]> US Army CERDEC

6010 Frankford Road Aberdeen Proving Ground Maryland 21005 USA +1 443 395 8744 robert.g.cole@us.army.mil http://www.cs.jhu.edu/~rgcole/

Naval Research Laboratory

Washington D.C. 20375 USA macker@itd.nrl.navy.mil

Naval Research Laboratory

Washington D.C. 20375 USA adamson@itd.nrl.navy.mil

Booz Allen Hamilton

333 City Boulevard West Orange CA 92868 USA harnedy_sean@bah.com

Routing Internet Engineering Task Force Network Management Management Information Base MIB SMIv2 Routing MANET Multicast This memo defines a portion of the Management Information Base (MIB) for use with network management protocols in the Internet community. In particular, it describes objects for configuring aspects of the Simplified Multicast Forwarding (SMF) process for Mobile Ad-Hoc Networks (MANETs). The SMF-MIB also reports state information, performance metrics, and notifications. In addition to configuration, the additional state and performance information is useful to operators troubleshooting multicast forwarding problems.

This memo defines a portion of the Management Information Base (MIB) for use with network management protocols in the Internet community. In particular, it describes objects for configuring aspects of a process implementing Simplified Multicast Forwarding (SMF) for Mobile Ad-Hoc Networks (MANETs). SMF provides multicast Duplicate Packet Detection (DPD) and supports algorithms for constructing an estimate of a MANET Minimum Connected Dominating Set (MCDS) for efficient multicast forwarding. The SMF-MIB also reports state information, performance metrics, and notifications. In addition to configuration, this additional state and performance information is useful to operators troubleshooting multicast forwarding problems.

For a detailed overview of the documents that describe the current Internet-Standard Management Framework, please refer to section 7 of RFC 3410 . Managed objects are accessed via a virtual information store, termed the Management Information Base or MIB. MIB objects are generally accessed through the Simple Network Management Protocol (SNMP). Objects in the MIB are defined using the mechanisms defined in the Structure of Management Information (SMI). This memo specifies a MIB module that is compliant to the SMIv2, which is described in STD 58, RFC 2578 , STD 58, RFC 2579 and STD 58, RFC 2580 .

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 .

SMF provides methods for implementing DPD-based multicast forwarding with the optional use of Connected Dominating Set (CDS)-based relay sets. The CDS provides a complete connected coverage of the nodes comprising the MANET. The MCDS is the smallest set of MANET nodes (comprising a connected cluster) which cover all the nodes in the cluster with their transmissions. As the density of the MANET nodes increase, the fraction of nodes required in an MCDS decreases. Using the MCDS as a multicast forwarding set then becomes an efficient multicast mechanism for MANETs. Various algorithms for the construction of estimates of the MCDS exist. The Simplified Multicast Framework describes some of these. It further defines various operational modes for a node which is participating in the collective creation of the MCDS estimates. These modes depend upon the set of related MANET routing and discovery protocols and mechanisms in operation in the specific MANET node. A SMF router's MIB contains SMF process configuration parameters (e.g. specific CDS algorithm), state information (e.g., current membership in the CDS), performance counters (e.g., packet counters), and notifications.

This section describes the management model for the SMF node process. Figure 1 (reproduced from Figure 4 of ) shows the relationship between the SMF Relay Set selection algorithm and the related algorithms, processes and protocols running in the MANET nodes. The Relay Set Selection Algorithm (RSSA) can rely upon topology information gotten from the MANET Neighborhood Discovery Protocol (NHDP), from the specific MANET routing protocol running on the node, or from Layer 2 information passed up to the higher layer protocol processes.

| Selection | | Protocol | neighbor | Algorithm | |______________| info |____________| \ / \ / neighbor\ / forwarding info* \ _____________ / status \ | | / `-->| Forwarding |<--' | Process | ----------------->|_____________|-----------------> incoming packet, forwarded packets interface id*, and previous hop* Figure 1: SMF Node Architecture ]]>

The following definitions apply throughout this document: Configuration Objects - switches, tables, objects which are initialized to default settings or set through the management interface defined by this MIB. Tunable Configuration Objects - objects whose values affect timing or attempt bounds on the SMF RS process. State Objects - automatically generated values which define the current operating state of the SMF RS process in the router. Performance Objects - automatically generated values which help an administrator or automated tool to assess the performance of the CDS multicast process on the router and the overall multicasting performance within the MANET routing domain.

This section presents the structure of the SMF-MIB module. The objects are arranged into the following groups: smfMIBNotifications - defines the notifications associated with the SMF-MIB. smfMIBObjects - defines the objects forming the basis for the SMF-MIB. These objects are divided up by function into the following groups: Capabilities Group - This group contains the SMF objects that the device uses to advertise its local capabilities with respect to, e.g., the supported RSSAs. Configuration Group - This group contains the SMF objects that configure specific options that determine the overall operation of the SMF RSSA and the resulting multicast performance. State Group - Contains information describing the current state of the SMF RSSA process such as the Neighbor Table. Performance Group - Contains objects which help to characterize the performance of the SMF RSSA process, typically statistics counters. smfMIBConformance - defines minimal and full conformance of implementations to this SMF-MIB.

The textual conventions defined within the SMF-MIB are as follows: The SmfStatus is defined within the SMF-MIB. This contains the current operational status of the SMF process on an interface. The SmfOpModeID represents an index that identifies a specific SMF operational mode. The SmfRssaID represents an index that identifies, through reference, a specific RSSA available for operation on the device.

The SMF device supports a set of capabilities. The list of capabilities which the device can advertise are: Operational Mode - topology information from NHDP, CDS-aware unicast routing or Cross-layer from Layer 2. SMF RSSA - the specific RSSA operational on the device. Note that configuration, state and performance objects related to a specific RSSA must be defined within another separate MIB.

The SMF device is configured with a set of controls. Some of the prominent configuration controls for the SMF device follow: Operational Mode - topology information from NHDP, CDS-aware unicast routing or Cross-layer from Layer 2. SMF RSSA - the specific RSSA operational on the device. Duplicate Packet detection for IPv4 - Identification-based or Hash-based DPD. Duplicate Packet detection for IPv6 - Identification-based or Hash-based DPD. SMF Type Message TLV - if NHDP mode is selected, then is the SMF Type Message TLV may be included in the NHDP exchanges. SMF Address Block TLV - if NHDP mode is selected, then is the SMF Address Block TLV should be included in the NHDP exchanges.

The State Subtree reports current state information, e.g., Node RSS State - is the node currently in or out of the Relay Set. Neighbors Table - a table containing current neighbors and their operational RSSA.

The Performance subtree reports primarily counters that relate to SMF RSSA performance. The SMF performance counters consists of per node and per interface objects: Total multicast packets received. Total multicast packets forwarded. Total duplicate multicast packets detected. Per interface statistics table with the following entries: Multicast packets received. Multicast packets forwarded. Duplicate multicast packets detected.

The Notifications Subtree contains the list of notifications supported within the SMF-MIB and their intended purpose or utility.

The 'system' group in the SNMPv2-MIB is defined as being mandatory for all systems, and the objects apply to the entity as a whole. The 'system' group provides identification of the management entity and certain other system-wide data. The SMF-MIB does not duplicate those objects.

The textual conventions imported for use in the SMF-MIB are as follows. The MODULE-IDENTITY, OBJECT-TYPE, NOTIFICATION-TYPE, Counter32, Unsigned32, Integer32 and mib-2 textual conventions are imported from RFC 2578 . The TEXTUAL-CONVENTION, RowStatus and TruthValue textual conventions are imported from RFC 2579 . The MODULE-COMPLIANCE, OBJECT-GROUP and NOTIFICATION-GROUP textual conventions are imported from RFC 2580 . The InterfaceIndexOrZero textual convention is imported from RFC 2863 . The SnmpAdminString textual convention is imported from RFC 3411 . The InetAddress, InetAddressType and InetAddressPrefixLength textual conventions are imported from RFC 4001 .

In a sense, the SMF-MIB is a general front-end to a set of, yet to be developed, RSSA-specific MIBs. These RSSA-specific MIBs will define the objects for the configuration, state, performance and notification objects required for the operation of these specific RSSAs. The SMF-MIB Capabilities Group allows the remote management station the ability to query the router to discover the set of supported RSSAs.

This section discusses security implications of the choices made in this SMF-MIB module. There are a number of management objects defined in this MIB module with a MAX-ACCESS clause of read-write and/or read-create. Such objects may be considered sensitive or vulnerable in some network environments. The support for SET operations in a non-secure environment without proper protection can have a negative effect on network operations. These are the tables and objects and their sensitivity/vulnerability: 'smfAdminStatus' - this writable configuration object controls the operational status of the SMF process. If this setting is configured inconsistently across the MANET multicasting domain, then delivery of multicast data may be inconsistent across the domain; some nodes may not receive multicast data intended for them. 'smfRouterIDAddrType' and 'smfRouterID' - these writable configuration objects define the ID of the SMF process. These objects should be configured with a routable address defined on the local SMF device. The smfRouterID is a logical identification that MUST be consistent across interoperating SMF neighborhoods and it is RECOMMENDED to be chosen as the numerically largest address contained in a node's 'Neighbor Address List' as defined in NHDP. A smfRouterID MUST be unique within the scope of the operating MANET network regardless of the method used for selecting it. 'smfConfiguredOpMode' - this writable configuration objects define the operational mode of the SMF process. The operational mode defines how the SMF process develops its local estimate of the CDS. 'smfConfiguredRssa' - this writable configuration object sets the specific Reduced Set Selection Algorithm (RSSA) for the SMF process. If this object is set inconsistently across the MANET domain, multicast delivery of data will fail. 'smfRssaMember' - this writable configuration object sets the 'interest' of the local SMF node in participating in the CDS. Setting this object to 'never(3)' on a highly highly connected device could lead to frequent island formation. Setting this object to 'always(2)' could support data ex-filtration from the MANET domain. 'smfIpv4Dpd' - this writable configuration object sets the duplicate packet detection method for forwarding of IPv4 multicast packets. 'smfIpv6Dpd' - this writable configuration object sets the duplicate packet detection method for forwarding of IPv6 multicast packets. 'smfMaxPktLifetime' - this writable configuration object sets the estimate of the network packet traversal time. If set too small, this could lead to poor multicast data delivery ratios throughout the MANET domain. 'smfDpdMaxMemorySize' - this writable configuration object sets the memory storage size (in Kilo-Bytes) for the cached DPD records for the combined IPv4 and IPv6 methods. If set too small this could lead to poor performance of the duplicate packet protection algorithms and lead to inefficient resource, e.g., link, utilization within the MANET domain. The local SMF device should protect itself against memory overruns in the event that too large a setting is requested. 'smfDpdEntryMaxLifetime' - this writable configuration object sets the maximum lifetime (in seconds) for the cached DPD records for the combined IPv4 and IPv6 methods. If the memory is running low prior to the MaxLifetimes being exceeded, the local SMF devices should purge the oldest records first. 'smfNhdpRssaMesgTLVIncluded' - this writable configuration object indicates whether the associated NHDP messages include the the RSSA Message TLV, or not. It is highly RECOMMENDED that this object be set to 'true(1)'. 'smfNhdpRssaAddrBlockTLVIncluded' - this writable configuration object indicates whether the associated NHDP messages include the the RSSA Address Block TLV, or not. The smfNhdpRssaAddrBlockTLVIncluded is optional in all cases as it depends on the existence of an address block which may not be present. If this SMF device is configured with NHDP, then this object should be set to 'true(1)'. 'smfConfiguredAddrForwardingTable' - the writable configuration objects in this table indicate which multicast IP address are to be forwarded by this SMF node. Misconfiguration of rows within this table can limit the ability of this SMF device to forward multicast data. 'smfInterfaceTable' - the writable configuration objects in this table indicate which SMF node interfaces are participating in the SMF packet forwarding process. Misconfiguration of rows within this table can limit the ability of this SMF device to forward multicast data. Some of the readable objects in this MIB module (i.e., objects with a MAX-ACCESS other than not-accessible) may be considered sensitive or vulnerable in some network environments. It is thus important to control even GET and/or NOTIFY access to these objects and possibly to even encrypt the values of these objects when sending them over the network via SNMP. These are the tables and objects and their sensitivity/vulnerability: 'smfNodeRsStatusIncluded' - this readable state object indicates that this SMF node is part of the CDS, or not. Being part of the CDS makes this node a distinguished device. It could be exploited for data ex-filtration, or denial of service attacks. 'smfDiscoveredAddrForwardingTable' - the readable state objects in this table indicate which, dynamically discovered, multicast IP address are to be forwarded by this SMF node. 'smfNeighborTable' - the readable state objects in this table indicate current neighbor nodes to this SMF node. Exposing this information to an attacker could allow the attacker easier access to the larger MANET domain. The remainder of the objects in the SMF-MIB are performance counter objects. While these give an indication of the activity of the SMF process on this node, it is not expected that exposing these values pose a security risk to the MANET network. SNMP versions prior to SNMPv3 did not include adequate security. Even if the network itself is secure (for example by using IPSec), even then, there is no control as to who on the secure network is allowed to access and GET/SET (read/change/create/delete) the objects in this MIB module. It is RECOMMENDED that implementers consider the security features as provided by the SNMPv3 framework (see , section 8), including full support for the SNMPv3 cryptographic mechanisms (for authentication and privacy). Further, deployment of SNMP versions prior to SNMPv3 is NOT RECOMMENDED. Instead, it is RECOMMENDED to deploy SNMPv3 and to enable cryptographic security. It is then a customer/operator responsibility to ensure that the SNMP entity giving access to an instance of this MIB module is properly configured to give access to the objects only to those principals (users) that have legitimate rights to indeed GET or SET (change/create/delete) them.

Editor's Note (to be removed prior to publication): the IANA is requested to assign a value for "XXXX" under the 'experimental' subtree and to record the assignment in the SMI Numbers registry. When the assignment has been made, the RFC Editor is asked to replace "XXXX" (here and in the MIB module) with the assigned value and to remove this note. Note well: prior to official assignment by the IANA, a draft document MUST use placeholders (such as "XXXX" above) rather than actual numbers. See RFC4181 Section 4.5 for an example of how this is done in a draft MIB module.

This MIB document uses the template authored by D. Harrington which is based on contributions from the MIB Doctors, especially Juergen Schoenwaelder, Dave Perkins, C.M.Heard and Randy Presuhn.

&rfc2863; &rfc3411; &rfc3418; &rfc4001; &rfc2119; &rfc2578; &rfc2579; &rfc2580; &SMF; &rfc3410;

This section tracks the revision history in the development of this SMF-MIB. It will be removed from the final version of this document. These changes were made from draft-ietf-manet-smf-mib-02 to draft-ietf-manet-smf-mib-03. Clarified and added discussion of default values for several of the configuration objects within the MIB. Added the security section. These changes were made from draft-ietf-manet-smf-mib-01 to draft-ietf-manet-smf-mib-02. Added the NotificationGroup to the MIB and updated the ConformanceGroup. Added the definition of an smfRouterID to the MIB. This is later used in the Notifications to indicate the origin of the event to the management station. Removed the Router Priority object as this was used only in the eCDS algorithm and hence should be contained within the future eCDS-MIB. Cleaned up the TEXTUAL CONVENTION for the `SmfOpMode'. Filled in some of the missing text in various object descriptions. These changes were made from draft-ietf-manet-smf-mib-00 to draft-ietf-manet-dsmf-mib-01. Editorial changes to the textual material. These included the addition of the paragraphs on TEXTUAL-CONVENTIONS defined and imported into this MIB and relationships to other MIBs. Identified those objects in the SMF-MIB requiring non-volatile storage. Changed the name of the TEXTUAL-CONVENTION 'Status', defined within this MIB to 'SmfStatus'.

This section contains the set of open issues related to the development and design of the SMF-MIB. This section will not be present in the final version of the MIB and will be removed once all the open issues have been resolved. A careful review by the working group.