DOCS-SEC-MIB

All MIBs › DOCS-SEC-MIB

Organization: Cable Television Laboratories, Inc.

Last Updated: 2016-01-13

Category: Domain: CATV/Cable, Domain: Security, Standard: DOCSIS

Description: Manages DOCSIS security features including certificate management, software authentication, and access control.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is DOCS-SEC-MIB?

DOCS-SEC-MIB manages DOCSIS security features on cable systems, covering certificate management, TFTP-based configuration file security, software/code authentication, and access control lists for cable modems at the CMTS. It exposes configuration objects for server-side certificate and encryption policy (e.g., TFTP options, config-file learning, encryption algorithm priority) as well as per-modem tables for authentication exclusion and Secure Access Verification (SAV) authorization. Its monitoring value is centered on software/security status: administrators can confirm which cable modems are excluded from Early Authentication and Encryption (EAE), track SAV authentication state per modem, and verify encryption policy settings are correctly applied fleet-wide. It works alongside the broader DOCSIS security framework including DOCS-IETF-BPI2-MIB and its BPI2EXT extension. It is deployed at the CMTS headend in DOCSIS cable access networks enforcing modem authentication and provisioning security, making this DOCS-SEC-MIB reference essential reading for CMTS security administrators.

IPNetwork Monitor allows you to monitor SNMP objects defined in DOCS-SEC-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

DOCSIS CMTS (cable modem termination system)
DOCSIS cable modem

Monitoring Examples

An operator would poll docsSecCmtsCmEaeExclusionTable/docsSecCmtsCmEaeExclusionEntry, keyed by docsSecCmtsCmEaeExclusionMacAddr, to confirm which modems are intentionally excluded from EAE and check docsSecCmtsCmEaeExclusionRowStatus for active entries, and query docsSecSavCmAuthTable/docsSecSavCmAuthEntry alongside docsSecCmtsSavControlCmAuthEnable to verify SAV authentication is enabled and functioning for a given modem. A modem unexpectedly appearing in the EAE exclusion table, or SAV authentication failing when docsSecCmtsSavControlCmAuthEnable is set, would flag a security policy misconfiguration or a spoofing/rogue-modem concern. docsSecCmtsServerCfgTftpOptions and docsSecCmtsEncryptEncryptAlgPriority round out the picture of server-side security configuration being enforced.

What Can Be Monitored

EAE exclusion list per modem
SAV authentication status
encryption algorithm priority
TFTP configuration security options
config-file learning enable state

Imported Objects

From CLAB-DEF-MIB

clabProjDocsis

OBJECT-IDENTITY

From DOCS-IETF-BPI2-MIB

docsBpi2CodeDownloadControl

OBJECT-IDENTITY

From DOCS-IF3-MIB

docsIf3CmtsCmRegStatusEntry	OBJECT-TYPE
docsIf3CmtsCmRegStatusId	OBJECT-TYPE

From INET-ADDRESS-MIB

InetAddress
InetAddressPrefixLength
InetAddressType

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMP-TARGET-MIB

SnmpTagList

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Counter32
MODULE-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DateAndTime
MacAddress
RowStatus
TEXTUAL-CONVENTION
TruthValue

How to Use in IPNetwork Monitor

Example using docsSecCmtsCmSavStatsSavDiscards OID:

Select a DOCSIS CMTS/cable modem (security: certificates/TFTP/EAE, vendor-neutral CableLabs standard) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type docsSecCmtsCmSavStatsSavDiscards into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. This attribute provides the information about number of dropped upstream packets due to SAV failure. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases between polls, since a rising count of errors, failures, or discards often points to a real underlying problem. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
DOC docsBpi2CodeUpdateCvcChain	1.3.6.1.2.1.126.1.4.10	DocsCvcCaCertificateChain	read-write	The value of this object is a degenerate PKCS7 signedData structure that contains the CVC and the CVC CA certificate chain in the certificates field. Setting this object triggers the device to verify the CVC and update the cvcAccessStart values. The content of this object is then discarded. If the device is not enabled to upgrade codefiles, or if the CVC verification fails, the CVC will be rejected. Reading this object always returns the zero-length OCTET STRING.
docsSecMib	1.3.6.1.4.1.4491.2.1.11			This MIB module contains the management objects for the management of the security requirements in the DOCSIS Security Specification.
docsSecMibObjects	1.3.6.1.4.1.4491.2.1.11.1
docsSecCmtsServerCfg	1.3.6.1.4.1.4491.2.1.11.1.1
BIT docsSecCmtsServerCfgTftpOptions	1.3.6.1.4.1.4491.2.1.11.1.1.1	Bits	read-write	This attribute instructs the CMTS to insert the source IP address and/or MAC address of received TFTP packets into the TFTP option fields before forwarding the packets to the Config File server. This attribute is only applicable when the TftpProxyEnabled attribute of the MdCfg object is 'true'.
T/F docsSecCmtsServerCfgConfigFileLearningEnable	1.3.6.1.4.1.4491.2.1.11.1.1.2	TruthValue	read-write	This attribute enables and disables Configuration File Learning functionality. If this attribute is set to 'true' the CMTS will respond with Authentication Failure in the REG-RSP message when there is a mismatch between learned config file parameters and REG-REQ parameters. If this attribute is set to 'false', the CMTS will not execute config file learning and mismatch check. This attribute is only applicable when the TftpProxyEnabled attribute of the MdCfg object is 'true'.
docsSecCmtsEncrypt	1.3.6.1.4.1.4491.2.1.11.1.2
SNM docsSecCmtsEncryptEncryptAlgPriority	1.3.6.1.4.1.4491.2.1.11.1.2.1	SnmpTagList	read-write	This attribute allows for configuration of a prioritized list of encryption algorithms the CMTS will use when selecting the primary SAID encryption algorithm for a given CM. The CMTS selects the highest priority encryption algorithm from this list that the CM supports. By default the following encryption algorithms are listed from highest to lowest priority (left being the highest): 128 bit AES, 56 bit DES, 40 bit DES. An empty list indicates that the CMTS attempts to use the latest and robust encryption algorithm supported by the CM. The CMTS will ignore unknown values or unsupported algorithms.
docsSecCmtsCmEaeExclusionTable	1.3.6.1.4.1.4491.2.1.11.1.3		not-accessible	This object defines a list of CMs or CM groups to exclude from Early Authentication and Encryption (EAE). This object allows overrides to the value of EAE Control for individual CMs or group of CMs for purposes such as debugging. The CMTS supports a minimum of 30 instances of the CmtsCmEaeExclusion object. This object is only applicable when the EarlyAuthEncryptCtrl attribute of the MdCfg object is enabled. This object supports the creation and deletion of multiple instances.
docsSecCmtsCmEaeExclusionEntry	1.3.6.1.4.1.4491.2.1.11.1.3.1		not-accessible	The conceptual row of docsSecCmtsCmEaeExclusion. The CMTS persists all instances of CmtsCmEaeExclusion across reinitializations.
U32 docsSecCmtsCmEaeExclusionId	1.3.6.1.4.1.4491.2.1.11.1.3.1.1	Unsigned32	not-accessible	This key uniquely identifies the exclusion MAC address rule.
MAC docsSecCmtsCmEaeExclusionMacAddr	1.3.6.1.4.1.4491.2.1.11.1.3.1.2	MacAddress	read-create	This attribute identifies the CM MAC address. A match is made when a CM MAC address bitwise ANDed with the MacAddrMask attribute equals the value of this attribute.
MAC docsSecCmtsCmEaeExclusionMacAddrMask	1.3.6.1.4.1.4491.2.1.11.1.3.1.3	MacAddress	read-create	This attribute identifies the CM MAC address mask and is used with the MacAddr attribute.
ROW docsSecCmtsCmEaeExclusionRowStatus	1.3.6.1.4.1.4491.2.1.11.1.3.1.4	RowStatus	read-create	Controls and reflects the status of rows in this table. There is no restriction on changing values in a row of this table while the row is active.
docsSecCmtsSavControl	1.3.6.1.4.1.4491.2.1.11.1.4
T/F docsSecCmtsSavControlCmAuthEnable	1.3.6.1.4.1.4491.2.1.11.1.4.1	TruthValue	read-write	This attribute enables or disables Source Address Verification (SAV) for CM configured policies in the SavCmAuth object. If this attribute is set to 'false', the CM configured policies in the SavCmAuth object are ignored. This attribute is only applicable when the SrcAddrVerificationEnabled attribute of the MdCfg object is 'true'.
docsSecSavCmAuthTable	1.3.6.1.4.1.4491.2.1.11.1.5		not-accessible	This object defines a read-only set of SAV policies associated with a CM that the CMTS will use in addition to the CMTS verification of an operator assigned IP Address being associated with a CM. When the CMTS has not resolved a source address of a CM CPE, the CMTS verifies if the CM CPE is authorized to pass traffic based on this object. These object policies include a list of subnet prefixes (defined in the SavStaticList object) or a SAV Group Name that could reference a CMTS configured list of subnet prefixes (defined in SavCfgList object) or vendor-specific policies. The CMTS populates the attributes of this object for a CM from that CM's config file. This object is only applicable when the SrcAddrVerificationEnabled attribute of the MdCfg object is 'true' and the CmAuthEnable attribute of the CmtsSavCtrl object is 'true'. The CMTS is not required to persist instances of this object across reinitializations.
docsSecSavCmAuthEntry	1.3.6.1.4.1.4491.2.1.11.1.5.1		not-accessible	The conceptual row of docsSecSavCmAuth.
STR docsSecSavCmAuthGrpName	1.3.6.1.4.1.4491.2.1.11.1.5.1.1	SnmpAdminString	read-only	This attribute references the Name attribute of the SavCfgList object of a CM. If the CM signaled group name is not configured in the CMTS, the CMTS ignores this attribute value for the purpose of Source Address Verification. The CMTS must allow the modification of the GrpName object and use the updated SAV rules for newly discovered CPEs from CMs. When a source IP address is claimed by two CMs (e.g., detected as duplicated), the CMTS must use the current SAV rules defined for both CMs in case the SAV GrpName rules may have been updated. In the case of a persisting conflict, it is up to vendor-implementation to decide what CM should hold the SAV authorization. The zero-length string indicates that no SAV Group was signaled by the CM. The zero-length value or a non-existing reference in the SavCfgList object means the SavCfgListName is ignored for the purpose of SAV.
U32 docsSecSavCmAuthStaticPrefixListId	1.3.6.1.4.1.4491.2.1.11.1.5.1.2	Unsigned32	read-only	This attribute identifies the reference to a CMTS created subnet prefix list based on the CM signaled static prefix list TLV elements. The CMTS may reuse this attribute value to reference more than one CM when those CMs have signaled the same subnet prefix list to the CMTS. The value zero indicates that no SAV static prefix encodings were signaled by the CM.
docsSecSavCfgListTable	1.3.6.1.4.1.4491.2.1.11.1.6		not-accessible	This object defines the CMTS configured subnet prefix extension to the SavCmAuth object. This object supports the creation and deletion of multiple instances. Creation of a new instance of this object requires the PrefixAddrType and PrefixAddr attributes to be set.
docsSecSavCfgListEntry	1.3.6.1.4.1.4491.2.1.11.1.6.1		not-accessible	The conceptual row of docsSecSavCfgList. The CMTS persists all instances of SavCfgList across reinitializations.
STR docsSecSavCfgListName	1.3.6.1.4.1.4491.2.1.11.1.6.1.1	SnmpAdminString	not-accessible	This attribute is the key that identifies the instance of the SavCmAuth object to which this object extension belongs.
U32 docsSecSavCfgListRuleId	1.3.6.1.4.1.4491.2.1.11.1.6.1.2	Unsigned32	not-accessible	This attribute is the key that identifies a particular subnet prefix rule of an instance of this object.
IPt docsSecSavCfgListPrefixAddrType	1.3.6.1.4.1.4491.2.1.11.1.6.1.3	InetAddressType	read-create	This attribute identifies the IP address type of this subnet prefix rule.
IP docsSecSavCfgListPrefixAddr	1.3.6.1.4.1.4491.2.1.11.1.6.1.4	InetAddress	read-create	This attribute corresponds to the IP address of this subnet prefix rule in accordance to the PrefixAddrType attribute.
ADR docsSecSavCfgListPrefixLen	1.3.6.1.4.1.4491.2.1.11.1.6.1.5	InetAddressPrefixLength	read-create	This attribute defines the length of the subnet prefix to be matched by this rule.
ROW docsSecSavCfgListRowStatus	1.3.6.1.4.1.4491.2.1.11.1.6.1.6	RowStatus	read-create	The row creation control of this conceptual row. An entry in this table can be set to active only when the following attributes are correctly assigned: PrefixAddrType PrefixAddress There are no restrictions to modify or delete entries in this table.
docsSecSavStaticListTable	1.3.6.1.4.1.4491.2.1.11.1.7		not-accessible	This object defines a subnet prefix extension to the SavCmAuth object based on CM statically signaled subnet prefixes to the CMTS. When a CM signals to the CMTS static subnet prefixes, the CMTS must create a List Id to be referenced by the CM in the SavCmAuth StaticPrefixListId attribute, or the CMTS may reference an existing List Id associated to previously registered CMs in case of those subnet prefixes associated with the List Id match the ones signaled by the CM.
docsSecSavStaticListEntry	1.3.6.1.4.1.4491.2.1.11.1.7.1		not-accessible	The conceptual row of docsSecSavStaticList. The CMTS may persist instances of this object across reinitializations.
U32 docsSecSavStaticListId	1.3.6.1.4.1.4491.2.1.11.1.7.1.1	Unsigned32	not-accessible	This key uniquely identifies the index that groups multiple subnet prefix rules. The CMTS assigns this value per CM or may reuse it among multiple CMs that share the same list of subnet prefixes.
U32 docsSecSavStaticListRuleId	1.3.6.1.4.1.4491.2.1.11.1.7.1.2	Unsigned32	not-accessible	This key identifies a particular static subnet prefix rule of an instance of this object.
IPt docsSecSavStaticListPrefixAddrType	1.3.6.1.4.1.4491.2.1.11.1.7.1.3	InetAddressType	read-only	This attribute identifies the IP address type of this subnet prefix rule.
IP docsSecSavStaticListPrefixAddr	1.3.6.1.4.1.4491.2.1.11.1.7.1.4	InetAddress	read-only	This attribute corresponds to the IP address of this subnet prefix rule in accordance to the PrefixAddrType attribute.
ADR docsSecSavStaticListPrefixLen	1.3.6.1.4.1.4491.2.1.11.1.7.1.5	InetAddressPrefixLength	read-only	This attribute defines the length of the subnet prefix to be matched by this rule.
docsSecCmtsCmSavStatsTable	1.3.6.1.4.1.4491.2.1.11.1.8		not-accessible	This object provides a read-only list of SAV counters for different service theft indications.
docsSecCmtsCmSavStatsEntry	1.3.6.1.4.1.4491.2.1.11.1.8.1		not-accessible	The conceptual row of docsSecCmtsCmSavStats.
C32 docsSecCmtsCmSavStatsSavDiscardsEx	1.3.6.1.4.1.4491.2.1.11.1.8.1.1	Counter32	read-only	This attribute provides the information about number of dropped upstream packets due to SAV failure.
docsSecCmtsCertificate	1.3.6.1.4.1.4491.2.1.11.1.9
INT docsSecCmtsCertificateCertRevocationMethod	1.3.6.1.4.1.4491.2.1.11.1.9.1	INTEGER	read-write	This attribute identifies which certificate revocation method is to be used by the CMTS to verify the cable modem certificate validity. The certificate revocation methods include Certification Revocation List (CRL) and Online Certificate Status Protocol (OCSP). The following options are available: The option 'none' indicates that the CMTS does not attempt to determine the revocation status of a certificate. The option 'crl' indicates the CMTS uses a Certificate Revocation List (CRL) as defined by the Url attribute of the CmtsCertRevocationList object. When the value of this attribute is changed to 'crl', it triggers the CMTS to retrieve the CRL from the URL specified by the Url attribute. If the value of this attribute is 'crl' when the CMTS starts up, it triggers the CMTS to retrieve the CRL from the URL specified by the Url attribute. The option 'ocsp' indicates the CMTS uses the Online Certificate Status Protocol (OCSP) as defined by the Url attribute of the CmtsOnlineCertStatusProtocol object. The option 'crlAndOcsp' indicates the CMTS uses both the CRL as defined by the Url attribute in the CmtsCertRevocationList object and OCSP as defined by the Url attribute in the CmtsOnlineCertStatusProtocol object. The CMTS persists the values of the CertRevocationMethod attribute across reinitializations.
docsSecCmtsCertRevocationList	1.3.6.1.4.1.4491.2.1.11.1.10
STR docsSecCmtsCertRevocationListUrl	1.3.6.1.4.1.4491.2.1.11.1.10.1	SnmpAdminString	read-write	This attribute contains the URL from where the CMTS will retrieve the CRL. When this attribute is set to a URL value different from the current value, it triggers the CMTS to retrieve the CRL from that URL. If the value of this attribute is a zero-length string, the CMTS does not attempt to retrieve the CRL. The CMTS persists the value of Url across reinitializations.
U32 docsSecCmtsCertRevocationListRefreshInterval	1.3.6.1.4.1.4491.2.1.11.1.10.2	Unsigned32	read-write	This attribute contains the refresh interval for the CMTS to retrieve the CRL (referred to in the Url attribute) with the purpose of updating its Certificate Revocation List. This attribute is meaningful if the tbsCertList.nextUpdate attribute does not exist in the last retrieved CRL, otherwise the value 0 is returned. The CMTS persists the value of RefreshInterval across reinitializations.
DAT docsSecCmtsCertRevocationListLastUpdate	1.3.6.1.4.1.4491.2.1.11.1.10.3	DateAndTime	read-only	This attribute contains the last date and time when the CRL was retrieved by the CMTS. If the CRL has not been updated, then this variable shall have the value corresponding to January 1, year 0000, 00:00:00.0, which is encoded as (hex)'00 00 01 01 00 00 00 00'.
docsSecCmtsOnlineCertStatusProtocol	1.3.6.1.4.1.4491.2.1.11.1.11
STR docsSecCmtsOnlineCertStatusProtocolUrl	1.3.6.1.4.1.4491.2.1.11.1.11.1	SnmpAdminString	read-write	This attribute contains the URL string to retrieve OCSP information. If the value of this attribute is a zero-length string, the CMTS does not attempt to request the status of a CM certificate. The CMTS persists the value of Url across reinitializations.
T/F docsSecCmtsOnlineCertStatusProtocolSignatureBypass	1.3.6.1.4.1.4491.2.1.11.1.11.2	TruthValue	read-write	This attribute enables or disables signature checking on OCSP response messages. The CMTS persists the value of SignatureBypass across reinitializations.
docsSecCmtsCmBpi2EnforceExclusionTable	1.3.6.1.4.1.4491.2.1.11.1.12		not-accessible	This object defines a list of CMs or CM groups to exclude from BPI+ enforcement policies configured within the CMTS. This object allows overrides to the value of BPI+ enforcement control for individual CMs or group of CMs for purposes such as debugging. The CMTS supports a minimum of 30 instances of the CmtsCmBpi2EnforceExclusion object. This object supports the creation and deletion of multiple instances.
docsSecCmtsCmBpi2EnforceExclusionEntry	1.3.6.1.4.1.4491.2.1.11.1.12.1		not-accessible	The conceptual row of docsSecCmtsCmBpi2EnforceExclusion. The CMTS persists all instances of CmtsCmBpi2EnforceExclusion across reinitializations.
U32 docsSecCmtsCmBpi2EnforceExclusionId	1.3.6.1.4.1.4491.2.1.11.1.12.1.1	Unsigned32	not-accessible	This key uniquely identifies the exclusion MAC address rule.
MAC docsSecCmtsCmBpi2EnforceExclusionMacAddr	1.3.6.1.4.1.4491.2.1.11.1.12.1.2	MacAddress	read-create	This attribute identifies the CM MAC address. A match is made when a CM MAC address bitwise ANDed with the MacAddrMask attribute equals the value of this attribute.
MAC docsSecCmtsCmBpi2EnforceExclusionMacAddrMask	1.3.6.1.4.1.4491.2.1.11.1.12.1.3	MacAddress	read-create	This attribute identifies the CM MAC address mask and is used with the MacAddr attribute.
ROW docsSecCmtsCmBpi2EnforceExclusionRowStatus	1.3.6.1.4.1.4491.2.1.11.1.12.1.4	RowStatus	read-create	Controls and reflects the status of rows in this table. There is no restriction on changing values in a row of this table while the row is active.
docsSecMibConformance	1.3.6.1.4.1.4491.2.1.11.2
docsSecMibCompliances	1.3.6.1.4.1.4491.2.1.11.2.1
docsSecCompliance	1.3.6.1.4.1.4491.2.1.11.2.1.1			The compliance statement for CMTSs that implement the DOCSIS Security MIB.
docsSecCmCompliance	1.3.6.1.4.1.4491.2.1.11.2.1.2			The compliance statement for CMs that implement the DOCSIS Security MIB.
docsSecMibGroups	1.3.6.1.4.1.4491.2.1.11.2.2
docsSecGroup	1.3.6.1.4.1.4491.2.1.11.2.2.1			Group of objects implemented in the CMTS.
docsSecCmGroup	1.3.6.1.4.1.4491.2.1.11.2.2.2			Group of objects implemented in the CM.

RFC description

DOCSIS security management MIB for cable modems and termination systems, handling authentication and encryption management.

Start monitoring DOCSIS CMTS/cable modem (security: certificates/TFTP/EAE, vendor-neutral CableLabs standard) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download DOCS-SEC-MIB