CISCOSB-TCPSESSIONS

All MIBs › CISCOSB-TCPSESSIONS

Organization: Cisco Small Business

Last Updated: 2011-05-30

Category: Vendor: RADLAN/Cisco SB

Description: Monitors active TCP session counts and connection state statistics on Cisco Small Business switch platforms.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is CISCOSB-TCPSESSIONS?

CISCOSB-TCPSESSIONS is a Cisco Small Business private MIB extension to standard TCP connection monitoring, exposing a table of active TCP sessions with local/remote address, port, connection state, and an identified application name. It falls into the performance/connection-monitoring category, giving visibility into which TCP conversations are currently open on the device itself (e.g., management or service connections terminating on the switch/router). Its monitoring role is software/service status: an administrator can see how many sessions are open, which remote endpoints are connected, and detect stuck sessions (e.g., stuck in a non-established state) that may indicate a hung service or connectivity issue. It extends the standard TCP-MIB connection table model (tcpConnTable) with additional application-name context. It is used on Cisco Small Business devices to audit and troubleshoot the device's own management and service-layer TCP connections, typically viewed by loading the CISCOSB-TCPSESSIONS MIB Browser to inspect each session's fields.

IPNetwork Monitor allows you to monitor SNMP objects defined in CISCOSB-TCPSESSIONS. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Cisco Small Business switches and routers

Monitoring Examples

An administrator would poll rlTcpSessionTable/rlTcpSessionEntry to list each session's rlTcpSessionLocalAddress/rlTcpSessionLocalPort against rlTcpSessionRemAddress/rlTcpSessionRemPort and rlTcpSessionState, using rlTcpSessionAppName to identify which service (e.g., web management, SSH) owns the connection. A session stuck in a non-established rlTcpSessionState for an extended period from an unexpected remote address could indicate a scanning attempt or a hung management session. Counting sessions per rlTcpSessionAppName helps spot a service leaking connections instead of closing them properly.

What Can Be Monitored

active TCP session count
local/remote address and port per session
TCP connection state
application name per session

Imported Objects

From INET-ADDRESS-MIB

InetAddress
InetAddressType

From SNMPv2-SMI

Integer32
MODULE-IDENTITY
OBJECT-TYPE
Unsigned32
mib-2

From SNMPv2-TC

DisplayString
TEXTUAL-CONVENTION

How to Use in IPNetwork Monitor

Example using rlTcpSessionState OID:

Select a Cisco Small Business switch or router as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type rlTcpSessionState into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. The state of this TCP connection. The only value which may be set by a management station is deleteTCB(12). On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is an INTEGER-type OID, Value bounds is the most useful condition here — trigger an alert if the connection stays in a transitional state (such as synSent or synReceived) for longer than a normal handshake should take, or drops to closed when you expect it to stay established. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
tcp	1.3.6.1.2.1.6			The private MIB module definition for TCP Private Extension.
rlTcpSessionTable	1.3.6.1.2.1.6.16		not-accessible	A table containing TCP sessions information.
rlTcpSessionEntry	1.3.6.1.2.1.6.16.1		not-accessible
IPt rlTcpSessionLocalAddrType	1.3.6.1.2.1.6.16.1.1	InetAddressType	not-accessible	The type of the rlTcpSessionLocalAddress address
IP rlTcpSessionLocalAddress	1.3.6.1.2.1.6.16.1.2	InetAddress	not-accessible	The local IP address for this TCP connection. In the case of a connection in the listen state which is willing to accept connections for any IP interface associated with the node, the value 0.0.0.0 is used.
INT rlTcpSessionLocalPort	1.3.6.1.2.1.6.16.1.3	INTEGER	not-accessible	The local port number for this TCP connection.
IPt rlTcpSessionRemAddrType	1.3.6.1.2.1.6.16.1.4	InetAddressType	not-accessible	The type of the rlTcpSessionRemAddress address
IP rlTcpSessionRemAddress	1.3.6.1.2.1.6.16.1.5	InetAddress	not-accessible	The remote IP address for this TCP connection.
INT rlTcpSessionRemPort	1.3.6.1.2.1.6.16.1.6	INTEGER	not-accessible	The remote port number for this TCP connection.
INT rlTcpSessionStateEx	1.3.6.1.2.1.6.16.1.7	INTEGER	read-write	The state of this TCP connection. The only value which may be set by a management station is deleteTCB(12). Accordingly, it is appropriate for an agent to return a `badValue' response if a management station attempts to set this object to any other value. If a management station sets this object to the value deleteTCB(12), then this has the effect of deleting the TCB (as defined in RFC 793) of the corresponding connection on the managed node, resulting in immediate termination of the connection. As an implementation-specific option, a RST segment may be sent from the managed node to the other TCP endpoint (note however that RST segments are not sent reliably).
STR rlTcpSessionAppName	1.3.6.1.2.1.6.16.1.8	DisplayString	read-only	The name of the application for this TCP connection.

RFC description

TCP session tracking and monitoring for Cisco Small Business devices with connection state and application details.

Start monitoring Cisco Small Business switches and routers with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download CISCOSB-TCPSESSIONS