Summary

  • RFC 2006 partitioned Mobile IP management across the mobile node, foreign agent and home agent, then exposed selected state through objects, tables, counters and one optional authentication-failure notification.
  • Those observations are testimony from a managed agent at a particular time. They do not, by themselves, prove a human identity, valid authority, attack origin, packet delivery, path integrity or continuing service.

In October 1996, Mobile IP acquired something more operationally useful than another packet format: a vocabulary for asking a running system what it thought it was doing. RFC 2006 placed the MIP-MIB under mib-2 44. It did not promise omniscience. Its selection rules were deliberately spare: follow the protocol’s division among mobile node, foreign agent and home agent; retain objects useful for fault or configuration management; keep the number of objects limited; omit values derivable elsewhere.

That restraint is the article’s real subject. A protocol event becomes evidence only through a chain: an implementation classifies it, an agent retains or computes a value, an access view exposes it, a manager polls or receives a notification, and an operator correlates the result with other records. RFC 2006 made the first half of that chain legible. It did not abolish the second.

Three roles, one incomplete view

mipEntities could report whether a managed system supported the mobile-node, foreign-agent or home-agent roles; more than one bit could be set. mipEnable could request that Mobile IP be enabled or disabled. mipEncapsulationSupported listed capability. Each answer is meaningful, but bounded. A role bit is not evidence that the role served traffic. A successful write is not proof that discovery and registration actually stopped. A capability bit does not show which tunnel was negotiated or whether any datagram crossed it.

The compliance statement reinforces that boundary. The basic system group was mandatory, while security associations, violation logging, per-node counters and notifications depended on what an implementation supported, logged or could report. An absent table or silent alert channel can therefore mean several things. It cannot automatically mean that the underlying event never occurred.

The mobile node’s remembered story

The mobile-node objects turned movement into agent-maintained state. mnState named five conditions—home, registered, pending, isolated and unknown. The foreign-agent table was refreshed by received advertisements and aged entries out when those advertisements expired. Counters recorded solicitations, advertisements, malformed extensions, ignored extensions and transitions the node had “decided” represented movement. Another counter recorded agent reboots “detected” through advertisement sequence numbers.

Those verbs matter. The MIB reports an implementation’s inference. A move counter does not certify physical travel. A reboot counter does not forensically establish why a sequence changed. A retained foreign-agent row shows what the node still knew at the poll, not that the agent remained reachable a moment later.

The registration table went further. It joined agent address, care-of address, flags, Identification, requested and remaining time, send time, an accepted flag and whether the care-of address was local. It was updated from requests sent, replies received and retransmissions. This is a useful local history, but it is not a packet capture and not a global transaction ledger. Its “accepted” value reports the node’s managed record of the reply; the separate RFC 2002 article owns what registration acceptance itself meant.

Different counters see different stages

The foreign agent counted valid requests received and relayed, denial codes, replies received and relayed, authentication failures and malformed messages. The home agent kept a mobility-binding table updated by registration events: home address, care-of address, received source address, flags, Identification and granted and remaining lifetime. It also kept aggregate and optional per-node counts of accepted and denied service requests, recent decisions and accumulated service time since reboot.

These surfaces cannot be safely collapsed. Ten requests at a foreign agent and ten at a home agent need not be the same ten. Retransmission, rejection, loss, reset and sampling time intervene. Similar totals do not create transaction identity. A binding row proves that the home agent reports retained state at that observation time; it does not show the packet reaching the care-of address, being decapsulated, crossing the last link or arriving at an application.

Counter and clock types add their own limits. Counter32 wraps. A remaining-lifetime Gauge32 is a poll-time value. TimeStamp is tied to the sysUpTime epoch, not automatically to civil time. The MIB even defines overall service time as accumulated since the home agent last rebooted. Width, epoch and sampling interval must be known before subtraction becomes evidence.

A security report is not an attacker’s identity

The security-association table was indexed by peer address and SPI. Its key could be created through management, but a read had to return a zero-length value. That blank is intentional concealment, not evidence that no secret exists.

Violation objects counted events and retained the latest reported address, SPI, Identification halves, time and reason. The optional mipAuthFailure notification carried part of that record when validation of a Registration Request or Reply failed. The RFC’s security section warned that this management power was itself risky and urged protected access.

An operator can use the report to investigate. The report cannot, standing alone, identify the human behind an address, distinguish a compromised node from spoofed or stale context, prove the manager received every alert, or establish legal authorization. A notification says the agent reported a validation failure. Attack attribution begins after that fact, not inside it.

RFC 2006’s durable contribution was therefore a bounded observation contract. It transformed otherwise hidden Mobile IP decisions into questions that a manager could repeat: which roles are claimed, what was attempted, what is retained, what increased, what expired, what was classified as a violation? Running evidence then requires corroboration—device identity, access and audit records, packet or control logs, uptime correlation, and data-plane or application observation. The MIB saw the binding. It did not see the whole journey.

Sources