A3COM-HUAWEI-IDS-MIB

All MIBs › A3COM-HUAWEI-IDS-MIB

Organization: Huawei-3com Technologies Co., Ltd.

Last Updated: 2005-07-14

Category: VPN and Security, Vendor: H3C/HH3C

Description: Monitors the H3C Intrusion Detection System engine status, signature rules, and detected-attack counters.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is A3COM-HUAWEI-IDS-MIB?

A3COM-HUAWEI-IDS-MIB is an H3C/3Com vendor MIB for managing and monitoring the Intrusion Detection System (IDS) engine embedded in or attached to H3C network devices, per its stated purpose of detecting intruder activity. It exposes IDS-specific data such as engine/process operating status, configured signature/attack-rule sets, and counters for detected attacks or intrusion events. As a security-monitoring MIB its primary hardware/software-status role is tracking whether the IDS detection process/engine is running and healthy, and surfacing how many attacks of each type have been detected, functioning like a process/service-status and event-counter MIB for the security subsystem. It is a self-contained vendor extension with no indicated dependency on other MIBs beyond standard SNMP SMI conventions. It is deployed on H3C/3Com routers, switches, or dedicated security appliances that include an integrated intrusion-detection feature, exposed to management systems through the A3COM-HUAWEI-IDS-MIB MIB.

IPNetwork Monitor allows you to monitor SNMP objects defined in A3COM-HUAWEI-IDS-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

H3C/3Com router/switch/security appliance with integrated IDS

Monitoring Examples

No concrete object or table names were provided for this module, so specific OIDs cannot be cited; based on its stated purpose, a monitoring scenario would involve polling the IDS engine's running/enabled status and its detected-attack counters to notice a spike in flagged intrusion attempts or an engine that has stopped processing traffic. Confirming exact object names would require the underlying MIB source.

What Can Be Monitored

IDS engine operational status
configured signature/attack rules
detected attack event counts

Imported Objects

From A3COM-HUAWEI-OID-MIB

h3cCommon

OBJECT-IDENTITY

From INET-ADDRESS-MIB

InetAddress
InetAddressType

From SNMPv2-SMI

Integer32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

OIDs

OID symbolic	OID numeric	Type	Access	Description
h3cIds	1.3.6.1.4.1.43.45.1.10.2.47
h3cIDSMib	1.3.6.1.4.1.43.45.1.10.2.47.1			This MIB describes IDS private information. IDS(Instruction Detecting System) is used to detect intruder activity.
h3cIDSTrapGroup	1.3.6.1.4.1.43.45.1.10.2.47.1.1
h3cIDSTrapInfo	1.3.6.1.4.1.43.45.1.10.2.47.1.1.1
U32 h3cIDSTrapIPFragmentQueueLen	1.3.6.1.4.1.43.45.1.10.2.47.1.1.1.1	Unsigned32	accessible-for-notify	The length of IP fragment queue.
U32 h3cIDSTrapStatSessionTabLen	1.3.6.1.4.1.43.45.1.10.2.47.1.1.1.2	Unsigned32	accessible-for-notify	The length of status session table.
IPt h3cIDSTrapIPAddressType	1.3.6.1.4.1.43.45.1.10.2.47.1.1.1.3	InetAddressType	accessible-for-notify	The type of IP Address.
IP h3cIDSTrapIPAddress	1.3.6.1.4.1.43.45.1.10.2.47.1.1.1.4	InetAddress	accessible-for-notify	IP Address.
OCT h3cIDSTrapUserName	1.3.6.1.4.1.43.45.1.10.2.47.1.1.1.5	OCTET STRING	accessible-for-notify	User name.
INT h3cIDSTrapLoginType	1.3.6.1.4.1.43.45.1.10.2.47.1.1.1.6	INTEGER	accessible-for-notify	Login type, including telnet, ssh and web.
INT h3cIDSTrapUpgradeType	1.3.6.1.4.1.43.45.1.10.2.47.1.1.1.7	INTEGER	accessible-for-notify	Upgrade type, including programme(system image), crb(custom rule base, one kind of configuration file), vrb(vendor rule base, one kind of configuration file).
OCT h3cIDSTrapCRLName	1.3.6.1.4.1.43.45.1.10.2.47.1.1.1.8	OCTET STRING	accessible-for-notify	CRL(Certificate Revoke List) name.
OCT h3cIDSTrapCertName	1.3.6.1.4.1.43.45.1.10.2.47.1.1.1.9	OCTET STRING	accessible-for-notify	Certificate name.
U32 h3cIDSTrapDetectRuleID	1.3.6.1.4.1.43.45.1.10.2.47.1.1.1.10	Unsigned32	accessible-for-notify	The rule ID which is a unique identifier for a specified detect rule.
I32 h3cIDSTrapEngineID	1.3.6.1.4.1.43.45.1.10.2.47.1.1.1.11	Integer32	accessible-for-notify	A unique number used to identify an interface.
OCT h3cIDSTrapFileName	1.3.6.1.4.1.43.45.1.10.2.47.1.1.1.12	OCTET STRING	accessible-for-notify	The file name.
U32 h3cIDSTrapCfgLineInFile	1.3.6.1.4.1.43.45.1.10.2.47.1.1.1.13	Unsigned32	accessible-for-notify	The line number in the configuration file.
OCT h3cIDSTrapReasonForError	1.3.6.1.4.1.43.45.1.10.2.47.1.1.1.14	OCTET STRING	accessible-for-notify	The information of the notification. Although the format and content of this object are device specific, they should be defined uniformly in the device.
h3cIDSTrap	1.3.6.1.4.1.43.45.1.10.2.47.1.1.2
h3cIDSTrapPrefix	1.3.6.1.4.1.43.45.1.10.2.47.1.1.2.0
NTF h3cIDSTrapIPFragQueueFull	1.3.6.1.4.1.43.45.1.10.2.47.1.1.2.0.1			This notification will be generated when the IP fragment queue is full. The h3cIDSTrapIPFragmentQueueLen describes the length of current fragment queue. The h3cIDSTrapReasonForError describes reason for error.
NTF h3cIDSTrapStatSessTabFull	1.3.6.1.4.1.43.45.1.10.2.47.1.1.2.0.2			This notification will be generated when the status session table is full. The h3cIDSTrapStatSessionTabLen describes the length of current status session table. The h3cIDSTrapReasonForError describes reason for error.
NTF h3cIDSTrapDetectRuleParseFail	1.3.6.1.4.1.43.45.1.10.2.47.1.1.2.0.3			This notification will be generated when failing to parse the rules for detecting. The h3cIDSTrapDetectRuleID object describes rule ID. The h3cIDSTrapEngineID object identifies an interface the rule applies to. The h3cIDSTrapReasonForError object describes reason for error.
NTF h3cIDSTrapDBConnLost	1.3.6.1.4.1.43.45.1.10.2.47.1.1.2.0.4			This notification will be generated when connecting with database server fails. The h3cIDSTrapIPAddressType object describes the IP address type of database server. The h3cIDSTrapIPAddress object describes the IP address of database server. The h3cIDSTrapReasonForError describes reason of connecting failure.
NTF h3cIDSTrapCRLNeedUpdate	1.3.6.1.4.1.43.45.1.10.2.47.1.1.2.0.5			This notification will be generated when IDS device detects that CRL is out of date. The h3cIDSTrapCRLName object describes the CRL(Certificate Revoke List) name. The h3cIDSTrapReasonForError object describes reason for error.
NTF h3cIDSTrapCertOverdue	1.3.6.1.4.1.43.45.1.10.2.47.1.1.2.0.6			This notification will be generated when IDS device detects that certificate is overdue. The h3cIDSTrapCertName object describes the certificate name. The h3cIDSTrapReasonForError object describes reason for error.
NTF h3cIDSTrapTooManyLoginFail	1.3.6.1.4.1.43.45.1.10.2.47.1.1.2.0.7			This notification will be generated when the login failure times of a user over a certain number. The h3cIDSTrapUserName object describes the user name when logging in. The h3cIDSTrapIPAddressType object describes the IP address type of client. The h3cIDSTrapIPAddress object describes the IP address of client. The h3cIDSTrapLoginType object describes login type, including: telnet, ssh, web. The h3cIDSTrapReasonForError object describes reason for error.
NTF h3cIDSTrapUpgradeError	1.3.6.1.4.1.43.45.1.10.2.47.1.1.2.0.8			This notification will be generated when upgrading fails. The h3cIDSTrapUpgradeType object describes upgrade type, including: programme, vrb. The h3cIDSTrapReasonForError object describes reason for error.
NTF h3cIDSTrapFileAccessError	1.3.6.1.4.1.43.45.1.10.2.47.1.1.2.0.9			This notification will be generated when accessing file fails. The h3cIDSTrapFileName object describes the name of file accessed. The h3cIDSTrapReasonForError object describes reason for error.
NTF h3cIDSTrapConsArithMemLow	1.3.6.1.4.1.43.45.1.10.2.47.1.1.2.0.10			This notification will be generated when memory used by constructing the arithmetic to seek content is lacking. The h3cIDSTrapReasonForError object describes reason for error.
NTF h3cIDSTrapSSRAMOperFail	1.3.6.1.4.1.43.45.1.10.2.47.1.1.2.0.11			This notification will be generated when reading or writing SSRAM of CIE card fails. The h3cIDSTrapReasonForError object describes reason for error.
NTF h3cIDSTrapPacketProcessDisorder	1.3.6.1.4.1.43.45.1.10.2.47.1.1.2.0.12			This notification will be generated when packets processed is in disorder. The h3cIDSTrapReasonForError object describes reason for error.
NTF h3cIDSTrapCfgFileFormatError	1.3.6.1.4.1.43.45.1.10.2.47.1.1.2.0.13			When devices startup and load the configuration file, if format error is found, this notification will be generated. The h3cIDSTrapFileName object describes the name of configuration file. The h3cIDSTrapCfgLineInFile object describes the line number in the file.

RFC description

Intrusion Detection System (IDS) MIB from Huawei-3COM for detecting and reporting intruder activity.

Start monitoring H3C/3Com routers/switches/security appliances with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download A3COM-HUAWEI-IDS-MIB

What Is A3COM-HUAWEI-IDS-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description