Some more standard MIBs



Some mib-2 extensions

{system 9}: see SNMPv2-MIB.txt

If you get the entire system group from a net-snmp agent, there will be a large number of entries under system.9 (1.3.6.1.2.1.1.9)
Take a look at a couple MIB files; look up definitions of mib-2.11, mib-2.25, mib-2.88, etc
mib-2: 1.3.6.1.2.1
system: mib-2 1, or 1.3.6.1.2.1.1
 
 
When you fetch .1.3.6.1.2.1. you get the Gang of Nine:
    system(1), interfaces(2), at(3), ip(4), icmp(5), tcp(6), udp(7), egp(8), snmp(10)
(note that egp is obsolete)
But you also get huge chunks prefixed with the following:

    {ip 24}        IP-FORWARD-MIB-V1SMI.MIB :
heavy-duty routing information on route age, protocol, TOS, masks, and extensible metric information
    {ip 25}        (small)  linuxmibs/IP-MIB.txt
    {ip 31}       
    {ip 34}        linuxmibs/IP-MIB.txt
    {ip 35}        linuxmibs/IP-MIB.txt
    {tcp 19}

These are there:

    {mib-2 25}    HOST-RESOURCES-MIB.txt (iReasoning)
    {mib-2 31}    IF-MIB.txt (iReasoning)
    {mib-2 55}
    {mib-2 88}    mibs/DISMAN-EVENT-MIB.txt (this is an important group)
 
    {enterprises 2021}   ireasoningmibs/UCD-SNMP-MIB.txt
    {enterprises 8072}   linuxmibs/NET-SNMP-MIB.txt
     
Starting point: SNMPv2-SMI.txt
Starting MIB file: RFC1213-MIB.txt (shown in browser; defines Gang of Nine)

some notes on    HOST-RESOURCES-MIB.txt:
hrStorage. Note that the indexing is a bit odd; 1,3,6,7,8,10,31,32,33,34, with the bold entries being physical disks.
hrDevice: cpu, networks, not video or USB or the mouse....
hrProcessorTable: including cpu load
hrNetworkTable
hrPrinterTable: are you in "lowToner" state?
hrDiskStorageTable: actual disk space
hrFS (File System)
hrSWRunTable: all running or loaded software. Basically the ps table.
....

Security implications:
    do you want them to know how much logging space you have?

Some notes on IF-MIB.txt:
Conceptually an extension of the original IF table. The same index is used. The original interface table is extended by the ifXTable:
IfXEntry ::=
    SEQUENCE {
        ifName                  DisplayString,
        ifInMulticastPkts       Counter32,
        ifInBroadcastPkts       Counter32,
        ifOutMulticastPkts      Counter32,
        ifOutBroadcastPkts      Counter32,
        ifHCInOctets            Counter64,
        ifHCInUcastPkts         Counter64,
        ifHCInMulticastPkts     Counter64,
        ifHCInBroadcastPkts     Counter64,
        ifHCOutOctets           Counter64,
        ifHCOutUcastPkts        Counter64,
        ifHCOutMulticastPkts    Counter64,
        ifHCOutBroadcastPkts    Counter64,
        ifLinkUpDownTrapEnable  INTEGER,
        ifHighSpeed             Gauge32,
        ifPromiscuousMode       TruthValue,
        ifConnectorPresent      TruthValue,
        ifAlias                 DisplayString,
        ifCounterDiscontinuityTime TimeStamp
    }
Note the ifIndex value is not replicated in this table! This table is a logical extension of the original interfaces table.

HC is for High Capacity, that is, 64-bit counters. These all extend their 32-bit counterparts in the original interfaces table. Counters for m'cast and b'cast packets are added.

Note the added fields in bold above:
    if this link goes up or down, is a trap sent?
    high-capacity version of bandwdith; why didn't they just use Gauge64?
    ifCounterDiscontinuityTime: the sysUpTime value of the last time one of the counters suffered a discontinuity. I tis not clear if wrapping around is included. Probably not; that's not a real discontinuity.


Some notes on ETHERLIKE-MIB:
Standard statistics for Ethernet: collision counts and other errors. Note the SingleCollisonFrames counter and the MultipleCollisionFrames counter.

The CollTable counts, on a per-interface basis, how many frames were involved in how many collisions, eg
123456 frames had no collisions
 87654 frames had 1 collision
 13579 frames had 2 collisions
   4128 frames had 3 collisions
     987 frames had 4 collisions
...