SNMP-TSM-MIB

All MIBs › SNMP-TSM-MIB

Organization: ISMS Working Group

Last Updated: 2009-06-09

Category: SNMP Framework

Description: Defines objects for the Transport Security Model, providing authentication and encryption of SNMP messages by leveraging external secure transport protocols.

IPNetwork Monitor uses several OIDs from this MIB in network discovery and polling the applicable devices. Start monitoring SNMP-TSM-MIB with a free 30-day trial of IPNetwork Monitor.

What Is SNMP-TSM-MIB?

SNMP-TSM-MIB defines the Transport Security Model (TSM) for SNMPv3, a vendor-neutral IETF standard (RFC 5591) that lets SNMP messages be authenticated and encrypted by delegating to an underlying secure transport protocol such as SSH or TLS, rather than SNMP's own USM cryptography. It exposes statistics and configuration objects covering invalid security-related caches, inadequate security-level attempts, and unknown/invalid transport prefix usage, along with notification objects for related security events. Its monitoring role is squarely software/security-status oriented: it lets an operator detect misconfigured or malicious SNMP access attempts, such as messages received with insufficient security levels or referencing invalid security caches, pointing to either a security misconfiguration or a probing/attack attempt against the SNMP agent. It is explicitly designed as a self-contained companion to the SNMPv3 framework (RFC 3411) and works alongside whatever secure transport (SSH, TLS/DTLS) is actually carrying the messages. It is deployed on any SNMPv3 agent/manager pair configured to use transport-based security instead of, or alongside, the traditional User-based Security Model. Engineers can download the SNMP-TSM-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in SNMP-TSM-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

vendor-neutral, standards-based MIB, not tied to a specific manufacturer
SNMPv3 agents/managers using transport-based security (SSH/TLS)

Monitoring Examples

An administrator would poll snmpTsmInvalidCaches and snmpTsmInadequateSecurityLevels to see how many incoming SNMP requests failed transport-security checks, and check snmpTsmUnknownPrefixes/snmpTsmInvalidPrefixes to detect misconfigured transport-prefix mappings. A steady increase in snmpTsmInadequateSecurityLevels would indicate a client attempting to communicate at a lower security level than the agent requires, a sign of misconfiguration or a potential downgrade attack. The snmpTsmNotifications group can also alert in real time when such security violations occur.

What Can Be Monitored

invalid security cache count
inadequate security level attempts
unknown transport prefixes
invalid transport prefixes
security-related trap notifications

Imported Objects

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Counter32
MODULE-IDENTITY
OBJECT-TYPE
mib-2

From SNMPv2-TC

TruthValue

How to Use in IPNetwork Monitor

Example using snmpTsmInvalidCaches OID:

Select a device implementing SNMP-TSM-MIB as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type snmpTsmInvalidCaches into the Find box to locate it in the OID tree, then select it and click OK. The number of incoming messages dropped because the tmStateReference referred to an invalid cache. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases between polls, since a rising count of errors, failures, or discards often points to a real underlying problem. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
snmpTsmMIB	1.3.6.1.2.1.190			The Transport Security Model MIB. In keeping with the RFC 3411 design decisions to use self-contained documents, the RFC that contains the definition of this MIB module also includes the elements of procedure that are needed for processing the Transport Security Model for SNMP. These MIB objects SHOULD NOT be modified via other subsystems or models defined in other documents. This allows the Transport Security Model for SNMP to be designed and documented as independent and self-contained, having no direct impact on other modules, and this allows this module to be upgraded and supplemented as the need arises, and to move along the standards track on different time-lines from other modules. Copyright (c) 2009 IETF Trust and the persons identified as authors of the code. All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: - Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. - Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. - Neither the name of Internet Society, IETF or IETF Trust, nor the names of specific contributors, may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 'AS IS' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. This version of this MIB module is part of RFC 5591; see the RFC itself for full legal notices.
snmpTsmNotifications	1.3.6.1.2.1.190.0
snmpTsmMIBObjects	1.3.6.1.2.1.190.1
snmpTsmStats	1.3.6.1.2.1.190.1.1
C32 snmpTsmInvalidCachesEx	1.3.6.1.2.1.190.1.1.1	Counter32	read-only	The number of incoming messages dropped because the tmStateReference referred to an invalid cache.
C32 snmpTsmInadequateSecurityLevels	1.3.6.1.2.1.190.1.1.2	Counter32	read-only	The number of incoming messages dropped because the securityLevel asserted by the Transport Model was less than the securityLevel requested by the application.
C32 snmpTsmUnknownPrefixes	1.3.6.1.2.1.190.1.1.3	Counter32	read-only	The number of messages dropped because snmpTsmConfigurationUsePrefix was set to true and there is no known prefix for the specified transport domain.
C32 snmpTsmInvalidPrefixes	1.3.6.1.2.1.190.1.1.4	Counter32	read-only	The number of messages dropped because the securityName associated with an outgoing message did not contain a valid transport domain prefix.
snmpTsmConfiguration	1.3.6.1.2.1.190.1.2
T/F snmpTsmConfigurationUsePrefix	1.3.6.1.2.1.190.1.2.1	TruthValue	read-write	If this object is set to true, then securityNames passing to and from the application are expected to contain a transport-domain-specific prefix. If this object is set to true, then a domain-specific prefix will be added by the TSM to the securityName for incoming messages and removed from the securityName when processing outgoing messages. Transport domains and prefixes are maintained in a registry by IANA. This object SHOULD persist across system reboots.
snmpTsmConformance	1.3.6.1.2.1.190.2
snmpTsmCompliances	1.3.6.1.2.1.190.2.1
snmpTsmCompliance	1.3.6.1.2.1.190.2.1.1			The compliance statement for SNMP engines that support the SNMP-TSM-MIB.
snmpTsmGroups	1.3.6.1.2.1.190.2.2
snmpTsmGroup	1.3.6.1.2.1.190.2.2.2			A collection of objects for maintaining information of an SNMP engine that implements the SNMP Transport Security Model.

RFC description

Transport Security Model MIB defining SNMP security processing procedures and transport-layer security mechanisms.

Start monitoring vendor-neutral, standards-based MIB, SNMPv3 agents/managers using transport-based security, SSH/TLS (security-event statistics) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download SNMP-TSM-MIB