CISCO-TAP2-MIB

All MIBs › CISCO-TAP2-MIB

Organization: Cisco Systems, Inc.

Last Updated: 2008-09-10

Category: Cisco Devices, VPN and Security

Description:

Manages next-generation CALEA lawful intercept streams supporting multiple transport types on Cisco IOS platforms.

Imported Objects

ciscoMgmt

OBJECT-IDENTITY

From IF-MIB

InterfaceIndexOrZero

From INET-ADDRESS-MIB

InetAddress
InetAddressType
InetPortNumber

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Counter64
Integer32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DateAndTime
RowStatus
StorageType
TEXTUAL-CONVENTION
TruthValue

What Is CISCO-TAP2-MIB?

CISCO-TAP2-MIB implements Cisco's next-generation lawful-intercept (CALEA) feature on Cisco IOS platforms, replacing the older CISCO-TAP-MIB, and provides a generic mediation-stream framework used across multiple intercept types (IP, 802 Ethernet, RADIUS user-connection) defined in companion extension MIBs. It exposes a mediation table describing where and how intercepted traffic content should be duplicated and forwarded - destination address/port, source interface, and transport parameters such as RTCP port and DSCP marking - along with notifications for intercept lifecycle events. Because lawful intercept is a security/compliance software feature rather than hardware telemetry, monitoring this MIB is about intercept-service software status - whether mediation streams are correctly configured and actively forwarding - and about notifications signaling stream state changes, rather than hardware health. Compliance teams configuring lawful intercept for the first time often consult a CISCO-TAP2-MIB MIB Browser to understand the mediation table's structure before provisioning live intercepts. It explicitly depends on companion extension MIBs (CISCO-IP-TAP-MIB, CISCO-802-TAP-MIB, CISCO-USER-CONNECTION-TAP-MIB) that supply intercept-type-specific filters on top of this common stream table. It is deployed on Cisco IOS routers/switches performing CALEA-compliant lawful intercept for service-provider or enterprise legal-compliance obligations.

IPNetwork Monitor allows you to monitor SNMP objects defined in CISCO-TAP2-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

What Can Be Monitored

mediation stream configuration status
intercept destination address/port
source interface being tapped
RTCP port and DSCP marking
data/retransmit type of intercept stream
mediation stream notifications

Supported Devices

Cisco ASR 1000 Series (e.g., ASR 1001-X/1002-HX) — current edge/aggregation router platform supporting CALEA lawful-intercept services

Monitoring Examples

An operator, in coordination with a mediation device, would create entries in cTap2MediationTable/cTap2MediationEntry via cTap2MediationNewIndex, configuring cTap2MediationDestAddressType/cTap2MediationDestAddress/cTap2MediationDestPort to point intercepted content at a mediation collector, with cTap2MediationSrcInterface identifying which interface's traffic is tapped. Fields like cTap2MediationRtcpPort, cTap2MediationDscp, cTap2MediationDataType, and cTap2MediationRetransmitType configure the delivery stream's transport behavior, while ciscoTap2MIBNotifs would signal changes in mediation-stream state that a compliance monitoring system needs to track.

OIDs

OID symbolic	OID numeric	Type	Access	Description
ciscoTap2DebugComplianceGroup	1.3.6.1.4.1.9.9.399.2.2.5			These objects are necessary for debug information.
ciscoTap2DebugComplianceGroupRev1	1.3.6.1.4.1.9.9.399.2.2.7			These objects are necessary for debug information. This compliance group deprecates ciscoTap2DebugComplianceGroup.
ciscoTap2MediationComplianceGroup	1.3.6.1.4.1.9.9.399.2.2.1			These objects are necessary for description of the data streams directed to a Mediation Device.
ciscoTap2MediationCpbComplianceGroup	1.3.6.1.4.1.9.9.399.2.2.4			These objects are necessary for a description of the mediation device to select for Lawful Intercept.
NTF ciscoTap2MediationDebug	1.3.6.1.4.1.9.9.399.0.3			When there is intervention needed due to some events related to entries configured in cTap2MediationTable, the device notifies the manager of the event. This notification may be generated in conjunction with the intercept application, which is designed to expect the notification to be sent as reliably as possible, e.g., through the use of a finite number of retransmissions until acknowledged, as and when such mechanisms are available; for example, with SNMPv3, this would be an InformRequest.
NTF ciscoTap2MediationTimedOut	1.3.6.1.4.1.9.9.399.0.2			When an intercept is autonomously removed by an intercepting device, such as due to the time specified in cTap2MediationTimeout arriving, the device notifies the manager of the action.
ciscoTap2MIB	1.3.6.1.4.1.9.9.399			This module manages Cisco's intercept feature. This MIB replaces CISCO-TAP-MIB. This MIB defines a generic stream table that contains fields common to all intercept types. Specific intercept filters are defined in extension MIBs. They are CISCO-IP-TAP-MIB for IP intercepts, CISCO-802-TAP-MIB for IEEE 802 intercepts and CISCO-USER-CONNECTION-TAP-MIB for RADIUS-based user connection intercepts.
NTF ciscoTap2MIBActive	1.3.6.1.4.1.9.9.399.0.1			This Notification is sent when an intercepting router or switch is first capable of intercepting a packet corresponding to a configured data stream. The value of the corresponding cTap2StreamType which identifies the actual intercept stream type is included in this notification. This notification may be generated in conjunction with the intercept application, which is designed to expect the notification to be sent as reliably as possible, e.g., through the use of a finite number of retransmissions until acknowledged, as and when such mechanisms are available; for example, with SNMPv3, this would be an InformRequest. Filter installation can take a long period of time, during which call progress may be delayed.
ciscoTap2MIBCompliance	1.3.6.1.4.1.9.9.399.2.1.1			The compliance statement for entities which implement the Cisco Intercept MIB
ciscoTap2MIBComplianceRev2	1.3.6.1.4.1.9.9.399.2.1.2			The compliance statement for entities which implement the Cisco Intercept MIB. This compliance deprecates ciscoTap2MIBCompliance.
ciscoTap2MIBComplianceRev3	1.3.6.1.4.1.9.9.399.2.1.3			The compliance statement for entities which implement the Cisco Intercept MIB. This compliance deprecates ciscoTap2MIBComplianceRev2.
ciscoTap2MIBCompliances	1.3.6.1.4.1.9.9.399.2.1
ciscoTap2MIBConform	1.3.6.1.4.1.9.9.399.2
ciscoTap2MIBGroups	1.3.6.1.4.1.9.9.399.2.2
ciscoTap2MIBNotifs	1.3.6.1.4.1.9.9.399.0
ciscoTap2MIBObjects	1.3.6.1.4.1.9.9.399.1
ciscoTap2NotificationGroup	1.3.6.1.4.1.9.9.399.2.2.3			These notifications are used to present status from the intercepting device to the Mediation Device.
ciscoTap2StreamComplianceGroup	1.3.6.1.4.1.9.9.399.2.2.2			These objects are necessary for a description of the packets to select for interception.
NTF ciscoTap2StreamDebug	1.3.6.1.4.1.9.9.399.0.4			When there is intervention needed due to some events related to entries configured in cTap2StreamTable, the device notifies the manager of the event. This notification may be generated in conjunction with the intercept application, which is designed to expect the notification to be sent as reliably as possible, e.g., through the use of a finite number of retransmissions until acknowledged, as and when such mechanisms are available; for example, with SNMPv3, this would be an InformRequest.
ciscoTap2StreamHCStatsGroup	1.3.6.1.4.1.9.9.399.2.2.6			These objects are required for 64 bit version of cTap2StreamInterceptedPackets and cTap2StreamInterceptDrops
NTF ciscoTap2Switchover	1.3.6.1.4.1.9.9.399.0.5			This notification is sent when there is a redundant (standby) route processor available on the intercepting device and the current active processor is going down causing standby to takeover. Note that this notification may be sent by the intercepting device only when it had a chance to know before it goes down. Mediation device when received this notification should assume that configured intercepts on the intercepting device no longer exist, when the standby processor takes control. This means that the Mediation device should again configure the intercepts.
I32 cTap2DebugAge	1.3.6.1.4.1.9.9.399.1.3.1	Integer32	read-only	This object contains the duration in minutes for which an entry in cTap2DebugTable is maintained by the implementing device after which the entry is deleted. The management station also has the option of deleting the entry itself by setting cTap2DebugStatus.
cTap2DebugEntry	1.3.6.1.4.1.9.9.399.1.3.3.1		not-accessible	A list of the debug messages.
cTap2DebugGroup	1.3.6.1.4.1.9.9.399.1.3
I32 cTap2DebugIndex	1.3.6.1.4.1.9.9.399.1.3.3.1.1	Integer32	not-accessible	Index to the debug table.
I32 cTap2DebugMaxEntries	1.3.6.1.4.1.9.9.399.1.3.2	Integer32	read-only	This object contains the maximum number of debug messages maintained by the implementing device at a time. If this limit is crossed, most recent message will replace the least recent message.
U32 cTap2DebugMediationId	1.3.6.1.4.1.9.9.399.1.3.3.1.2	Unsigned32	read-only	The value of this object is that of cTap2MediationContentId identifying an entry in cTap2MediationTable. Note this object may contain a value for which an entry in cTap2MediationTable does not exist. This happens when creation of an entry in cTap2MediationTable fails and this debug message conveys more detailed information regarding the failure.
STR cTap2DebugMessage	1.3.6.1.4.1.9.9.399.1.3.3.1.4	SnmpAdminString	read-only	A text string contains the debug message.
ROW cTap2DebugStatus	1.3.6.1.4.1.9.9.399.1.3.3.1.5	RowStatus	read-write	The status of this conceptual row. A row in this table is created by the implementing device. A management station cannot modify any of the objects in this row, except deleting the row by setting this object to 'destroy'.
U32 cTap2DebugStreamId	1.3.6.1.4.1.9.9.399.1.3.3.1.3	Unsigned32	read-only	The value of this object is that of cTap2StreamIndex of an entry in cTap2StreamTable. This object along with cTap2DebugMediationId identifies an entry in cTap2StreamTable. The value of this object may be zero, in which this debug message is regarding a Mediation Device, but not a particular stream. Note this object may contain a value for which an entry in cTap2MediationTable does not exist. This happens when creation of an entry in cTap2StreamTable fails.
cTap2DebugTable	1.3.6.1.4.1.9.9.399.1.3.3		not-accessible	A table that contains Lawful Intercept debug messages generated by the implementing device. This table is used by ciscoTap2MediationDebug and ciscoTap2StreamDebug notifications. An entry in this table contains a debug message which is regarding either a Mediation Device or a intercept stream created by a Mediation Device. The Mediation device is identified by cTap2DebugMediationId whose value is that of cTap2MediationContentId of cTapMediationEntry. The stream is identified by cTap2DebugMediationId and cTap2DebugStreamId whose values are that of cTap2MediationContentId and cTap2StreamIndex of the corresponding cTap2StreamEntry. Note that cTap2DebugStreamId may be zero for an entry, in which case the debug message is regarding a Medation Device. Entries are added to this table via cTap2DebugStatus in accordance with the RowStatus convention.
cTap2DebugUserEntry	1.3.6.1.4.1.9.9.399.1.3.4.1		not-accessible	A conceptual row in the cTap2DebugUserTable. Each row represents name of user on the router to whom Mediation Device with CCCid represented by cTap2MediationContentId has given access to Lawful Intercept commands and cTap2DebugUserTimeout represents the time when the entry will expire.
STR cTap2DebugUserName	1.3.6.1.4.1.9.9.399.1.3.4.1.1	SnmpAdminString	not-accessible	A human readable string representing the name of debug user who will have access to Lawful Intercept commands.
ROW cTap2DebugUserStatus	1.3.6.1.4.1.9.9.399.1.3.4.1.4	RowStatus	read-create	The status of this conceptual row. This object manages creation, modification, and deletion of rows in this table. cTap2DebugUserTimeout may be modified any time even when the value of this entry rowStatus object is 'active'.
STO cTap2DebugUserStorageType	1.3.6.1.4.1.9.9.399.1.3.4.1.3	StorageType	read-create	This object specifies the storage type of this conceptual row. If it is set to 'nonVolatile', this entry can be saved into non-volatile memory.
cTap2DebugUserTable	1.3.6.1.4.1.9.9.399.1.3.4		not-accessible	The User Table lists information of all the users configured in the system who are given permission by different Mediation Devices to access Lawful Intercept CLIs. This table will have dependancy on cTap2MediationTable. When entry in cTap2MediationTable is deleted or moved to 'notInService', entries corresponding cTap2MediationContentId in this table will be deleted.
DAT cTap2DebugUserTimeout	1.3.6.1.4.1.9.9.399.1.3.4.1.2	DateAndTime	read-create	This object specifies the time at which the row will be removed from the table by the system. The value of this object is only effective when the value of corresponding instance of cTap2DebugUserStatus is 'active'.
BIT cTap2MediationCapabilities	1.3.6.1.4.1.9.9.399.1.1.3	Bits	read-only	This object displays the device capabilities with respect to certain fields in Mediation Device table. This may be dependent on hardware capabilities, software capabilities. The following values may be supported: ipV4SrcInterface: SNMP ifIndex Value may be used to select the interface (denoted by cTap2MediationSrcInterface) on the intercepting device from which to transmit intercepted data to an IPv4 address Mediation Device. ipV6SrcInterface: SNMP ifIndex Value may be used to select the interface (denoted by cTap2MediationSrcInterface) on the intercepting device from which to transmit intercepted data to an IPv6 address Mediation Device. udp: UDP may be used as transport protocol (denoted by cTap2MediationTransport) in transferring intercepted data to the Mediation Device. rtcpNack: RTP with Nack resilience may be used as transport protocol (denoted by cTap2MediationTransport) in transferring intercepted data to the Mediation Device. tcp: TCP may be used as transport protocol (denoted by cTap2MediationTransport) in transferring intercepted data to the Mediation Device. sctp: SCTP may be used as transport protocol (denoted by cTap2MediationTransport) in transferring intercepted data to the Mediation Device. rtp: RTP may be used as transport protocol (denoted by cTap2MediationTransport) in transferring intercepted data to the Mediation Device.
I32 cTap2MediationContentId	1.3.6.1.4.1.9.9.399.1.1.2.1.1	Integer32	not-accessible	cTap2MediationContentId is a session identifier, from the intercept application's perspective, and a content identifier from the Mediation Device's perspective. The Mediation Device is responsible for making sure these are unique, although the SNMP RowStatus row creation process will help by not allowing it to create conflicting entries. Before creating a new entry, a value for this variable may be obtained by reading cTap2MediationNewIndex to reduce the probability of a value collision.
I32 cTap2MediationDataType	1.3.6.1.4.1.9.9.399.1.1.2.1.8	Integer32	read-create	If RTP with Ack/Nack resilience is selected as a transport, the mediation process requires an RTP payload type for data transmissions, and a second RTP payload type for retransmissions. This is the RTP payload type for transmissions. This object is only effective when the value of cTap2MediationTransport is 'rtpNack'.
IP cTap2MediationDestAddress	1.3.6.1.4.1.9.9.399.1.1.2.1.3	InetAddress	read-create	The IP Address of the Mediation Device's network interface to which to direct intercepted traffic.
IPt cTap2MediationDestAddressType	1.3.6.1.4.1.9.9.399.1.1.2.1.2	InetAddressType	read-create	The type of cTap2MediationDestAddress.
INE cTap2MediationDestPort	1.3.6.1.4.1.9.9.399.1.1.2.1.4	InetPortNumber	read-create	The port number on the Mediation Device's network interface to which to direct intercepted traffic.
CTA cTap2MediationDscp	1.3.6.1.4.1.9.9.399.1.1.2.1.7	Ctap2Dscp	read-create	The Differentiated Services Code Point the intercepting device applies to the IP packets encapsulating the intercepted traffic.
cTap2MediationEntry	1.3.6.1.4.1.9.9.399.1.1.2.1		not-accessible	The entry describes a single session maintained with an application on a Mediation Device.
cTap2MediationGroup	1.3.6.1.4.1.9.9.399.1.1
I32 cTap2MediationNewIndex	1.3.6.1.4.1.9.9.399.1.1.1	Integer32	read-only	This object contains a value which may be used as an index value for a new cTap2MediationEntry. Whenever read, the agent will change the value to a new non-conflicting value. This is to reduce the probability of errors during creation of new cTap2MediationTable entries.
T/F cTap2MediationNotificationEnable	1.3.6.1.4.1.9.9.399.1.1.2.1.12	TruthValue	read-create	This variable controls the generation of any notifications or informs by the MIB agent for this table entry.
I32 cTap2MediationRetransmitType	1.3.6.1.4.1.9.9.399.1.1.2.1.9	Integer32	read-create	If RTP with Ack/Nack resilience is selected as a transport, the mediation process requires an RTP payload type for data transmissions, and a second RTP payload type for retransmissions. This is the RTP payload type for retransmissions. This object is only effective when the value of cTap2MediationTransport is 'rtpNack'.
INE cTap2MediationRtcpPort	1.3.6.1.4.1.9.9.399.1.1.2.1.6	InetPortNumber	read-only	The port number on the intercepting device to which the Mediation Devices directs RTCP Receiver Reports and Nacks. This object is only relevant when the value of cTap2MediationTransport is 'rtpNack'. This port is assigned by the intercepting device, rather than by the Mediation Device or manager application. The value of this MIB object has no effect before activating the cTap2MediationEntry.
NUM cTap2MediationSrcInterface	1.3.6.1.4.1.9.9.399.1.1.2.1.5	InterfaceIndexOrZero	read-create	The interface on the intercepting device from which to transmit intercepted data. If zero, any interface may be used according to normal IP practice.
ROW cTap2MediationStatus	1.3.6.1.4.1.9.9.399.1.1.2.1.13	RowStatus	read-create	The status of this conceptual row. This object is used to manage creation, modification and deletion of rows in this table. cTap2MediationTimeout may be modified at any time (even while the row is active). But when the row is active, the other writable objects may not be modified without setting its value to 'notInService'. The entry may not be deleted or deactivated by setting its value to 'destroy' or 'notInService' if there is any associated entry in cTap2StreamTable.
cTap2MediationTable	1.3.6.1.4.1.9.9.399.1.1.2		not-accessible	This table lists the Mediation Devices with which the intercepting device communicates. These may be on the same or different Mediation Devices. This table is written by the Mediation Device, and is always volatile. This is because intercepts may disappear during a restart of the intercepting equipment. Entries are added to this table via cTap2MediationStatus in accordance with the RowStatus convention.
DAT cTap2MediationTimeout	1.3.6.1.4.1.9.9.399.1.1.2.1.10	DateAndTime	read-create	The time at which this row and all related Stream Table rows should be automatically removed, and the intercept function cease. Since the initiating network manager may be the only device able to manage a specific intercept or know of its existence, this acts as a fail-safe for the failure or removal of the network manager. The object is only effective when the value of cTap2MediationStatus is 'active'.
INT cTap2MediationTransport	1.3.6.1.4.1.9.9.399.1.1.2.1.11	INTEGER	read-create	The protocol used in transferring intercepted data to the Mediation Device. The following protocols may be supported: udp: PacketCable udp format rtpNack: RTP with Nack resilience tcp: TCP with head of line blocking sctp: SCTP with head of line blocking rtp: Realtime Transport Protocol(RTP) packet format
cTap2StreamEntry	1.3.6.1.4.1.9.9.399.1.2.1.1		not-accessible	A stream entry indicates a single data stream to be intercepted to a Mediation Device. Many selected data streams may go to the same application interface, and many application interfaces are supported.
cTap2StreamGroup	1.3.6.1.4.1.9.9.399.1.2
I32 cTap2StreamIndex	1.3.6.1.4.1.9.9.399.1.2.1.1.1	Integer32	not-accessible	The index of the stream itself.
C32 cTap2StreamInterceptDrops	1.3.6.1.4.1.9.9.399.1.2.1.1.5	Counter32	read-only	The number of packets matching this data stream specification that, having been intercepted, were dropped in the lawful intercept process.
C64 cTap2StreamInterceptedHCPackets	1.3.6.1.4.1.9.9.399.1.2.1.1.7	Counter64	read-only	The number of packets matching this data stream specification that have been intercepted. This object is a 64-bit version of cTap2StreamInterceptedPackets.
C32 cTap2StreamInterceptedPackets	1.3.6.1.4.1.9.9.399.1.2.1.1.4	Counter32	read-only	The number of packets matching this data stream specification that have been intercepted.
T/F cTap2StreamInterceptEnable	1.3.6.1.4.1.9.9.399.1.2.1.1.3	TruthValue	read-create	If 'true', the tap should intercept matching traffic. The value for this object should be set to 'true' only after an additional filter specification has been attached to this stream.
C64 cTap2StreamInterceptHCDrops	1.3.6.1.4.1.9.9.399.1.2.1.1.8	Counter64	read-only	The number of packets matching this data stream specification that, having been intercepted, were dropped in the lawful intercept process. This object is a 64-bit version of cTap2StreamInterceptDrops.
ROW cTap2StreamStatus	1.3.6.1.4.1.9.9.399.1.2.1.1.6	RowStatus	read-create	The status of this conceptual row. This object manages creation, modification, and deletion of rows in this table. cTap2StreamInterceptEnable may be modified any time even the value of this entry rowStatus object is 'active'. When other rows must be changed, cTap2StreamStatus must be first set to 'notInService'.
cTap2StreamTable	1.3.6.1.4.1.9.9.399.1.2.1		not-accessible	The Intercept Stream Table lists the traffic streams to be intercepted. The same data stream may be required by multiple taps, and one might assume that often the intercepted stream is a small subset of the traffic that could be intercepted. The Table consists of generic fields that are independent of the type of intercept. It contains type of the specific filter which is defined in an extension MIB and counters to account for packets intercepted or dropped by the attached filter specification. Note that the Mediation Device must make sure there is only one type of specific filter created with the same indices as that of a row in this table, otherwise the later creations will fail. For example, if there is a row in this table with index 1.2, there can be a corresponding row with the same index either in citapStreamTable, c8tapStreamTable or cuctTapStreamTable, but not all. The first index indicates which Mediation Device the intercepted traffic will be diverted to. The second index permits multiple classifiers to be used together. Entries are added to this table via cTap2StreamStatus in accordance with the RowStatus convention.
INT cTap2StreamType	1.3.6.1.4.1.9.9.399.1.2.1.1.2	INTEGER	read-create	Identifies the type of intercept filter associated to this generic stream. The following types of streams are supported: ip: The specific filter is an IP filter with same indices as that of this table. The exact filter is a row in citapStreamTable of CISCO-IP-TAP-MIB. mac: The specific filter is a MAC filter with same indices as that of this table. The exact filter is a row in c8tapStreamTable of CISCO-802-TAP-MIB. userConnecton: The specific filter is a user connection filter with same indices as that of this table. The exact filter is a row in cuctTapStreamTable of CISCO-USER-CONNECTION-TAP-MIB. msPdsn: The specific filter is a Mobile Sub connection filter with same indices as that of this table. The exact filter is a row in ccptapStreamTable of CISCO-CDMA-PDSN-TAP-MIB. mobility: The specific filter is a Mobile Subscriber connection filter with same indices as that of this table. The exact filter is a row in cmtapStreamTable of CISCO-MOBILITY-TAP-MIB.

OID symbolic	OID numeric	Type	Access	Description
ciscoTap2MIB	1.3.6.1.4.1.9.9.399			This module manages Cisco's intercept feature. This MIB replaces CISCO-TAP-MIB. This MIB defines a generic stream table that contains fields common to all intercept types. Specific intercept filters are defined in extension MIBs. They are CISCO-IP-TAP-MIB for IP intercepts, CISCO-802-TAP-MIB for IEEE 802 intercepts and CISCO-USER-CONNECTION-TAP-MIB for RADIUS-based user connection intercepts.
ciscoTap2MIBNotifs	1.3.6.1.4.1.9.9.399.0
NTF ciscoTap2MIBActive	1.3.6.1.4.1.9.9.399.0.1			This Notification is sent when an intercepting router or switch is first capable of intercepting a packet corresponding to a configured data stream. The value of the corresponding cTap2StreamType which identifies the actual intercept stream type is included in this notification. This notification may be generated in conjunction with the intercept application, which is designed to expect the notification to be sent as reliably as possible, e.g., through the use of a finite number of retransmissions until acknowledged, as and when such mechanisms are available; for example, with SNMPv3, this would be an InformRequest. Filter installation can take a long period of time, during which call progress may be delayed.
NTF ciscoTap2MediationTimedOut	1.3.6.1.4.1.9.9.399.0.2			When an intercept is autonomously removed by an intercepting device, such as due to the time specified in cTap2MediationTimeout arriving, the device notifies the manager of the action.
NTF ciscoTap2MediationDebug	1.3.6.1.4.1.9.9.399.0.3			When there is intervention needed due to some events related to entries configured in cTap2MediationTable, the device notifies the manager of the event. This notification may be generated in conjunction with the intercept application, which is designed to expect the notification to be sent as reliably as possible, e.g., through the use of a finite number of retransmissions until acknowledged, as and when such mechanisms are available; for example, with SNMPv3, this would be an InformRequest.
NTF ciscoTap2StreamDebug	1.3.6.1.4.1.9.9.399.0.4			When there is intervention needed due to some events related to entries configured in cTap2StreamTable, the device notifies the manager of the event. This notification may be generated in conjunction with the intercept application, which is designed to expect the notification to be sent as reliably as possible, e.g., through the use of a finite number of retransmissions until acknowledged, as and when such mechanisms are available; for example, with SNMPv3, this would be an InformRequest.
NTF ciscoTap2Switchover	1.3.6.1.4.1.9.9.399.0.5			This notification is sent when there is a redundant (standby) route processor available on the intercepting device and the current active processor is going down causing standby to takeover. Note that this notification may be sent by the intercepting device only when it had a chance to know before it goes down. Mediation device when received this notification should assume that configured intercepts on the intercepting device no longer exist, when the standby processor takes control. This means that the Mediation device should again configure the intercepts.
ciscoTap2MIBObjects	1.3.6.1.4.1.9.9.399.1
cTap2MediationGroup	1.3.6.1.4.1.9.9.399.1.1
I32 cTap2MediationNewIndex	1.3.6.1.4.1.9.9.399.1.1.1	Integer32	read-only	This object contains a value which may be used as an index value for a new cTap2MediationEntry. Whenever read, the agent will change the value to a new non-conflicting value. This is to reduce the probability of errors during creation of new cTap2MediationTable entries.
cTap2MediationTable	1.3.6.1.4.1.9.9.399.1.1.2		not-accessible	This table lists the Mediation Devices with which the intercepting device communicates. These may be on the same or different Mediation Devices. This table is written by the Mediation Device, and is always volatile. This is because intercepts may disappear during a restart of the intercepting equipment. Entries are added to this table via cTap2MediationStatus in accordance with the RowStatus convention.
cTap2MediationEntry	1.3.6.1.4.1.9.9.399.1.1.2.1		not-accessible	The entry describes a single session maintained with an application on a Mediation Device.
I32 cTap2MediationContentId	1.3.6.1.4.1.9.9.399.1.1.2.1.1	Integer32	not-accessible	cTap2MediationContentId is a session identifier, from the intercept application's perspective, and a content identifier from the Mediation Device's perspective. The Mediation Device is responsible for making sure these are unique, although the SNMP RowStatus row creation process will help by not allowing it to create conflicting entries. Before creating a new entry, a value for this variable may be obtained by reading cTap2MediationNewIndex to reduce the probability of a value collision.
IPt cTap2MediationDestAddressType	1.3.6.1.4.1.9.9.399.1.1.2.1.2	InetAddressType	read-create	The type of cTap2MediationDestAddress.
IP cTap2MediationDestAddress	1.3.6.1.4.1.9.9.399.1.1.2.1.3	InetAddress	read-create	The IP Address of the Mediation Device's network interface to which to direct intercepted traffic.
INE cTap2MediationDestPort	1.3.6.1.4.1.9.9.399.1.1.2.1.4	InetPortNumber	read-create	The port number on the Mediation Device's network interface to which to direct intercepted traffic.
NUM cTap2MediationSrcInterface	1.3.6.1.4.1.9.9.399.1.1.2.1.5	InterfaceIndexOrZero	read-create	The interface on the intercepting device from which to transmit intercepted data. If zero, any interface may be used according to normal IP practice.
INE cTap2MediationRtcpPort	1.3.6.1.4.1.9.9.399.1.1.2.1.6	InetPortNumber	read-only	The port number on the intercepting device to which the Mediation Devices directs RTCP Receiver Reports and Nacks. This object is only relevant when the value of cTap2MediationTransport is 'rtpNack'. This port is assigned by the intercepting device, rather than by the Mediation Device or manager application. The value of this MIB object has no effect before activating the cTap2MediationEntry.
CTA cTap2MediationDscp	1.3.6.1.4.1.9.9.399.1.1.2.1.7	Ctap2Dscp	read-create	The Differentiated Services Code Point the intercepting device applies to the IP packets encapsulating the intercepted traffic.
I32 cTap2MediationDataType	1.3.6.1.4.1.9.9.399.1.1.2.1.8	Integer32	read-create	If RTP with Ack/Nack resilience is selected as a transport, the mediation process requires an RTP payload type for data transmissions, and a second RTP payload type for retransmissions. This is the RTP payload type for transmissions. This object is only effective when the value of cTap2MediationTransport is 'rtpNack'.
I32 cTap2MediationRetransmitType	1.3.6.1.4.1.9.9.399.1.1.2.1.9	Integer32	read-create	If RTP with Ack/Nack resilience is selected as a transport, the mediation process requires an RTP payload type for data transmissions, and a second RTP payload type for retransmissions. This is the RTP payload type for retransmissions. This object is only effective when the value of cTap2MediationTransport is 'rtpNack'.
DAT cTap2MediationTimeout	1.3.6.1.4.1.9.9.399.1.1.2.1.10	DateAndTime	read-create	The time at which this row and all related Stream Table rows should be automatically removed, and the intercept function cease. Since the initiating network manager may be the only device able to manage a specific intercept or know of its existence, this acts as a fail-safe for the failure or removal of the network manager. The object is only effective when the value of cTap2MediationStatus is 'active'.
INT cTap2MediationTransport	1.3.6.1.4.1.9.9.399.1.1.2.1.11	INTEGER	read-create	The protocol used in transferring intercepted data to the Mediation Device. The following protocols may be supported: udp: PacketCable udp format rtpNack: RTP with Nack resilience tcp: TCP with head of line blocking sctp: SCTP with head of line blocking rtp: Realtime Transport Protocol(RTP) packet format
T/F cTap2MediationNotificationEnable	1.3.6.1.4.1.9.9.399.1.1.2.1.12	TruthValue	read-create	This variable controls the generation of any notifications or informs by the MIB agent for this table entry.
ROW cTap2MediationStatus	1.3.6.1.4.1.9.9.399.1.1.2.1.13	RowStatus	read-create	The status of this conceptual row. This object is used to manage creation, modification and deletion of rows in this table. cTap2MediationTimeout may be modified at any time (even while the row is active). But when the row is active, the other writable objects may not be modified without setting its value to 'notInService'. The entry may not be deleted or deactivated by setting its value to 'destroy' or 'notInService' if there is any associated entry in cTap2StreamTable.
BIT cTap2MediationCapabilities	1.3.6.1.4.1.9.9.399.1.1.3	Bits	read-only	This object displays the device capabilities with respect to certain fields in Mediation Device table. This may be dependent on hardware capabilities, software capabilities. The following values may be supported: ipV4SrcInterface: SNMP ifIndex Value may be used to select the interface (denoted by cTap2MediationSrcInterface) on the intercepting device from which to transmit intercepted data to an IPv4 address Mediation Device. ipV6SrcInterface: SNMP ifIndex Value may be used to select the interface (denoted by cTap2MediationSrcInterface) on the intercepting device from which to transmit intercepted data to an IPv6 address Mediation Device. udp: UDP may be used as transport protocol (denoted by cTap2MediationTransport) in transferring intercepted data to the Mediation Device. rtcpNack: RTP with Nack resilience may be used as transport protocol (denoted by cTap2MediationTransport) in transferring intercepted data to the Mediation Device. tcp: TCP may be used as transport protocol (denoted by cTap2MediationTransport) in transferring intercepted data to the Mediation Device. sctp: SCTP may be used as transport protocol (denoted by cTap2MediationTransport) in transferring intercepted data to the Mediation Device. rtp: RTP may be used as transport protocol (denoted by cTap2MediationTransport) in transferring intercepted data to the Mediation Device.
cTap2StreamGroup	1.3.6.1.4.1.9.9.399.1.2
cTap2StreamTable	1.3.6.1.4.1.9.9.399.1.2.1		not-accessible	The Intercept Stream Table lists the traffic streams to be intercepted. The same data stream may be required by multiple taps, and one might assume that often the intercepted stream is a small subset of the traffic that could be intercepted. The Table consists of generic fields that are independent of the type of intercept. It contains type of the specific filter which is defined in an extension MIB and counters to account for packets intercepted or dropped by the attached filter specification. Note that the Mediation Device must make sure there is only one type of specific filter created with the same indices as that of a row in this table, otherwise the later creations will fail. For example, if there is a row in this table with index 1.2, there can be a corresponding row with the same index either in citapStreamTable, c8tapStreamTable or cuctTapStreamTable, but not all. The first index indicates which Mediation Device the intercepted traffic will be diverted to. The second index permits multiple classifiers to be used together. Entries are added to this table via cTap2StreamStatus in accordance with the RowStatus convention.
cTap2StreamEntry	1.3.6.1.4.1.9.9.399.1.2.1.1		not-accessible	A stream entry indicates a single data stream to be intercepted to a Mediation Device. Many selected data streams may go to the same application interface, and many application interfaces are supported.
I32 cTap2StreamIndex	1.3.6.1.4.1.9.9.399.1.2.1.1.1	Integer32	not-accessible	The index of the stream itself.
INT cTap2StreamType	1.3.6.1.4.1.9.9.399.1.2.1.1.2	INTEGER	read-create	Identifies the type of intercept filter associated to this generic stream. The following types of streams are supported: ip: The specific filter is an IP filter with same indices as that of this table. The exact filter is a row in citapStreamTable of CISCO-IP-TAP-MIB. mac: The specific filter is a MAC filter with same indices as that of this table. The exact filter is a row in c8tapStreamTable of CISCO-802-TAP-MIB. userConnecton: The specific filter is a user connection filter with same indices as that of this table. The exact filter is a row in cuctTapStreamTable of CISCO-USER-CONNECTION-TAP-MIB. msPdsn: The specific filter is a Mobile Sub connection filter with same indices as that of this table. The exact filter is a row in ccptapStreamTable of CISCO-CDMA-PDSN-TAP-MIB. mobility: The specific filter is a Mobile Subscriber connection filter with same indices as that of this table. The exact filter is a row in cmtapStreamTable of CISCO-MOBILITY-TAP-MIB.
T/F cTap2StreamInterceptEnable	1.3.6.1.4.1.9.9.399.1.2.1.1.3	TruthValue	read-create	If 'true', the tap should intercept matching traffic. The value for this object should be set to 'true' only after an additional filter specification has been attached to this stream.
C32 cTap2StreamInterceptedPackets	1.3.6.1.4.1.9.9.399.1.2.1.1.4	Counter32	read-only	The number of packets matching this data stream specification that have been intercepted.
C32 cTap2StreamInterceptDrops	1.3.6.1.4.1.9.9.399.1.2.1.1.5	Counter32	read-only	The number of packets matching this data stream specification that, having been intercepted, were dropped in the lawful intercept process.
ROW cTap2StreamStatus	1.3.6.1.4.1.9.9.399.1.2.1.1.6	RowStatus	read-create	The status of this conceptual row. This object manages creation, modification, and deletion of rows in this table. cTap2StreamInterceptEnable may be modified any time even the value of this entry rowStatus object is 'active'. When other rows must be changed, cTap2StreamStatus must be first set to 'notInService'.
C64 cTap2StreamInterceptedHCPackets	1.3.6.1.4.1.9.9.399.1.2.1.1.7	Counter64	read-only	The number of packets matching this data stream specification that have been intercepted. This object is a 64-bit version of cTap2StreamInterceptedPackets.
C64 cTap2StreamInterceptHCDrops	1.3.6.1.4.1.9.9.399.1.2.1.1.8	Counter64	read-only	The number of packets matching this data stream specification that, having been intercepted, were dropped in the lawful intercept process. This object is a 64-bit version of cTap2StreamInterceptDrops.
cTap2DebugGroup	1.3.6.1.4.1.9.9.399.1.3
I32 cTap2DebugAge	1.3.6.1.4.1.9.9.399.1.3.1	Integer32	read-only	This object contains the duration in minutes for which an entry in cTap2DebugTable is maintained by the implementing device after which the entry is deleted. The management station also has the option of deleting the entry itself by setting cTap2DebugStatus.
I32 cTap2DebugMaxEntries	1.3.6.1.4.1.9.9.399.1.3.2	Integer32	read-only	This object contains the maximum number of debug messages maintained by the implementing device at a time. If this limit is crossed, most recent message will replace the least recent message.
cTap2DebugTable	1.3.6.1.4.1.9.9.399.1.3.3		not-accessible	A table that contains Lawful Intercept debug messages generated by the implementing device. This table is used by ciscoTap2MediationDebug and ciscoTap2StreamDebug notifications. An entry in this table contains a debug message which is regarding either a Mediation Device or a intercept stream created by a Mediation Device. The Mediation device is identified by cTap2DebugMediationId whose value is that of cTap2MediationContentId of cTapMediationEntry. The stream is identified by cTap2DebugMediationId and cTap2DebugStreamId whose values are that of cTap2MediationContentId and cTap2StreamIndex of the corresponding cTap2StreamEntry. Note that cTap2DebugStreamId may be zero for an entry, in which case the debug message is regarding a Medation Device. Entries are added to this table via cTap2DebugStatus in accordance with the RowStatus convention.
cTap2DebugEntry	1.3.6.1.4.1.9.9.399.1.3.3.1		not-accessible	A list of the debug messages.
I32 cTap2DebugIndex	1.3.6.1.4.1.9.9.399.1.3.3.1.1	Integer32	not-accessible	Index to the debug table.
U32 cTap2DebugMediationId	1.3.6.1.4.1.9.9.399.1.3.3.1.2	Unsigned32	read-only	The value of this object is that of cTap2MediationContentId identifying an entry in cTap2MediationTable. Note this object may contain a value for which an entry in cTap2MediationTable does not exist. This happens when creation of an entry in cTap2MediationTable fails and this debug message conveys more detailed information regarding the failure.
U32 cTap2DebugStreamId	1.3.6.1.4.1.9.9.399.1.3.3.1.3	Unsigned32	read-only	The value of this object is that of cTap2StreamIndex of an entry in cTap2StreamTable. This object along with cTap2DebugMediationId identifies an entry in cTap2StreamTable. The value of this object may be zero, in which this debug message is regarding a Mediation Device, but not a particular stream. Note this object may contain a value for which an entry in cTap2MediationTable does not exist. This happens when creation of an entry in cTap2StreamTable fails.
STR cTap2DebugMessage	1.3.6.1.4.1.9.9.399.1.3.3.1.4	SnmpAdminString	read-only	A text string contains the debug message.
ROW cTap2DebugStatus	1.3.6.1.4.1.9.9.399.1.3.3.1.5	RowStatus	read-write	The status of this conceptual row. A row in this table is created by the implementing device. A management station cannot modify any of the objects in this row, except deleting the row by setting this object to 'destroy'.
cTap2DebugUserTable	1.3.6.1.4.1.9.9.399.1.3.4		not-accessible	The User Table lists information of all the users configured in the system who are given permission by different Mediation Devices to access Lawful Intercept CLIs. This table will have dependancy on cTap2MediationTable. When entry in cTap2MediationTable is deleted or moved to 'notInService', entries corresponding cTap2MediationContentId in this table will be deleted.
cTap2DebugUserEntry	1.3.6.1.4.1.9.9.399.1.3.4.1		not-accessible	A conceptual row in the cTap2DebugUserTable. Each row represents name of user on the router to whom Mediation Device with CCCid represented by cTap2MediationContentId has given access to Lawful Intercept commands and cTap2DebugUserTimeout represents the time when the entry will expire.
STR cTap2DebugUserName	1.3.6.1.4.1.9.9.399.1.3.4.1.1	SnmpAdminString	not-accessible	A human readable string representing the name of debug user who will have access to Lawful Intercept commands.
DAT cTap2DebugUserTimeout	1.3.6.1.4.1.9.9.399.1.3.4.1.2	DateAndTime	read-create	This object specifies the time at which the row will be removed from the table by the system. The value of this object is only effective when the value of corresponding instance of cTap2DebugUserStatus is 'active'.
STO cTap2DebugUserStorageType	1.3.6.1.4.1.9.9.399.1.3.4.1.3	StorageType	read-create	This object specifies the storage type of this conceptual row. If it is set to 'nonVolatile', this entry can be saved into non-volatile memory.
ROW cTap2DebugUserStatus	1.3.6.1.4.1.9.9.399.1.3.4.1.4	RowStatus	read-create	The status of this conceptual row. This object manages creation, modification, and deletion of rows in this table. cTap2DebugUserTimeout may be modified any time even when the value of this entry rowStatus object is 'active'.
ciscoTap2MIBConform	1.3.6.1.4.1.9.9.399.2
ciscoTap2MIBCompliances	1.3.6.1.4.1.9.9.399.2.1
ciscoTap2MIBCompliance	1.3.6.1.4.1.9.9.399.2.1.1			The compliance statement for entities which implement the Cisco Intercept MIB
ciscoTap2MIBComplianceRev2	1.3.6.1.4.1.9.9.399.2.1.2			The compliance statement for entities which implement the Cisco Intercept MIB. This compliance deprecates ciscoTap2MIBCompliance.
ciscoTap2MIBComplianceRev3	1.3.6.1.4.1.9.9.399.2.1.3			The compliance statement for entities which implement the Cisco Intercept MIB. This compliance deprecates ciscoTap2MIBComplianceRev2.
ciscoTap2MIBGroups	1.3.6.1.4.1.9.9.399.2.2
ciscoTap2MediationComplianceGroup	1.3.6.1.4.1.9.9.399.2.2.1			These objects are necessary for description of the data streams directed to a Mediation Device.
ciscoTap2StreamComplianceGroup	1.3.6.1.4.1.9.9.399.2.2.2			These objects are necessary for a description of the packets to select for interception.
ciscoTap2NotificationGroup	1.3.6.1.4.1.9.9.399.2.2.3			These notifications are used to present status from the intercepting device to the Mediation Device.
ciscoTap2MediationCpbComplianceGroup	1.3.6.1.4.1.9.9.399.2.2.4			These objects are necessary for a description of the mediation device to select for Lawful Intercept.
ciscoTap2DebugComplianceGroup	1.3.6.1.4.1.9.9.399.2.2.5			These objects are necessary for debug information.
ciscoTap2StreamHCStatsGroup	1.3.6.1.4.1.9.9.399.2.2.6			These objects are required for 64 bit version of cTap2StreamInterceptedPackets and cTap2StreamInterceptDrops
ciscoTap2DebugComplianceGroupRev1	1.3.6.1.4.1.9.9.399.2.2.7			These objects are necessary for debug information. This compliance group deprecates ciscoTap2DebugComplianceGroup.

Bits (1)
BIT cTap2MediationCapabilities	1.3.6.1.4.1.9.9.399.1.1.3	Bits	read-only	This object displays the device capabilities with respect to certain fields in Mediation Device table. This may be dependent on hardware capabilities, software capabilities. The following values may be supported: ipV4SrcInterface: SNMP ifIndex Value may be used to select the interface (denoted by cTap2MediationSrcInterface) on the intercepting device from which to transmit intercepted data to an IPv4 address Mediation Device. ipV6SrcInterface: SNMP ifIndex Value may be used to select the interface (denoted by cTap2MediationSrcInterface) on the intercepting device from which to transmit intercepted data to an IPv6 address Mediation Device. udp: UDP may be used as transport protocol (denoted by cTap2MediationTransport) in transferring intercepted data to the Mediation Device. rtcpNack: RTP with Nack resilience may be used as transport protocol (denoted by cTap2MediationTransport) in transferring intercepted data to the Mediation Device. tcp: TCP may be used as transport protocol (denoted by cTap2MediationTransport) in transferring intercepted data to the Mediation Device. sctp: SCTP may be used as transport protocol (denoted by cTap2MediationTransport) in transferring intercepted data to the Mediation Device. rtp: RTP may be used as transport protocol (denoted by cTap2MediationTransport) in transferring intercepted data to the Mediation Device.
Counter32 (2)
C32 cTap2StreamInterceptDrops	1.3.6.1.4.1.9.9.399.1.2.1.1.5	Counter32	read-only	The number of packets matching this data stream specification that, having been intercepted, were dropped in the lawful intercept process.
C32 cTap2StreamInterceptedPackets	1.3.6.1.4.1.9.9.399.1.2.1.1.4	Counter32	read-only	The number of packets matching this data stream specification that have been intercepted.
Counter64 (2)
C64 cTap2StreamInterceptedHCPackets	1.3.6.1.4.1.9.9.399.1.2.1.1.7	Counter64	read-only	The number of packets matching this data stream specification that have been intercepted. This object is a 64-bit version of cTap2StreamInterceptedPackets.
C64 cTap2StreamInterceptHCDrops	1.3.6.1.4.1.9.9.399.1.2.1.1.8	Counter64	read-only	The number of packets matching this data stream specification that, having been intercepted, were dropped in the lawful intercept process. This object is a 64-bit version of cTap2StreamInterceptDrops.
Ctap2Dscp (1)
CTA cTap2MediationDscp	1.3.6.1.4.1.9.9.399.1.1.2.1.7	Ctap2Dscp	read-create	The Differentiated Services Code Point the intercepting device applies to the IP packets encapsulating the intercepted traffic.
DateAndTime (2)
DAT cTap2DebugUserTimeout	1.3.6.1.4.1.9.9.399.1.3.4.1.2	DateAndTime	read-create	This object specifies the time at which the row will be removed from the table by the system. The value of this object is only effective when the value of corresponding instance of cTap2DebugUserStatus is 'active'.
DAT cTap2MediationTimeout	1.3.6.1.4.1.9.9.399.1.1.2.1.10	DateAndTime	read-create	The time at which this row and all related Stream Table rows should be automatically removed, and the intercept function cease. Since the initiating network manager may be the only device able to manage a specific intercept or know of its existence, this acts as a fail-safe for the failure or removal of the network manager. The object is only effective when the value of cTap2MediationStatus is 'active'.
InetAddress (1)
IP cTap2MediationDestAddress	1.3.6.1.4.1.9.9.399.1.1.2.1.3	InetAddress	read-create	The IP Address of the Mediation Device's network interface to which to direct intercepted traffic.
InetAddressType (1)
IPt cTap2MediationDestAddressType	1.3.6.1.4.1.9.9.399.1.1.2.1.2	InetAddressType	read-create	The type of cTap2MediationDestAddress.
InetPortNumber (2)
INE cTap2MediationDestPort	1.3.6.1.4.1.9.9.399.1.1.2.1.4	InetPortNumber	read-create	The port number on the Mediation Device's network interface to which to direct intercepted traffic.
INE cTap2MediationRtcpPort	1.3.6.1.4.1.9.9.399.1.1.2.1.6	InetPortNumber	read-only	The port number on the intercepting device to which the Mediation Devices directs RTCP Receiver Reports and Nacks. This object is only relevant when the value of cTap2MediationTransport is 'rtpNack'. This port is assigned by the intercepting device, rather than by the Mediation Device or manager application. The value of this MIB object has no effect before activating the cTap2MediationEntry.
INTEGER (2)
INT cTap2MediationTransport	1.3.6.1.4.1.9.9.399.1.1.2.1.11	INTEGER	read-create	The protocol used in transferring intercepted data to the Mediation Device. The following protocols may be supported: udp: PacketCable udp format rtpNack: RTP with Nack resilience tcp: TCP with head of line blocking sctp: SCTP with head of line blocking rtp: Realtime Transport Protocol(RTP) packet format
INT cTap2StreamType	1.3.6.1.4.1.9.9.399.1.2.1.1.2	INTEGER	read-create	Identifies the type of intercept filter associated to this generic stream. The following types of streams are supported: ip: The specific filter is an IP filter with same indices as that of this table. The exact filter is a row in citapStreamTable of CISCO-IP-TAP-MIB. mac: The specific filter is a MAC filter with same indices as that of this table. The exact filter is a row in c8tapStreamTable of CISCO-802-TAP-MIB. userConnecton: The specific filter is a user connection filter with same indices as that of this table. The exact filter is a row in cuctTapStreamTable of CISCO-USER-CONNECTION-TAP-MIB. msPdsn: The specific filter is a Mobile Sub connection filter with same indices as that of this table. The exact filter is a row in ccptapStreamTable of CISCO-CDMA-PDSN-TAP-MIB. mobility: The specific filter is a Mobile Subscriber connection filter with same indices as that of this table. The exact filter is a row in cmtapStreamTable of CISCO-MOBILITY-TAP-MIB.
Integer32 (8)
I32 cTap2DebugAge	1.3.6.1.4.1.9.9.399.1.3.1	Integer32	read-only	This object contains the duration in minutes for which an entry in cTap2DebugTable is maintained by the implementing device after which the entry is deleted. The management station also has the option of deleting the entry itself by setting cTap2DebugStatus.
I32 cTap2DebugIndex	1.3.6.1.4.1.9.9.399.1.3.3.1.1	Integer32	not-accessible	Index to the debug table.
I32 cTap2DebugMaxEntries	1.3.6.1.4.1.9.9.399.1.3.2	Integer32	read-only	This object contains the maximum number of debug messages maintained by the implementing device at a time. If this limit is crossed, most recent message will replace the least recent message.
I32 cTap2MediationContentId	1.3.6.1.4.1.9.9.399.1.1.2.1.1	Integer32	not-accessible	cTap2MediationContentId is a session identifier, from the intercept application's perspective, and a content identifier from the Mediation Device's perspective. The Mediation Device is responsible for making sure these are unique, although the SNMP RowStatus row creation process will help by not allowing it to create conflicting entries. Before creating a new entry, a value for this variable may be obtained by reading cTap2MediationNewIndex to reduce the probability of a value collision.
I32 cTap2MediationDataType	1.3.6.1.4.1.9.9.399.1.1.2.1.8	Integer32	read-create	If RTP with Ack/Nack resilience is selected as a transport, the mediation process requires an RTP payload type for data transmissions, and a second RTP payload type for retransmissions. This is the RTP payload type for transmissions. This object is only effective when the value of cTap2MediationTransport is 'rtpNack'.
I32 cTap2MediationNewIndex	1.3.6.1.4.1.9.9.399.1.1.1	Integer32	read-only	This object contains a value which may be used as an index value for a new cTap2MediationEntry. Whenever read, the agent will change the value to a new non-conflicting value. This is to reduce the probability of errors during creation of new cTap2MediationTable entries.
I32 cTap2MediationRetransmitType	1.3.6.1.4.1.9.9.399.1.1.2.1.9	Integer32	read-create	If RTP with Ack/Nack resilience is selected as a transport, the mediation process requires an RTP payload type for data transmissions, and a second RTP payload type for retransmissions. This is the RTP payload type for retransmissions. This object is only effective when the value of cTap2MediationTransport is 'rtpNack'.
I32 cTap2StreamIndex	1.3.6.1.4.1.9.9.399.1.2.1.1.1	Integer32	not-accessible	The index of the stream itself.
InterfaceIndexOrZero (1)
NUM cTap2MediationSrcInterface	1.3.6.1.4.1.9.9.399.1.1.2.1.5	InterfaceIndexOrZero	read-create	The interface on the intercepting device from which to transmit intercepted data. If zero, any interface may be used according to normal IP practice.
RowStatus (4)
ROW cTap2DebugStatus	1.3.6.1.4.1.9.9.399.1.3.3.1.5	RowStatus	read-write	The status of this conceptual row. A row in this table is created by the implementing device. A management station cannot modify any of the objects in this row, except deleting the row by setting this object to 'destroy'.
ROW cTap2DebugUserStatus	1.3.6.1.4.1.9.9.399.1.3.4.1.4	RowStatus	read-create	The status of this conceptual row. This object manages creation, modification, and deletion of rows in this table. cTap2DebugUserTimeout may be modified any time even when the value of this entry rowStatus object is 'active'.
ROW cTap2MediationStatus	1.3.6.1.4.1.9.9.399.1.1.2.1.13	RowStatus	read-create	The status of this conceptual row. This object is used to manage creation, modification and deletion of rows in this table. cTap2MediationTimeout may be modified at any time (even while the row is active). But when the row is active, the other writable objects may not be modified without setting its value to 'notInService'. The entry may not be deleted or deactivated by setting its value to 'destroy' or 'notInService' if there is any associated entry in cTap2StreamTable.
ROW cTap2StreamStatus	1.3.6.1.4.1.9.9.399.1.2.1.1.6	RowStatus	read-create	The status of this conceptual row. This object manages creation, modification, and deletion of rows in this table. cTap2StreamInterceptEnable may be modified any time even the value of this entry rowStatus object is 'active'. When other rows must be changed, cTap2StreamStatus must be first set to 'notInService'.
SnmpAdminString (2)
STR cTap2DebugMessage	1.3.6.1.4.1.9.9.399.1.3.3.1.4	SnmpAdminString	read-only	A text string contains the debug message.
STR cTap2DebugUserName	1.3.6.1.4.1.9.9.399.1.3.4.1.1	SnmpAdminString	not-accessible	A human readable string representing the name of debug user who will have access to Lawful Intercept commands.
StorageType (1)
STO cTap2DebugUserStorageType	1.3.6.1.4.1.9.9.399.1.3.4.1.3	StorageType	read-create	This object specifies the storage type of this conceptual row. If it is set to 'nonVolatile', this entry can be saved into non-volatile memory.
TruthValue (2)
T/F cTap2MediationNotificationEnable	1.3.6.1.4.1.9.9.399.1.1.2.1.12	TruthValue	read-create	This variable controls the generation of any notifications or informs by the MIB agent for this table entry.
T/F cTap2StreamInterceptEnable	1.3.6.1.4.1.9.9.399.1.2.1.1.3	TruthValue	read-create	If 'true', the tap should intercept matching traffic. The value for this object should be set to 'true' only after an additional filter specification has been attached to this stream.
Unsigned32 (2)
U32 cTap2DebugMediationId	1.3.6.1.4.1.9.9.399.1.3.3.1.2	Unsigned32	read-only	The value of this object is that of cTap2MediationContentId identifying an entry in cTap2MediationTable. Note this object may contain a value for which an entry in cTap2MediationTable does not exist. This happens when creation of an entry in cTap2MediationTable fails and this debug message conveys more detailed information regarding the failure.
U32 cTap2DebugStreamId	1.3.6.1.4.1.9.9.399.1.3.3.1.3	Unsigned32	read-only	The value of this object is that of cTap2StreamIndex of an entry in cTap2StreamTable. This object along with cTap2DebugMediationId identifies an entry in cTap2StreamTable. The value of this object may be zero, in which this debug message is regarding a Mediation Device, but not a particular stream. Note this object may contain a value for which an entry in cTap2MediationTable does not exist. This happens when creation of an entry in cTap2StreamTable fails.
No type (32)
ciscoTap2DebugComplianceGroup	1.3.6.1.4.1.9.9.399.2.2.5			These objects are necessary for debug information.
ciscoTap2DebugComplianceGroupRev1	1.3.6.1.4.1.9.9.399.2.2.7			These objects are necessary for debug information. This compliance group deprecates ciscoTap2DebugComplianceGroup.
ciscoTap2MediationComplianceGroup	1.3.6.1.4.1.9.9.399.2.2.1			These objects are necessary for description of the data streams directed to a Mediation Device.
ciscoTap2MediationCpbComplianceGroup	1.3.6.1.4.1.9.9.399.2.2.4			These objects are necessary for a description of the mediation device to select for Lawful Intercept.
NTF ciscoTap2MediationDebug	1.3.6.1.4.1.9.9.399.0.3			When there is intervention needed due to some events related to entries configured in cTap2MediationTable, the device notifies the manager of the event. This notification may be generated in conjunction with the intercept application, which is designed to expect the notification to be sent as reliably as possible, e.g., through the use of a finite number of retransmissions until acknowledged, as and when such mechanisms are available; for example, with SNMPv3, this would be an InformRequest.
NTF ciscoTap2MediationTimedOut	1.3.6.1.4.1.9.9.399.0.2			When an intercept is autonomously removed by an intercepting device, such as due to the time specified in cTap2MediationTimeout arriving, the device notifies the manager of the action.
ciscoTap2MIB	1.3.6.1.4.1.9.9.399			This module manages Cisco's intercept feature. This MIB replaces CISCO-TAP-MIB. This MIB defines a generic stream table that contains fields common to all intercept types. Specific intercept filters are defined in extension MIBs. They are CISCO-IP-TAP-MIB for IP intercepts, CISCO-802-TAP-MIB for IEEE 802 intercepts and CISCO-USER-CONNECTION-TAP-MIB for RADIUS-based user connection intercepts.
NTF ciscoTap2MIBActive	1.3.6.1.4.1.9.9.399.0.1			This Notification is sent when an intercepting router or switch is first capable of intercepting a packet corresponding to a configured data stream. The value of the corresponding cTap2StreamType which identifies the actual intercept stream type is included in this notification. This notification may be generated in conjunction with the intercept application, which is designed to expect the notification to be sent as reliably as possible, e.g., through the use of a finite number of retransmissions until acknowledged, as and when such mechanisms are available; for example, with SNMPv3, this would be an InformRequest. Filter installation can take a long period of time, during which call progress may be delayed.
ciscoTap2MIBCompliance	1.3.6.1.4.1.9.9.399.2.1.1			The compliance statement for entities which implement the Cisco Intercept MIB
ciscoTap2MIBComplianceRev2	1.3.6.1.4.1.9.9.399.2.1.2			The compliance statement for entities which implement the Cisco Intercept MIB. This compliance deprecates ciscoTap2MIBCompliance.
ciscoTap2MIBComplianceRev3	1.3.6.1.4.1.9.9.399.2.1.3			The compliance statement for entities which implement the Cisco Intercept MIB. This compliance deprecates ciscoTap2MIBComplianceRev2.
ciscoTap2MIBCompliances	1.3.6.1.4.1.9.9.399.2.1
ciscoTap2MIBConform	1.3.6.1.4.1.9.9.399.2
ciscoTap2MIBGroups	1.3.6.1.4.1.9.9.399.2.2
ciscoTap2MIBNotifs	1.3.6.1.4.1.9.9.399.0
ciscoTap2MIBObjects	1.3.6.1.4.1.9.9.399.1
ciscoTap2NotificationGroup	1.3.6.1.4.1.9.9.399.2.2.3			These notifications are used to present status from the intercepting device to the Mediation Device.
ciscoTap2StreamComplianceGroup	1.3.6.1.4.1.9.9.399.2.2.2			These objects are necessary for a description of the packets to select for interception.
NTF ciscoTap2StreamDebug	1.3.6.1.4.1.9.9.399.0.4			When there is intervention needed due to some events related to entries configured in cTap2StreamTable, the device notifies the manager of the event. This notification may be generated in conjunction with the intercept application, which is designed to expect the notification to be sent as reliably as possible, e.g., through the use of a finite number of retransmissions until acknowledged, as and when such mechanisms are available; for example, with SNMPv3, this would be an InformRequest.
ciscoTap2StreamHCStatsGroup	1.3.6.1.4.1.9.9.399.2.2.6			These objects are required for 64 bit version of cTap2StreamInterceptedPackets and cTap2StreamInterceptDrops
NTF ciscoTap2Switchover	1.3.6.1.4.1.9.9.399.0.5			This notification is sent when there is a redundant (standby) route processor available on the intercepting device and the current active processor is going down causing standby to takeover. Note that this notification may be sent by the intercepting device only when it had a chance to know before it goes down. Mediation device when received this notification should assume that configured intercepts on the intercepting device no longer exist, when the standby processor takes control. This means that the Mediation device should again configure the intercepts.
cTap2DebugEntry	1.3.6.1.4.1.9.9.399.1.3.3.1		not-accessible	A list of the debug messages.
cTap2DebugGroup	1.3.6.1.4.1.9.9.399.1.3
cTap2DebugTable	1.3.6.1.4.1.9.9.399.1.3.3		not-accessible	A table that contains Lawful Intercept debug messages generated by the implementing device. This table is used by ciscoTap2MediationDebug and ciscoTap2StreamDebug notifications. An entry in this table contains a debug message which is regarding either a Mediation Device or a intercept stream created by a Mediation Device. The Mediation device is identified by cTap2DebugMediationId whose value is that of cTap2MediationContentId of cTapMediationEntry. The stream is identified by cTap2DebugMediationId and cTap2DebugStreamId whose values are that of cTap2MediationContentId and cTap2StreamIndex of the corresponding cTap2StreamEntry. Note that cTap2DebugStreamId may be zero for an entry, in which case the debug message is regarding a Medation Device. Entries are added to this table via cTap2DebugStatus in accordance with the RowStatus convention.
cTap2DebugUserEntry	1.3.6.1.4.1.9.9.399.1.3.4.1		not-accessible	A conceptual row in the cTap2DebugUserTable. Each row represents name of user on the router to whom Mediation Device with CCCid represented by cTap2MediationContentId has given access to Lawful Intercept commands and cTap2DebugUserTimeout represents the time when the entry will expire.
cTap2DebugUserTable	1.3.6.1.4.1.9.9.399.1.3.4		not-accessible	The User Table lists information of all the users configured in the system who are given permission by different Mediation Devices to access Lawful Intercept CLIs. This table will have dependancy on cTap2MediationTable. When entry in cTap2MediationTable is deleted or moved to 'notInService', entries corresponding cTap2MediationContentId in this table will be deleted.
cTap2MediationEntry	1.3.6.1.4.1.9.9.399.1.1.2.1		not-accessible	The entry describes a single session maintained with an application on a Mediation Device.
cTap2MediationGroup	1.3.6.1.4.1.9.9.399.1.1
cTap2MediationTable	1.3.6.1.4.1.9.9.399.1.1.2		not-accessible	This table lists the Mediation Devices with which the intercepting device communicates. These may be on the same or different Mediation Devices. This table is written by the Mediation Device, and is always volatile. This is because intercepts may disappear during a restart of the intercepting equipment. Entries are added to this table via cTap2MediationStatus in accordance with the RowStatus convention.
cTap2StreamEntry	1.3.6.1.4.1.9.9.399.1.2.1.1		not-accessible	A stream entry indicates a single data stream to be intercepted to a Mediation Device. Many selected data streams may go to the same application interface, and many application interfaces are supported.
cTap2StreamGroup	1.3.6.1.4.1.9.9.399.1.2
cTap2StreamTable	1.3.6.1.4.1.9.9.399.1.2.1		not-accessible	The Intercept Stream Table lists the traffic streams to be intercepted. The same data stream may be required by multiple taps, and one might assume that often the intercepted stream is a small subset of the traffic that could be intercepted. The Table consists of generic fields that are independent of the type of intercept. It contains type of the specific filter which is defined in an extension MIB and counters to account for packets intercepted or dropped by the attached filter specification. Note that the Mediation Device must make sure there is only one type of specific filter created with the same indices as that of a row in this table, otherwise the later creations will fail. For example, if there is a row in this table with index 1.2, there can be a corresponding row with the same index either in citapStreamTable, c8tapStreamTable or cuctTapStreamTable, but not all. The first index indicates which Mediation Device the intercepted traffic will be diverted to. The second index permits multiple classifiers to be used together. Entries are added to this table via cTap2StreamStatus in accordance with the RowStatus convention.

RFC description

Cisco Lawful Intercept (TAP2 - Traffic Analysis Points) management for lawful interception.

Start monitoring Cisco ASR 1000 series router (CALEA lawful-intercept) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download CISCO-TAP2-MIB

This MIB depends on

Related MIBs

What Is CISCO-TAP2-MIB?

What Can Be Monitored

Supported Devices

Monitoring Examples

RFC description