solely to distinguish conceptual rows, and a management station without specific knowledge of the conceptual row might examine the instances present in order to determine an unused instance-identifier. (This approach may be used, but it is often highly sub-optimal; however, it is also a questionable practice for a naive management station to attempt conceptual row creation.) Alternately, the MIB module which defines the conceptual row might provide one or more objects which provide assistance in determining an unused instance-identifier. For example, if the conceptual row is indexed by an integer-value, then an object having an integer-valued SYNTAX clause might be defined for such a purpose, allowing a management station to issue a management protocol retrieval operation. In order to avoid unnecessary collisions between competing management stations, `adjacent' retrievals of this object should be different. Finally, the management station could select a pseudo-random number to use as the index. In the event that this index was already in use and an inconsistentValue was returned in response to the management protocol set operation, the management station should simply select a new pseudo-random number and retry the operation. A MIB designer should choose between the two latter algorithms based on the size of the table (and therefore the efficiency of each algorithm). For tables in which a large number of entries are expected, it is recommended that a MIB object be defined that returns an acceptable index for creation. For tables with small numbers of entries, it is recommended that the latter pseudo-random index mechanism be used. Interaction 2: Creating the Conceptual Row Once an unused instance-identifier has been selected, the management station determines if it wishes to create and activate the conceptual row in one transaction or in a negotiated set of interactions. Interaction 2a: Creating and Activating the Conceptual Row The management station must first determine the column requirements, i.e., it must determine those columns for which it must or must not provide values. Depending on the complexity of the table and the management station's knowledge of the agent's capabilities, this determination can be made locally by the management station. Alternately, the management station issues a management protocol get operation to examine all columns in the conceptual row that it wishes to create. In response, for each column, there are three possible outcomes: - a value is returned, indicating that some other management station has already created this conceptual row. We return to interaction 1. - the exception `noSuchInstance' is returned, indicating that the agent implements the object-type associated with this column, and that this column in at least one conceptual row would be accessible in the MIB view used by the retrieval were it to exist. For those columns to which the agent provides read-create access, the `noSuchInstance' exception tells the management station that it should supply a value for this column when the conceptual row is to be created. - the exception `noSuchObject' is returned, indicating that the agent does not implement the object-type associated with this column or that there is no conceptual row for which this column would be accessible in the MIB view used by the retrieval. As such, the management station can not issue any management protocol set operations to create an instance of this column. Once the column requirements have been determined, a management protocol set operation is accordingly issued. This operation also sets the new instance of the status column to `createAndGo'. When the agent processes the set operation, it verifies that it has sufficient information to make the conceptual row available for use by the managed device. The information available to the agent is provided by two sources: the management protocol set operation which creates the conceptual row, and, implementation-specific defaults supplied by the agent (note that an agent must provide implementation-specific defaults for at least those objects which it implements as read-only). If there is sufficient information available, then the conceptual row is created, a `noError' response is returned, the status column is set to `active', and no further interactions are necessary (i.e., interactions 3 and 4 are skipped). If there is insufficient information, then the conceptual row is not created, and the set operation fails with an error of `inconsistentValue'. On this error, the management station can issue a management protocol retrieval operation to determine if this was because it failed to specify a value for a required column, or, because the selected instance of the status column already existed. In the latter case, we return to interaction 1. In the former case, the management station can re-issue the set operation with the additional information, or begin interaction 2 again using `createAndWait' in order to negotiate creation of the conceptual row. NOTE WELL Regardless of the method used to determine the column requirements, it is possible that the management station might deem a column necessary when, in fact, the agent will not allow that particular columnar instance to be created or written. In this case, the management protocol set operation will fail with an error such as `noCreation' or `notWritable'. In this case, the management station decides whether it needs to be able to set a value for that particular columnar instance. If not, the management station re-issues the management protocol set operation, but without setting a value for that particular columnar instance; otherwise, the management station aborts the row creation algorithm. Interaction 2b: Negotiating the Creation of the Conceptual Row The management station issues a management protocol set operation which sets the desired instance of the status column to `createAndWait'. If the agent is unwilling to process a request of this sort, the set operation fails with an error of `wrongValue'. (As a consequence, such an agent must be prepared to accept a single management protocol set operation, i.e., interaction 2a above, containing all of the columns indicated by its column requirements.) Otherwise, the conceptual row is created, a `noError' response is returned, and the status column is immediately set to either `notInService' or `notReady', depending on whether it has sufficient information to (attempt to) make the conceptual row available for use by the managed device. If there is sufficient information available, then the status column is set to `notInService'; otherwise, if there is insufficient information, then the status column is set to `notReady'. Regardless, we proceed to interaction 3. Interaction 3: Initializing non-defaulted Objects The management station must now determine the column requirements. It issues a management protocol get operation to examine all columns in the created conceptual row. In the response, for each column, there are three possible outcomes: - a value is returned, indicating that the agent implements the object-type associated with this column and had sufficient information to provide a value. For those columns to which the agent provides read-create access (and for which the agent allows their values to be changed after their creation), a value return tells the management station that it may issue additional management protocol set operations, if it desires, in order to change the value associated with this column. - the exception `noSuchInstance' is returned, indicating that the agent implements the object-type associated with this column, and that this column in at least one conceptual row would be accessible in the MIB view used by the retrieval were it to exist. However, the agent does not have sufficient information to provide a value, and until a value is provided, the conceptual row may not be made available for use by the managed device. For those columns to which the agent provides read-create access, the `noSuchInstance' exception tells the management station that it must issue additional management protocol set operations, in order to provide a value associated with this column. - the exception `noSuchObject' is returned, indicating that the agent does not implement the object-type associated with this column or that there is no conceptual row for which this column would be accessible in the MIB view used by the retrieval. As such, the management station can not issue any management protocol set operations to create an instance of this column. If the value associated with the status column is `notReady', then the management station must first deal with all `noSuchInstance' columns, if any. Having done so, the value of the status column becomes `notInService', and we proceed to interaction 4. Interaction 4: Making the Conceptual Row Available Once the management station is satisfied with the values associated with the columns of the conceptual row, it issues a management protocol set operation to set the status column to `active'. If the agent has sufficient information to make the conceptual row available for use by the managed device, the management protocol set operation succeeds (a `noError' response is returned). Otherwise, the management protocol set operation fails with an error of `inconsistentValue'. NOTE WELL A conceptual row having a status column with value `notInService' or `notReady' is unavailable to the managed device. As such, it is possible for the managed device to create its own instances during the time between the management protocol set operation which sets the status column to `createAndWait' and the management protocol set operation which sets the status column to `active'. In this case, when the management protocol set operation is issued to set the status column to `active', the values held in the agent supersede those used by the managed device. If the management station is prevented from setting the status column to `active' (e.g., due to management station or network failure) the conceptual row will be left in the `notInService' or `notReady' state, consuming resources indefinitely. The agent must detect conceptual rows that have been in either state for an abnormally long period of time and remove them. It is the responsibility of the DESCRIPTION clause of the status column to indicate what an abnormally long period of time would be. This period of time should be long enough to allow for human response time (including `think time') between the creation of the conceptual row and the setting of the status to `active'. In the absence of such information in the DESCRIPTION clause, it is suggested that this period be approximately 5 minutes in length. This removal action applies not only to newly-created rows, but also to previously active rows which are set to, and left in, the notInService state for a prolonged period exceeding that which is considered normal for such a conceptual row. Conceptual Row Suspension When a conceptual row is `active', the management station may issue a management protocol set operation which sets the instance of the status column to `notInService'. If the agent is unwilling to do so, the set operation fails with an error of `wrongValue' or `inconsistentValue'. Otherwise, the conceptual row is taken out of service, and a `noError' response is returned. It is the responsibility of the DESCRIPTION clause of the status column to indicate under what circumstances the status column should be taken out of service (e.g., in order for the value of some other column of the same conceptual row to be modified). Conceptual Row Deletion For deletion of conceptual rows, a management protocol set operation is issued which sets the instance of the status column to `destroy'. This request may be made regardless of the current value of the status column (e.g., it is possible to delete conceptual rows which are either `notReady', `notInService' or `active'.) If the operation succeeds, then all instances associated with the conceptual row are immediately removed. · Integer32

This object is used to create or delete the row entry in cnpdThresholdConfigTable. When creating a row entry the management station is required to specify a value for cnpdThresholdConfigIfIndex, cnpdThresholdConfigRising and cnpdThresholdConfigFalling. 'active' means that a createAndGo or active has been issued, AND a valid ifIndex exists. And therefore if a row is 'active' it means a ThresholdHistory entry may have been generated if the value was breached. If you set an 'active' row to 'createAndWait' - it will in fact get the status 'notReady'. Likewise if you set any row to 'notInService' or 'notReady' it will go to the 'notReady' state.

Unsigned32 (1..1000)

A monotonically increasing integer which uniquely identifies this cnpdThresholdHistoryEntry in the cnpdThresholdHistory table.

Unsigned32 (1..1000)

The cnpdThresholdConfigTable entry which generated this entry. Using this object the management station can backtrack to the appropriate cnpdThresholdConfigEntry.

Unsigned32 (1..4294967295)

The actual value of the statistic when the sampling was made.

INTEGER1 = risingBreach2 = fallingBreach · Integer32

Describes whether this is an event caused by a rising or falling threshold breach.

TimeTicks

The value of sysUpTime of the running configuration when the event occurred.

CiscoPdProtocolIndexAn object which represents a unique identifier for a protocol or application which NBAR currently recognizes. The value of this object is defined in the cnpdSupportedProtocolsTable. (1..1024) · Unsigned32

The application or protocol which the management station configured a threshold on. This object is an index into the SupportedProtocolsTable where details of the protocol can be found.

CiscoPdDataType1 = bitRateIn2 = bitRateOut3 = bitRateSum4 = byteCountIn5 = byteCountOut6 = byteCountSum7 = packetCountIn8 = packetCountOut9 = packetCountSumThese are the data types which NBAR can measure a particular protocol by. bitRateIn(1) - incoming bitrate. bitRateOut(2) - outgoing bitrate. bitRateSum(3) - sum of incoming and outgoing bitrate. byteCountIn(4) - incoming bytecount. byteCountOut(5) - outgoing bytecount. byteCountSum(6) - sum of incoming and outgoing bytecount. packetCountIn(7) - incoming packetcount. packetCountOut(8) - outgoing packetcount. packetCountSum(9) - sum of incoming and outgoing packetcount. UNITS: bitrate - unit is kilo bits per second bytecount - unit is bytes packetcount - unit is packets · Integer32

This is the statistic used to base the threshold on.

CiscoPdProtocolIndexAn object which represents a unique identifier for a protocol or application which NBAR currently recognizes. The value of this object is defined in the cnpdSupportedProtocolsTable. (1..1024) · Unsigned32

A unique identifier of a row in this table. Thus it also represents a unique identifier for a protocol or application which NBAR currently recognizes.

CiscoPdProtocolNameName of an application or protocol, which NBAR is capable of recognizing. For example: ftp, vdolive and citrix. SIZE (1..255) · OCTET STRING

This object reflects the valid string of a protocol or application which NBAR currently recognizes.