SNMPv2-USEC-MIB

All MIBs › SNMPv2-USEC-MIB

Organization: IETF SNMPv2 Working Group

Last Updated: 1996-01-12

Category: SNMP Framework

Description: Defines managed objects for the SNMPv2 user-based security model, including agent boot counters and time synchronization for replay protection.

IPNetwork Monitor uses several OIDs from this MIB in network discovery and polling the applicable devices. Start monitoring SNMPv2-USEC-MIB with a free 30-day trial of IPNetwork Monitor.

What Is SNMPv2-USEC-MIB?

SNMPv2-USEC-MIB is a vendor-neutral, IETF standards-track MIB defining the original User-based Security Model (USec, a precursor to the RFC 3414 USM) for SNMPv2 entities, providing authentication and replay-protection mechanisms. It exposes agent identity and time-synchronization objects (agentID, agentBoots, agentTime, agentSize) used for replay detection, along with a set of security-violation statistics counters. Its monitoring relevance is entirely software/protocol status: administrators track agentBoots and agentTime to confirm time-window synchronization is functioning (preventing replay attacks), and monitor usecStats counters for unsupported QoS, out-of-window requests, unknown users, bad digests, unknown contexts, and unauthorized operations, any of which spikes would indicate a misconfigured manager, a compromised credential attempt, or a clock-sync problem. It is an early/alternative implementation of the security model later standardized as SNMP-USER-BASED-SM-MIB, so it has a direct historical dependency relationship with that later standard. It would be deployed on any legacy SNMPv2 agent implementing this particular security model, mostly of historical interest in modern deployments. Engineers implementing or auditing this functionality typically reference the SNMPv2-USEC-MIB RFC/standard documentation for the authoritative specification.

IPNetwork Monitor allows you to monitor SNMP objects defined in SNMPv2-USEC-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

vendor-neutral, standards-based MIB, not tied to a specific manufacturer
legacy SNMPv2 agent implementing the User-based Security Model

Monitoring Examples

An administrator would poll agentBoots and agentTime to confirm the agent's replay-protection clock is incrementing correctly and stays within the expected time window relative to the manager. A rising usecStatsNotInWindows or usecStatsWrongDigestValues counter would reveal requests failing authentication due to clock skew or credential mismatches, respectively. Similarly, usecStatsUnauthorizedOperations climbing would flag a user attempting operations beyond their permitted access, worth investigating as a potential security incident.

What Can Be Monitored

agent boot/time counters for replay protection
authentication failure counts
unknown user/context counts
unauthorized operation attempts
unsupported QoS requests

Imported Objects

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Counter32
MODULE-IDENTITY
OBJECT-TYPE
Unsigned32
snmpModules

From SNMPv2-TC

TEXTUAL-CONVENTION

How to Use in IPNetwork Monitor

Example using usecStatsUnsupportedQoS OID:

Select a device implementing SNMPv2-USEC-MIB as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type usecStatsUnsupportedQoS into the Find box to locate it in the OID tree, then select it and click OK. The total number of packets received by the SNMPv2 entity which were dropped because they requested a quality-of- service that was unknown to the agent or otherwise unavailable. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases between polls, since a rising count of errors, failures, or discards often points to a real underlying problem. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
usecMIB	1.3.6.1.6.3.6			The MIB module for SNMPv2 entities implementing the user- based security model.
usecMIBObjects	1.3.6.1.6.3.6.1
usecAgent	1.3.6.1.6.3.6.1.1
AGE agentID	1.3.6.1.6.3.6.1.1.1	AgentID	read-only	The agent's administratively-unique identifier.
U32 agentBoots	1.3.6.1.6.3.6.1.1.2	Unsigned32	read-only	The number of times that the agent has re-initialized itself since its initial configuration.
U32 agentTime	1.3.6.1.6.3.6.1.1.3	Unsigned32	read-only	The number of seconds since the agent last incremented the agentBoots object.
INT agentSize	1.3.6.1.6.3.6.1.1.4	INTEGER	read-only	The maximum length in octets of an SNMPv2 message which this agent will accept using any transport mapping.
usecStats	1.3.6.1.6.3.6.1.2
C32 usecStatsUnsupportedQoSEx	1.3.6.1.6.3.6.1.2.1	Counter32	read-only	The total number of packets received by the SNMPv2 entity which were dropped because they requested a quality-of- service that was unknown to the agent or otherwise unavailable.
C32 usecStatsNotInWindows	1.3.6.1.6.3.6.1.2.2	Counter32	read-only	The total number of packets received by the SNMPv2 entity which were dropped because they appeared outside of the agent's window.
C32 usecStatsUnknownUserNames	1.3.6.1.6.3.6.1.2.3	Counter32	read-only	The total number of packets received by the SNMPv2 entity which were dropped because they referenced a user that was not known to the agent.
C32 usecStatsWrongDigestValues	1.3.6.1.6.3.6.1.2.4	Counter32	read-only	The total number of packets received by the SNMPv2 entity which were dropped because they didn't contain the expected digest value.
C32 usecStatsUnknownContexts	1.3.6.1.6.3.6.1.2.5	Counter32	read-only	The total number of packets received by the SNMPv2 entity which were dropped because they referenced a context that was not known to the agent.
C32 usecStatsBadParameters	1.3.6.1.6.3.6.1.2.6	Counter32	read-only	The total number of packets received by the SNMPv2 entity which were dropped because the field was improperly encoded or had invalid syntax.
C32 usecStatsUnauthorizedOperations	1.3.6.1.6.3.6.1.2.7	Counter32	read-only	The total number of packets received by the SNMPv2 entity which were dropped because the PDU type referred to an operation that is invalid or not authorized.
usecMIBConformance	1.3.6.1.6.3.6.2
usecMIBCompliances	1.3.6.1.6.3.6.2.1
usecMIBCompliance	1.3.6.1.6.3.6.2.1.1			The compliance statement for SNMPv2 entities which implement the SNMPv2 USEC model.
usecMIBGroups	1.3.6.1.6.3.6.2.2
usecBasicGroup	1.3.6.1.6.3.6.2.2.1			A collection of objects providing identification, clocks, and capabilities of an SNMPv2 entity which implements the SNMPv2 USEC model.
usecStatsGroup	1.3.6.1.6.3.6.2.2.2			A collection of objects providing basic error statistics of an SNMPv2 entity which implements the SNMPv2 USEC model.

RFC description

User-based security model (USM) implementation for SNMPv2 agent authentication and privacy.

Start monitoring vendor-neutral, standards-based MIB, legacy SNMPv2 agent implementing the User-based Security Model (agent replay-protection/security counters) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download SNMPv2-USEC-MIB