Network Working Group P. Phaal
Request for Comments: 3176 S. Panchen
Category: Informational N. McKee
InMon Corp.
September 2001
Network Working Group P. Phaal
Request for Comments: 3176 S. Panchen
Category: Informational N. McKee
InMon Corp.
September 2001
InMon Corporation's sFlow: A Method for Monitoring Traffic in Switched and Routed Networks
InMon公司的sFlow：一种监控交换和路由网络流量的方法
Status of this Memo
本备忘录的状况
This memo provides information for the Internet community. It does not specify an Internet standard of any kind. Distribution of this memo is unlimited.
本备忘录为互联网社区提供信息。它没有规定任何类型的互联网标准。本备忘录的分发不受限制。
Copyright Notice
版权公告
Copyright (C) The Internet Society (2001). All Rights Reserved.
版权所有（C）互联网协会（2001年）。版权所有。
Abstract
摘要
This memo defines InMon Coporation's sFlow system. sFlow is a technology for monitoring traffic in data networks containing switches and routers. In particular, it defines the sampling mechanisms implemented in an sFlow Agent for monitoring traffic, the sFlow MIB for controlling the sFlow Agent, and the format of sample data used by the sFlow Agent when forwarding data to a central data collector.
本备忘录定义了InMon公司的sFlow系统。sFlow是一种监控包含交换机和路由器的数据网络流量的技术。具体而言，它定义了在sFlow代理中实现的用于监控流量的采样机制、用于控制sFlow代理的sFlow MIB，以及sFlow代理在将数据转发到中央数据采集器时使用的采样数据格式。
Table of Contents
目录
1. Overview ..................................................... 2
2. Sampling Mechanisms .......................................... 2
2.1 Sampling of Switched Flows ............................... 3
2.1.1 Distributed Switching .............................. 4
2.1.2 Random Number Generation ........................... 4
2.2 Sampling of Network Interface Statistics ................. 4
3. sFlow MIB .................................................... 5
3.1 The SNMP Management Framework ............................ 5
3.2 Definitions .............................................. 6
4. sFlow Datagram Format ........................................ 14
5. Security Considerations ...................................... 25
5.1 Control .................................................. 26
5.2 Transport ................................................ 26
5.3 Confidentiality .......................................... 26
6. References ................................................... 27
7. Authors' Addresses ........................................... 29
1. Overview ..................................................... 2
2. Sampling Mechanisms .......................................... 2
2.1 Sampling of Switched Flows ............................... 3
2.1.1 Distributed Switching .............................. 4
2.1.2 Random Number Generation ........................... 4
2.2 Sampling of Network Interface Statistics ................. 4
3. sFlow MIB .................................................... 5
3.1 The SNMP Management Framework ............................ 5
3.2 Definitions .............................................. 6
4. sFlow Datagram Format ........................................ 14
5. Security Considerations ...................................... 25
5.1 Control .................................................. 26
5.2 Transport ................................................ 26
5.3 Confidentiality .......................................... 26
6. References ................................................... 27
7. Authors' Addresses ........................................... 29
8. Intellectual Property Statement .............................. 30
9. Full Copyright Statement ..................................... 31
8. Intellectual Property Statement .............................. 30
9. Full Copyright Statement ..................................... 31
sFlow is a technology for monitoring traffic in data networks containing switches and routers. In particular, it defines the sampling mechanisms implemented in an sFlow Agent for monitoring traffic, the sFlow MIB for controlling the sFlow Agent, and the format of sample data used by the sFlow Agent when forwarding data to a central data collector.
sFlow是一种监控包含交换机和路由器的数据网络流量的技术。具体而言，它定义了在sFlow代理中实现的用于监控流量的采样机制、用于控制sFlow代理的sFlow MIB，以及sFlow代理在将数据转发到中央数据采集器时使用的采样数据格式。
The architecture and sampling techniques used in the sFlow monitoring system are designed to provide continuous site-wide (and network-wide) traffic monitoring for high speed switched and routed networks.
sFlow监控系统中使用的架构和采样技术旨在为高速交换和路由网络提供连续的站点范围（和网络范围）流量监控。
The design specifically addresses issues associated with:
该设计特别解决了与以下相关的问题：
o Accurately monitoring network traffic at Gigabit speeds and higher.
o 以千兆和更高的速度精确监控网络流量。
o Scaling to manage tens of thousands of agents from a single point.
o 扩展以从单个点管理数万个代理。
o Extremely low cost agent implementation.
o 极低的代理实现成本。
The sFlow monitoring system consists of an sFlow Agent (embedded in a switch or router or in a stand alone probe) and a central data collector, or sFlow Analyzer.
sFlow监控系统由sFlow代理（嵌入交换机或路由器或独立探头）和中央数据采集器或sFlow分析仪组成。
The sFlow Agent uses sampling technology to capture traffic statistics from the device it is monitoring. sFlow Datagrams are used to immediately forward the sampled traffic statistics to an sFlow Analyzer for analysis.
sFlow代理使用采样技术从其监视的设备捕获流量统计信息。sFlow数据报用于立即将采样的流量统计数据转发给sFlow分析器进行分析。
This document describes the sampling mechanisms used by the sFlow Agent, the SFLOW MIB used by the sFlow Analyzer to control the sFlow Agent, and the sFlow Datagram Format used by the sFlow Agent to send traffic data to the sFlow Analyzer.
本文档描述了sFlow代理使用的采样机制、sFlow Analyzer用于控制sFlow代理的sFlow MIB以及sFlow代理用于向sFlow Analyzer发送流量数据的sFlow数据报格式。
The sFlow Agent uses two forms of sampling: statistical packet-based sampling of switched flows, and time-based sampling of network interface statistics.
sFlow代理使用两种形式的采样：基于分组的交换流统计采样和基于时间的网络接口统计采样。
A flow is defined as all the packets that are received on one interface, enter the Switching/Routing Module and are sent to another interface. In the case of a one-armed router, the source and destination interface could be the same. In the case of a broadcast or multicast packet there may be multiple destination interfaces. The sampling mechanism must ensure that any packet involved in a flow has an equal chance of being sampled, irrespective of the flow to which it belongs.
流定义为在一个接口上接收的所有数据包，进入交换/路由模块并发送到另一个接口。在单臂路由器的情况下，源和目标接口可以相同。在广播或多播分组的情况下，可能存在多个目的地接口。采样机制必须确保流中涉及的任何数据包都有相同的被采样机会，而不管它属于哪个流。
Sampling flows is accomplished as follows: When a packet arrives on an interface, a filtering decision is made that determines whether the packet should be dropped. If the packet is not filtered a destination interface is assigned by the switching/routing function. At this point a decision is made on whether or not to sample the packet. The mechanism involves a counter that is decremented with each packet. When the counter reaches zero a sample is taken. Whether or not a sample is taken, the counter Total_Packets is incremented. Total_Packets is a count of all the packets that could have been sampled.
采样流按如下方式完成：当数据包到达接口时，进行过滤决策，确定是否应丢弃数据包。如果数据包未被过滤，则交换/路由功能将分配一个目的地接口。此时将决定是否对数据包进行采样。该机制涉及一个计数器，该计数器随每个数据包递减。当计数器达到零时，采集样本。无论是否采集样本，计数器总_数据包都会递增。Total_Packets是可能已采样的所有数据包的计数。
Taking a sample involves either copying the packet's header, or extracting features from the packet (see sFlow Datagram Format for a description of the different forms of sample). Every time a sample is taken, the counter Total_Samples, is incremented. Total_Samples is a count of the number of samples generated. Samples are sent by the sampling entity to the sFlow Agent for processing. The sample includes the packet information, and the values of the Total_Packets and Total_Samples counters.
采样包括复制数据包的报头，或从数据包中提取特征（请参阅sFlow数据报格式以了解不同形式的样本的描述）。每次采样时，计数器的总采样数都会增加。Total_Samples是生成的样本数的计数。采样实体将样本发送到sFlow代理进行处理。样本包括数据包信息、总数据包和总样本计数器的值。
When a sample is taken, the counter indicating how many packets to skip before taking the next sample should be reset. The value of the counter should be set to a random integer where the sequence of random integers used over time should be such that
采集样本时，指示在采集下一个样本之前要跳过多少数据包的计数器应重置。计数器的值应设置为随机整数，其中随时间使用的随机整数序列应为
(1) Total_Packets/Total_Samples = Rate
(1) 总数据包/总样本数=速率
An alternative strategy for packet sampling is to generate a random number for each packet, compare the random number to a preset threshold and take a sample whenever the random number is smaller than the threshold value. Calculation of an appropriate threshold value depends on the characteristics of the random number generator, however, the resulting sample stream must still satisfy (1).
分组抽样的另一种策略是为每个分组生成一个随机数，将随机数与预设阈值进行比较，并在随机数小于阈值时进行抽样。适当阈值的计算取决于随机数生成器的特性，但是，生成的样本流必须仍然满足（1）。
The SFLOW MIB permits separate sampling entities to be associated with different physical or logical elements of the switch (such as interfaces, backplanes or VLANs). Each sampling engine has its own independent state (i.e., Total_Packets, Total_Samples, Skip and Rate), and forwards its own sample messages to the sFlow Agent. The sFlow Agent is responsible for packaging the samples into datagrams for transmission to an sFlow Analyzer.
SFLOW MIB允许单独的采样实体与交换机的不同物理或逻辑元件（如接口、背板或VLAN）相关联。每个采样引擎都有自己的独立状态（即，Total_数据包、Total_样本、Skip和Rate），并将自己的样本消息转发给sFlow代理。sFlow代理负责将样本打包成数据报，以传输至sFlow分析仪。
The essential property of the random number generator is that the mean value of the numbers it generates converges to the required sampling rate.
随机数生成器的基本特性是它生成的数的平均值收敛到所需的采样率。
A uniform distribution random number generator is very effective. The range of skip counts (the variance) does not significantly affect results; variation of +-10% of the mean value is sufficient.
均匀分布随机数发生器非常有效。跳过计数的范围（方差）对结果没有显著影响；平均值+-10%的变化就足够了。
The random number generator must ensure that all numbers in the range between its maximum and minimum values of the distribution are possible; a random number generator only capable of generating even numbers, or numbers with any common divisor is unsuitable.
随机数生成器必须确保分布的最大值和最小值之间的所有数字都是可能的；一个随机数生成器只能生成偶数，或者具有任何公约数的数是不合适的。
A new skip value is only required every time a sample is taken.
仅在每次采样时才需要新的跳过值。
The objective of the counter sampling is to efficiently, periodically poll each data source on the device and extract key statistics.
计数器采样的目标是高效、定期轮询设备上的每个数据源并提取关键统计信息。
For efficiency and scalability reasons, the sFlow System implements counter polling in the sFlow Agent. A maximum polling interval is assigned to the agent, but the agent is free to schedule polling in order maximize internal efficiency.
出于效率和可伸缩性的原因，sFlow系统在sFlow代理中实现了计数器轮询。为代理分配了最大轮询间隔，但代理可以自由安排轮询以最大限度地提高内部效率。
Flow sampling and counter sampling are designed as part of an integrated system. Both types of samples are combined in sFlow Datagrams. Since flow sampling will cause a steady, but random, stream of datagrams to be sent to the sFlow Analyzer, counter samples may be taken opportunistically in order to fill these datagrams.
流量采样和计数器采样设计为集成系统的一部分。这两种类型的样本组合在sFlow数据报中。由于流量采样将导致稳定但随机的数据报流发送至sFlow Analyzer，因此可能会有机会采集计数器样本以填充这些数据报。
One strategy for counter sampling has the sFlow Agent keep a list of counter sources being sampled. When a flow sample is generated the sFlow Agent examines the list and adds counters to the sample datagram, least recently sampled first. Counters are only added to the datagram if the sources are within a short period, 5 seconds say,
计数器采样的一种策略是sFlow代理保留正在采样的计数器源列表。生成流样本时，sFlow代理会检查列表并将计数器添加到样本数据报中，最近采样的计数器最少。只有在源在短时间内（比如5秒）才会将计数器添加到数据报中，
of failing to meet the required sampling interval (see sFlowCounterSamplingInterval in SFLOW MIB). Whenever a counter source's statistics are added to a sample datagram, the time the counter source was last sampled is updated and the counter source is placed at the end of the list. Periodically, say every second, the sFlow Agent examines the list of counter sources and sends any counters that need to be sent to meet the sampling interval requirement.
未能满足要求的采样间隔（请参阅SFLOW MIB中的sFlowCounterSamplingInterval）。每当将计数器源的统计信息添加到样本数据报时，计数器源上次采样的时间将被更新，计数器源将被置于列表的末尾。sFlow代理会定期（例如每秒）检查计数器源列表，并发送任何需要发送以满足采样间隔要求的计数器。
Alternatively, if the agent regularly schedules counter sampling, then it should schedule each counter source at a different start time (preferably randomly) so that counter sampling is not synchronized within an agent or between agents.
或者，如果代理定期安排计数器采样，则应在不同的开始时间（最好是随机）安排每个计数器源，以便在代理内或代理之间不同步计数器采样。
The sFlow MIB defines a control interface for an sFlow Agent. This interface provides a standard mechanism for remotely controlling and configuring an sFlow Agent.
sFlow MIB为sFlow代理定义一个控制接口。此接口提供用于远程控制和配置sFlow代理的标准机制。
The SNMP Management Framework presently consists of five major components:
SNMP管理框架目前由五个主要组件组成：
o An overall architecture, described in RFC 2571 [2].
o RFC 2571[2]中描述的总体架构。
o Mechanisms for describing and naming objects and events for the purpose of management. The first version of this Structure of Management Information (SMI) is called SMIv1 and described in STD 16,
o 为管理目的描述和命名对象和事件的机制。这种管理信息结构（SMI）的第一个版本称为SMIv1，并在STD 16中进行了描述，
RFC 1155 [3], STD 16, RFC 1212 [4] and RFC 1215 [5]. The second version, called SMIv2, is described in STD 58, RFC 2578 [6], STD 58, RFC 2579 [7] and STD 58, RFC 2580 [8].
RFC 1155[3]，STD 16，RFC 1212[4]和RFC 1215[5]。第二个版本称为SMIv2，在STD 58、RFC 2578[6]、STD 58、RFC 2579[7]和STD 58、RFC 2580[8]中进行了描述。
o Message protocols for transferring management information. The first version of the SNMP message protocol is called SNMPv1 and described in STD 15, RFC 1157 [9]. A second version of the SNMP message protocol, which is not an Internet standards track protocol, is called SNMPv2c and described in RFC 1901 [10] and RFC 1906 [11]. The third version of the message protocol is called SNMPv3 and described in RFC 1906 [11], RFC 2572 [12] and RFC 2574 [13].
o 用于传输管理信息的消息协议。SNMP消息协议的第一个版本称为SNMPv1，在STD 15、RFC 1157[9]中进行了描述。SNMP消息协议的第二个版本不是互联网标准跟踪协议，称为SNMPv2c，在RFC 1901[10]和RFC 1906[11]中进行了描述。消息协议的第三个版本称为SNMPv3，在RFC 1906[11]、RFC 2572[12]和RFC 2574[13]中进行了描述。
o Protocol operations for accessing management information. The first set of protocol operations and associated PDU formats is described in STD 15, RFC 1157 [9]. A second set of protocol operations and associated PDU formats is described in RFC 1905 [14].
o 访问管理信息的协议操作。STD 15、RFC 1157[9]中描述了第一组协议操作和相关PDU格式。RFC 1905[14]中描述了第二组协议操作和相关PDU格式。
o A set of fundamental applications described in RFC 2573 [15] and the view-based access control mechanism described in RFC 2575 [16].
o RFC 2573[15]中描述的一组基本应用程序和RFC 2575[16]中描述的基于视图的访问控制机制。
A more detailed introduction to the current SNMP Management Framework can be found in RFC 2570 [17].
有关当前SNMP管理框架的更详细介绍，请参见RFC 2570[17]。
Managed objects are accessed via a virtual information store, termed the Management Information Base or MIB. Objects in the MIB are defined using the mechanisms defined in the SMI.
托管对象通过虚拟信息存储（称为管理信息库或MIB）进行访问。MIB中的对象是使用SMI中定义的机制定义的。
This memo specifies a MIB module that is compliant to the SMIv2. A MIB conforming to the SMIv1 can be produced through the appropriate translations. The resulting translated MIB must be semantically equivalent, except where objects or events are omitted because no translation is possible (use of Counter64). Some machine readable information in SMIv2 will be converted into textual descriptions in SMIv1 during the translation process. However, this loss of machine readable information is not considered to change the semantics of the MIB.
此备忘录指定了符合SMIv2的MIB模块。通过适当的翻译，可以生成符合SMIv1的MIB。生成的已翻译MIB必须在语义上等效，除非由于无法翻译而省略了对象或事件（使用计数器64）。在翻译过程中，SMIv2中的一些机器可读信息将转换为SMIv1中的文本描述。但是，这种机器可读信息的丢失不被认为会改变MIB的语义。
SFLOW-MIB DEFINITIONS ::= BEGIN
SFLOW-MIB DEFINITIONS ::= BEGIN
IMPORTS
进口
MODULE-IDENTITY, OBJECT-TYPE, Integer32, enterprises FROM SNMPv2-SMI SnmpAdminString FROM SNMP-FRAMEWORK-MIB OwnerString FROM RMON-MIB InetAddressType, InetAddress FROM INET-ADDRESS-MIB MODULE-COMPLIANCE, OBJECT-GROUP FROM SNMPv2-CONF;
模块标识，对象类型，整数32，SNMPv2中的企业SMI SNMPAdminInstalling FROM SNMP-FRAMEWORK-MIB OwnerString FROM RMON-MIB InetAddressType，InetAddress FROM INET-ADDRESS-MIB MODULE-COMPLIANCE，OBJECT-GROUP FROM SNMPv2 CONF；
sFlowMIB MODULE-IDENTITY LAST-UPDATED "200105150000Z" -- May 15, 2001 ORGANIZATION "InMon Corp." CONTACT-INFO
sFlowMIB模块标识最后一次更新“200105150000Z”-2001年5月15日组织“InMon公司”联系方式
"Peter Phaal InMon Corp. http://www.inmon.com/
彼得·法尔·因蒙公司。http://www.inmon.com/
Tel: +1-415-661-6343 Email: peter_phaal@inmon.com" DESCRIPTION "The MIB module for managing the generation and transportation of sFlow data records."
电话：+1-415-661-6343电子邮件：peter_phaal@inmon.com“描述”用于管理sFlow数据记录的生成和传输的MIB模块
-- -- Revision History -- REVISION "200105150000Z" -- May 15, 2001 DESCRIPTION "Version 1.2
----修订历史--修订版“200105150000Z”-2001年5月15日说明“版本1.2”
Brings MIB into SMI v2 compliance."
将MIB纳入SMI v2法规遵从性。”
REVISION "200105010000Z" -- May 1, 2001 DESCRIPTION "Version 1.1
修订版“200105010000Z”-2001年5月1日说明“版本1.1
Adds sFlowDatagramVersion."
::= { enterprises 4300 1 }
Adds sFlowDatagramVersion."
::= { enterprises 4300 1 }
sFlowAgent OBJECT IDENTIFIER ::= { sFlowMIB 1 }
sFlowAgent OBJECT IDENTIFIER ::= { sFlowMIB 1 }
sFlowVersion OBJECT-TYPE SYNTAX SnmpAdminString MAX-ACCESS read-only STATUS current DESCRIPTION "Uniquely identifies the version and implementation of this MIB. The version string must have the following structure: <MIB Version>;<Organization>;<Software Revision> where: <MIB Version> must be '1.2', the version of this MIB. <Organization> the name of the organization responsible for the agent implementation. <Revision> the specific software build of this agent.
sFlowVersion对象类型语法SnmpAdminString MAX-ACCESS只读状态当前说明“唯一标识此MIB的版本和实现。版本字符串必须具有以下结构：<MIB version><组织><软件版本>其中：<MIB Version>必须为“1.2”，即此MIB的版本<Organization>负责代理实现的组织的名称<修订>此代理的特定软件版本。
As an example, the string '1.2;InMon Corp.;2.1.1' indicates that this agent implements version '1.2' of the SFLOW MIB, that it was developed by 'InMon Corp.' and that the software build is '2.1.1'.
例如，字符串“1.2；英蒙公司。；“2.1.1”表示该代理实现了SFLOW MIB的“1.2”版本，由“InMon公司”开发，软件版本为“2.1.1”。
The MIB Version will change with each revision of the SFLOW
MIB版本将随SFLOW的每次修订而变化
MIB.
MIB。
Management entities must check the MIB Version and not attempt to manage agents with MIB Versions greater than that for which they were designed.
管理实体必须检查MIB版本，不得尝试管理MIB版本大于其设计版本的代理。
Note: The sFlow Datagram Format has an independent version
number which may change independently from <MIB Version>.
<MIB Version> applies to the structure and semantics of
the SFLOW MIB only."
DEFVAL { "1.2;;" }
::= { sFlowAgent 1 }
Note: The sFlow Datagram Format has an independent version
number which may change independently from <MIB Version>.
<MIB Version> applies to the structure and semantics of
the SFLOW MIB only."
DEFVAL { "1.2;;" }
::= { sFlowAgent 1 }
sFlowAgentAddressType OBJECT-TYPE
SYNTAX InetAddressType
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The address type of the address associated with this agent.
Only ipv4 and ipv6 types are supported."
::= { sFlowAgent 2 }
sFlowAgentAddressType OBJECT-TYPE
SYNTAX InetAddressType
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The address type of the address associated with this agent.
Only ipv4 and ipv6 types are supported."
::= { sFlowAgent 2 }
sFlowAgentAddress OBJECT-TYPE
SYNTAX InetAddress
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The IP address associated with this agent. In the case of a
multi-homed agent, this should be the loopback address of the
agent. The sFlowAgent address must provide SNMP connectivity
to the agent. The address should be an invariant that does not
change as interfaces are reconfigured, enabled, disabled,
added or removed. A manager should be able to use the
sFlowAgentAddress as a unique key that will identify this
agent over extended periods of time so that a history can
be maintained."
::= { sFlowAgent 3 }
sFlowAgentAddress OBJECT-TYPE
SYNTAX InetAddress
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The IP address associated with this agent. In the case of a
multi-homed agent, this should be the loopback address of the
agent. The sFlowAgent address must provide SNMP connectivity
to the agent. The address should be an invariant that does not
change as interfaces are reconfigured, enabled, disabled,
added or removed. A manager should be able to use the
sFlowAgentAddress as a unique key that will identify this
agent over extended periods of time so that a history can
be maintained."
::= { sFlowAgent 3 }
sFlowTable OBJECT-TYPE
SYNTAX SEQUENCE OF SFlowEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A table of the sFlow samplers within a device."
::= { sFlowAgent 4 }
sFlowTable OBJECT-TYPE
SYNTAX SEQUENCE OF SFlowEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A table of the sFlow samplers within a device."
::= { sFlowAgent 4 }
sFlowEntry OBJECT-TYPE SYNTAX SFlowEntry
sFlowEntry对象类型语法sFlowEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Attributes of an sFlow sampler."
INDEX { sFlowDataSource }
::= { sFlowTable 1 }
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Attributes of an sFlow sampler."
INDEX { sFlowDataSource }
::= { sFlowTable 1 }
SFlowEntry ::= SEQUENCE {
sFlowDataSource OBJECT IDENTIFIER,
sFlowOwner OwnerString,
sFlowTimeout Integer32,
sFlowPacketSamplingRate Integer32,
sFlowCounterSamplingInterval Integer32,
sFlowMaximumHeaderSize Integer32,
sFlowMaximumDatagramSize Integer32,
sFlowCollectorAddressType InetAddressType,
sFlowCollectorAddress InetAddress,
sFlowCollectorPort Integer32,
sFlowDatagramVersion Integer32
}
SFlowEntry ::= SEQUENCE {
sFlowDataSource OBJECT IDENTIFIER,
sFlowOwner OwnerString,
sFlowTimeout Integer32,
sFlowPacketSamplingRate Integer32,
sFlowCounterSamplingInterval Integer32,
sFlowMaximumHeaderSize Integer32,
sFlowMaximumDatagramSize Integer32,
sFlowCollectorAddressType InetAddressType,
sFlowCollectorAddress InetAddress,
sFlowCollectorPort Integer32,
sFlowDatagramVersion Integer32
}
sFlowDataSource OBJECT-TYPE SYNTAX OBJECT IDENTIFIER MAX-ACCESS read-only STATUS current DESCRIPTION "Identifies the source of the data for the sFlow sampler. The following data source types are currently defined:
sFlowDataSource对象类型语法对象标识符MAX-ACCESS只读状态当前描述“标识sFlow采样器的数据源。当前定义了以下数据源类型：
- ifIndex.<I> DataSources of this traditional form are called 'port-based'. Ideally the sampling entity will perform sampling on all flows originating from or destined to the specified interface. However, if the switch architecture only permits input or output sampling then the sampling agent is permitted to only sample input flows input or output flows. Each packet must only be considered once for sampling, irrespective of the number of ports it will be forwarded to.
- iIndex.<I>这种传统形式的数据源称为“基于端口的”。理想情况下，采样实体将对源自或目的地为指定接口的所有流执行采样。但是，如果交换机体系结构仅允许输入或输出采样，则允许采样代理仅对输入流或输出流进行采样。每个数据包必须只考虑一次采样，而不考虑它将转发到的端口数。
Note: Port 0 is used to indicate that all ports on the device are represented by a single data source. - sFlowPacketSamplingRate applies to all ports on the device capable of packet sampling. - sFlowCounterSamplingInterval applies to all ports.
注意：端口0用于指示设备上的所有端口由单个数据源表示。-sFlowPacketSamplingRate适用于设备上能够进行数据包采样的所有端口。-sFlowCounterSamplingInterval适用于所有端口。
- smonVlanDataSource.<V> A dataSource of this form refers to a 'Packet-based VLAN' and is called a 'VLAN-based' dataSource. <V> is the VLAN
- smonVlanDataSource.<V>这种形式的数据源指的是“基于数据包的VLAN”，称为“基于VLAN的”数据源<五> 是VLAN吗
ID as defined by the IEEE 802.1Q standard. The value is between 1 and 4094 inclusive, and it represents an 802.1Q VLAN-ID with global scope within a given bridged domain. Sampling is performed on all packets received that are part of the specified VLAN (no matter which port they arrived on). Each packet will only be considered once for sampling, irrespective of the number of ports it will be forwarded to.
由IEEE 802.1Q标准定义的ID。该值介于1和4094（含1和4094）之间，表示给定桥接域内具有全局作用域的802.1Q VLAN-ID。对接收到的属于指定VLAN的所有数据包执行采样（无论它们到达哪个端口）。每个数据包只考虑一次采样，而不考虑它将转发到的端口数。
- entPhysicalEntry.<N> A dataSource of this form refers to a physical entity within the agent (e.g., entPhysicalClass = backplane(4)) and is called an 'entity-based' dataSource. Sampling is performed on all packets entering the resource (e.g. If the backplane is being sampled, all packets transmitted onto the backplane will be considered as single candidates for sampling irrespective of the number of ports they ultimately reach).
- entPhysicalEntry.<N>此表单的数据源指代理内的物理实体（例如entPhysicalClass=backplane（4）），称为“基于实体的”数据源。对进入资源的所有数据包进行采样（例如，如果对背板进行采样，则传输到背板上的所有数据包将被视为采样的单个候选数据包，而与它们最终到达的端口数无关）。
Note: Since each DataSource operates independently, a packet
that crosses multiple DataSources may generate multiple
flow records."
::= { sFlowEntry 1 }
Note: Since each DataSource operates independently, a packet
that crosses multiple DataSources may generate multiple
flow records."
::= { sFlowEntry 1 }
sFlowOwner OBJECT-TYPE SYNTAX OwnerString MAX-ACCESS read-write STATUS current DESCRIPTION "The entity making use of this sFlow sampler. The empty string indicates that the sFlow sampler is currently unclaimed. An entity wishing to claim an sFlow sampler must make sure that the sampler is unclaimed before trying to claim it. The sampler is claimed by setting the owner string to identify the entity claiming the sampler. The sampler must be claimed before any changes can be made to other sampler objects.
sFlowOwner对象类型语法OwnerString最大访问读写状态当前说明“使用此sFlow采样器的实体。空字符串表示sFlow采样器当前无人认领。希望申领sFlow采样器的实体必须确保采样器无人认领，然后再尝试申领。通过设置所有者字符串来标识声明采样器的实体，从而声明采样器。必须先声明采样器，然后才能对其他采样器对象进行任何更改。
In order to avoid a race condition, the entity taking control of the sampler must set both the owner and a value for sFlowTimeout in the same SNMP set request.
为了避免竞争条件，控制采样器的实体必须在同一个SNMP set请求中设置所有者和sFlowTimeout值。
When a management entity is finished using the sampler, it should set its value back to unclaimed. The agent must restore all other entities this row to their default values when the owner is set to unclaimed.
当管理实体完成使用采样器时，应将其值设置回无人认领。当所有者设置为“无人认领”时，代理必须将此行的所有其他实体恢复为其默认值。
This mechanism provides no enforcement and relies on the cooperation of management entities in order to ensure that
这一机制不提供强制执行，依靠管理实体的合作来确保：
competition for a sampler is fairly resolved."
DEFVAL { "" }
::= { sFlowEntry 2 }
competition for a sampler is fairly resolved."
DEFVAL { "" }
::= { sFlowEntry 2 }
sFlowTimeout OBJECT-TYPE SYNTAX Integer32 MAX-ACCESS read-write STATUS current DESCRIPTION "The time (in seconds) remaining before the sampler is released and stops sampling. When set, the owner establishes control for the specified period. When read, the remaining time in the interval is returned.
sFlowTimeout对象类型语法Integer32 MAX-ACCESS读写状态当前描述“在释放采样器并停止采样之前剩余的时间（以秒为单位）。设置时，所有者为指定的时间段建立控制。读取时，返回间隔中的剩余时间。
A management entity wanting to maintain control of the sampler is responsible for setting a new value before the old one expires.
希望保持对采样器控制的管理实体负责在旧值过期之前设置新值。
When the interval expires, the agent is responsible for
restoring all other entities in this row to their default
values."
DEFVAL { 0 }
::= { sFlowEntry 3 }
When the interval expires, the agent is responsible for
restoring all other entities in this row to their default
values."
DEFVAL { 0 }
::= { sFlowEntry 3 }
sFlowPacketSamplingRate OBJECT-TYPE SYNTAX Integer32 MAX-ACCESS read-write STATUS current DESCRIPTION "The statistical sampling rate for packet sampling from this source.
sFlowPacketSamplingRate对象类型语法整数32 MAX-ACCESS读写状态当前描述“此源的数据包采样的统计采样率。
Set to N to sample 1/Nth of the packets in the monitored flows. An agent should choose its own algorithm introduce variance into the sampling so that exactly every Nth packet is not counted. A sampling rate of 1 counts all packets. A sampling rate of 0 disables sampling.
设置为N以对监视流中的1/N个数据包进行采样。代理应该选择自己的算法，在采样中引入方差，这样就不会精确计算每N个数据包。采样率为1统计所有数据包。采样率为0将禁用采样。
The agent is permitted to have minimum and maximum allowable values for the sampling rate. A minimum rate lets the agent designer set an upper bound on the overhead associated with sampling, and a maximum rate may be the result of hardware restrictions (such as counter size). In addition not all values between the maximum and minimum may be realizable as the sampling rate (again because of implementation considerations).
允许该试剂具有采样率的最小和最大允许值。最小速率允许代理设计器设置与采样相关的开销上限，而最大速率可能是硬件限制（如计数器大小）的结果。此外，并非最大值和最小值之间的所有值都可以实现为采样率（同样是出于实施考虑）。
When the sampling rate is set the agent is free to adjust the value so that it lies between the maximum and minimum values
设置采样率后，代理可以自由调整该值，使其位于最大值和最小值之间
and has the closest achievable value.
并且具有最接近可实现的价值。
When read, the agent must return the actual sampling rate it
will be using (after the adjustments previously described). The
sampling algorithm must converge so that over time the number
of packets sampled approaches 1/Nth of the total number of
packets in the monitored flows."
DEFVAL { 0 }
::= { sFlowEntry 4 }
When read, the agent must return the actual sampling rate it
will be using (after the adjustments previously described). The
sampling algorithm must converge so that over time the number
of packets sampled approaches 1/Nth of the total number of
packets in the monitored flows."
DEFVAL { 0 }
::= { sFlowEntry 4 }
sFlowCounterSamplingInterval OBJECT-TYPE
SYNTAX Integer32
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The maximum number of seconds between successive samples of the
counters associated with this data source. A sampling interval
of 0 disables counter sampling."
DEFVAL { 0 }
::= { sFlowEntry 5 }
sFlowCounterSamplingInterval OBJECT-TYPE
SYNTAX Integer32
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The maximum number of seconds between successive samples of the
counters associated with this data source. A sampling interval
of 0 disables counter sampling."
DEFVAL { 0 }
::= { sFlowEntry 5 }
sFlowMaximumHeaderSize OBJECT-TYPE
SYNTAX Integer32
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The maximum number of bytes that should be copied from a
sampled packet. The agent may have an internal maximum and
minimum permissible sizes. If an attempt is made to set this
value outside the permissible range then the agent should
adjust the value to the closest permissible value."
DEFVAL { 128 }
::= { sFlowEntry 6 }
sFlowMaximumHeaderSize OBJECT-TYPE
SYNTAX Integer32
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The maximum number of bytes that should be copied from a
sampled packet. The agent may have an internal maximum and
minimum permissible sizes. If an attempt is made to set this
value outside the permissible range then the agent should
adjust the value to the closest permissible value."
DEFVAL { 128 }
::= { sFlowEntry 6 }
sFlowMaximumDatagramSize OBJECT-TYPE
SYNTAX Integer32
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The maximum number of data bytes that can be sent in a single
sample datagram. The manager should set this value to avoid
fragmentation of the sFlow datagrams."
DEFVAL { 1400 }
::= { sFlowEntry 7 }
sFlowMaximumDatagramSize OBJECT-TYPE
SYNTAX Integer32
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The maximum number of data bytes that can be sent in a single
sample datagram. The manager should set this value to avoid
fragmentation of the sFlow datagrams."
DEFVAL { 1400 }
::= { sFlowEntry 7 }
sFlowCollectorAddressType OBJECT-TYPE SYNTAX InetAddressType MAX-ACCESS read-write
sFlowCollectorAddressType对象类型语法InetAddressType MAX-ACCESS读写
STATUS current
DESCRIPTION
"The type of sFlowCollectorAddress."
DEFVAL { ipv4 }
::= { sFlowEntry 8 }
STATUS current
DESCRIPTION
"The type of sFlowCollectorAddress."
DEFVAL { ipv4 }
::= { sFlowEntry 8 }
sFlowCollectorAddress OBJECT-TYPE
SYNTAX InetAddress
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The IP address of the sFlow collector.
If set to 0.0.0.0 all sampling is disabled."
DEFVAL { "0.0.0.0" }
::= { sFlowEntry 9 }
sFlowCollectorAddress OBJECT-TYPE
SYNTAX InetAddress
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The IP address of the sFlow collector.
If set to 0.0.0.0 all sampling is disabled."
DEFVAL { "0.0.0.0" }
::= { sFlowEntry 9 }
sFlowCollectorPort OBJECT-TYPE
SYNTAX Integer32
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The destination port for sFlow datagrams."
DEFVAL { 6343 }
::= { sFlowEntry 10 }
sFlowCollectorPort OBJECT-TYPE
SYNTAX Integer32
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The destination port for sFlow datagrams."
DEFVAL { 6343 }
::= { sFlowEntry 10 }
sFlowDatagramVersion OBJECT-TYPE SYNTAX Integer32 MAX-ACCESS read-write STATUS current DESCRIPTION "The version of sFlow datagrams that should be sent.
sFlowDatagramVersion对象类型语法Integer32 MAX-ACCESS读写状态当前描述“应发送的sFlow数据报的版本。
When set to a value not support by the agent, the agent should
adjust the value to the highest supported value less than the
requested value, or return an error if no such values exist."
DEFVAL { 4 }
::= { sFlowEntry 11 }
When set to a value not support by the agent, the agent should
adjust the value to the highest supported value less than the
requested value, or return an error if no such values exist."
DEFVAL { 4 }
::= { sFlowEntry 11 }
-- -- Compliance Statements --
----合规声明--
sFlowMIBConformance OBJECT IDENTIFIER ::= { sFlowMIB 2 }
sFlowMIBGroups OBJECT IDENTIFIER ::= { sFlowMIBConformance 1 }
sFlowMIBCompliances OBJECT IDENTIFIER ::= { sFlowMIBConformance 2 }
sFlowMIBConformance OBJECT IDENTIFIER ::= { sFlowMIB 2 }
sFlowMIBGroups OBJECT IDENTIFIER ::= { sFlowMIBConformance 1 }
sFlowMIBCompliances OBJECT IDENTIFIER ::= { sFlowMIBConformance 2 }
sFlowCompliance MODULE-COMPLIANCE STATUS current
sFlowCompliance模块-合规状态当前
DESCRIPTION "Compliance statements for the sFlow Agent."
说明“sFlow代理的合规声明”
MODULE -- this module
MANDATORY-GROUPS { sFlowAgentGroup }
OBJECT sFlowAgentAddressType
SYNTAX InetAddressType { ipv4(1) }
DESCRIPTION
"Agents need only support ipv4."
MODULE -- this module
MANDATORY-GROUPS { sFlowAgentGroup }
OBJECT sFlowAgentAddressType
SYNTAX InetAddressType { ipv4(1) }
DESCRIPTION
"Agents need only support ipv4."
OBJECT sFlowCollectorAddressType SYNTAX InetAddressType { ipv4(1) } DESCRIPTION "Agents need only support ipv4."
对象sFlowCollectorAddressType语法InetAddressType{ipv4（1）}说明“代理只需要支持ipv4。”
::= { sFlowMIBCompliances 1 }
::= { sFlowMIBCompliances 1 }
sFlowAgentGroup OBJECT-GROUP
OBJECTS { sFlowVersion, sFlowAgentAddressType, sFlowAgentAddress,
sFlowDataSource, sFlowOwner, sFlowTimeout,
sFlowPacketSamplingRate, sFlowCounterSamplingInterval,
sFlowMaximumHeaderSize, sFlowMaximumDatagramSize,
sFlowCollectorAddressType, sFlowCollectorAddress,
sFlowCollectorPort, sFlowDatagramVersion }
STATUS current
DESCRIPTION
"A collection of objects for managing the generation and
transportation of sFlow data records."
::= { sFlowMIBGroups 1 }
sFlowAgentGroup OBJECT-GROUP
OBJECTS { sFlowVersion, sFlowAgentAddressType, sFlowAgentAddress,
sFlowDataSource, sFlowOwner, sFlowTimeout,
sFlowPacketSamplingRate, sFlowCounterSamplingInterval,
sFlowMaximumHeaderSize, sFlowMaximumDatagramSize,
sFlowCollectorAddressType, sFlowCollectorAddress,
sFlowCollectorPort, sFlowDatagramVersion }
STATUS current
DESCRIPTION
"A collection of objects for managing the generation and
transportation of sFlow data records."
::= { sFlowMIBGroups 1 }
END
终止
The sFlow MIB references definitions from a number of existing RFCs [18], [19], [20] and [21].
sFlow MIB引用了许多现有RFC[18]、[19]、[20]和[21]中的定义。
The sFlow datagram format specifies a standard format for the sFlow Agent to send sampled data to a remote data collector.
sFlow数据报格式指定sFlow代理向远程数据采集器发送采样数据的标准格式。
The format of the sFlow datagram is specified using the XDR standard [1]. XDR is more compact than ASN.1 and simpler for the sFlow Agent to encode and the sFlow Analyzer to decode.
sFlow数据报的格式使用XDR标准[1]指定。XDR比ASN.1更紧凑，sFlow代理编码和sFlow分析器解码更简单。
Samples are sent as UDP packets to the host and port specified in the SFLOW MIB. The lack of reliability in the UDP transport mechanism does not significantly affect the accuracy of the measurements obtained from an sFlow Agent.
样本作为UDP数据包发送到SFLOW MIB中指定的主机和端口。UDP传输机制中缺乏可靠性不会显著影响从sFlow代理获得的测量的准确性。
o If counter samples are lost then new values will be sent during the next polling interval. The chance of an undetected counter wrap is negligible. The sFlow datagram specifies 64 bit octet counters, and with typical counter polling intervals between 20 to 120 seconds, the chance of a long enough sequence of sFlow datagrams being lost to hide a counter wrap is very small.
o 如果计数器样本丢失，则将在下一个轮询间隔期间发送新值。未检测到反包裹的可能性微乎其微。sFlow数据报指定64位八位计数器，典型的计数器轮询间隔在20到120秒之间，丢失足够长的sFlow数据报序列以隐藏计数器包装的可能性非常小。
o The net effect of lost flow samples is a slight reduction in the effective sampling rate.
o 流失样品的净影响是有效采样率略有降低。
The use of UDP reduces the amount of memory required to buffer data. UDP also provides a robust means of delivering timely traffic information during periods of intense traffic (such as a denial of service attack). UDP is more robust than a reliable transport mechanism because under overload the only effect on overall system performance is a slight increase in transmission delay and a greater number of lost packets, neither of which has a significant effect on an sFlow-based monitoring system. If a reliable transport mechanism were used then an overload would introduce long transmission delays and require large amounts of buffer memory on the agent.
UDP的使用减少了缓冲数据所需的内存量。UDP还提供了一种强大的方法，可在流量密集期间（如拒绝服务攻击）及时提供流量信息。UDP比可靠的传输机制更健壮，因为在过载情况下，对整体系统性能的唯一影响是传输延迟的轻微增加和更多的丢失数据包，这两种情况都不会对基于sFlow的监控系统产生显著影响。如果使用可靠的传输机制，则过载将导致长传输延迟，并需要代理上的大量缓冲内存。
While the sFlow Datagram structure permits multiple samples to be included in each datagram, the sampling agent must not wait for a buffer to fill with samples before sending the sample datagram. sFlow sampling is intended to provide timely information on traffic. The agent may at most delay a sample by 1 second before it is required to send the datagram.
虽然sFlow数据报结构允许在每个数据报中包含多个样本，但在发送样本数据报之前，采样代理不能等待缓冲区充满样本。sFlow采样旨在提供有关流量的及时信息。在需要发送数据报之前，代理最多可以将样本延迟1秒。
The agent should try to piggyback counter samples on the datagram stream resulting from flow sampling. Before sending out a datagram the remaining space in the buffer can be filled with counter samples. The agent has discretion in the timing of its counter polling, the specified counter sampling intervals sFlowCounterSamplingInterval is a maximum, so the agent is free to sample counters early if it has space in a datagram. If counters must be sent in order to satisfy the maximum sampling interval then a datagram must be sent containing the outstanding counters.
代理应该尝试在流采样产生的数据报流上携带计数器样本。在发送数据报之前，缓冲区中的剩余空间可以用计数器样本填充。代理可以自行决定计数器轮询的计时，指定的计数器采样间隔sFlowCounterSamplingInterval是最大值，因此，如果数据报中有空间，代理可以提前对计数器进行采样。如果必须发送计数器以满足最大采样间隔，则必须发送包含未完成计数器的数据报。
The following is the XDR description of an sFlow Datagram:
以下是sFlow数据报的XDR说明：
/* sFlow Datagram Version 4 */
/* sFlow Datagram Version 4 */
/* Revision History
- version 4 adds support BGP communities
- version 3 adds support for extended_url information
*/
/* Revision History
- version 4 adds support BGP communities
- version 3 adds support for extended_url information
*/
/* sFlow Sample types */
/* sFlow Sample types */
/* Address Types */
/* Address Types */
typedef opaque ip_v4[4];
typedef opaque ip_v6[16];
typedef opaque ip_v4[4];
typedef opaque ip_v6[16];
enum address_type {
IP_V4 = 1,
IP_V6 = 2
}
enum address_type {
IP_V4 = 1,
IP_V6 = 2
}
union address (address_type type) {
case IP_V4:
ip_v4;
case IP_V6:
ip_v6;
}
union address (address_type type) {
case IP_V4:
ip_v4;
case IP_V6:
ip_v6;
}
/* Packet header data */
/* Packet header data */
const MAX_HEADER_SIZE = 256; /* The maximum sampled header size. */
const MAX_HEADER_SIZE = 256; /* The maximum sampled header size. */
/* The header protocol describes the format of the sampled header */
enum header_protocol {
ETHERNET-ISO8023 = 1,
ISO88024-TOKENBUS = 2,
ISO88025-TOKENRING = 3,
FDDI = 4,
FRAME-RELAY = 5,
X25 = 6,
PPP = 7,
SMDS = 8,
AAL5 = 9,
AAL5-IP = 10, /* e.g., Cisco AAL5 mux */
IPv4 = 11,
IPv6 = 12,
MPLS = 13
}
/* The header protocol describes the format of the sampled header */
enum header_protocol {
ETHERNET-ISO8023 = 1,
ISO88024-TOKENBUS = 2,
ISO88025-TOKENRING = 3,
FDDI = 4,
FRAME-RELAY = 5,
X25 = 6,
PPP = 7,
SMDS = 8,
AAL5 = 9,
AAL5-IP = 10, /* e.g., Cisco AAL5 mux */
IPv4 = 11,
IPv6 = 12,
MPLS = 13
}
struct sampled_header {
header_protocol protocol; /* Format of sampled header */
unsigned int frame_length; /* Original length of packet before
sampling */
opaque header<MAX_HEADER_SIZE>; /* Header bytes */
}
struct sampled_header {
header_protocol protocol; /* Format of sampled header */
unsigned int frame_length; /* Original length of packet before
sampling */
opaque header<MAX_HEADER_SIZE>; /* Header bytes */
}
/* Packet IP version 4 data */
/* Packet IP version 4 data */
struct sampled_ipv4 {
ipv4结构{
unsigned int length; /* The length of the IP packet excluding
lower layer encapsulations */
unsigned int protocol; /* IP Protocol type
(for example, TCP = 6, UDP = 17) */
ip_v4 src_ip; /* Source IP Address */
ip_v4 dst_ip; /* Destination IP Address */
unsigned int src_port; /* TCP/UDP source port number or
equivalent */
unsigned int dst_port; /* TCP/UDP destination port number or
equivalent */
unsigned int tcp_flags; /* TCP flags */
unsigned int tos; /* IP type of service */
}
/* Packet IP version 6 data */
unsigned int length; /* The length of the IP packet excluding
lower layer encapsulations */
unsigned int protocol; /* IP Protocol type
(for example, TCP = 6, UDP = 17) */
ip_v4 src_ip; /* Source IP Address */
ip_v4 dst_ip; /* Destination IP Address */
unsigned int src_port; /* TCP/UDP source port number or
equivalent */
unsigned int dst_port; /* TCP/UDP destination port number or
equivalent */
unsigned int tcp_flags; /* TCP flags */
unsigned int tos; /* IP type of service */
}
/* Packet IP version 6 data */
struct sampled_ipv6 {
unsigned int length; /* The length of the IP packet excluding
lower layer encapsulations */
unsigned int protocol; /* IP next header
(for example, TCP = 6, UDP = 17) */
ip_v6 src_ip; /* Source IP Address */
ip_v6 dst_ip; /* Destination IP Address */
unsigned int src_port; /* TCP/UDP source port number or
equivalent */
unsigned int dst_port; /* TCP/UDP destination port number or
equivalent */
unsigned int tcp_flags; /* TCP flags */
unsigned int priority; /* IP priority */
}
struct sampled_ipv6 {
unsigned int length; /* The length of the IP packet excluding
lower layer encapsulations */
unsigned int protocol; /* IP next header
(for example, TCP = 6, UDP = 17) */
ip_v6 src_ip; /* Source IP Address */
ip_v6 dst_ip; /* Destination IP Address */
unsigned int src_port; /* TCP/UDP source port number or
equivalent */
unsigned int dst_port; /* TCP/UDP destination port number or
equivalent */
unsigned int tcp_flags; /* TCP flags */
unsigned int priority; /* IP priority */
}
/* Packet data */
/* Packet data */
enum packet_information_type {
HEADER = 1, /* Packet headers are sampled */
IPV4 = 2, /* IP version 4 data */
IPV6 = 3 /* IP version 6 data */
}
enum packet_information_type {
HEADER = 1, /* Packet headers are sampled */
IPV4 = 2, /* IP version 4 data */
IPV6 = 3 /* IP version 6 data */
}
union packet_data_type (packet_information_type type) {
case HEADER:
sampled_header header;
case IPV4:
sampled_ipv4 ipv4;
case IPV6:
sampled_ipv6 ipv6;
}
union packet_data_type (packet_information_type type) {
case HEADER:
sampled_header header;
case IPV4:
sampled_ipv4 ipv4;
case IPV6:
sampled_ipv6 ipv6;
}
/* Extended data types */
/* Extended data types */
/* Extended switch data */
/* Extended switch data */
struct extended_switch {
unsigned int src_vlan; /* The 802.1Q VLAN id of incoming frame */
unsigned int src_priority; /* The 802.1p priority of incoming
frame */
unsigned int dst_vlan; /* The 802.1Q VLAN id of outgoing frame */
unsigned int dst_priority; /* The 802.1p priority of outgoing
frame */
}
struct extended_switch {
unsigned int src_vlan; /* The 802.1Q VLAN id of incoming frame */
unsigned int src_priority; /* The 802.1p priority of incoming
frame */
unsigned int dst_vlan; /* The 802.1Q VLAN id of outgoing frame */
unsigned int dst_priority; /* The 802.1p priority of outgoing
frame */
}
/* Extended router data */
/* Extended router data */
struct extended_router {
address nexthop; /* IP address of next hop router */
unsigned int src_mask; /* Source address prefix mask bits */
unsigned int dst_mask; /* Destination address prefix mask bits */
}
struct extended_router {
address nexthop; /* IP address of next hop router */
unsigned int src_mask; /* Source address prefix mask bits */
unsigned int dst_mask; /* Destination address prefix mask bits */
}
/* Extended gateway data */
/* Extended gateway data */
enum as_path_segment_type {
AS_SET = 1, /* Unordered set of ASs */
AS_SEQUENCE = 2 /* Ordered set of ASs */
}
enum as_path_segment_type {
AS_SET = 1, /* Unordered set of ASs */
AS_SEQUENCE = 2 /* Ordered set of ASs */
}
union as_path_type (as_path_segment_type) {
case AS_SET:
unsigned int as_set<>;
case AS_SEQUENCE:
unsigned int as_sequence<>;
}
union as_path_type (as_path_segment_type) {
case AS_SET:
unsigned int as_set<>;
case AS_SEQUENCE:
unsigned int as_sequence<>;
}
struct extended_gateway {
unsigned int as; /* Autonomous system number of router */
unsigned int src_as; /* Autonomous system number of source */
unsigned int src_peer_as; /* Autonomous system number of source
peer */
as_path_type dst_as_path<>; /* Autonomous system path to the
destination */
unsigned int communities<>; /* Communities associated with this
route */
unsigned int localpref; /* LocalPref associated with this
route */
}
struct extended_gateway {
unsigned int as; /* Autonomous system number of router */
unsigned int src_as; /* Autonomous system number of source */
unsigned int src_peer_as; /* Autonomous system number of source
peer */
as_path_type dst_as_path<>; /* Autonomous system path to the
destination */
unsigned int communities<>; /* Communities associated with this
route */
unsigned int localpref; /* LocalPref associated with this
route */
}
/* Extended user data */
/* Extended user data */
struct extended_user {
string src_user<>; /* User ID associated with packet
source */
string dst_user<>; /* User ID associated with packet
destination */
struct extended_user {
string src_user<>; /* User ID associated with packet
source */
string dst_user<>; /* User ID associated with packet
destination */
}
}
/* Extended URL data */
/* Extended URL data */
enum url_direction {
src = 1, /* URL is associated with source
address */
dst = 2 /* URL is associated with destination
address */
}
enum url_direction {
src = 1, /* URL is associated with source
address */
dst = 2 /* URL is associated with destination
address */
}
struct extended_url {
url_direction direction; /* URL associated with packet source */
string url<>; /* URL associated with the packet flow */
}
struct extended_url {
url_direction direction; /* URL associated with packet source */
string url<>; /* URL associated with the packet flow */
}
/* Extended data */
enum extended_information_type {
SWITCH = 1, /* Extended switch information */
ROUTER = 2, /* Extended router information */
GATEWAY = 3, /* Extended gateway router information */
USER = 4, /* Extended TACACS/RADIUS user information */
URL = 5 /* Extended URL information */
}
/* Extended data */
enum extended_information_type {
SWITCH = 1, /* Extended switch information */
ROUTER = 2, /* Extended router information */
GATEWAY = 3, /* Extended gateway router information */
USER = 4, /* Extended TACACS/RADIUS user information */
URL = 5 /* Extended URL information */
}
union extended_data_type (extended_information_type type) {
case SWITCH:
extended_switch switch;
case ROUTER:
extended_router router;
case GATEWAY:
extended_gateway gateway;
case USER:
extended_user user;
case URL:
extended_url url;
}
union extended_data_type (extended_information_type type) {
case SWITCH:
extended_switch switch;
case ROUTER:
extended_router router;
case GATEWAY:
extended_gateway gateway;
case USER:
extended_user user;
case URL:
extended_url url;
}
/* Format of a single flow sample */
/* Format of a single flow sample */
struct flow_sample {
unsigned int sequence_number; /* Incremented with each flow sample
generated by this source_id */
unsigned int source_id; /* sFlowDataSource encoded as follows:
The most significant byte of the
source_id is used to indicate the
type of sFlowDataSource
(0 = ifIndex,
1 = smonVlanDataSource,
2 = entPhysicalEntry) and the
lower three bytes contain the
relevant index value.*/
struct flow_sample {
unsigned int sequence_number; /* Incremented with each flow sample
generated by this source_id */
unsigned int source_id; /* sFlowDataSource encoded as follows:
The most significant byte of the
source_id is used to indicate the
type of sFlowDataSource
(0 = ifIndex,
1 = smonVlanDataSource,
2 = entPhysicalEntry) and the
lower three bytes contain the
relevant index value.*/
unsigned int sampling_rate; /* sFlowPacketSamplingRate */
unsigned int sample_pool; /* Total number of packets that could
have been sampled (i.e., packets
skipped by sampling process + total
number of samples) */
unsigned int drops; /* Number times a packet was dropped
due to lack of resources */
unsigned int sampling_rate; /* sFlowPacketSamplingRate */
unsigned int sample_pool; /* Total number of packets that could
have been sampled (i.e., packets
skipped by sampling process + total
number of samples) */
unsigned int drops; /* Number times a packet was dropped
due to lack of resources */
unsigned int input; /* SNMP ifIndex of input interface.
0 if interface is not known. */
unsigned int output; /* SNMP ifIndex of output interface,
0 if interface is not known.
Set most significant bit to
indicate multiple destination
interfaces (i.e., in case of
broadcast or multicast)
and set lower order bits to
indicate number of destination
interfaces.
Examples:
0x00000002 indicates ifIndex =
2
0x00000000 ifIndex unknown.
0x80000007 indicates a packet
sent to 7
interfaces.
0x80000000 indicates a packet
sent to an unknown
number of interfaces
greater than 1. */
unsigned int input; /* SNMP ifIndex of input interface.
0 if interface is not known. */
unsigned int output; /* SNMP ifIndex of output interface,
0 if interface is not known.
Set most significant bit to
indicate multiple destination
interfaces (i.e., in case of
broadcast or multicast)
and set lower order bits to
indicate number of destination
interfaces.
Examples:
0x00000002 indicates ifIndex =
2
0x00000000 ifIndex unknown.
0x80000007 indicates a packet
sent to 7
interfaces.
0x80000000 indicates a packet
sent to an unknown
number of interfaces
greater than 1. */
packet_data_type packet_data; /* Information about sampled
packet */
extended_data_type extended_data<>; /* Extended flow information */
}
packet_data_type packet_data; /* Information about sampled
packet */
extended_data_type extended_data<>; /* Extended flow information */
}
/* Counter types */
/* Counter types */
/* Generic interface counters - see RFC 2233 */
/* Generic interface counters - see RFC 2233 */
struct if_counters {
unsigned int ifIndex;
unsigned int ifType;
unsigned hyper ifSpeed;
unsigned int ifDirection; /* derived from MAU MIB (RFC 2668)
0 = unknown, 1=full-duplex,
2=half-duplex, 3 = in, 4=out */
unsigned int ifStatus; /* bit field with the following bits
assigned
bit 0 = ifAdminStatus
(0 = down, 1 = up)
bit 1 = ifOperStatus
(0 = down, 1 = up) */
unsigned hyper ifInOctets;
unsigned int ifInUcastPkts;
unsigned int ifInMulticastPkts;
unsigned int ifInBroadcastPkts;
unsigned int ifInDiscards;
unsigned int ifInErrors;
unsigned int ifInUnknownProtos;
unsigned hyper ifOutOctets;
unsigned int ifOutUcastPkts;
unsigned int ifOutMulticastPkts;
unsigned int ifOutBroadcastPkts;
unsigned int ifOutDiscards;
unsigned int ifOutErrors;
unsigned int ifPromiscuousMode;
}
struct if_counters {
unsigned int ifIndex;
unsigned int ifType;
unsigned hyper ifSpeed;
unsigned int ifDirection; /* derived from MAU MIB (RFC 2668)
0 = unknown, 1=full-duplex,
2=half-duplex, 3 = in, 4=out */
unsigned int ifStatus; /* bit field with the following bits
assigned
bit 0 = ifAdminStatus
(0 = down, 1 = up)
bit 1 = ifOperStatus
(0 = down, 1 = up) */
unsigned hyper ifInOctets;
unsigned int ifInUcastPkts;
unsigned int ifInMulticastPkts;
unsigned int ifInBroadcastPkts;
unsigned int ifInDiscards;
unsigned int ifInErrors;
unsigned int ifInUnknownProtos;
unsigned hyper ifOutOctets;
unsigned int ifOutUcastPkts;
unsigned int ifOutMulticastPkts;
unsigned int ifOutBroadcastPkts;
unsigned int ifOutDiscards;
unsigned int ifOutErrors;
unsigned int ifPromiscuousMode;
}
/* Ethernet interface counters - see RFC 2358 */
/* Ethernet interface counters - see RFC 2358 */
struct ethernet_counters {
if_counters generic;
unsigned int dot3StatsAlignmentErrors;
unsigned int dot3StatsFCSErrors;
unsigned int dot3StatsSingleCollisionFrames;
unsigned int dot3StatsMultipleCollisionFrames;
unsigned int dot3StatsSQETestErrors;
unsigned int dot3StatsDeferredTransmissions;
unsigned int dot3StatsLateCollisions;
unsigned int dot3StatsExcessiveCollisions;
unsigned int dot3StatsInternalMacTransmitErrors;
unsigned int dot3StatsCarrierSenseErrors;
unsigned int dot3StatsFrameTooLongs;
struct ethernet_counters {
if_counters generic;
unsigned int dot3StatsAlignmentErrors;
unsigned int dot3StatsFCSErrors;
unsigned int dot3StatsSingleCollisionFrames;
unsigned int dot3StatsMultipleCollisionFrames;
unsigned int dot3StatsSQETestErrors;
unsigned int dot3StatsDeferredTransmissions;
unsigned int dot3StatsLateCollisions;
unsigned int dot3StatsExcessiveCollisions;
unsigned int dot3StatsInternalMacTransmitErrors;
unsigned int dot3StatsCarrierSenseErrors;
unsigned int dot3StatsFrameTooLongs;
unsigned int dot3StatsInternalMacReceiveErrors;
unsigned int dot3StatsSymbolErrors;
}
unsigned int dot3StatsInternalMacReceiveErrors;
unsigned int dot3StatsSymbolErrors;
}
/* FDDI interface counters - see RFC 1512 */
struct fddi_counters {
if_counters generic;
}
/* FDDI interface counters - see RFC 1512 */
struct fddi_counters {
if_counters generic;
}
/* Token ring counters - see RFC 1748 */
/* Token ring counters - see RFC 1748 */
struct tokenring_counters {
if_counters generic;
unsigned int dot5StatsLineErrors;
unsigned int dot5StatsBurstErrors;
unsigned int dot5StatsACErrors;
unsigned int dot5StatsAbortTransErrors;
unsigned int dot5StatsInternalErrors;
unsigned int dot5StatsLostFrameErrors;
unsigned int dot5StatsReceiveCongestions;
unsigned int dot5StatsFrameCopiedErrors;
unsigned int dot5StatsTokenErrors;
unsigned int dot5StatsSoftErrors;
unsigned int dot5StatsHardErrors;
unsigned int dot5StatsSignalLoss;
unsigned int dot5StatsTransmitBeacons;
unsigned int dot5StatsRecoverys;
unsigned int dot5StatsLobeWires;
unsigned int dot5StatsRemoves;
unsigned int dot5StatsSingles;
unsigned int dot5StatsFreqErrors;
}
struct tokenring_counters {
if_counters generic;
unsigned int dot5StatsLineErrors;
unsigned int dot5StatsBurstErrors;
unsigned int dot5StatsACErrors;
unsigned int dot5StatsAbortTransErrors;
unsigned int dot5StatsInternalErrors;
unsigned int dot5StatsLostFrameErrors;
unsigned int dot5StatsReceiveCongestions;
unsigned int dot5StatsFrameCopiedErrors;
unsigned int dot5StatsTokenErrors;
unsigned int dot5StatsSoftErrors;
unsigned int dot5StatsHardErrors;
unsigned int dot5StatsSignalLoss;
unsigned int dot5StatsTransmitBeacons;
unsigned int dot5StatsRecoverys;
unsigned int dot5StatsLobeWires;
unsigned int dot5StatsRemoves;
unsigned int dot5StatsSingles;
unsigned int dot5StatsFreqErrors;
}
/* 100 BaseVG interface counters - see RFC 2020 */
/* 100 BaseVG interface counters - see RFC 2020 */
struct vg_counters {
if_counters generic;
unsigned int dot12InHighPriorityFrames;
unsigned hyper dot12InHighPriorityOctets;
unsigned int dot12InNormPriorityFrames;
unsigned hyper dot12InNormPriorityOctets;
unsigned int dot12InIPMErrors;
unsigned int dot12InOversizeFrameErrors;
unsigned int dot12InDataErrors;
unsigned int dot12InNullAddressedFrames;
unsigned int dot12OutHighPriorityFrames;
unsigned hyper dot12OutHighPriorityOctets;
unsigned int dot12TransitionIntoTrainings;
struct vg_counters {
if_counters generic;
unsigned int dot12InHighPriorityFrames;
unsigned hyper dot12InHighPriorityOctets;
unsigned int dot12InNormPriorityFrames;
unsigned hyper dot12InNormPriorityOctets;
unsigned int dot12InIPMErrors;
unsigned int dot12InOversizeFrameErrors;
unsigned int dot12InDataErrors;
unsigned int dot12InNullAddressedFrames;
unsigned int dot12OutHighPriorityFrames;
unsigned hyper dot12OutHighPriorityOctets;
unsigned int dot12TransitionIntoTrainings;
unsigned hyper dot12HCInHighPriorityOctets;
unsigned hyper dot12HCInNormPriorityOctets;
unsigned hyper dot12HCOutHighPriorityOctets;
}
unsigned hyper dot12HCInHighPriorityOctets;
unsigned hyper dot12HCInNormPriorityOctets;
unsigned hyper dot12HCOutHighPriorityOctets;
}
/* WAN counters */
/* WAN counters */
struct wan_counters {
if_counters generic;
}
struct wan_counters {
if_counters generic;
}
/* VLAN counters */
/* VLAN counters */
struct vlan_counters {
unsigned int vlan_id;
unsigned hyper octets;
unsigned int ucastPkts;
unsigned int multicastPkts;
unsigned int broadcastPkts;
unsigned int discards;
}
struct vlan_counters {
unsigned int vlan_id;
unsigned hyper octets;
unsigned int ucastPkts;
unsigned int multicastPkts;
unsigned int broadcastPkts;
unsigned int discards;
}
/* Counter data */
/* Counter data */
enum counters_version {
GENERIC = 1,
ETHERNET = 2,
TOKENRING = 3,
FDDI = 4,
VG = 5,
WAN = 6,
VLAN = 7
}
enum counters_version {
GENERIC = 1,
ETHERNET = 2,
TOKENRING = 3,
FDDI = 4,
VG = 5,
WAN = 6,
VLAN = 7
}
union counters_type (counters_version version) {
case GENERIC:
if_counters generic;
case ETHERNET:
ethernet_counters ethernet;
case TOKENRING:
tokenring_counters tokenring;
case FDDI:
fddi_counters fddi;
case VG:
vg_counters vg;
case WAN:
wan_counters wan;
case VLAN:
union counters_type (counters_version version) {
case GENERIC:
if_counters generic;
case ETHERNET:
ethernet_counters ethernet;
case TOKENRING:
tokenring_counters tokenring;
case FDDI:
fddi_counters fddi;
case VG:
vg_counters vg;
case WAN:
wan_counters wan;
case VLAN:
vlan_counters vlan;
}
vlan_counters vlan;
}
/* Format of a single counter sample */
/* Format of a single counter sample */
struct counters_sample {
unsigned int sequence_number; /* Incremented with each counter
sample generated by this
source_id */
unsigned int source_id; /* sFlowDataSource encoded as
follows:
The most significant byte of the
source_id is used to indicate the
type of sFlowDataSource
(0 = ifIndex,
1 = smonVlanDataSource,
2 = entPhysicalEntry) and the
lower three
bytes contain the relevant
index value.*/
struct counters_sample {
unsigned int sequence_number; /* Incremented with each counter
sample generated by this
source_id */
unsigned int source_id; /* sFlowDataSource encoded as
follows:
The most significant byte of the
source_id is used to indicate the
type of sFlowDataSource
(0 = ifIndex,
1 = smonVlanDataSource,
2 = entPhysicalEntry) and the
lower three
bytes contain the relevant
index value.*/
unsigned int sampling_interval; /* sFlowCounterSamplingInterval*/
counters_type counters;
}
unsigned int sampling_interval; /* sFlowCounterSamplingInterval*/
counters_type counters;
}
/* Format of a sample datagram */
/* Format of a sample datagram */
enum sample_types {
FLOWSAMPLE = 1,
COUNTERSSAMPLE = 2
}
enum sample_types {
FLOWSAMPLE = 1,
COUNTERSSAMPLE = 2
}
union sample_type (sample_types sampletype) {
case FLOWSAMPLE:
flow_sample flowsample;
case COUNTERSSAMPLE:
counters_sample counterssample;
}
union sample_type (sample_types sampletype) {
case FLOWSAMPLE:
flow_sample flowsample;
case COUNTERSSAMPLE:
counters_sample counterssample;
}
struct sample_datagram_v4 {
address agent_address /* IP address of sampling agent,
sFlowAgentAddress. */
unsigned int sequence_number; /* Incremented with each sample
datagram generated */
unsigned int uptime; /* Current time (in milliseconds since
device last booted). Should be set
as close to datagram transmission
time as possible.*/
struct sample_datagram_v4 {
address agent_address /* IP address of sampling agent,
sFlowAgentAddress. */
unsigned int sequence_number; /* Incremented with each sample
datagram generated */
unsigned int uptime; /* Current time (in milliseconds since
device last booted). Should be set
as close to datagram transmission
time as possible.*/
sample_type samples<>; /* An array of flow, counter and delay
samples */
}
sample_type samples<>; /* An array of flow, counter and delay
samples */
}
enum datagram_version {
VERSION4 = 4
}
enum datagram_version {
VERSION4 = 4
}
union sample_datagram_type (datagram_version version) {
case VERSION4:
sample_datagram_v4 datagram;
}
union sample_datagram_type (datagram_version version) {
case VERSION4:
sample_datagram_v4 datagram;
}
struct sample_datagram {
sample_datagram_type version;
}
struct sample_datagram {
sample_datagram_type version;
}
The sFlow Datagram specification makes use of definitions from a number of existing RFCs [22], [23], [24], [25], [26], [27] and [28].
sFlow数据报规范使用了许多现有RFC[22]、[23]、[24]、[25]、[26]、[27]和[28]中的定义。
Deploying a traffic monitoring system raises a number of security related issues. sFlow does not provide specific security mechanisms, relying instead on proper deployment and configuration to maintain an adequate level of security.
部署交通监控系统会引发许多与安全相关的问题。sFlow不提供特定的安全机制，而是依靠适当的部署和配置来维持足够的安全级别。
While the deployment of traffic monitoring systems does create some risk, it also provides a powerful means of detecting and tracing unauthorized network activity.
虽然流量监控系统的部署确实会带来一些风险，但它也提供了检测和跟踪未经授权的网络活动的强大手段。
This section is intended to provide information that will help understand potential risks and configuration options for mitigating those risks.
本节旨在提供有助于了解潜在风险的信息以及缓解这些风险的配置选项。
The sFlow MIB is used to configure the generation of sFlow samples. The security of SNMP, with access control lists, is usually considered adequate in an enterprise setting. However, there are situations when these security measures are insufficient (for example a WAN router) and SNMP configuration control will be disabled.
sFlow MIB用于配置sFlow样本的生成。具有访问控制列表的SNMP的安全性在企业环境中通常被认为是足够的。但是，有些情况下，这些安全措施不足（例如WAN路由器），SNMP配置控制将被禁用。
When SNMP is disabled, a command line interface is typically provided. The following arguments are required to configure sFlow sampling on an interface.
禁用SNMP时，通常会提供命令行界面。在接口上配置sFlow采样需要以下参数。
-sFlowDataSource <source>
-sFlowPacketSamplingRate <rate>
-sFlowCounterSamplingInterval <interval>
-sFlowMaximumHeaderSize <header size>
-sFlowMaximumDatagramSize <datagram size>
-sFlowCollectorAddress <address>
-sFlowCollectorPort <port>
-sFlowDataSource <source>
-sFlowPacketSamplingRate <rate>
-sFlowCounterSamplingInterval <interval>
-sFlowMaximumHeaderSize <header size>
-sFlowMaximumDatagramSize <datagram size>
-sFlowCollectorAddress <address>
-sFlowCollectorPort <port>
Traffic information is sent unencrypted across the network from the sFlow Agent to the sFlow Analyzer and is thus vulnerable to eavesdropping. This risk can be limited by creating a secure measurement network and routing the sFlow Datagrams over this network. The choice of technology for creating the secure measurement network is deployment specific, but could include the use of VLANs or VPN tunnels.
流量信息通过网络从sFlow代理未加密地发送到sFlow Analyzer，因此容易被窃听。通过创建安全的测量网络并在此网络上路由sFlow数据报，可以限制此风险。创建安全测量网络的技术选择取决于部署，但可能包括使用VLAN或VPN隧道。
The sFlow Analyzer is vulnerable to attacks involving spoofed sFlow Datagrams. To limit this vulnerability the sFlow Analyzer should check sequence numbers and verify source addresses. If a secure measurement network has been constructed then only sFlow Datagrams received from that network should be processed.
sFlow Analyzer容易受到涉及伪造sFlow数据报的攻击。为限制此漏洞，sFlow Analyzer应检查序列号并验证源地址。如果已构建安全测量网络，则仅应处理从该网络接收的sFlow数据报。
Traffic information can reveal confidential information about individual network users. The degree of visibility of application level data can be controlled by limiting the number of header bytes captured by the sFlow agent. In addition, packet sampling makes it virtually impossible to capture sequences of packets from an individual transaction.
流量信息可能会泄露个人网络用户的机密信息。可以通过限制sFlow代理捕获的头字节数来控制应用程序级数据的可见性。此外，数据包采样几乎不可能从单个事务中捕获数据包序列。
The traffic patterns discernible by decoding the sFlow Datagrams in the sFlow Analyzer can reveal details of an individual's network related activities and due care should be taken to secure access to the sFlow Analyzer.
通过对sFlow Analyzer中的sFlow数据报进行解码可识别的流量模式可揭示个人网络相关活动的详细信息，应采取适当措施确保对sFlow Analyzer的访问安全。
[1] Sun Microsystems, Inc., "XDR: External Data Representation Standard", RFC 1014, June 1987.
[1] Sun Microsystems，Inc.，“XDR：外部数据表示标准”，RFC 10141987年6月。
[2] Harrington, D., Presuhn, R., and B. Wijnen, "An Architecture for Describing SNMP Management Frameworks", RFC 2571, April 1999.
[2] Harrington，D.，Presuhn，R.，和B.Wijnen，“描述SNMP管理框架的体系结构”，RFC 2571，1999年4月。
[3] Rose, M. and K. McCloghrie, "Structure and Identification of Management Information for TCP/IP-based Internets", STD 16, RFC 1155, May 1990.
[3] Rose，M.和K.McCloghrie，“基于TCP/IP的互联网管理信息的结构和识别”，STD 16，RFC 1155，1990年5月。
[4] Rose, M. and K. McCloghrie, "Concise MIB Definitions", STD 16, RFC 1212, March 1991.
[4] Rose，M.和K.McCloghrie，“简明MIB定义”，STD 16，RFC 1212，1991年3月。
[5] Rose, M., "A Convention for Defining Traps for use with the SNMP", RFC 1215, March 1991.
[5] Rose，M.“定义用于SNMP的陷阱的约定”，RFC1215，1991年3月。
[6] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J., Rose, M. and S. Waldbusser, "Structure of Management Information Version 2 (SMIv2)", STD 58, RFC 2578, April 1999.
[6] McCloghrie，K.，Perkins，D.，Schoenwaeld，J.，Case，J.，Rose，M.和S.Waldbusser，“管理信息的结构版本2（SMIv2）”，STD 58，RFC 2578，1999年4月。
[7] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J., Rose, M. and S. Waldbusser, "Textual Conventions for SMIv2", STD 58, RFC 2579, April 1999.
[7] McCloghrie，K.，Perkins，D.，Schoenwaeld，J.，Case，J.，Rose，M.和S.Waldbusser，“SMIv2的文本约定”，STD 58，RFC 2579，1999年4月。
[8] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J., Rose, M. and S. Waldbusser, "Conformance Statements for SMIv2", STD 58, RFC 2580, April 1999.
[8] McCloghrie，K.，Perkins，D.，Schoenwaeld，J.，Case，J.，Rose，M.和S.Waldbusser，“SMIv2的一致性声明”，STD 58，RFC 25801999年4月。
[9] Case, J., Fedor, M., Schoffstall, M. and J. Davin, "Simple Network Management Protocol", STD 15, RFC 1157, May 1990.
[9] Case，J.，Fedor，M.，Schoffstall，M.和J.Davin，“简单网络管理协议”，STD 15，RFC 1157，1990年5月。
[10] Case, J., McCloghrie, K., Rose, M. and S. Waldbusser, "Introduction to Community-based SNMPv2", RFC 1901, January 1996.
[10] Case，J.，McCloghrie，K.，Rose，M.和S.Waldbusser，“基于社区的SNMPv2简介”，RFC 19011996年1月。
[11] Case, J., McCloghrie, K., Rose, M. and S. Waldbusser, "Transport Mappings for Version 2 of the Simple Network Management Protocol (SNMPv2)", RFC 1906, January 1996.
[11] Case，J.，McCloghrie，K.，Rose，M.和S.Waldbusser，“简单网络管理协议（SNMPv2）版本2的传输映射”，RFC 1906，1996年1月。
[12] Case, J., Harrington D., Presuhn R. and B. Wijnen, "Message Processing and Dispatching for the Simple Network Management Protocol (SNMP)", RFC 2572, April 1999.
[12] Case，J.，Harrington D.，Presohn R.和B.Wijnen，“简单网络管理协议（SNMP）的消息处理和调度”，RFC 2572，1999年4月。
[13] Blumenthal, U. and B. Wijnen, "User-based Security Model (USM) for version 3 of the Simple Network Management Protocol (SNMPv3)", RFC 2574, April 1999.
[13] Blumenthal，U.和B.Wijnen，“简单网络管理协议（SNMPv3）第3版的基于用户的安全模型（USM）”，RFC 2574，1999年4月。
[14] Case, J., McCloghrie, K., Rose, M. and S. Waldbusser, "Protocol Operations for Version 2 of the Simple Network Management Protocol (SNMPv2)", RFC 1905, January 1996.
[14] Case，J.，McCloghrie，K.，Rose，M.和S.Waldbusser，“简单网络管理协议（SNMPv2）版本2的协议操作”，RFC 1905，1996年1月。
[15] Levi, D., Meyer, P. and B. Stewart, "SNMPv3 Applications", RFC 2573, April 1999.
[15] Levi，D.，Meyer，P.和B.Stewart，“SNMPv3应用”，RFC2573，1999年4月。
[16] Wijnen, B., Presuhn, R. and K. McCloghrie, "View-based Access Control Model (VACM) for the Simple Network Management Protocol (SNMP)", RFC 2575, April 1999.
[16] Wijnen，B.，Presuhn，R.和K.McCloghrie，“用于简单网络管理协议（SNMP）的基于视图的访问控制模型（VACM）”，RFC2575，1999年4月。
[17] Case, J., Mundy, R., Partain, D. and B. Stewart, "Introduction to Version 3 of the Internet-standard Network Management Framework", RFC 2570, April 1999.
[17] Case，J.，Mundy，R.，Partain，D.和B.Stewart，“互联网标准网络管理框架第3版简介”，RFC 25701999年4月。
[18] Waldbusser, S., "Remote Network Monitoring Management Information Base", RFC 2819, May 2000.
[18] Waldbusser，S.，“远程网络监测管理信息库”，RFC 2819，2000年5月。
[19] Waterman, R., Lahaye, B., Romascanu, D. and S. Waldbusser, "Remote Network Monitoring MIB Extensions for Switched Networks Version 1.0", RFC 2613, June 1999.
[19] Waterman，R.，Lahaye，B.，Romascanu，D.和S.Waldbusser，“交换网络1.0版的远程网络监控MIB扩展”，RFC 2613，1999年6月。
[20] Daniele, M., Haberman, B., Routhier, S. and J. Schoenwaelder, "Textual Conventions for Internet Network Addresses", RFC 2851, June 2000.
[20] Daniele，M.，Haberman，B.，Routhier，S.和J.Schoenwaeld，“因特网网络地址的文本约定”，RFC 28512000年6月。
[21] Brownlee, N., "Traffic Flow Measurement: Meter MIB", RFC 2720, October 1999.
[21] 北布朗利，“交通流量测量：仪表MIB”，RFC2720，1999年10月。
[22] Smith, A., Flick, J., de Graaf, K., Romanscanu, D., McMaster, D., McCloghrie, K. and S. Roberts, "Definition of Managed Objects for IEEE 802.3 Medium Attachment Units (MAUs)", RFC 2668, August 1999.
[22] Smith，A.，Flick，J.，de Graaf，K.，Romanscanu，D.，McMaster，D.，McCloghrie，K.和S.Roberts，“IEEE 802.3介质连接单元（MAU）受管对象的定义”，RFC 26681999年8月。
[23] McCloghrie, K. and F. Kastenholz, "The Interfaces Group MIB using SMIv2", RFC 2233, November 1997.
[23] McCloghrie，K.和F.Kastenholz，“使用SMIv2的接口组MIB”，RFC 2233，1997年11月。
[24] Flick, J. and J. Johnson, "Definition of Managed Objects for the Ethernet-like Interface Types", RFC 2358, June 1998.
[24] Flick，J.和J.Johnson，“类似以太网接口类型的托管对象定义”，RFC 2358，1998年6月。
[25] Case, J., "FDDI Management Information Base", RFC 1512, September 1993.
[25] Case，J.，“FDDI管理信息库”，RFC 1512，1993年9月。
[26] McCloghrie, K. and E. Decker, "IEEE 802.5 MIB using SMIv2", RFC 1748, December 1994.
[26] McCloghrie，K.和E.Decker，“使用SMIv2的IEEE 802.5 MIB”，RFC 17481994年12月。
[27] Flick, J., "Definitions of Managed Objects for IEEE 802.12 Interfaces", RFC 2020, October 1996.
[27] Flick，J.，“IEEE 802.12接口受管对象的定义”，RFC 2020，1996年10月。
[28] Willis, S., Burruss, J. and J. Chu, "Definitions of Managed Objects for the Fourth Version of the Border Gateway Protocol (BGP-4) using SMIv2", RFC 1657, July 1994.
[28] Willis，S.，Burruss，J.和J.Chu，“使用SMIv2的第四版边界网关协议（BGP-4）的托管对象定义”，RFC 1657，1994年7月。
Peter Phaal InMon Corporation 1404 Irving Street San Francisco, CA 94122
Peter Phaal InMon公司1404欧文街旧金山，CA 94122
Phone: (415) 661-6343 EMail: peter_phaal@INMON.COM
电话：（415）661-6343电子邮件：peter_phaal@INMON.COM
Sonia Panchen InMon Corporation 1404 Irving Street San Francisco, CA 94122
Sonia Panchen InMon公司1404欧文街旧金山，CA 94122
Phone: (415) 661-6343 EMail: sonia_panchen@INMON.COM
电话：（415）661-6343电子邮件：sonia_panchen@INMON.COM
Neil McKee InMon Corporation 1404 Irving Street San Francisco, CA 94122
Neil McKee InMon公司1404欧文街旧金山，CA 94122
Phone: (415) 661-6343 EMail: neil_mckee@INMON.COM
电话：（415）661-6343电子邮件：neil_mckee@INMON.COM
The IETF takes no position regarding the validity or scope of any intellectual property or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; neither does it represent that it has made any effort to identify any such rights. Information on the IETF's procedures with respect to rights in standards-track and standards-related documentation can be found in BCP-11. Copies of claims of rights made available for publication and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementors or users of this specification can be obtained from the IETF Secretariat.
IETF对可能声称与本文件所述技术的实施或使用有关的任何知识产权或其他权利的有效性或范围，或此类权利下的任何许可可能或可能不可用的程度，不采取任何立场；它也不表示它已作出任何努力来确定任何此类权利。有关IETF在标准跟踪和标准相关文件中权利的程序信息，请参见BCP-11。可从IETF秘书处获得可供发布的权利声明副本和任何许可证保证，或本规范实施者或用户试图获得使用此类专有权利的一般许可证或许可的结果。
The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights which may cover technology that may be required to practice this standard. Please address the information to the IETF Executive Director.
IETF邀请任何相关方提请其注意任何版权、专利或专利申请，或其他可能涉及实施本标准所需技术的专有权利。请将信息发送给IETF执行董事。
Copyright (C) The Internet Society (2001). All Rights Reserved.
版权所有（C）互联网协会（2001年）。版权所有。
This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English.
本文件及其译本可复制并提供给他人，对其进行评论或解释或协助其实施的衍生作品可全部或部分编制、复制、出版和分发，不受任何限制，前提是上述版权声明和本段包含在所有此类副本和衍生作品中。但是，不得以任何方式修改本文件本身，例如删除版权通知或对互联网协会或其他互联网组织的引用，除非出于制定互联网标准的需要，在这种情况下，必须遵循互联网标准过程中定义的版权程序，或根据需要将其翻译成英语以外的其他语言。
The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns.
上述授予的有限许可是永久性的，互联网协会或其继承人或受让人不会撤销。
This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
本文件和其中包含的信息是按“原样”提供的，互联网协会和互联网工程任务组否认所有明示或暗示的保证，包括但不限于任何保证，即使用本文中的信息不会侵犯任何权利，或对适销性或特定用途适用性的任何默示保证。
Acknowledgement
确认
Funding for the RFC Editor function is currently provided by the Internet Society.
RFC编辑功能的资金目前由互联网协会提供。