ALCATEL-IND1-NETSEC-MIB: View SNMP OID List / Download MIB

This module describes an authoritative enterprise-specific Simple Network Management Protocol (SNMP) Management Information Base (MIB): For the Birds Of Prey Product Line Configuration and monitoring of the EtherBreaker feature. The right to make changes in specification and other information contained in this document without prior notice is reserved. No liability shall be assumed for any incidental, indirect, special, or consequential damages whatsoever arising from or related to this document or the information contained herein. Vendors, end-users, and other interested parties are granted non-exclusive license to use this specification in connection with management of the products for which it is intended to be used. Copyright (C) 1995-2007 Alcatel-Lucent ALL RIGHTS RESERVED WORLDWIDE

Branch For NETSEC MIB Subsystem Notifications.

Trap for an anomaly detected on a port.

Trap for an anomalous port quarantine.

Table for collecting port-range and monitoring-group associations. A port belongs to at most one monitoring-group.

Each entry is identified by a unique port-range.

Starting interface index of a port-range

Ending interface index of a port-range

Name of monitoring-group with which this port-range is associated.

identifies state of this entry. CREATEANDGO will only work, if the name of alaNetSecPortRangeGroupName is part of the create request

Table for collecting monitoring-groups' anomaly configurations

Each entry identifies configuration of a monitoring-group's anomaly-type's parameter

name of the monitoring-group

monitoring-group's anomaly-type

State of detecting indexed anomaly.

State of logging upon detecting anomaly.

State of sending traps upon detecting anomaly.

State of Quarantining anomalous port upon detecting anomaly.

Count of packets that must be seen during monitoring period to initiate anomaly detection check. Default value varies as below with anomaly: Anomaly Count ------- ----- ARP address scan 50 ARP flood 90 ARP poisoning 6 ARP Failure 6 ICMP address scan 30 ICMP Flood 90 ICMP Unreachable 20 TCP port Scan 20 TCP address scan 30 SYN flood 90 SYN Failure 10 SYN-ACK Scan 2 FIN Scan 6 FIN-ACK Diff 5 RST Count 50

Sensitivity of Anomaly Check to deviation from expected behavior.

Time in seconds to monitor packets before checking for anomaly.

CREATEANDGO will only work if, besides RowStatus, at least one of State, Log, Trap, Quarantine, Count, Sensitivity or Period is part of the request.

Table for reporting port specific statistics

Stats are collected on a basis

Interface Index of the port

Packet type

Count of Indexed Ingress packets observed during last 5 seconds

Count of Indexed Egress packets observed during last 5 seconds

Count of Indexed Ingress packets observed since monitoring was enabled, Counter will loop back from zero upon reaching the maximum

Count of Indexed Egress packets observed since monitoring was enabled. Counter will loop back from zero upon reaching the maximum

Table for reporting Anomaly statistics

Stats are collected on a basis

Interface Index of the port

Anomaly type

Packet type

Count of Indexed packets ingress during current monitoring period.

Count of Indexed packets egress during current monitoring period.

Count of Indexed packets ingress during last monitoring period.

Count of Indexed packets egress during last monitoring period.

Table for reporting Anomaly summaries

Summary are reported on a basis

Interface Index of port

Anomaly type

Count of observations for indexed anomaly on indexed port since monitoring was enabled.

Count of detections for indexed anomaly on indexed port since monitoring was enabled.

Table for reporting port anomaly operation parameters

Each entry is identified by a unique port, and anomaly-type combination

interface index of port

anomaly-type

state of anomaly

Logging state of anomaly

Trap state of anomaly

Quarantine state of anomaly

activation-count being used by netsec on the indexed object

sensitivity being used by netsec on the indexed object

monitoring period being used by netsec on the indexed object

Table for reporting group anomaly operation parameters

Each entry is identified by a unique group, and anomaly-type combination

name of the group

anomaly-type

state of anomaly

Logging state of anomaly

Trap state of anomaly

Quarantine state of anomaly

activation-count being used by netsec on the indexed object

sensitivity being used by netsec on the indexed object

monitoring period being used by netsec on the indexed object

Table of groups configured

Each entry identifies a configured group

Name of configured group

Yes if there are ports in this group.

Yes if any of this group's anomaly has a non-default configuration.

Interface index of port on which anomaly is detected

Type of anomaly detected on the interface

Nature of anomaly. Informs if system attached to interface is source or target of the anomaly. Enumeration: 'unknown': 1, 'target': 3, 'source': 2.

Branch for NETSEC application conformance information

Branch for NETSEC application units of conformance

Collection of objects for management at port range level

Collection of objects for management at port group level

Traps

Port Statistics Collection

Port Anomaly Statistics Collection

Anomaly summary Collection

Port operation parameter value Collection

Group operation parameter value Collection

Monitoring Group port membership Collection

Entry identifies configuration of a monitoring-group's anomaly-type's parameter group.

Entry is identified by a unique port-range group.

Trap for an anomaly detected on a port group.

Branch for NETSEC application compliance statements

Compliance statement for NetSec.