Internet Accounting Working Group                    July 9, 1992



           Internet Accounting Meter Services Experimental MIB


  Status of this Memo

  This document is an Internet Draft.  Internet Drafts are working
  documents of the Internet Engineering Task Force (IETF), its Areas,
  and its Working Groups. Note that other groups may also distribute
  working documents as Internet Drafts.  This Internet Draft is a
  product of the Internet Accounting Working Group of the IETF.

  Internet Drafts are draft documents valid for a maximum of six
  months. Internet Drafts may be updated, replaced, or obsoleted by
  other documents at any time.  It is not appropriate to use Internet
  Drafts as reference material or to cite them other than as a "working
  draft" or "work in progress."

  Please check the I-D abstract listing contained in each Internet Draft
  directory to learn the current status of this or any other Internet
  Draft.


  Table of Contents

     1. Abstract ..............................................    1
     2. The Network Management Framework.......................    1
     3. Objects ...............................................    2
     3.1 Format of Definitions ...............................     2
     4. Overview ..............................................    2
     4.1 Scope of Definitions ................................     3
     4.2 Textual Conventions .................................     3
     5. Definitions ...........................................    3
     6. Acknowledgements ......................................   24
     7. References ............................................   24
     8. Security Considerations................................   25
     9. Authors' Addresses.....................................   25


  1.  Abstract

  This memo defines an experimental portion of the Management
  Information Base (MIB) for use with network management protocols in
  TCP/IP-based internets.  In particular, this memo defines managed
  objects used for obtaining accounting information from network devices
  (meters).


  2.  The Network Management Framework

  The Internet-standard Network Management Framework consists of three



  Mills, Brooks & Owen  Expires Jan. 9, 1993               [Page 1]




  Internet Accounting Working Group                    July 9, 1992



  components.  They are:

       RFC 1155 which defines the SMI, the mechanisms used for
       describing and naming objects for the purpose of management.  RFC
       1212 defines a more concise description mechanism, which is
       wholly consistent with the SMI.

       RFC 1156 which defines MIB-I, the core set of managed objects for
       the Internet suite of protocols.  RFC 1213, defines MIB-II, an
       evolution of MIB-I based on implementation experience and new
       operational requirements.

  RFC 1157 which defines the SNMP, the protocol used for network access
  to managed objects.

  The Framework permits new objects to be defined for the purpose of
  experimentation and evaluation.


  3.  Objects

  Managed objects are accessed via a virtual information store, termed
  the Management Information Base or MIB.  Objects in the MIB are
  defined using the subset of Abstract Syntax Notation One (ASN.1) [7]
  defined in the SMI.  In particular, each object has a name, a syntax,
  and an encoding.  The name is an object identifier, an
  administratively assigned name, which specifies an object type.  The
  object type together with an object instance serves to uniquely
  identify a specific instantiation of the object.  For human
  convenience, we often use a textual string, termed the OBJECT
  DESCRIPTOR, to also refer to the object type.

  The syntax of an object type defines the abstract data structure
  corresponding to that object type.  The ASN.1 language is used for
  this purpose.  However, the SMI [3] purposely restricts the ASN.1
  constructs which may be used.  These restrictions are explicitly made
  for simplicity.

  The encoding of an object type is simply how that object type is
  represented using the object type's syntax.  Implicitly tied to the
  notion of an object type's syntax and encoding is how the object type
  is represented when being transmitted on the network.

  The SMI specifies the use of the basic encoding rules of ASN.1 [8],
  subject to the additional requirements imposed by the SNMP.


  3.1.  Format of Definitions

   Section 5 contains contains the specification of all object types



  Mills, Brooks & Owen  Expires Jan. 9, 1993               [Page 2]




  Internet Accounting Working Group                    July 9, 1992



   contained in this MIB module.  The object types are defined using the
   conventions defined in the SMI, as amended by the extensions
   specified in [9,10].


  4.  Overview

  This memo defines object, the internet-accounting object.  This object
  contains coutrol, counter and state information related to the
  performance of the accounting function.  In particular, the meter is
  assumed to be one which forwards PDUs, like a router, (counting PDUs
  as they enter or leave the device), or monitors the passage of PDUs,
  like a LAN monitor.  The results are contain in FlowEntrys which are
  contained in the internet-accounting object.  A managed system will
  have exactly (zero or) one internet-accounting object.


  4.1.  Scope of Definitions

  All objects defined in this memo are registered in a single subtree
  within the experimental namespace [3], and are for use in network
  device which may perform a PDU forwarding or monitoring function.  For
  these devices, the value of the ifSpecific variable in the MIB-II [4,
  6] has the OBJECT IDENTIFIER value:

          internet-accounting OBJECT IDENTIFIER ::= { experimental 99 }

  as defined below.  << Need real identifier value. >>


  4.2.  Textual Conventions

  A number of fields are bit coded in this mib.  We declare these fields
  as INTEGER, naming the individual bits as distinguished values.  The
  value of such a field is the sum of of zero or more of these
  individual values.


  5. Definitions

  --
  -- Internet Accounting MIB $Revision: 1.10 $
  -- $Principal-Author: cbrooks $
  -- $Current-Author: ado @

  -- Internet Accounting MIB
  -- This following text defines an initial SNMP MIB for internet accounting.
  -- For additional details, see RFC 1272, "Internet Accounting: Background",
  -- C. Mills, D. Hirsch, and G. Ruth, and the Internet Draft
  -- "Internet Accounting Architecture", Mills, Laube, and Ruth.



  Mills, Brooks & Owen  Expires Jan. 9, 1993               [Page 3]




  Internet Accounting Working Group                    July 9, 1992



  ACCOUNTING-MIB DEFINITIONS ::= BEGIN

  IMPORTS experimental, OBJECT-TYPE, ObjectName, Counter, Gauge,
      NetworkAddress, TimeTicks  FROM RFC1155-SMI
          TRAP-TYPE FROM RFC1215;

  internet-accounting OBJECT IDENTIFIER ::= { experimental 99 }

  control         OBJECT IDENTIFIER ::= { internet-accounting 1 }

  oldflowdata     OBJECT IDENTIFIER ::= { internet-accounting 2 }

  flowdata        OBJECT IDENTIFIER ::= { internet-accounting 3 }

  ruledata        OBJECT IDENTIFIER ::= { internet-accounting 4 }

  actiondata      OBJECT IDENTIFIER ::= { internet-accounting 5 }

  GroupMask ::= OCTET STRING (SIZE (1))


  -- The Address Tuple construct ...
  -- in future, might have any address for any layer in the protocol
  -- stack (session, presentation, application). The intent here is to
  -- represent the fact that the address tuple field can contain from 1 to
  -- 4 attributes.

  -- Address-Tuple ::= SEQUENCE {
  --          interface        [0] INTEGER OPTIONAL,
  --          adjacent_address [1] NetWork_Address OPTIONAL,
  --          internet_address [2] NetWork_Address OPTIONAL,
  --          subscriberId     [3] OCTET STRING OPTIONAL
  --          }

  -- The Network Address construct. The intent here is that this
  -- address type represent a choice of N-1 layer addresses based on the
  -- protocol layer at which accounting is done.  For example, if
  -- accounting is being performed at the presentation level, then this
  -- address might be a session layer address; if done at the transport
  -- level, it might be a DECNet address.

  -- In the following, "adjacent" means the level below the current level.
  -- I.e. for IP, the adjacent layer address might be the ethernet or 802
  -- mac layer address.  A better encoding convention is needed so that
  -- addresses at any layer can be specified unambiguously.

  -- NetWork_Address ::= CHOICE {
  --     adjacentLayerAddress     [1] IMPLICIT OCTET STRING,
  --     ipAddress        [2] IMPLICIT IpAddress,
  --     nsapAddress      [3] IMPLICIT OCTET STRING,



  Mills, Brooks & Owen  Expires Jan. 9, 1993               [Page 4]




  Internet Accounting Working Group                    July 9, 1992



  --     idprAddress      [4] IMPLICIT OCTET STRING,
  --     decnetAddress    [5] IMPLICIT OCTET STRING
  --     }
  --

  -- The AddressType type
  -- The intent of this type is to indicate the type of address
  -- that is being recorded. This would probably be encoded as a
  -- tag in the above Network-Address type if using full ASN.1. Instead,
  -- we explicitly call it out as a separate value, and instantiate it
  -- as a separate field.

  AddressType ::= INTEGER {
          adjacentlayer(1), ipaddress(2), nsapaddress(3),
          idpraddress(4), decnetaddress(5)
          }

  -- The Control Group

  highWaterMark   OBJECT-TYPE
          SYNTAX INTEGER (0..100)
          ACCESS read-write
          STATUS mandatory
          DESCRIPTION
              "A value expressed as a percent, interpreted by the meter as an
        indication of when to send a trap indicating that the management
        station should increase the polling interval.  Values of 0% or
        100% disable the checking represented by this variable."
          ::= { control 1 }


  floodMark       OBJECT-TYPE
          SYNTAX INTEGER (0..100)
          ACCESS read-write
          STATUS mandatory
          DESCRIPTION
              "A value expressed as a percent, interpreted by the meter
        as an indication of how full the flow record table should become
        before the meter should panic and start dumping the contents of
        the flow table to the management station in raw form.  0% or 100%
        disables the checking represented by this variable."
          ::= { control 2 }


  inactivityTimeout       OBJECT-TYPE
          SYNTAX INTEGER
          ACCESS read-write
          STATUS mandatory
          DESCRIPTION
              "The time in seconds since the last packet seen (and the last



  Mills, Brooks & Owen  Expires Jan. 9, 1993               [Page 5]




  Internet Accounting Working Group                    July 9, 1992



        report) after which the flow may be terminated."
          DEFVAL { 600 } -- 10 minutes
          ::= { control 3 }



  maxLifetime     OBJECT-TYPE
          SYNTAX INTEGER
          ACCESS read-write
          STATUS mandatory
          DESCRIPTION
              "A value in seconds interpreted by the meter as the maximum
        lifetime of a flow. N.B. Interpretation of this value by the
        meter is optional."
          DEFVAL { 3600 } -- 1 hour
          ::= { control 4 }



  flowPriorityGroupMask   OBJECT-TYPE
          SYNTAX GroupMask
          ACCESS read-write
          STATUS mandatory
          DESCRIPTION
              "Tells the meter which flows are considered critical. Flows can
        be indentified as belonging to one of 8 groups."
          ::= { control 5 }


  flowRoutingMask OBJECT-TYPE
          SYNTAX GroupMask
          ACCESS read-write
          STATUS mandatory
          DESCRIPTION
              "Sent to the meter indicating that a normal report of indicated
        flows should be made (i.e., any flow whose rule indicates that
        it has a bit set which is set in the mask."
          DEFVAL { '0'h }
          ::= { control 6 }


  flowRecoveryTrigger     OBJECT-TYPE
          SYNTAX INTEGER
          ACCESS read-write
          STATUS mandatory
          DESCRIPTION
              "Writing into this variable acknowledges reciept of any recoverable
          flowRecords by the collector."
          ::= { control 7 }




  Mills, Brooks & Owen  Expires Jan. 9, 1993               [Page 6]




  Internet Accounting Working Group                    July 9, 1992



  flowSamplingRate        OBJECT-TYPE
          SYNTAX SEQUENCE OF FlowSamplingRate
          ACCESS not-accessible
          STATUS mandatory
          DESCRIPTION
              "One for each interface.  The paramater N for statistical counting.
          Set to zero to count every packet on this interface.  Set to N to
          count 1/Nth of the packets from this interface.  The meter should
          choose its own algorithm to introduce variance into the sampling
          so that exactly every Nth packet is not counted.  A sampling rate
          of 1 yields a normal counter."
          ::= { 8  }


  FlowSamplingRate ::= SEQUENCE { rate INTEGER }

  -- the accounting table object

  -- The following two variables, flowdata and oldflowdata represent a view of
  -- a single set of data.  flowEntries will appear in only one of these tables
  -- at any instant in time, depending on their state, and may spontaneously
  -- "move" from one to the other, i.e. may appear in one and stop appearing
  -- in the other.  The implimentation may well keep this set in a single
  -- list or other structure.  The collector can optimize space usage by polling
  -- oldflowdata, and acknowledging it, before reading flowdata.  This allows
  -- reuse of the space taken by inactive flowEntries, instead forcing the
  -- meter to make a less optimal decision when it reuses space.

  acctFullTable OBJECT-TYPE
          SYNTAX SEQUENCE OF AcctFlowEntry
          ACCESS  not-accessible
          STATUS  mandatory
          DESCRIPTION
              "The list of completed (i.e. inactive) flows being retained
          for reading by the collector by the meter"
          ::= { oldflowdata 1 }

  acctFlowTable OBJECT-TYPE
          SYNTAX SEQUENCE OF AcctFlowEntry
          ACCESS  not-accessible
          STATUS  mandatory
          DESCRIPTION
              "The list of all currently active flows being kept for
          accounting purposes on this system"
          ::= { flowdata 1 }

  acctFlowEntry OBJECT-TYPE
          SYNTAX  AcctFlowEntry
          ACCESS  not-accessible
          STATUS  mandatory



  Mills, Brooks & Owen  Expires Jan. 9, 1993               [Page 7]




  Internet Accounting Working Group                    July 9, 1992



          DESCRIPTION
                  "The flow record for a particular flow"
          INDEX { acctFlowIndex }
          ::= { acctFlowTable 1 }

  AcctFlowEntry ::= SEQUENCE {
          acctFlowIndex                   INTEGER,        --
          acctFlowGroupMask               GroupMask,
          acctFlowStatus                  INTEGER,        -- flow status
          acctFlowFromInterface           INTEGER,
          acctFlowFromAdjacentType        AddressType ,
          acctFlowFromAdjacent            OCTET STRING,
          acctFlowFromPeerType            AddressType,
          acctFlowFromPeerAddress         OCTET STRING,
          acctFlowFromSubscriberID        OCTET STRING,
          acctFlowToInterface             INTEGER,        -- really an AddressTuple
          acctFlowToAdjacentType          AddressType,
          acctFlowToAdjacent              OCTET STRING,
          acctFlowToPeerType              AddressType,
          acctFlowToPeerAddress           OCTET STRING,
          acctFlowToSubscriberID          OCTET STRING,
          acctFlowSubscriberID            OCTET STRING,   -- can be NULL
          acctFlowPDUScale                INTEGER,
          acctFlowOctetScale              INTEGER,
          acctFlowToOctets                Counter,        -- To Counters
          acctFlowToPDUs                  Counter,        -- NOT derivitive
          acctFlowFromOctets              Counter,        -- From Counters
          acctFlowFromPDUs                Counter,        -- NOT derivitive
          acctFlowFirstTime               TimeTicks,
          acctFlowLastTime                TimeTicks
          }


  acctFlowIndex   OBJECT-TYPE
          SYNTAX INTEGER
          ACCESS read-only
          STATUS mandatory
          DESCRIPTION
              "An artifice introduced to aid modeling by
          SNMP. This is the bucket number for this flow.
          The different values for this variable need
          not be consecutive"
          ::= { acctFlowEntry 1  }


  acctFlowGroupMask       OBJECT-TYPE
          SYNTAX GroupMask
          ACCESS read-only
          STATUS mandatory
          DESCRIPTION



  Mills, Brooks & Owen  Expires Jan. 9, 1993               [Page 8]




  Internet Accounting Working Group                    July 9, 1992



              "The group mask for this flow"
          ::= { acctFlowEntry 2  }



  acctFlowStatus  OBJECT-TYPE
          SYNTAX INTEGER { valid(1), recently-read(2), active(4), recoverable(8) }
          ACCESS read-only
          STATUS mandatory
          DESCRIPTION
              "Status of this flow.  Allows all table rows
          to be collected via a table sweep, whilst throwing out
          all flows that are invalid."
          ::= { acctFlowEntry 3  }


  acctFlowFromInterface   OBJECT-TYPE
          SYNTAX INTEGER
          ACCESS read-only
          STATUS mandatory
          DESCRIPTION
              "The  of the interface upon which this packet was
          received. This value is one of the values contained in the
          ifIndex field of the interfaces table."
          ::= { acctFlowEntry 4  }


  acctFlowFromAdjacentType        OBJECT-TYPE
          SYNTAX AddressType
          ACCESS read-only
          STATUS mandatory
          DESCRIPTION
              "The address type of the adjacent address."
          ::= { acctFlowEntry 5  }



  acctFlowFromAdjacent    OBJECT-TYPE
          SYNTAX OCTET STRING -- actually Network-Address
          ACCESS read-only
          STATUS mandatory
          DESCRIPTION
              "The address of the adjacent device on the from path."
          ::= { acctFlowEntry 6  }


  acctFlowFromPeerType    OBJECT-TYPE
          SYNTAX AddressType
          ACCESS read-only
          STATUS mandatory



  Mills, Brooks & Owen  Expires Jan. 9, 1993               [Page 9]




  Internet Accounting Working Group                    July 9, 1992



          DESCRIPTION
              "The address type of the peer from address."
          ::= { acctFlowEntry 7  }


  acctFlowFromPeerAddress OBJECT-TYPE
          SYNTAX OCTET STRING -- actually Network-Address
          ACCESS read-only
          STATUS mandatory
          DESCRIPTION
              "The address of the previous hop from entity expressed in
          the same format as the level being monitored (i.e., if we are
          measuring at the IP level; this would be the IP address; if
          measuring at the CLNP level, the OSI address."
          ::= { acctFlowEntry 8  }


  acctFlowFromSubscriberID        OBJECT-TYPE
          SYNTAX OCTET STRING
          ACCESS read-only
          STATUS mandatory
          DESCRIPTION
              "The Subscriber ID associated with the source of the packet"
          ::= { acctFlowEntry 9  }


  acctFlowToInterface     OBJECT-TYPE
          SYNTAX INTEGER
          ACCESS read-only
          STATUS mandatory
          DESCRIPTION
              "The index of the interface on the downstream side of the flow.
          This value is one of the values contained in the
          ifIndex field of the interfaces table."
          ::= { acctFlowEntry 10  }


  acctFlowToAdjacentType  OBJECT-TYPE
          SYNTAX AddressType
          ACCESS read-only
          STATUS mandatory
          DESCRIPTION
              "The address type of the adjacent to address."
          ::= { acctFlowEntry 11  }


  acctFlowToAdjacent      OBJECT-TYPE
          SYNTAX OCTET STRING
          ACCESS read-only
          STATUS mandatory



  Mills, Brooks & Owen  Expires Jan. 9, 1993              [Page 10]




  Internet Accounting Working Group                    July 9, 1992



          DESCRIPTION
              "The address of the adjacent device on the
          downstream side of the flow."
          ::= { acctFlowEntry 12  }


  acctFlowToPeerType      OBJECT-TYPE
          SYNTAX AddressType
          ACCESS read-only
          STATUS mandatory
          DESCRIPTION
              "The address type of the peer from address."
          ::= { acctFlowEntry 13  }



  acctFlowToPeerAddress   OBJECT-TYPE
          SYNTAX OCTET STRING
          ACCESS read-only
          STATUS mandatory
          DESCRIPTION
              "The address of the next downstream network entity  in
          the same format as the level being monitored (i.e., if we are
          measuring at the IP level; this would be the IP address; if
          measuring at the CLNP level, the OSI address."
          ::= { acctFlowEntry 14  }


  acctFlowToSubscriberID  OBJECT-TYPE
          SYNTAX OCTET STRING
          ACCESS read-only
          STATUS mandatory
          DESCRIPTION
              "The Subscriber ID associated with the ultimate
          destination of the packet"
          ::= { acctFlowEntry 15  }


  acctFlowSubscriberID    OBJECT-TYPE
          SYNTAX OCTET STRING
          ACCESS read-only
          STATUS mandatory
          DESCRIPTION
              "The subscriber ID for this flow, assuming no
          source/destination flow indicators."
          ::= { acctFlowEntry 16  }



  acctFlowPDUScale        OBJECT-TYPE



  Mills, Brooks & Owen  Expires Jan. 9, 1993              [Page 11]




  Internet Accounting Working Group                    July 9, 1992



          SYNTAX INTEGER (1..127)
          ACCESS read-only
          STATUS mandatory
          DESCRIPTION
              "The scale factor applied to this particular flow.  Indicates
          that number of bits to left shift the value of the PDU
          counters to obtain the actual values."
          ::= { acctFlowEntry 17  }



  acctFlowOctetScale      OBJECT-TYPE
          SYNTAX INTEGER (1..127)
          ACCESS read-only
          STATUS mandatory
          DESCRIPTION
              "The scale factor applied to this particular flow.  Indicates
          that number of bits to left shift the value of the octet
          counters to obtain the actual values."
          ::= { acctFlowEntry 18  }


  acctFlowToOctets        OBJECT-TYPE
          SYNTAX Counter
          ACCESS read-only
          STATUS mandatory
          DESCRIPTION
              "The count of octets delivered to the protocol level being
          metered. In the case of IP, this would count the number of
          octets delivered to the IP level"
          ::= { acctFlowEntry 19  }


  acctFlowToPDUs  OBJECT-TYPE
          SYNTAX Counter
          ACCESS read-only
          STATUS mandatory
          DESCRIPTION
              "The count of protocol packets delivered to the protocol
          level being metered. In the case of IP, for example, this
          would count all the IP packets delivered to the IP protocol level."
          ::= { acctFlowEntry 20  }


  acctFlowFromOctets      OBJECT-TYPE
          SYNTAX Counter
          ACCESS read-only
          STATUS mandatory
          DESCRIPTION
              "The count of octets delivered from a particular protocol



  Mills, Brooks & Owen  Expires Jan. 9, 1993              [Page 12]




  Internet Accounting Working Group                    July 9, 1992



          level to the N-1 level."
          ::= { acctFlowEntry 21  }


  acctFlowFromPDUs        OBJECT-TYPE
          SYNTAX Counter
          ACCESS read-only
          STATUS mandatory
          DESCRIPTION
              "The count of a given protocols PDUs delivered to the N-1
          protocol layer."
          ::= { acctFlowEntry 22  }


  acctFlowFirstTime       OBJECT-TYPE
          SYNTAX Timeticks
          ACCESS read-only
          STATUS mandatory
          DESCRIPTION
              "The time at which the flow was first entered in the table"
          ::= { acctFlowEntry 23  }


  acctFlowLastTime        OBJECT-TYPE
          SYNTAX Timeticks
          ACCESS read-only
          STATUS mandatory
          DESCRIPTION
              "The last time this flow had activity"
          ::= { acctFlowEntry 24  }


  --
  -- The Rule Table
  --

  -- in the following table, the combination of acctRuleAction and
  -- acctRuleJumpIndex might alternatively be encode as the following:
  -- RuleAction ::= CHOICE {
  --      direct [0] IMPLICIT ENUMERATED { ignore(1), count(2) },
  --      goto [1] IMPLICIT INTEGER  __  rule number to jump to
  --      }

  -- The semantics of the rule table are such that implementations must
  -- consider how to effect the atomic creation or reset of the entire rule
  -- table. One possible implemenation might  an implementation of a
  -- "shadow" rule table and a control variable.  All changes to the rule
  -- table would be made to the shadow table instead, until the control
  -- variable was set to a value such that contents of the shadow table
  -- would atomically replace the contents of the actual rule table



  Mills, Brooks & Owen  Expires Jan. 9, 1993              [Page 13]




  Internet Accounting Working Group                    July 9, 1992



  acctRuleTable OBJECT-TYPE
          SYNTAX SEQUENCE OF AcctRuleEntry
          ACCESS  not-accessible
          STATUS  mandatory
          DESCRIPTION
              "The list of rules used to determine the
          granularity of accounting data."
          ::= { ruledata 1 }

  acctRuleEntry OBJECT-TYPE
          SYNTAX  AcctRuleEntry
          ACCESS  not-accessible
          STATUS  mandatory
          DESCRIPTION
              "The rule record itself."
          INDEX { acctRuleIndex }
          ::= { acctRuleTable 1 }


  AcctRuleEntry ::= SEQUENCE {
          acctRuleIndex           INTEGER,         -- index
          acctRuleSelector        INTEGER,         -- what to select on
          acctRuleMask            OCTET STRING,    -- the mask value
          acctRuleMatchedValue    OCTET STRING,    -- the matched value
          acctRuleAction          INTEGER,         -- action to take
          acctRuleJumpIndex       INTEGER          -- where to go
          }

  acctRuleIndex   OBJECT-TYPE
          SYNTAX INTEGER
          ACCESS read-write
          STATUS mandatory
          DESCRIPTION
              "The Index into the Rule table. N.B. These values must be
          consecutive, given the fall-through semantics of processing
          the table"
          ::= { acctRuleEntry 1  }


  acctRuleSelector        OBJECT-TYPE
          SYNTAX INTEGER { null(1),
              source-interface(2),    destination-interface(4),
              source-adjacent(8),     destination-adjacent(16),
              source-peer(32),        destination-peer(64),
              source-subscriber(128), destination-subscriber(256)
          }
          ACCESS read-write
          STATUS mandatory
          DESCRIPTION
              "Defines the source of the value to match."



  Mills, Brooks & Owen  Expires Jan. 9, 1993              [Page 14]




  Internet Accounting Working Group                    July 9, 1992



          ::= { acctRuleEntry 2  }


  acctRuleMask    OBJECT-TYPE
          SYNTAX OCTET STRING
          ACCESS read-write
          STATUS mandatory
          DESCRIPTION
              "The initial mask used to compute the desired value, encoded
          as an OCTET STRING."
          ::= { acctRuleEntry 3  }


  acctRuleMatchedValue    OBJECT-TYPE
          SYNTAX OCTET STRING
          ACCESS read-write
          STATUS mandatory
          DESCRIPTION
              "The resulting value to be matched for equality.
          Specifically, if the attribute chosen by the acctRuleSelector
          logically ANDed with the mask specified by the acctRuleMask
          equals the value specified in the acctRuleMatchedValue, then
          continue processing the table entry based on the action
          specified by the acctRuleAction entry. Otherwise, proceed to
          the next entry in the rule table."
          ::= { acctRuleEntry 4  }


  acctRuleAction  OBJECT-TYPE
          SYNTAX INTEGER { ignore(1), goto(2), count(3), individuate(4) }
          ACCESS read-write
          STATUS mandatory
          DESCRIPTION
              "The action to be taken if there is a match between this rule and
          the PDU under consideration. If ignore(1), the search is stopped.  If
          count(3) or individuate(4), then execute the action specified by
          acctAction[AcctRuleJumpIndex].  If goto(2), then record the value of
          the attribute indicated by the acctRuleSelector, and use the value of
          the acctRuleJumpIndex to continue the matching process at that entry in
          the rule table."
          ::= { acctRuleEntry 5  }


  acctRuleJumpIndex       OBJECT-TYPE
          SYNTAX INTEGER
          ACCESS read-write
          STATUS mandatory
          DESCRIPTION
              "An index into the Rule table. Where to re-start the search.
          Must take on one of the values for acctRuleIndex."



  Mills, Brooks & Owen  Expires Jan. 9, 1993              [Page 15]




  Internet Accounting Working Group                    July 9, 1992



          ::= { acctRuleEntry 6  }


  ---
  --- AcctRuleAction Table
  ---

  acctActionTable OBJECT-TYPE
          SYNTAX SEQUENCE OF AcctRuleAction
          ACCESS  not-accessible
          STATUS  mandatory
          DESCRIPTION
              "The list of rules used to determine the
          granularity of accounting data."
          ::= { actiondata 1 }

  acctRuleAction OBJECT-TYPE
          SYNTAX  AcctRuleAction
          ACCESS  not-accessible
          STATUS  mandatory
          DESCRIPTION
              "The rule action record."
          INDEX { acctActionIndex }
          ::= { acctActionTable 1 }


  AcctRuleAction ::= SEQUENCE {
          acctActionIndex                 INTEGER,        -- index
          acctActionSelector              INTEGER,        -- mask of fields
                                                          --  to indivituate
          acctActionCountType             INTEGER,

          -- below are triples of <value, mask, type>.  The type supplies the
          -- type of the address.  The mask supplies bits which are used to
          -- identify bits from this field which will identify/establish a
          -- particular flowEntry. bits not covered by the mask bits are
          -- taken from the value field and stuffed into the corresponding
          --  bit positions of the flowEntry.

                                  -- applied to next adjacent system address
          acctActionToAdjacentValue       OCTET STRING,
          acctActionToAdjacentMask        OCTET STRING,
          acctActionToAdjacentType        INTEGER,

                                  -- applied to preceeding adjacent system address
          acctActionFromAdjacentValue     OCTET STRING,
          acctActionFromAdjacentMask      OCTET STRING,
          acctActionFromAdjacentType      INTEGER,

                                  -- applied to destination system address



  Mills, Brooks & Owen  Expires Jan. 9, 1993              [Page 16]




  Internet Accounting Working Group                    July 9, 1992



          acctActionToPeerValue           OCTET STRING,
          acctActionToPeerMask            OCTET STRING,
          acctActionToPeerType            INTEGER,

                                  -- applied to source system address
          acctActionFromPeerValue         OCTET STRING,
          acctActionFromPeerMask          OCTET STRING,
          acctActionFromPeerType          INTEGER,

                                  -- applied to destination subscriber id field
          acctActionToSubscriberIDValue   OCTET STRING,
          acctActionToSubscriberIDMask    OCTET STRING,
          acctActionToSubscriberIDType    INTEGER,

                                  -- applied to source subscriber id field
          acctActionFromSubscriberIDValue OCTET STRING,
          acctActionFromSubscriberIDMask  OCTET STRING,
          acctActionFromSubscriberIDType  INTEGER,

                                  -- applied to destination interface
          acctActionToInterfaceValue      OCTET STRING,
          acctActionToInterfaceMask       OCTET STRING,
          acctActionToInterfaceType       OCTET STRING,

                                  -- applied to source interface
          acctActionFromInterfaceValue    OCTET STRING,
          acctActionFromInterfaceMask     OCTET STRING,
          acctActionFromInterfaceType     OCTET STRING,

                                  -- imposed value for subscriber id
          acctActionSubscriberID          OCTET STRING
          }

  acctActionIndex OBJECT-TYPE
          SYNTAX INTEGER
          ACCESS read-write
          STATUS mandatory
          DESCRIPTION
              "The Index into the Action table."
          ::= { acctActionEntry 1  }


  acctActionSelector      OBJECT-TYPE
          SYNTAX INTEGER { null(1),
              source-interface(2), destination-interface(4),
              source-adjacent(8), destination-adjacent(16),
              source-peer(32),  destination-peer(64),
              source-subscriber(128), destination-subscriber(256),
              stuff-subscriber(512)
          }



  Mills, Brooks & Owen  Expires Jan. 9, 1993              [Page 17]




  Internet Accounting Working Group                    July 9, 1992



          ACCESS read-write
          STATUS mandatory
          DESCRIPTION
              "Defines the sources of the values to individuate."
          ::= { acctActionEntry 2  }


  acctActionCountType     OBJECT-TYPE
          SYNTAX INTEGER  {
            normal(2), hop-weighted(3), charge-weighted(4)
          }
          ACCESS read-write
          STATUS mandatory
          DESCRIPTION
              "Type of count information called for by this action table entry.
          A normal count counts packets and bytes.  A hop wighted count sums
          packet*hop and byte*hop product.  A charge-weighted count uses a
          multiplier proportional to charge to destination instead of hopcount
          to destination.  Other values for CountType are reserved for future
          use."
          ::= { acctActionEntry 3  }



  acctActionToAdjacentMask        OBJECT-TYPE
          SYNTAX OCTET STRING
          ACCESS read-write
          STATUS mandatory
          DESCRIPTION
              "The mask applied to the acctToAdjacentValuefield, encoded
          as an OCTET STRING."
          ::= { acctActionEntry 4  }

  acctActionToAdjacentType        OBJECT-TYPE
          SYNTAX INTEGER
          ACCESS read-write
          STATUS mandatory
          DESCRIPTION
              "The type of address in the acctActionToAdjacentValue field."
          ::= { acctActionEntry 5  }

  acctActionToAdjacentValue       OBJECT-TYPE
          SYNTAX OCTET STRING
          ACCESS read-write
          STATUS mandatory
          DESCRIPTION
              "The bit value to be used with the mask field.
          Bits covered by the mask are selected for indiduation.
          Bits not covered by the mask are stuffed into the FlowRecord
          from the acctActionToAdjacentValue."



  Mills, Brooks & Owen  Expires Jan. 9, 1993              [Page 18]




  Internet Accounting Working Group                    July 9, 1992



          ::= { acctActionEntry 6  }



  acctActionFromAdjacentMask      OBJECT-TYPE
          SYNTAX OCTET STRING
          ACCESS read-write
          STATUS mandatory
          DESCRIPTION
              "The mask applied to the acctFromAdjacentValuefield, encoded
          as an OCTET STRING."
          ::= { acctActionEntry 7  }

  acctActionFromAdjacentType      OBJECT-TYPE
          SYNTAX INTEGER
          ACCESS read-write
          STATUS mandatory
          DESCRIPTION
              "The type of address in the acctActionFromAdjacentValue field."
          ::= { acctActionEntry 8  }

  acctActionFromAdjacentValue     OBJECT-TYPE
          SYNTAX OCTET STRING
          ACCESS read-write
          STATUS mandatory
          DESCRIPTION
              "The bit value to be used with the mask field.
          Bits covered by the mask are selected for indiduation.
          Bits not covered by the mask are stuffed into the FlowRecord
          from the acctActionFromAdjacentValue."
          ::= { acctActionEntry 9  }



  acctActionToPeerMask    OBJECT-TYPE
          SYNTAX OCTET STRING
          ACCESS read-write
          STATUS mandatory
          DESCRIPTION
              "The mask applied to the acctToPeerValuefield, encoded
          as an OCTET STRING."
          ::= { acctActionEntry 10  }

  acctActionToPeerType    OBJECT-TYPE
          SYNTAX INTEGER
          ACCESS read-write
          STATUS mandatory
          DESCRIPTION
              "The type of address in the acctActionToPeerValue field."
          ::= { acctActionEntry 11  }



  Mills, Brooks & Owen  Expires Jan. 9, 1993              [Page 19]




  Internet Accounting Working Group                    July 9, 1992




  acctActionToPeerValue   OBJECT-TYPE
          SYNTAX OCTET STRING
          ACCESS read-write
          STATUS mandatory
          DESCRIPTION
              "The bit value to be used with the mask field.
          Bits covered by the mask are selected for indiduation.
          Bits not covered by the mask are stuffed into the FlowRecord
          from the acctActionToPeerValue."
          ::= { acctActionEntry 12  }



  acctActionFromPeerMask  OBJECT-TYPE
          SYNTAX OCTET STRING
          ACCESS read-write
          STATUS mandatory
          DESCRIPTION
              "The mask applied to the acctFromPeerValuefield, encoded
          as an OCTET STRING."
          ::= { acctActionEntry 13  }

  acctActionFromPeerType  OBJECT-TYPE
          SYNTAX INTEGER
          ACCESS read-write
          STATUS mandatory
          DESCRIPTION
              "The type of address in the acctActionFromPeerValue field."
          ::= { acctActionEntry 14  }

  acctActionFromPeerValue OBJECT-TYPE
          SYNTAX OCTET STRING
          ACCESS read-write
          STATUS mandatory
          DESCRIPTION
              "The bit value to be used with the mask field.
          Bits covered by the mask are selected for indiduation.
          Bits not covered by the mask are stuffed into the FlowRecord
          from the acctActionFromPeerValue."
          ::= { acctActionEntry 15  }



  acctActionToSubscriberIDMask    OBJECT-TYPE
          SYNTAX OCTET STRING
          ACCESS read-write
          STATUS mandatory
          DESCRIPTION
              "The mask applied to the acctToSubscriberIDValuefield, encoded



  Mills, Brooks & Owen  Expires Jan. 9, 1993              [Page 20]




  Internet Accounting Working Group                    July 9, 1992



          as an OCTET STRING."
          ::= { acctActionEntry 16  }

  acctActionToSubscriberIDType    OBJECT-TYPE
          SYNTAX INTEGER
          ACCESS read-write
          STATUS mandatory
          DESCRIPTION
              "The type of address in the acctActionToSubscriberIDValue field."
          ::= { acctActionEntry 17  }

  acctActionToSubscriberIDValue   OBJECT-TYPE
          SYNTAX OCTET STRING
          ACCESS read-write
          STATUS mandatory
          DESCRIPTION
              "The bit value to be used with the mask field.
          Bits covered by the mask are selected for indiduation.
          Bits not covered by the mask are stuffed into the FlowRecord
          from the acctActionToSubscriberIDValue."
          ::= { acctActionEntry 18  }



  acctActionFromSubscriberIDMask  OBJECT-TYPE
          SYNTAX OCTET STRING
          ACCESS read-write
          STATUS mandatory
          DESCRIPTION
              "The mask applied to the acctFromSubscriberIDValuefield, encoded
          as an OCTET STRING."
          ::= { acctActionEntry 19  }

  acctActionFromSubscriberIDType  OBJECT-TYPE
          SYNTAX INTEGER
          ACCESS read-write
          STATUS mandatory
          DESCRIPTION
              "The type of address in the acctActionFromSubscriberIDValue field."
          ::= { acctActionEntry 20  }

  acctActionFromSubscriberIDValue OBJECT-TYPE
          SYNTAX OCTET STRING
          ACCESS read-write
          STATUS mandatory
          DESCRIPTION
              "The bit value to be used with the mask field.
          Bits covered by the mask are selected for indiduation.
          Bits not covered by the mask are stuffed into the FlowRecord
          from the acctActionFromSubscriberIDValue."



  Mills, Brooks & Owen  Expires Jan. 9, 1993              [Page 21]




  Internet Accounting Working Group                    July 9, 1992



          ::= { acctActionEntry 21  }



  acctActionSubscriberID  OBJECT-TYPE
          SYNTAX OCTET STRING
          ACCESS read-write
          STATUS mandatory
          DESCRIPTION
              "The subscriber id to stuff into this flow record."
          ::= { acctActionEntry 22  }



  acctActionToInterfaceMask       OBJECT-TYPE
          SYNTAX OCTET STRING
          ACCESS read-write
          STATUS mandatory
          DESCRIPTION
              "The mask applied to the acctToInterfaceValuefield, encoded
          as an OCTET STRING."
          ::= { acctActionEntry 23  }

  acctActionToInterfaceType       OBJECT-TYPE
          SYNTAX INTEGER
          ACCESS read-write
          STATUS mandatory
          DESCRIPTION
              "The type of address in the acctActionToInterfaceValue field."
          ::= { acctActionEntry 24  }

  acctActionToInterfaceValue      OBJECT-TYPE
          SYNTAX OCTET STRING
          ACCESS read-write
          STATUS mandatory
          DESCRIPTION
              "The bit value to be used with the mask field.
          Bits covered by the mask are selected for indiduation.
          Bits not covered by the mask are stuffed into the FlowRecord
          from the acctActionToInterfaceValue."
          ::= { acctActionEntry 25  }



  acctActionFromInterfaceMask     OBJECT-TYPE
          SYNTAX OCTET STRING
          ACCESS read-write
          STATUS mandatory
          DESCRIPTION
              "The mask applied to the acctFromInterfaceValuefield, encoded



  Mills, Brooks & Owen  Expires Jan. 9, 1993              [Page 22]




  Internet Accounting Working Group                    July 9, 1992



          as an OCTET STRING."
          ::= { acctActionEntry 26  }

  acctActionFromInterfaceType     OBJECT-TYPE
          SYNTAX INTEGER
          ACCESS read-write
          STATUS mandatory
          DESCRIPTION
              "The type of address in the acctActionFromInterfaceValue field."
          ::= { acctActionEntry 27  }

  acctActionFromInterfaceValue    OBJECT-TYPE
          SYNTAX OCTET STRING
          ACCESS read-write
          STATUS mandatory
          DESCRIPTION
              "The bit value to be used with the mask field.
          Bits covered by the mask are selected for indiduation.
          Bits not covered by the mask are stuffed into the FlowRecord
          from the acctActionFromInterfaceValue."
          ::= { acctActionEntry 28  }



  ---
  --- Internet Accounting Traps
  ---

  declareDataLoss TRAP-TYPE
          ENTERPRISE { internet-accounting }
          DESCRIPTION
              "Sent by the meter to the management host to
          indicate that usage data is being lost."
          ::= 1

  declareHighWater TRAP-TYPE
          ENTERPRISE { internet-accounting }
          VARIABLES { highWaterMark }
          DESCRIPTION
              "Sent by the meter to the management host to
          indicate that the high water mark has been exceeded.
          This should be interpreted by the management host as a
          request to increase the polling interval. N.B. this
          trap is optional. Meters are not required to implement
          this trap; management hosts are not required to
          increase increase their polling period."
          ::= 2

  declareFlood TRAP-TYPE
          ENTERPRISE { internet-accounting }



  Mills, Brooks & Owen  Expires Jan. 9, 1993              [Page 23]




  Internet Accounting Working Group                    July 9, 1992



          DESCRIPTION
              "This trap contains, as part of the trap body,
          internet accounting flow records. The assumption here is
          that these flow records will be send as Opaque values,
          allowing an escape to more detailed ASN.1 types."
          ::= 3

  END


  6.  Acknowledgements

  This document was produced under the auspices of the IETF's Accounting
  Working Group with assistance from SNMP and SAAG working groups.
  (names forthcoming).  Nevil Brownlee and the University of Auckland
  have invested significant time and effort towards implementation.

  7.  References

     [1] Cerf, V., "IAB Recommendations for the Development of Internet
         Network Management Standards", RFC 1052, NRI, April 1988.

     [2] Cerf, V., "Report of the Second Ad Hoc Network Management
         Review Group", RFC 1109, NRI, August 1989.

     [3] Rose M., and K. McCloghrie, "Structure and Identification of
         Management Information for TCP/IP-based internets", RFC 1155,
         Performance Systems International, Hughes LAN Systems, May
         1990.

     [4] McCloghrie K., and M. Rose, "Management Information Base for
         Network Management of TCP/IP-based internets", RFC 1156, Hughes
         LAN Systems, Performance Systems International, May 1990.

     [5] Case, J., Fedor, M., Schoffstall, M., and J. Davin, "Simple
         Network Management Protocol (SNMP), RFC 1157, SNMP Research,
         Performance Systems International, Performance Systems
         International, MIT Laboratory for Computer Science, May 1990.

     [6] McCloghrie K., and M. Rose, Editors, "Management Information
         Base for Network Management of TCP/IP-based internets", RFC
         1213, Performance Systems International, March 1991.

     [7] Information processing systems - Open Systems Interconnection -
         Specification of Abstract Syntax Notation One (ASN.1),
         International Organization for Standardization, International
         Standard 8824, December 1987.

     [8] Information processing systems - Open Systems Interconnection -
         Specification of Basic Encoding Rules for Abstract Notation One



  Mills, Brooks & Owen  Expires Jan. 9, 1993              [Page 24]




  Internet Accounting Working Group                    July 9, 1992



         (ASN.1), International Organization for Standardization,
         International Standard 8825, December 1987.

     [9] Rose, M., and K. McCloghrie, Editors, "Concise MIB
         Definitions", RFC 1212, Performance Systems International,
         Hughes LAN Systems, March 1991.

     [10] Mills, C., Hirsch, G. and Ruth, G., "Internet Accounting
         Background", RFC 1272, Bolt Beranek and Newman Inc., Meridian
         Technology Corporation, November 1991.

     [11] Mills, C., Laube, K. and Ruth, G., "Internet Accounting
         Architecture", Internet Draft, Bolt Beranek and Newman Inc.,
         July 1992.

     [12] McCloghrie, K., Editor, "Extensions to the Generic-Interface
         MIB", RFC 1229, Hughes LAN Systems, May 1991.


  8.  Security Considerations

  Security issues are not discussed in this memo.


  9.  Authors' Addresses

     Cyndi Mills
     BBN Systems and Technologies
     10 Moulton St.
     Cambridge Mass. 02138

     Phone: (617) 873-4143
     Email: CMills@bbn.com

     Charles Brooks
     BBN Systems and Technologies
     10 Moulton St.
     Cambridge Mass. 02138

     Phone: (617) 873-3589
     Email: CBrooks@bbn.com

     A. D. (Buz) Owen
     BBN Systems and Technologies
     10 Moulton St.
     Cambridge Mass. 02138

     Phone: (617) 873-3688
     Email: ADO@bbn.com




  Mills, Brooks & Owen  Expires Jan. 9, 1993              [Page 25]