MIBs Depot

EXTREME-IP-SECURITY-MIB

Registered at
1.3.6.1.4.1.1916.1.34
Last updated
2005-02-14 00:00
Organization
Extreme Networks, Inc.
Namespace
extreme
Source file
EXTREME-IP-SECURITY-MIB
Digest
sha256:7a7c67e9766a9cffd9fbdccb64dcbcf3a7d07d0db22938e65241be359d1b95df

Description

Extreme IP Security MIB

Contact

www.extremenetworks.com

Imports

FromSymbols
EXTREME-BASE-MIBextremeAgent
INET-ADDRESS-MIBInetAddress, InetAddressType, InetPortNumber
SNMPv2-CONFMODULE-COMPLIANCE, NOTIFICATION-GROUP
SNMPv2-SMICounter64, Integer32, IpAddress, MODULE-IDENTITY, NOTIFICATION-TYPE, OBJECT-IDENTITY, OBJECT-TYPE, iso
SNMPv2-TCDisplayString, MacAddress, RowStatus, TEXTUAL-CONVENTION

Imported by

Nothing in this corpus imports this module.

Load order

Every file a consumer needs in order to load this module, dependencies first.

EXTREME-BASE-MIB
EXTREME-IP-SECURITY-MIB
INET-ADDRESS-MIB
SNMPv2-CONF
SNMPv2-SMI
SNMPv2-TC

Textual conventions

NameOIDSyntaxAccessStatus
HexOctet
TEXTUAL-CONVENTION
A single hexidecimal octet used to specify TCP flags
current
IcmpAnomalyReason
TEXTUAL-CONVENTION
1) the size of ICMP is large than pre-configured allowed size 2) Fragmented ICMP packet
current
IpProtocol
TEXTUAL-CONVENTION
The value of the IP Protocol field of an IP Datagram Header. This identifies the protocol layer above IP. For example, the value 6 is used for TCP and the value 17 is used for UDP. The values of this field are defined in the Assigned Numbers RFC.
current
TcpFlagAnomalyReason
TEXTUAL-CONVENTION
1) (TCP flag SYN is set) and (its TCP source port < 1024). OR 2) (TCP flag == 0) and (TCP seq # == 0). OR 3) (TCP flag FIN/URG/PSH bits sre set) and (TCP seq # == 0). OR 4) Both TCP iflag SYN and FIN are set
current
TcpFragmentAnomalyReason
TEXTUAL-CONVENTION
1) TCP packet and incompleted TCP header (IP payload less tahn MIN_TCP_HDR_SIZE) 2) Fragmented TCP packet (IP fragment offset = 1)
current
VlanTag
TEXTUAL-CONVENTION
The tag used when encapsulating packets transmitted
current

Objects

NameOIDSyntaxAccessStatus
extremeIpSecurityTraps
OBJECT-IDENTITY
1.3.6.1.4.1.1916.1.34.1
extremeIpSecurityTrapsPrefix
OBJECT-IDENTITY
1.3.6.1.4.1.1916.1.34.1.0
extremeIpSecurityVlanIfIndex
OBJECT-TYPE
The ifIndex of the VLAN on which the violating packet was received.
1.3.6.1.4.1.1916.1.34.1.1Integer32accessible-for-notifycurrent
extremeIpSecurityVlanDescr
OBJECT-TYPE
The description(name) of the VLAN on which the violating packet was received.
1.3.6.1.4.1.1916.1.34.1.2DisplayString (SIZE(0..32))accessible-for-notifycurrent
extremeIpSecurityPortIfIndex
OBJECT-TYPE
The ifIndex of the port on which the violating packet was received.
1.3.6.1.4.1.1916.1.34.1.3Integer32accessible-for-notifycurrent
extremeIpSecurityIpAddr
OBJECT-TYPE
Source IP address of the violating packet
1.3.6.1.4.1.1916.1.34.1.4IpAddressaccessible-for-notifycurrent
extremeIpSecurityMacAddress
OBJECT-TYPE
Source MAC address from the ethernet header of the violating packet
1.3.6.1.4.1.1916.1.34.1.5MacAddressaccessible-for-notifycurrent
extremeIpSecurityViolationType
OBJECT-TYPE
The type of IP Security violation that occurred - rogueDhcpServerPacket(1) A rogue DHCP server packet was received. - badIpMacBindingInArpPacket(2) The IP-MAC binding received in the ARP packet does not exist in the DHCP Bindings table or is incorrect. - badIpInArpPacket(3) The Source IP address in the ARP payload is invalid. - badMacInArpPacket(4) One of the MAC addresses in the ARP payload does not match with its counterpart in the ethernet header. - bcastSenderIpInArpPacket(5) The Sender IP address in the ARP payload is Broadcast. - bcastTargetIpInArpPacket(6) The Target IP address in the ARP payload is Broadcast.
1.3.6.1.4.1.1916.1.34.1.6INTEGER {rogueDhcpServerPacket(1), badIpMacBindingInArpPacket(2), badIpInArpPacket(3), badMacInArpPacket(4), bcastSenderIpInArpPacket(5), bcastTargetIpInArpPacket(6)}accessible-for-notifycurrent
extremeIpSecurityAnomalyTraps
OBJECT-IDENTITY
1.3.6.1.4.1.1916.1.34.2
extremeIpSecurityAnomalyTrapsPrefix
OBJECT-IDENTITY
1.3.6.1.4.1.1916.1.34.2.0
esAnomalyPortIfIndex
OBJECT-TYPE
The ifIndex of the port on which the violating packet was received.
1.3.6.1.4.1.1916.1.34.2.1Integer32accessible-for-notifycurrent
esAnomalyVlanIfIndex
OBJECT-TYPE
The ifIndex of the VLAN on which the violating packet was received.
1.3.6.1.4.1.1916.1.34.2.2Integer32accessible-for-notifycurrent
esAnomalyVlanDescr
OBJECT-TYPE
The description(name) of the VLAN on which the violating packet was received.
1.3.6.1.4.1.1916.1.34.2.3DisplayString (SIZE(0..32))accessible-for-notifycurrent
esAnomalySrcMacAddress
OBJECT-TYPE
Source MAC address in the violating packet
1.3.6.1.4.1.1916.1.34.2.4MacAddressaccessible-for-notifycurrent
esAnomalyDestMacAddress
OBJECT-TYPE
Destination MAC address in the violating packet
1.3.6.1.4.1.1916.1.34.2.5MacAddressaccessible-for-notifycurrent
esAnomalySrcIpAddrType
OBJECT-TYPE
source IP address type: ipv4 or ipv6
1.3.6.1.4.1.1916.1.34.2.6InetAddressTypeaccessible-for-notifycurrent
esAnomalySrcIpAddr
OBJECT-TYPE
source IP address in the violating packet
1.3.6.1.4.1.1916.1.34.2.7InetAddressaccessible-for-notifycurrent
esAnomalyDestIpAddrType
OBJECT-TYPE
destination IP address type: ipv4 or ipv6
1.3.6.1.4.1.1916.1.34.2.8InetAddressTypeaccessible-for-notifycurrent
esAnomalyDestIpAddr
OBJECT-TYPE
destination IP address in the violating packet
1.3.6.1.4.1.1916.1.34.2.9InetAddressaccessible-for-notifycurrent
esAnomalyIpProto
OBJECT-TYPE
IP protocol in the violating packet
1.3.6.1.4.1.1916.1.34.2.10IpProtocolaccessible-for-notifycurrent
esAnomalySrcL4Port
OBJECT-TYPE
tcp/udp source port number in the violating packet
1.3.6.1.4.1.1916.1.34.2.11InetPortNumberaccessible-for-notifycurrent
esAnomalyDestL4Port
OBJECT-TYPE
tcp/udp destination port in the violating packet
1.3.6.1.4.1.1916.1.34.2.12InetPortNumberaccessible-for-notifycurrent
esAnomalyTcpFlag
OBJECT-TYPE
TCP flags in the violating packet
1.3.6.1.4.1.1916.1.34.2.13HexOctetaccessible-for-notifycurrent
esAnomalyTcpSeq
OBJECT-TYPE
TCP sequence number in the violating packet
1.3.6.1.4.1.1916.1.34.2.14Integer32accessible-for-notifycurrent
esAnomalyTcpHdrSize
OBJECT-TYPE
TCP Header size in the violating packet
1.3.6.1.4.1.1916.1.34.2.15Integer32accessible-for-notifycurrent
esAnomalyTcpFlagReason
OBJECT-TYPE
TCP flag anomaly reason code
1.3.6.1.4.1.1916.1.34.2.16TcpFlagAnomalyReasonaccessible-for-notifycurrent
esAnomalyIcmpReason
OBJECT-TYPE
ICMP anomaly reason code
1.3.6.1.4.1.1916.1.34.2.17IcmpAnomalyReasonaccessible-for-notifycurrent
esAnomalyVlanTag
OBJECT-TYPE
the vlan tag in the violating packet
1.3.6.1.4.1.1916.1.34.2.18VlanTagaccessible-for-notifycurrent
esAnomalyTcpFragmentReason
OBJECT-TYPE
TCP fragment anomaly reason code
1.3.6.1.4.1.1916.1.34.2.19TcpFragmentAnomalyReasonaccessible-for-notifycurrent

Notifications

NameOIDStatus
extremeIpSecurityViolation
NOTIFICATION-TYPE
For vlans/ports on which one or more of the IP Security features have been enabled, this trap will be generated when a packet received on that vlan/port is in violation of the configured IP Security protections
1.3.6.1.4.1.1916.1.34.1.0.1current
extremeIpSecurityAnomalyIpViolation
NOTIFICATION-TYPE
For ports on which the protocol anomaly protection IP features has been enabled, this trap will be generated when a packet received on that port if the packet's source IP == destination IP
1.3.6.1.4.1.1916.1.34.2.0.1current
extremeIpSecurityAnomalyL4PortViolation
NOTIFICATION-TYPE
For ports on which the protocol anomaly protection L4port features has been enabled, this trap will be generated when a packet received on that port if 1) the packet is a TCP or UDP packetr. AND 2) its source L4 port == destination port
1.3.6.1.4.1.1916.1.34.2.0.2current
extremeIpSecurityAnomalyTcpFlagViolation
NOTIFICATION-TYPE
For ports on which the protocol anomaly protection TCP flags features has been enabled, this trap will be generated when a TCP packet received on that port if 1) (TCP flag SYN is set) and (its TCP source port < 1024). OR 2) (TCP flag == 0) and (TCP seq # == 0). OR 3) (TCP flag FIN/URG/PSH bits sre set) and (TCP seq # == 0). OR 4) Both TCP iflag SYN and FIN are set
1.3.6.1.4.1.1916.1.34.2.0.3current
extremeIpSecurityAnomalyTcpFragmentViolation
NOTIFICATION-TYPE
For ports on which the protocol anomaly protection TCP fragment features has been enabled, this trap will be generated when a packet received on that port if 1) the packet is a TCP, and its size of the TCP header is less than pre-configured value; or 2) the packet is a TCP and it is a IP fragmented packet (IP offset != 0)
1.3.6.1.4.1.1916.1.34.2.0.4current
extremeIpSecurityAnomalyIcmpViolation
NOTIFICATION-TYPE
For ports on which the protocol anomaly protection ICMP features has been enabled, this trap will be generated when an ICMP packet received on that port if 1) the size of ICMP (IP payload) is large thant pre-configured value; or 2) it is a fragmented IP/ICMP packet (IP offset != 0)
1.3.6.1.4.1.1916.1.34.2.0.5current