File: rfc1353.txt

package info (click to toggle)
doc-rfc 20181229-2
  • links: PTS, VCS
  • area: non-free
  • in suites: buster
  • size: 570,944 kB
  • sloc: xml: 285,646; sh: 107; python: 90; perl: 42; makefile: 14
file content (1459 lines) | stat: -rw-r--r-- 59,556 bytes parent folder | download | duplicates (8)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338
1339
1340
1341
1342
1343
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362
1363
1364
1365
1366
1367
1368
1369
1370
1371
1372
1373
1374
1375
1376
1377
1378
1379
1380
1381
1382
1383
1384
1385
1386
1387
1388
1389
1390
1391
1392
1393
1394
1395
1396
1397
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415
1416
1417
1418
1419
1420
1421
1422
1423
1424
1425
1426
1427
1428
1429
1430
1431
1432
1433
1434
1435
1436
1437
1438
1439
1440
1441
1442
1443
1444
1445
1446
1447
1448
1449
1450
1451
1452
1453
1454
1455
1456
1457
1458
1459






Network Working Group                                     K. McCloghrie
Request for Comments: 1353                     Hughes LAN Systems, Inc.
                                                               J. Davin
                                    MIT Laboratory for Computer Science
                                                              J. Galvin
                                      Trusted Information Systems, Inc.
                                                              July 1992


                     Definitions of Managed Objects
                   for Administration of SNMP Parties

Status of this Memo

   This document specifies an IAB standards track protocol for the
   Internet community, and requests discussion and suggestions for
   improvements. Please refer to the current edition of the "IAB
   Official Protocol Standards" for the standardization state and status
   of this protocol. Distribution of this memo is unlimited.

Abstract

   This memo defines a portion of the Management Information Base (MIB)
   for use with network management protocols in TCP/IP-based internets.
   In particular, it describes a representation of the SNMP parties
   defined in [8] as objects defined according to the Internet Standard
   SMI [1]. These definitions are consistent with the SNMP Security
   protocols set forth in [9].

Table of Contents

   1. The Network Management Framework ...........................    2
   2. Objects ....................................................    2
   2.1 Format of Definitions .....................................    3
   3. Overview ...................................................    3
   3.1 Structure .................................................    3
   3.2 Instance Identifiers ......................................    3
   3.3 Textual Conventions .......................................    4
   4. Definitions ................................................    4
   4.1 The SNMP Party Public Database Group ......................    9
   4.2 The SNMP Party Secrets Database Group .....................   15
   4.3 The SNMP Access Privileges Database Group .................   18
   4.4 The MIB View Database Group ...............................   21
   5. Acknowledgments ............................................   25
   6. References .................................................   25
   7. Security Considerations.....................................   26
   8. Authors' Addresses..........................................   26




McCloghrie, Davin, & Galvin                                     [Page 1]

RFC 1353                     SNMP Party MIB                    July 1992


1.  The Network Management Framework

   the Internet-standard Network Management Framework consists of three
   components.  They are:

      RFC 1155 which defines the SMI, the mechanisms used for describing
      and naming objects for the purpose of management.  RFC 1212
      defines a more concise description mechanism, which is wholly
      consistent with the SMI.

      RFC 1156 which defines MIB-I, the core set of managed objects for
      the Internet suite of protocols.  RFC 1213, defines MIB-II, an
      evolution of MIB-I based on implementation experience and new
      operational requirements.

      RFC 1157 which defines the SNMP, the protocol used for network
      access to managed objects.

   The Framework permits new objects to be defined for the purpose of
   experimentation and evaluation.

2.  Objects

   Managed objects are accessed via a virtual information store, termed
   the Management Information Base or MIB.  Objects in the MIB are
   defined using the subset of Abstract Syntax Notation One (ASN.1) [5]
   defined in the SMI.  In particular, each object has a name, a syntax,
   and an encoding.  The name is an object identifier, an
   administratively assigned name, which specifies an object type.  The
   object type together with an object instance serves to uniquely
   identify a specific instantiation of the object.  For human
   convenience, we often use a textual string, termed the OBJECT
   DESCRIPTOR, to also refer to the object type.

   The syntax of an object type defines the abstract data structure
   corresponding to that object type.  The ASN.1 language is used for
   this purpose.  However, the SMI [1] purposely restricts the ASN.1
   constructs which may be used.  These restrictions are explicitly made
   for simplicity.

   The encoding of an object type is simply how that object type is
   represented using the object type's syntax.  Implicitly tied to the
   notion of an object type's syntax and encoding is how the object type
   is represented when being transmitted on the network.

   The SMI specifies the use of the basic encoding rules of ASN.1 [6],
   subject to the additional requirements imposed by the SNMP.




McCloghrie, Davin, & Galvin                                     [Page 2]

RFC 1353                     SNMP Party MIB                    July 1992


2.1.  Format of Definitions

   Section 4 contains the specification of all object types contained in
   this MIB module.  The object types are defined using the conventions
   defined in the SMI, as amended by the extensions specified in [7].

3.  Overview

3.1.  Structure

   This MIB contains the definitions for four tables, a number of OBJECT
   IDENTIFIER assignments, and some conventions for initial use with
   some of the assignments.  The four tables are the SNMP Party Public
   database, the SNMP Party Secrets database, the SNMP Access Control
   database, and the SNMP Views database.

   The SNMP Party Public database and the SNMP Party Secrets database
   are defined as separate tables specifically for the purpose of
   positioning them in different parts of the MIB tree namespace.  In
   particular, the SNMP Party Secrets database contains secret
   information, for which security demands that access to it be limited
   to parties which use both authentication and privacy.  It is
   therefore positioned in a separate branch of the MIB tree so as to
   provide for the easiest means of accommodating the required
   limitation.

   In contrast, the SNMP Party Public database contains public
   information about SNMP parties.  In particular, it contains the
   parties' clocks which need to be read-able (but not write-able) by
   unauthenticated queries, since an unauthenticated query of a party's
   clock is the first step of the procedure to re-establish clock
   synchronization (see [9]).

   The objects in this MIB are organized into four groups.  All four of
   the groups are mandatory for those SNMP implementations that realize
   the security framework and mechanisms defined in [8] and [9].

3.2.  Instance Identifiers

   In all four of the tables in this MIB, the object instances are
   identified by values which have an underlying syntax of OBJECT
   IDENTIFIER.  For the Party Public database and the Party Secrets
   database, the index variable is the party identifier.  For the Access
   Control database and the Views database, two index variables are
   defined, both of which have a syntax of OBJECT IDENTIFIER.  (See the
   INDEX clauses in the MIB definitions below for the specific
   variables.)




McCloghrie, Davin, & Galvin                                     [Page 3]

RFC 1353                     SNMP Party MIB                    July 1992


   According to RFC 1212 [7], section 4.1.6, the syntax of the object(s)
   specified in an INDEX clause indicates how to form the instance-
   identifier.  In particular, for each index object which is object
   identifier-valued, its contribution to the instance identifier is:

      `n+1' sub-identifiers, where `n' is the number of sub-identifiers
      in the value (the first sub-identifier is `n' itself, following
      this, each sub-identifier in the value is copied).

3.3.  Textual Conventions

   The datatypes, Party, Clock, and TAddress, are used as textual
   conventions in this document.  These textual conventions have NO
   effect on either the syntax nor the semantics of any managed object.
   Objects defined using these conventions are always encoded by means
   of the rules that define their primitive type.  Hence, no changes to
   the SMI or the SNMP are necessary to accommodate these textual
   conventions which are adopted merely for the convenience of readers.

4.  Definitions

          RFC1353-MIB DEFINITIONS ::= BEGIN

          IMPORTS
                  system, mib, private, internet    FROM RFC1155-SMI
                  OBJECT-TYPE                       FROM RFC-1212;

          snmpParties     OBJECT IDENTIFIER ::= { mib-2 20 }
          partyAdmin      OBJECT IDENTIFIER ::= { snmpParties 1 }
          partyPublic     OBJECT IDENTIFIER ::= { snmpParties 2 }

          snmpSecrets     OBJECT IDENTIFIER ::= { mib-2 21 }
          partyPrivate    OBJECT IDENTIFIER ::= { snmpSecrets 1 }
          partyAccess     OBJECT IDENTIFIER ::= { snmpSecrets 2 }
          partyViews      OBJECT IDENTIFIER ::= { snmpSecrets 3 }


          --                  Textual Conventions

          --    A textual convention denoting a SNMP party identifier:

          Party ::= OBJECT IDENTIFIER


          --    A party's authentication clock - a non-negative integer
          -- which is incremented as specified/allowed by the party's
          -- Authentication Protocol.
          --    For noAuth, a party's authentication clock is unused and



McCloghrie, Davin, & Galvin                                     [Page 4]

RFC 1353                     SNMP Party MIB                    July 1992


          -- its value is undefined.
          --    For md5AuthProtocol, a party's authentication clock is a
          -- relative clock with 1-second granularity.

          Clock ::= INTEGER (0..2147483647)


          --    A textual convention denoting a transport service
          -- address.
          --    For rfc1351Domain, a TAddress is 6 octets long,
          -- the initial 4 octets containing the IP-address in
          -- network-byte order and the last 2 containing the
          -- UDP port in network-byte order.

          TAddress ::= OCTET STRING


          --- Definitions of Security Protocols

          partyProtocols
              OBJECT IDENTIFIER ::= { partyAdmin 1 }

          noAuth                  -- The protocol without authentication
              OBJECT IDENTIFIER ::= { partyProtocols 1 }

          noPriv                  -- The protocol without privacy
              OBJECT IDENTIFIER ::= { partyProtocols 3 }

          desPrivProtocol         -- The DES Privacy Protocol
              OBJECT IDENTIFIER ::= { partyProtocols 4 }

          md5AuthProtocol         -- The MD5 Authentication Protocol
              OBJECT IDENTIFIER ::= { partyProtocols 5 }


          --- definitions of Transport Domains

          transportDomains
              OBJECT IDENTIFIER ::= { partyAdmin 2 }

          rfc1351Domain --- RFC-1351 (SNMP over UDP, using SNMP Parties)
              OBJECT IDENTIFIER ::= { transportDomains 1 }









McCloghrie, Davin, & Galvin                                     [Page 5]

RFC 1353                     SNMP Party MIB                    July 1992


          --- definitions of Proxy Domains

          proxyDomains
              OBJECT IDENTIFIER ::= { partyAdmin 3 }

          noProxy                --- Local operation
              OBJECT IDENTIFIER ::= { proxyDomains 1 }


          ---    Definition of Initial Party Identifiers

          --  When devices are installed, they need to be configured
          --  with an initial set of SNMP parties.  The configuration
          --  of SNMP parties requires (among other things) the
          --  assignment of several OBJECT IDENTIFIERs.  Any local
          --  network administration can obtain the delegated
          --  authority necessary to assign its own OBJECT
          --  IDENTIFIERs.  However, to provide for those
          --  administrations who have not obtained the necessary
          --  authority, this document allocates a branch of the
          --  naming tree for use with the following conventions.

          initialPartyId
              OBJECT IDENTIFIER ::= { partyAdmin 4 }

          --  Note these are identified as "initial" party identifiers
          --  since these allow secure SNMP communication to proceed,
          --  thereby allowing further SNMP parties to be configured
          --  through use of the SNMP itself.

          --  The following definitions identify a party identifier,
          --  and specify the initial values of various object
          --  instances indexed by that identifier.  In addition,
          --  the initial MIB view and access control parameters
          --  assigned, by convention, to these parties are identified.

          --    Party Identifiers for use as initial SNMP parties
          --       at IP address  a.b.c.d

          -- partyIdentity            = { initialPartyId a b c d 1 }
          -- partyTDomain             = { rfc1351Domain }
          -- partyTAddress            = a.b.c.d, 161
          -- partyProxyFor            = { noProxy }
          -- partyAuthProtocol        = { noAuth }
          -- partyAuthClock           = 0
          -- partySecretsAuthPrivate  = ''h    (the empty string)
          -- partyAuthPublic          = ''h    (the empty string)
          -- partyAuthLifetime        = 0



McCloghrie, Davin, & Galvin                                     [Page 6]

RFC 1353                     SNMP Party MIB                    July 1992


          -- partyPrivProtocol        = { noPriv }
          -- partySecretsPrivPrivate  = ''h    (the empty string)
          -- partyPrivPublic          = ''h    (the empty string)

          -- partyIdentity            = { initialPartyId a b c d 2 }
          -- partyTDomain             = { rfc1351Domain }
          -- partyTAddress            = assigned by local administration
          -- partyProxyFor            = { noProxy }
          -- partyAuthProtocol        = { noAuth }
          -- partyAuthClock           = 0
          -- partySecretsAuthPrivate  = ''h    (the empty string)
          -- partyAuthPublic          = ''h    (the empty string)
          -- partyAuthLifetime        = 0
          -- partyPrivProtocol        = { noPriv }
          -- partySecretsPrivPrivate  = ''h    (the empty string)
          -- partyPrivPublic          = ''h    (the empty string)

          -- partyIdentity            = { initialPartyId a b c d 3 }
          -- partyTDomain             = { rfc1351Domain }
          -- partyTAddress            = a.b.c.d, 161
          -- partyProxyFor            = { noProxy }
          -- partyAuthProtocol        = { md5AuthProtocol }
          -- partyAuthClock           = 0
          -- partySecretsAuthPrivate  = assigned by local administration
          -- partyAuthPublic          = ''h    (the empty string)
          -- partyAuthLifetime        = 300
          -- partyPrivProtocol        = { noPriv }
          -- partySecretsPrivPrivate  = ''h    (the empty string)
          -- partyPrivPublic          = ''h    (the empty string)

          -- partyIdentity            = { initialPartyId a b c d 4 }
          -- partyTDomain             = { rfc1351Domain }
          -- partyTAddress            = assigned by local administration
          -- partyProxyFor            = { noProxy }
          -- partyAuthProtocol        = { md5AuthProtocol }
          -- partyAuthClock           = 0
          -- partySecretsAuthPrivate  = assigned by local administration
          -- partyAuthPublic          = ''h    (the empty string)
          -- partyAuthLifetime        = 300
          -- partyPrivProtocol        = { noPriv }
          -- partySecretsPrivPrivate  = ''h    (the empty string)
          -- partyPrivPublic          = ''h    (the empty string)

          -- partyIdentity            = { initialPartyId a b c d 5 }
          -- partyTDomain             = { rfc1351Domain }
          -- partyTAddress            = a.b.c.d, 161
          -- partyProxyFor            = { noProxy }
          -- partyAuthProtocol        = { md5AuthProtocol }



McCloghrie, Davin, & Galvin                                     [Page 7]

RFC 1353                     SNMP Party MIB                    July 1992


          -- partyAuthClock           = 0
          -- partySecretsAuthPrivate  = assigned by local administration
          -- partyAuthPublic          = ''h    (the empty string)
          -- partyAuthLifetime        = 300
          -- partyPrivProtocol        = { desPrivProtocol }
          -- partySecretsPrivPrivate  = assigned by local administration
          -- partyPrivPublic          = ''h    (the empty string)

          -- partyIdentity            = { initialPartyId a b c d 6 }
          -- partyTDomain             = { rfc1351Domain }
          -- partyTAddress            = assigned by local administration
          -- partyProxyFor            = { noProxy }
          -- partyAuthProtocol        = { md5AuthProtocol }
          -- partyAuthClock           = 0
          -- partySecretsAuthPrivate  = assigned by local administration
          -- partyAuthPublic          = ''h    (the empty string)
          -- partyAuthLifetime        = 300
          -- partyPrivProtocol        = { desPrivProtocol }
          -- partySecretsPrivPrivate  = assigned by local administration
          -- partyPrivPublic          = ''h   (the empty string)


          --  The initial access control parameters assigned, by
          --  convention, to these parties are:

          -- aclTarget     = { initialPartyId a b c d 1 }
          -- aclSubject    = { initialPartyId a b c d 2 }
          -- aclPrivileges = 3 (Get & Get-Next)

          -- aclTarget     = { initialPartyId a b c d 2 }
          -- aclSubject    = { initialPartyId a b c d 1 }
          -- aclPrivileges = 20 (GetResponse & Trap)

          -- aclTarget     = { initialPartyId a b c d 3 }
          -- aclSubject    = { initialPartyId a b c d 4 }
          -- aclPrivileges = 11 (Get, Get-Next & Set)

          -- aclTarget     = { initialPartyId a b c d 4 }
          -- aclSubject    = { initialPartyId a b c d 3 }
          -- aclPrivileges = 20 (GetResponse & Trap)

          -- aclTarget     = { initialPartyId a b c d 5 }
          -- aclSubject    = { initialPartyId a b c d 6 }
          -- aclPrivileges = 11 (Get, Get-Next & Set)

          -- aclTarget     = { initialPartyId a b c d 6 }
          -- aclSubject    = { initialPartyId a b c d 5 }
          -- aclPrivileges = 20 (GetResponse & Trap)



McCloghrie, Davin, & Galvin                                     [Page 8]

RFC 1353                     SNMP Party MIB                    July 1992


          --  The initial MIB views assigned, by convention, to
          --  these parties are:

          -- viewParty    = { initialPartyId a b c d 1 }
          -- viewSubtree  = { system }
          -- viewStatus   = { included }
          -- viewMask     = { ''h }

          -- viewParty    = { initialPartyId a b c d 1 }
          -- viewSubtree  = { snmpParties }
          -- viewStatus   = { included }
          -- viewMask     = { ''h }

          -- viewParty    = { initialPartyId a b c d 3 }
          -- viewSubtree  = { internet }
          -- viewStatus   = { included }
          -- viewMask     = { ''h }

          -- viewParty    = { initialPartyId a b c d 3 }
          -- viewSubtree  = { partyPrivate }
          -- viewStatus   = { excluded }
          -- viewMask     = { ''h }

          -- viewParty    = { initialPartyId a b c d 5 }
          -- viewSubtree  = { internet }
          -- viewStatus   = { included }
          -- viewMask     = { ''h }


          --   The SNMP Party Public Database Group
          --
          -- The non-secret party information.
          --
          -- Implementation of the objects in this group is mandatory.

          partyTable OBJECT-TYPE
              SYNTAX  SEQUENCE OF PartyEntry
              ACCESS  not-accessible
              STATUS  mandatory
              DESCRIPTION
                      "The SNMP Party Public database.

                      An agent must ensure that there is, at all times,
                      a one-to-one correspondence between entries in
                      this table and entries in the partySecretsTable.

                      The creation/deletion of instances in this table
                      via SNMP Set-Requests is not allowed.  Instead,



McCloghrie, Davin, & Galvin                                     [Page 9]

RFC 1353                     SNMP Party MIB                    July 1992


                      entries in this table are created/deleted as a
                      side-effect of the creation/deletion of
                      corresponding entries in the partySecretsTable.

                      Thus, a SNMP Set-Request whose varbinds contain a
                      reference to a non-existent instance of a
                      partyTable object, but no reference to the
                      corresponding instance of a partySecretsTable
                      object, will be rejected."
          ::= { partyPublic 1 }

          partyEntry OBJECT-TYPE
              SYNTAX  PartyEntry
              ACCESS  not-accessible
              STATUS  mandatory
              DESCRIPTION
                      "Locally held non-secret information about a
                      particular SNMP party, which is available for
                      access by network management.  Note that this does
                      not include all locally held information about a
                      party.  In particular, it does not include the
                      'last-timestamp' (i.e., the timestamp of the last
                      authentic message received) or the 'nonce'
                      values."
              INDEX  { partyIdentity }
              ::= { partyTable 1 }

          PartyEntry ::=
              SEQUENCE {
                  partyIdentity
                      Party,
                  partyTDomain
                      OBJECT IDENTIFIER,
                  partyTAddress
                      TAddress,
                  partyProxyFor
                      Party,
                  partyAuthProtocol
                      OBJECT IDENTIFIER,
                  partyAuthClock
                      Clock,
                  partyAuthPublic
                      OCTET STRING,
                  partyAuthLifetime
                      INTEGER,
                  partyPrivProtocol
                      OBJECT IDENTIFIER,
                  partyPrivPublic



McCloghrie, Davin, & Galvin                                    [Page 10]

RFC 1353                     SNMP Party MIB                    July 1992


                      OCTET STRING,
                  partyMaxMessageSize
                      INTEGER,
                  partyStatus
                      INTEGER
              }

          partyIdentity  OBJECT-TYPE
              SYNTAX  Party
              ACCESS  read-write
              STATUS  mandatory
              DESCRIPTION
                      "A party identifier uniquely identifying a
                      particular SNMP party."
              ::= { partyEntry 1 }

          partyTDomain  OBJECT-TYPE
              SYNTAX  OBJECT IDENTIFIER
              ACCESS  read-write
              STATUS  mandatory
              DESCRIPTION
                      "Indicates the kind of transport service by which
                      the party receives network management traffic. An
                      example of a transport domain is 'rfc1351Domain'
                      (SNMP over UDP)."
              DEFVAL  { rfc1351Domain }
              ::= { partyEntry 2 }

          partyTAddress  OBJECT-TYPE
              SYNTAX  TAddress
              ACCESS  read-write
              STATUS  mandatory
              DESCRIPTION
                      "The transport service address by which the party
                      receives network management traffic, formatted
                      according to the corresponding value of
                      partyTDomain.  For rfc1351Domain, partyTAddress is
                      formatted as a 4-octet IP Address concatenated
                      with a 2-octet UDP port number."
              DEFVAL  { '000000000000'h }
              ::= { partyEntry 3 }

          partyProxyFor OBJECT-TYPE
              SYNTAX  Party
              ACCESS  read-write
              STATUS  mandatory
              DESCRIPTION
                      "The identity of a second SNMP party or other



McCloghrie, Davin, & Galvin                                    [Page 11]

RFC 1353                     SNMP Party MIB                    July 1992


                      management entity with which interaction may be
                      necessary to satisfy received management requests.
                      In this context, the distinguished value { noProxy
                      } signifies that the party responds to received
                      management requests by entirely local mechanisms."
              DEFVAL  { noProxy }
              ::= { partyEntry 4 }

          partyAuthProtocol OBJECT-TYPE
              SYNTAX  OBJECT IDENTIFIER
              ACCESS  read-write
              STATUS  mandatory
              DESCRIPTION
                      "The authentication protocol by which all messages
                      generated by the party are authenticated as to
                      origin and integrity.  In this context, the value
                      { noAuth } signifies that messages generated by
                      the party are not authenticated."
              DEFVAL  { md5AuthProtocol }
              ::= { partyEntry 5 }

          partyAuthClock OBJECT-TYPE
              SYNTAX  Clock
              ACCESS  read-write
              STATUS  mandatory
              DESCRIPTION
                      "The authentication clock which represents the
                      local notion of the current time specific to the
                      party.  This value must not be decremented unless
                      the party's secret information is changed
                      simultaneously, at which time the party's nonce
                      and last-timestamp values must also be reset to
                      zero, and the new value of the clock,
                      respectively."
              DEFVAL  { 0 }
              ::= { partyEntry 6 }

          partyAuthPublic OBJECT-TYPE
              SYNTAX  OCTET STRING -- for md5AuthProtocol: (SIZE (0..16))
              ACCESS  read-write
              STATUS  mandatory
              DESCRIPTION
                      "A publically-readable value for the party.

                      Depending on the party's authentication protocol,
                      this value may be needed to support the party's
                      authentication protocol.  Alternatively, it may be
                      used by a manager during the procedure for



McCloghrie, Davin, & Galvin                                    [Page 12]

RFC 1353                     SNMP Party MIB                    July 1992


                      altering secret information about a party.  (For
                      example, by altering the value of an instance of
                      this object in the same SNMP Set-Request used to
                      update an instance of partyAuthPrivate, a
                      subsequent Get-Request can determine if the Set-
                      Request was successful in the event that no
                      response to the Set-Request is received, see RFC
                      1352.)

                      The length of the value is dependent on the
                      party's authentication protocol.  If not used by
                      the authentication protocol, it is recommended
                      that agents support values of any length up to and
                      including the length of the corresponding
                      partyAuthPrivate object."
              DEFVAL  { ''h }      -- the empty string
              ::= { partyEntry 7 }

          partyAuthLifetime OBJECT-TYPE
              SYNTAX  INTEGER (0..2147483647)
              ACCESS  read-write
              STATUS  mandatory
              DESCRIPTION
                      "The lifetime (in units of seconds) which
                      represents an administrative upper bound on
                      acceptable delivery delay for protocol messages
                      generated by the party."
              DEFVAL  { 300 }
              ::= { partyEntry 8 }

          partyPrivProtocol OBJECT-TYPE
              SYNTAX  OBJECT IDENTIFIER
              ACCESS  read-write
              STATUS  mandatory
              DESCRIPTION
                      "The privacy protocol by which all protocol
                      messages received by the party are protected from
                      disclosure.  In this context, the value { noPriv }
                      signifies that messages received by the party are
                      not protected."
              DEFVAL  { noPriv }
              ::= { partyEntry 9 }

          partyPrivPublic OBJECT-TYPE
              SYNTAX  OCTET STRING -- for desPrivProtocol: (SIZE (0..16))
              ACCESS  read-write
              STATUS  mandatory
              DESCRIPTION



McCloghrie, Davin, & Galvin                                    [Page 13]

RFC 1353                     SNMP Party MIB                    July 1992


                      "A publically-readable value for the party.

                      Depending on the party's privacy protocol, this
                      value may be needed to support the party's privacy
                      protocol.  Alternatively, it may be used by a
                      manager as a part of its procedure for altering
                      secret information about a party.  (For example,
                      by altering the value of an instance of this
                      object in the same SNMP Set-Request used to update
                      an instance of partyPrivPrivate, a subsequent
                      Get-Request can determine if the Set-Request was
                      successful in the event that no response to the
                      Set-Request is received, see RFC 1352.)

                      The length of the value is dependent on the
                      party's privacy protocol.  If not used by the
                      privacy protocol, it is recommended that agents
                      support values of any length up to and including
                      the length of the corresponding partyPrivPrivate
                      object."
              DEFVAL  { ''h }     -- the empty string
              ::= { partyEntry 10 }

          partyMaxMessageSize OBJECT-TYPE
              SYNTAX  INTEGER (484..65507)
              ACCESS  read-write
              STATUS  mandatory
              DESCRIPTION
                      "The maximum length in octets of a SNMP message
                      which this party will accept.  For parties which
                      execute at an agent, the agent initializes this
                      object to the maximum length supported by the
                      agent, and does not let the object be set to any
                      larger value.  For parties which do not execute at
                      the agent, the agent must allow the manager to set
                      this object to any legal value, even if it is
                      larger than the agent can generate."
              DEFVAL  { 484 }
              ::= { partyEntry 11 }

          partyStatus OBJECT-TYPE
              SYNTAX  INTEGER  { valid(1), invalid(2) }
              ACCESS  read-only
              STATUS  mandatory
              DESCRIPTION
                      "The status of the locally-held information on a
                      particular SNMP party.




McCloghrie, Davin, & Galvin                                    [Page 14]

RFC 1353                     SNMP Party MIB                    July 1992


                      The instance of this object for a particular party
                      and the instance of partySecretsStatus for the
                      same party always have the same value.

                      This object will typically provide unrestricted
                      read-only access to the status of parties.  In
                      contrast, partySecretsStatus will typically
                      provide restricted read-write access to the status
                      of parties."
              ::= { partyEntry 12 }


          --   The SNMP Party Secrets Database Group

          -- The secret party information
          --
          -- Implementation of the objects in this group is mandatory.

          partySecretsTable OBJECT-TYPE
              SYNTAX  SEQUENCE OF PartySecretsEntry
              ACCESS  not-accessible
              STATUS  mandatory
              DESCRIPTION
                      "The SNMP Party Secrets database."
          ::= { partyPrivate 1 }

          partySecretsEntry OBJECT-TYPE
              SYNTAX  PartySecretsEntry
              ACCESS  not-accessible
              STATUS  mandatory
              DESCRIPTION
                      "Locally held secret information about a
                      particular SNMP party, which is available for
                      access by network management.

                      When a SNMP Set-Request is used to update the
                      values of instances of objects in this table, it
                      is recommended that the same SNMP Set-Request also
                      alter the value of a non-secret object instance
                      (e.g., an instance of partyAuthPublic or
                      partyPrivPublic).  This allows a Get-Request of
                      that non-secret object instance to determine if
                      the Set-Request was successful in the event that
                      no response which matches the Set-Request is
                      received, see RFC 1352."
              INDEX  { partySecretsIdentity }
              ::= { partySecretsTable 1 }




McCloghrie, Davin, & Galvin                                    [Page 15]

RFC 1353                     SNMP Party MIB                    July 1992


          PartySecretsEntry ::=
              SEQUENCE {
                  partySecretsIdentity
                      Party,
                  partySecretsAuthPrivate
                      OCTET STRING,
                  partySecretsPrivPrivate
                      OCTET STRING,
                  partySecretsStatus
                      INTEGER
              }

          partySecretsIdentity  OBJECT-TYPE
              SYNTAX  Party
              ACCESS  read-write
              STATUS  mandatory
              DESCRIPTION
                      "A party identifier uniquely identifying a
                      particular SNMP party."
              ::= { partySecretsEntry 1 }

          partySecretsAuthPrivate OBJECT-TYPE
              SYNTAX  OCTET STRING   -- for md5AuthProtocol: (SIZE (16))
              ACCESS  read-write
              STATUS  mandatory
              DESCRIPTION
                      "An encoding of the party's private authentication
                      key which may be needed to support the
                      authentication protocol.  Although the value of
                      this variable may be altered by a management
                      operation (e.g., a SNMP Set-Request), its value
                      can never be retrieved by a management operation:
                      when read, the value of this variable is the zero
                      length OCTET STRING.

                      The private authentication key is NOT directly
                      represented by the value of this variable, but
                      rather it is represented according to an encoding.
                      This encoding is the bitwise exclusive-OR of the
                      old key with the new key, i.e., of the old private
                      authentication key (prior to the alteration) with
                      the new private authentication key (after the
                      alteration).  Thus, when processing a received
                      protocol Set operation, the new private
                      authentication key is obtained from the value of
                      this variable as the result of a bitwise
                      exclusive-OR of the variable's value and the old
                      private authentication key.  In calculating the



McCloghrie, Davin, & Galvin                                    [Page 16]

RFC 1353                     SNMP Party MIB                    July 1992


                      exclusive-OR, if the old key is shorter than the
                      new key, zero-valued padding is appended to the
                      old key.  If no value for the old key exists, a
                      zero-length OCTET STRING is used in the
                      calculation."
              DEFVAL  { ''h }     -- the empty string
              ::= { partySecretsEntry 2 }

          partySecretsPrivPrivate OBJECT-TYPE
              SYNTAX  OCTET STRING   -- for desPrivProtocol: (SIZE (16))
              ACCESS  read-write
              STATUS  mandatory
              DESCRIPTION
                      "An encoding of the party's private encryption key
                      which may be needed to support the privacy
                      protocol.  Although the value of this variable may
                      be altered by a management operation (e.g., a SNMP
                      Set-Request), its value can never be retrieved by
                      a management operation: when read, the value of
                      this variable is the zero length OCTET STRING.

                      The private encryption key is NOT directly
                      represented by the value of this variable, but
                      rather it is represented according to an encoding.
                      This encoding is the bitwise exclusive-OR of the
                      old key with the new key, i.e., of the old private
                      encryption key (prior to the alteration) with the
                      new private encryption key (after the alteration).
                      Thus, when processing a received protocol Set
                      operation, the new private encryption key is
                      obtained from the value of this variable as the
                      result of a bitwise exclusive-OR of the variable's
                      value and the old private encryption key.  In
                      calculating the exclusive-OR, if the old key is
                      shorter than the new key, zero-valued padding is
                      appended to the old key.  If no value for the old
                      key exists, a zero-length OCTET STRING is used in
                      the calculation."
              DEFVAL  { ''h }     -- the empty string
              ::= { partySecretsEntry 3 }

          partySecretsStatus OBJECT-TYPE
              SYNTAX  INTEGER  { valid(1), invalid(2) }
              ACCESS  read-write
              STATUS  mandatory
              DESCRIPTION
                      "The status of the locally-held information on a
                      particular SNMP party.



McCloghrie, Davin, & Galvin                                    [Page 17]

RFC 1353                     SNMP Party MIB                    July 1992


                      Setting an instance of this object to the value
                      'valid(1)' has the effect of ensuring that valid
                      local knowledge exists for the corresponding
                      party.  For valid local knowledge to exist, there
                      must be corresponding instances of each object in
                      this table and in the partyTable.  Thus, the
                      creation of instances in the partyTable (but not
                      in the aclTable or viewTable) occurs as a direct
                      result of the creation of instances in this table.

                      Setting an instance of this object to the value
                      'invalid(2)' has the effect of invalidating all
                      local knowledge of the corresponding party,
                      including the invalidating of any/all entries in
                      the partyTable, the partySecretsTable, the
                      aclTable, and the viewTable which reference said
                      party.

                      It is an implementation-specific matter as to
                      whether the agent removes an invalidated entry
                      from the table.  Accordingly, management stations
                      must be prepared to receive from agents tabular
                      information corresponding to entries not currently
                      in use.  Proper interpretation of such entries
                      requires examination of the relevant
                      partySecretsStatus object."
              DEFVAL  { valid }
              ::= { partySecretsEntry 4 }


          --  The SNMP Access Privileges Database Group

          --  This group of objects allows the SNMP itself to be used to
          --  configure new SNMP parties, or to manipulate the access
          --  privileges of existing parties.
          --
          --  Implementation of the objects in this group is mandatory.


          aclTable OBJECT-TYPE
              SYNTAX  SEQUENCE OF AclEntry
              ACCESS  not-accessible
              STATUS  mandatory
              DESCRIPTION
                      "The access privileges database."
          ::= { partyAccess 1 }





McCloghrie, Davin, & Galvin                                    [Page 18]

RFC 1353                     SNMP Party MIB                    July 1992


          aclEntry OBJECT-TYPE
              SYNTAX  AclEntry
              ACCESS  not-accessible
              STATUS  mandatory
              DESCRIPTION
                      "The access privileges for a particular requesting
                      SNMP party in accessing a particular target SNMP
                      party."
              INDEX  { aclTarget, aclSubject }
              ::= { aclTable 1 }

          AclEntry ::=
              SEQUENCE {
                  aclTarget
                      Party,
                  aclSubject
                      Party,
                  aclPrivileges
                      INTEGER,
                  aclStatus
                      INTEGER
              }

          aclTarget OBJECT-TYPE
              SYNTAX  Party
              ACCESS  read-write
              STATUS  mandatory
              DESCRIPTION
                      "The target SNMP party whose performance of
                      management operations is constrained by this set
                      of access privileges."
              ::= { aclEntry 1 }

          aclSubject OBJECT-TYPE
              SYNTAX  Party
              ACCESS  read-write
              STATUS  mandatory
              DESCRIPTION
                      "The subject SNMP party whose requests for
                      management operations to be performed is
                      constrained by this set of access privileges."
              ::= { aclEntry 2 }

          aclPrivileges OBJECT-TYPE
              SYNTAX  INTEGER (0..31)
              ACCESS  read-write
              STATUS  mandatory
              DESCRIPTION



McCloghrie, Davin, & Galvin                                    [Page 19]

RFC 1353                     SNMP Party MIB                    July 1992


                      "The access privileges which govern what
                      management operations a particular target party
                      may perform when requested by a particular subject
                      party.  These privileges are specified as a sum of
                      values, where each value specifies a SNMP PDU type
                      by which the subject party may request a permitted
                      operation.  The value for a particular PDU type is
                      computed as 2 raised to the value of the ASN.1
                      context-specific tag for the appropriate SNMP PDU
                      type.  The values (for the tags defined in RFC
                      1157) are defined in RFC 1351 as:

                       Get         :   1
                       GetNext     :   2
                       GetResponse :   4
                       Set         :   8
                       Trap        :  16

                      The null set is represented by the value zero."
              DEFVAL  { 3 }      -- Get & Get-Next
              ::= { aclEntry 3 }

          aclStatus OBJECT-TYPE
              SYNTAX  INTEGER  { valid(1), invalid(2) }
              ACCESS  read-write
              STATUS  mandatory
              DESCRIPTION
                      "The status of the access privileges for a
                      particular requesting SNMP party in accessing a
                      particular target SNMP party.  Setting an instance
                      of this object to the value 'invalid(2)' has the
                      effect of invalidating the corresponding access
                      privileges.

                      It is an implementation-specific matter as to
                      whether the agent removes an invalidated entry
                      from the table.  Accordingly, management stations
                      must be prepared to receive from agents tabular
                      information corresponding to entries not currently
                      in use.  Proper interpretation of such entries
                      requires examination of the relevant aclStatus
                      object."
              DEFVAL  { valid }
              ::= { aclEntry 4 }







McCloghrie, Davin, & Galvin                                    [Page 20]

RFC 1353                     SNMP Party MIB                    July 1992


          --   The MIB View Database Group

          --  This group of objects allows the SNMP itself to be used to
          --  configure new SNMP parties, or to manipulate the MIB
          --  MIB views of existing parties.
          --
          --  Implementation of the objects in this group is mandatory.


          viewTable OBJECT-TYPE
              SYNTAX  SEQUENCE OF ViewEntry
              ACCESS  not-accessible
              STATUS  mandatory
              DESCRIPTION
                      "The table contained in the local database which
                      defines local MIB views.  Each SNMP party has a
                      single MIB view which is defined by two
                      collections of view subtrees: the included view
                      subtrees, and the excluded view subtrees.  Every
                      such subtree, both included and excluded, is
                      defined in this table.

                      To determine if a particular object instance is in
                      a particular SNMP party's MIB view, compare the
                      object instance's Object Identifier with each
                      entry (for this party) in this table.  If none
                      match, then the object instance is not in the MIB
                      view.  If one or more match, then the object
                      instance is included in, or excluded from, the MIB
                      view according to the value of viewStatus in the
                      entry whose value of viewSubtree has the most
                      sub-identifiers.  If multiple entries match and
                      have the same number of sub-identifiers, then the
                      lexicographically greatest instance of viewStatus
                      determines the inclusion or exclusion.

                      An object instance's Object Identifier X matches
                      an entry in this table when the number of sub-
                      identifiers in X is at least as many as in the
                      value of viewSubtree for the entry, and each sub-
                      identifier in the value of viewSubtree matches its
                      corresponding sub-identifier in X.  Two sub-
                      identifiers match either if the corresponding bit
                      of viewMask is zero (the 'wild card' value), or if
                      they are equal.

                      Due to this 'wild card' capability, we introduce
                      the term, a 'family' of view subtrees, to refer to



McCloghrie, Davin, & Galvin                                    [Page 21]

RFC 1353                     SNMP Party MIB                    July 1992


                      the set of subtrees defined by a particular
                      combination of values of viewSubtree and viewMask.
                      In the case where no 'wild card' is defined in
                      viewMask, the family of view subtrees reduces to a
                      single view subtree."
          ::= { partyViews 1 }

          viewEntry OBJECT-TYPE
              SYNTAX  ViewEntry
              ACCESS  not-accessible
              STATUS  mandatory
              DESCRIPTION
                      "Information on a particular family of view
                      subtrees included in or excluded from a particular
                      SNMP party's MIB view."
              INDEX  { viewParty, viewSubtree }
              ::= { viewTable 1 }

          ViewEntry ::=
              SEQUENCE {
                  viewParty
                      Party,
                  viewSubtree
                      OBJECT IDENTIFIER,
                  viewStatus
                      INTEGER,
                  viewMask
                      OCTET STRING
              }

          viewParty  OBJECT-TYPE
              SYNTAX  Party
              ACCESS  read-write
              STATUS  mandatory
              DESCRIPTION
                      "The SNMP party whose single MIB view includes or
                      excludes a particular family of view subtrees."
              ::= { viewEntry 1 }

          viewSubtree OBJECT-TYPE
              SYNTAX  OBJECT IDENTIFIER
              ACCESS  read-write
              STATUS  mandatory
              DESCRIPTION
                      "The view subtree which, in combination with the
                      corresponding instance of viewMask, defines a
                      family of view subtrees.  This family is included
                      in, or excluded from the particular SNMP party's



McCloghrie, Davin, & Galvin                                    [Page 22]

RFC 1353                     SNMP Party MIB                    July 1992


                      MIB view, according to the value of the
                      corresponding instance of viewStatus."
              ::= { viewEntry 2 }

          viewStatus OBJECT-TYPE
              SYNTAX  INTEGER  {
                          included(1),
                          excluded(2),
                          invalid(3)
                      }
              ACCESS  read-write
              STATUS  mandatory
              DESCRIPTION
                      "The status of a particular family of view
                      subtrees within the particular SNMP party's MIB
                      view.  The value 'included(1)' indicates that the
                      corresponding instances of viewSubtree and
                      viewMask define a family of view subtrees included
                      in the MIB view.  The  value 'excluded(2)'
                      indicates that the corresponding instances of
                      viewSubtree and viewMask define a family of view
                      subtrees excluded from the MIB view.

                      Setting an instance of this object to the value
                      'invalid(3)' has the effect of invalidating the
                      presence or absence of the corresponding family of
                      view subtrees in the corresponding SNMP party's
                      MIB view.

                      It is an implementation-specific matter as to
                      whether the agent removes an invalidated entry
                      from the table.  Accordingly, management stations
                      must be prepared to receive from agents tabular
                      information corresponding to entries not currently
                      in use.  Proper interpretation of such entries
                      requires examination of the relevant viewStatus
                      object."
              DEFVAL  { included }
              ::= { viewEntry 3 }

          viewMask  OBJECT-TYPE
              SYNTAX  OCTET STRING (SIZE (0..16))
              ACCESS  read-write
              STATUS  mandatory
              DESCRIPTION
                      "The bit mask which, in combination with the
                      corresponding instance of viewSubtree, defines a
                      family of view subtrees.



McCloghrie, Davin, & Galvin                                    [Page 23]

RFC 1353                     SNMP Party MIB                    July 1992


                      Each bit of this bit mask corresponds to a sub-
                      identifier of viewSubtree, with the most
                      significant bit of the i-th octet of this octet
                      string value (extended if necessary, see below)
                      corresponding to the (8*i - 7)-th sub-identifier,
                      and the least significant bit of the i-th octet of
                      this octet string corresponding to the (8*i)-th
                      sub-identifier, where i is in the range 1 through
                      16.

                      Each bit of this bit mask specifies whether or not
                      the corresponding sub-identifiers must match when
                      determining if an Object Identifier is in this
                      family of view subtrees; a '1' indicates that an
                      exact match must occur; a '0' indicates 'wild
                      card', i.e., any sub-identifier value matches.

                      Thus, the Object Identifier X of an object
                      instance is contained in a family of view subtrees
                      if the following criteria are met:

                           for each sub-identifier of the value of
                           viewSubtree, either:

                                the i-th bit of viewMask is 0, or

                                the i-th sub-identifier of X is equal to
                                the i-th sub-identifier of the value of
                                viewSubtree.

                      If the value of this bit mask is M bits long and
                      there are more than M sub-identifiers in the
                      corresponding instance of viewSubtree, then the
                      bit mask is extended with 1's to be the required
                      length.

                      Note that when the value of this object is the
                      zero-length string, this extension rule results in
                      a mask of all-1's being used (i.e., no 'wild
                      card'), and the family of view subtrees is the one
                      view subtree uniquely identified by the
                      corresponding instance of viewSubtree."
              DEFVAL  { ''h }
              ::= { viewEntry 4 }


          END




McCloghrie, Davin, & Galvin                                    [Page 24]

RFC 1353                     SNMP Party MIB                    July 1992


5.  Acknowledgments

   This document was produced on behalf of the SNMP Security Working
   Group of the Internet Engineering Task Force.  The authors wish to
   thank the members of the working group, and others who contributed to
   this effort.

6.  References

   [1] Rose, M., and K. McCloghrie, "Structure and Identification of
       Management Information for TCP/IP based internets", RFC 1155,
       Performance Systems International, Hughes LAN Systems, May 1990.

   [2] McCloghrie, K., and M. Rose, "Management Information Base for
       Network Management of TCP/IP-based Internets", RFC 1156, Hughes
       LAN Systems and Performance Systems International, May 1990.

   [3] Case, J., M. Fedor, M. Schoffstall, and J. Davin, The Simple
       Network Management Protocol", RFC 1157, University of Tennessee
       at Knoxville, Performance Systems International, Performance
       Systems International, and the MIT Laboratory for Computer
       Science, May 1990.

   [4] McCloghrie K., and M. Rose, Editors, "Management Information Base
       for Network Management of TCP/IP-based internets", RFC 1213,
       Performance Systems International, March 1991.

   [5] Information processing systems - Open Systems Interconnection -
       Specification of Abstract Syntax Notation One (ASN.1),
       International Organization for Standardization, International
       Standard 8824, December 1987.

   [6] Information processing systems - Open Systems Interconnection -
       Specification of Basic Encoding Rules for Abstract Notation One
       (ASN.1), International Organization for Standardization,
       International Standard 8825, December 1987.

   [7] Rose, M., and K. McCloghrie, Editors, "Concise MIB Definitions",
       RFC 1212, Performance Systems International, Hughes LAN Systems,
       March 1991.

   [8] Davin, J., Galvin, J., and K. McCloghrie, "SNMP Administrative
       Model", RFC 1351, MIT Laboratory for Computer Science, Trusted
       Information Systems, Inc., Hughes LAN Systems, Inc., July 1992.

   [9] Galvin, J., McCloghrie, K., and J. Davin, "SNMP Security
       Protocols", RFC 1352, Trusted Information Systems, Inc., Hughes
       LAN Systems, Inc., MIT Laboratory for Computer Science, July



McCloghrie, Davin, & Galvin                                    [Page 25]

RFC 1353                     SNMP Party MIB                    July 1992


       1992.

Security Considerstions

   Security issues are discussed in section 3.1. and in RFCs 1351 and
   1352.

Authors' Addresses

   Keith McCloghrie
   Hughes LAN Systems, Inc.
   Mountain View, CA 94043

   Phone:  (415) 966-7934
   EMail:  kzm@hls.com


   James R. Davin
   MIT Laboratory for Computer Science
   545 Technology Square
   Cambridge, MA 02139

   Phone:  (617) 253-6020
   EMail:  jrd@ptt.lcs.mit.edu


   James M. Galvin
   Trusted Information Systems, Inc.
   3060 Washington Road, Route 97
   Glenwood, MD 21738

   Phone:  (301) 854-6889
   EMail:  galvin@tis.com


















McCloghrie, Davin, & Galvin                                    [Page 26]