Summary

  • RFC 3498's apsCommandSwitch readback returned the last command written, not necessarily the command currently governing a SONET protection group.
  • An equal- or higher-priority local or remote request could preempt that command. Current received/transmitted K1/K2, channel state, optical traffic and service recovery therefore required their own evidence.

Suppose an operator writes a manual switch from the working line to protection. Later, a more urgent signal-failure request arrives from the far end. A subsequent SNMP read still returns the manual switch. Every byte in that answer can be correct while the live optical system is obeying another request.

RFC 3498 put the warning directly into the object definition. apsCommandSwitch returns the last command written, or noCmd after initialization. The RFC then says that this does not imply the command is currently in effect. It may have been preempted by a higher-priority local or remote request. To determine current group state, the manager has to read received and transmitted K1/K2.

That is the article's central distinction: a management object can be an accurate history of intention and an inaccurate description of present control.

The surrounding system was SONET linear Automatic Protection Switching. RFC 3498 defined an SMIv2 MIB for 1+1 and 1:n architectures; ring protection was outside its scope. A manager could assemble channels into named groups, activate a coherent configuration, issue commands, inspect group and channel state, count failures and switchovers, and enable selected notifications.

Configuration began with channel rows. Each named a SONET line-terminating interface, channel number and, for 1:n, priority. Before a group could become active, channels had to form a valid consecutive set, starting at zero for most modes or one for the optimized 1+1 mode, with working channels no higher than fourteen. Group activation checked those relations and returned inconsistentValue when numbering, architecture or configuration did not fit.

An active RowStatus was therefore meaningful: the management model was internally consistent. It was not a receipt for a fault, peer agreement, completed physical switch or restored customer traffic. The command table appeared as a side effect of activation, but its existence only made actions addressable.

Those actions carried real operational force. A manager could clear requests, lock out the protection line, force or manually request movement in either direction, or exercise the APS protocol. In 1:n it could also lock out a working channel. If an equal- or higher-priority request was already active, the command failed with inconsistentValue. Command acceptance depended on an arbitration hierarchy larger than the SNMP session.

K1 and K2 were the live protocol surface. K1 encoded the request and channel. K2 encoded the channel, 1+1 versus 1:n architecture, and unidirectional, bidirectional, RDI-L or AIS-L mode. The MIB exposed both what the node was transmitting and what it received. Their agreement, mismatch or failure said more about the present APS conversation than the remembered command did.

Even K1/K2 stopped short of application outcome. Group state separately reported mode mismatch, channel mismatch, protection-switch-byte failure, far-end protection-line failure and extra traffic. A protection-switch-byte failure could arise when no three K1 bytes in the relevant twelve-frame window were consistent, or when invalid codes persisted for three frames. Channel state separately identified lockout, signal degrade, signal failure, switched and wait-to-restore.

History required its own qualifications. Counters recorded degrade, failure and switchover; timestamps recorded the last switch; duration counted seconds carried on protection. But protection duration was valid only in revertive mode. Turning reversion off could change a non-zero value to zero, with a discontinuity timestamp marking the semantic break. Management reinitialization could also reset counters. Zero without mode and epoch was not “never happened.”

Notifications offered another non-equivalence. The enable object selected switchover and four mismatch/failure events, but its default bit set was empty, and the event group was optional. Silence could mean no event, disabled events, an unsupported optional group, delivery failure or management failure. It could not certify a quiet optical plant.

Security magnified the stakes. Switch commands, lockouts, group activation, direction, reversion, BER thresholds, interface selection, priority and notification settings were writable or creatable. Malicious SETs could disrupt protection. RFC 3498 rejected pre-SNMPv3 security and recommended authentication, privacy and access restricted to legitimate principals. Yet authenticated authorship still did not grant a low-priority command supremacy over a remote failure request.

The evidence chain is consequently longer than one GET: an authenticated and authorized SET, accepted syntax, successful priority arbitration, recorded command, emitted K1/K2, converged peer response, current switched-channel state, actual optical movement, continuous counters and alarms, recovered customer traffic, and a post-reversion posture ready for the next fault. Each transition can fail while the earlier receipt remains true.

This is distinct from RFC 1595's provisional SONET performance intervals, RFC 3637's inhibited WIS counters and RFC 3469's broader recovery cycle. RFC 3498 owns a narrower, enduring lesson. Management standardization makes commands and observations portable. It does not make a record of the last command sovereign over the current system.

Sources