Summary

  • RFC 2021's protocol directory inventoried packet types a probe could already decode and count; it was not a store of downloadable parsers.
  • “Limited extensibility” could add one child discriminator only where implementation-time code already knew the parent protocol's demultiplexing field.

The most useful example in RFC 2021 begins after much of the difficult work is already done. A probe's C code understands Ethernet encapsulations, IP, the IP protocol field, UDP and UDP port numbers. Its table already associates 161 with SNMP, 53 with DNS and 69 with TFTP. A manager may then add a row associating UDP port 123 with NTP and begin counting matching packets.

That sounds like an extensible analyser until the starting conditions are restored. The new row does not teach the probe Ethernet, IP, UDP, ports or NTP message syntax. Code written when the product was built has already found every boundary needed to reach the UDP port. Configuration supplies one more value at the final, table-driven fork. RFC 2021 therefore chose the exact phrase “limited extensibility”: the mechanism worked only when code had been designed to accommodate it, and it went no more than one level higher.

Inventory before configuration

Section 5.2 calls the protocol directory an inventory of protocol types the probe is capable of monitoring. The protocolDirTable description is even narrower: one row for each protocol the agent has the capability to decode and count. An agent boots with entries for protocols it knows and elects to monitor. It need not enumerate every possible Ethernet protocol type, nor create a row merely because a packet appeared on the wire.

The rejection rule closes the gap between a writable table and an open-ended parser. If a manager writes a protocolDirID the agent does not understand, directly or through an algorithmic assignment, the SET must fail. Mutability governs a vocabulary within implemented recognition; it does not manufacture recognition.

Three fields keep different kinds of identity apart. protocolDirID describes a hierarchical encapsulation path. protocolDirParameters contributes one parameter octet for every node in that path, in the same order, qualifying how the path is interpreted. protocolDirLocalIndex is an agent-assigned shortcut for downstream tables: locally arbitrary, unique within one SNMP entity, stable across a management-system reinitialisation, and not reusable after deletion until the next agent restart. It is not a portable global protocol number.

protocolDirType then reports capability rather than granting it. Its extensible bit says whether a manager may create children. A child added where the probe has no built-in support is itself non-extensible. The address-recognition bit is separate because recognising and counting a network-layer protocol does not necessarily mean being able to extract its addresses. For manager-created limited extensions, address mapping must be notSupported.

Every downstream count inherits the parser boundary

The protocol-distribution group collected packets and octets by the highest protocol detected on an interface. Host and matrix tables used local protocol-directory indexes to state both the network address format and the highest recognised protocol. They could populate entries only when the relevant support switches and recognition abilities were present.

This dependency is the historical point. A packet count is evidence that the probe matched an implemented classification path. It does not show that the probe understood a complete payload, identified a process, observed an application transaction, proved delivery, found a responsible party or assessed security. Even RFC 2021's “Application Level” label usually did not mean OSI layer 7; it denoted the broader territory above MAC and network layers, potentially including transport, session and presentation protocols.

The identifiers evolved; the boundary remained

RFC 2074, published alongside RFC 2021, supplied encoding algorithms and protocol-identifier examples. In 2000, RFC 2895 replaced it with a standards-track reference for encoding, while RFC 2896 separated out non-normative macro examples. RFC 2896 explicitly said those examples were not required for conformance and noted that maintenance ended for lack of contributions. A richer catalogue still did not become executable decoding code.

IPv6 exposed a different limit. RFC 3796 recorded an IPv4 dependency in RFC 2021's address representation and said the update then in progress did not resolve it. Hierarchical names could describe many encapsulations while downstream address fields still carried older address assumptions.

RFC 4502 obsoleted RFC 2021 in May 2006 and retained the limited-extensibility account while revising the MIB, including high-capacity Top N options and tighter size constraints. The RFC Editor also records one verified erratum for RFC 2021: reversed numeric references for RAM and PROM download actions. That correction does not change the protocol-directory mechanism.

The durable lesson is deliberately modest. A directory makes implemented distinctions visible and configurable. It can tell a management application what a particular probe says it can monitor, and it can provide stable local keys for statistics. It cannot turn a declared name into running parser capability.

Sources