CISCO-USER-CONNECTION-TAP-MIB

All MIBs › CISCO-USER-CONNECTION-TAP-MIB

Organization: Cisco Systems, Inc.

Last Updated: 2007-08-09

Category: Cisco Devices, VPN and Security

Description: Manages lawful intercept taps for user connections enabling court-ordered monitoring of network sessions.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is CISCO-USER-CONNECTION-TAP-MIB?

This MIB supports Cisco's lawful intercept infrastructure, specifically managing intercept (tap) configuration for individual user connections/sessions, working alongside CISCO-TAP2-MIB which provides the common intercept stream framework. It exposes objects for defining tap stream filters, matched by accounting session ID, and their status/capabilities, enabling court-ordered monitoring of specific user network sessions. It is a security/compliance-oriented MIB rather than a hardware/performance one, as its monitoring purpose is to track whether a lawful intercept tap for a given user session is correctly configured and active via row status, not general device health. It explicitly depends on CISCO-TAP2-MIB for the underlying common stream mechanism and replaces the older CISCO-TAP-MIB alongside other filter-specific MIBs. It is deployed on Cisco service provider edge/aggregation routers and gateways that support regulatory lawful intercept requirements. Engineers can download the CISCO-USER-CONNECTION-TAP-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in CISCO-USER-CONNECTION-TAP-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Cisco service provider edge routers
Cisco broadband/aggregation gateways

Monitoring Examples

A lawful intercept administrator would create a cuctTapStreamEntry in cuctTapStreamTable, setting cuctTapStreamAcctSessID to match a specific user's accounting session and cuctTapStreamStatus to activate the row. The corresponding entry in CISCO-TAP2-MIB's cTap2StreamEntry would tie this to the common intercept stream infrastructure that actually captures and encodes packets, per cuctTapStreamEncodePacket. This MIB is used strictly for compliance/legal-intercept configuration status, not general traffic monitoring.

What Can Be Monitored

tap stream configuration status (row status)
matched accounting session ID
packet encoding mode for intercepted stream
tap stream capabilities

Imported Objects

From CISCO-SMI

ciscoMgmt

OBJECT-IDENTITY

From CISCO-TAP2-MIB

cTap2MediationContentId	OBJECT-TYPE
cTap2StreamIndex	OBJECT-TYPE

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

MODULE-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

RowStatus

OIDs

OID symbolic	OID numeric	Type	Access	Description
ciscoUserConnectionTapMIB	1.3.6.1.4.1.9.9.400			This module manages Cisco's intercept feature for user connections. This MIB is used along with CISCO-TAP2-MIB to intercept user traffic. CISCO-TAP2-MIB along with specific filter MIBs like this MIB replace CISCO-TAP-MIB. To create an user connection intercept, an entry cuctTapStreamEntry is created which contains the filter details. An entry cTap2StreamEntry of CISCO-TAP2-MIB is created, which is the common stream information for all kinds of intercepts and type of the specific stream is set to userconnection in this entry.
cUserConnectionTapMIBObjects	1.3.6.1.4.1.9.9.400.1
cuctTapStreamEncodePacket	1.3.6.1.4.1.9.9.400.1.1
BIT cuctTapStreamCapabilities	1.3.6.1.4.1.9.9.400.1.1.1	Bits	read-only	This object displays the types of intercepts supported on this device. This may be dependent on hardware capabilities or software capabilities. The value of this object is non zero, if the device supports interception of user connection traffic. A device may support both types of intercepts at the same time. The following fields may be supported: acctSessonId: packets belonging to a user connection identified by RADIUS attribute account-session-ID may be intercepted. tapEnable: set if table entries with cTap2StreamInterceptEnable set to 'false' are used to pre-screen packets for intercept; otherwise these entries are ignored.
cuctTapStreamTable	1.3.6.1.4.1.9.9.400.1.1.2		not-accessible	The Intercept Stream Connection Table lists the user connections (sessions) to be intercepted. The same data stream may be required by multiple taps, and one might assume that often the intercepted stream is a small subset of the traffic that could be intercepted. This essentially provides options for packet selection. The only option available is RADIUS attribute 44, account session ID. When a user tries to use a service provided by a Network Access Server(NAS) such as PPP, NAS authenticates the user with RADIUS server. Upon successful authentication of the user, the user is provided with the requested service and NAS creates an accounting record with RADIUS accounting server for the user. The NAS assigns a unique account session id for the user session in the accounting record created with the RADIUS server. The account session ID may be used to intercept traffic belonging to the user session. The value of first index is that of an entry in the cTap2MediationTable, which identifies the application to which intercepted traffic will be sent to. The second index permits connection classifiers to be used to identify traffic to be intercepted. The value of the second index is that of the stream's counter entry in the cTap2StreamTable.
cuctTapStreamEntry	1.3.6.1.4.1.9.9.400.1.1.2.1		not-accessible	A stream entry indicates a single data stream to be intercepted to a Mediation Device. Many selected data streams may go to the same application interface, and many application interfaces are supported.
U32 cuctTapStreamAcctSessID	1.3.6.1.4.1.9.9.400.1.1.2.1.1	Unsigned32	read-create	This is the RADIUS attribute 44 acct-session-ID. It identifies a user connection. It is used to specify a user connection to intercept.
ROW cuctTapStreamStatus	1.3.6.1.4.1.9.9.400.1.1.2.1.2	RowStatus	read-create	The status of this conceptual row. This object manages creation, modification, and deletion of rows in this table. When any rows must be changed, cuctTapStreamStatus must be first set to 'notInService'.
cUserConnectionTapMIBConform	1.3.6.1.4.1.9.9.400.2
cUserConnectionTapMIBCompliances	1.3.6.1.4.1.9.9.400.2.1
cUserConnectionTapMIBCompliance	1.3.6.1.4.1.9.9.400.2.1.1			The compliance statement for entities which implement the Cisco Intercept MIB for user connections.
cUserConnectionTapMIBGroups	1.3.6.1.4.1.9.9.400.2.2
cuctTapStreamComplianceGroup	1.3.6.1.4.1.9.9.400.2.2.1			These objects are necessary for a description of user traffic packets to select for interception.

RFC description

Manages Cisco intercept feature for user connections; extends CISCO-TAP2-MIB for traffic filtering.

Start monitoring Cisco service provider edge routers (lawful intercept) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download CISCO-USER-CONNECTION-TAP-MIB

What Is CISCO-USER-CONNECTION-TAP-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description