A3COM-HUAWEI-LI-MIB

All MIBs › A3COM-HUAWEI-LI-MIB

Organization: Hangzhou H3C Tech. Co., Ltd.

Last Updated: 2009-08-25

Category: VPN and Security, Vendor: H3C/HH3C

Description: Manages lawful intercept mediation configuration and intercept session state on H3C network devices.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is A3COM-HUAWEI-LI-MIB?

A3COM-HUAWEI-LI-MIB is a vendor-specific MIB from Hangzhou H3C Technologies (the module's h3cLI object tree is explicitly attributed to H3C in its contact information) that manages lawful intercept (LI) mediation configuration and intercept stream state on H3C network devices. Its h3cLIMediationTable, indexed by h3cLIMediationIndex, configures the mediation device an intercepting router sends traffic to — destination address/port (h3cLIMediationDestAddr, h3cLIMediationDestPort), source interface, DSCP marking, and a timeout after which the intercept is automatically removed — while h3cLIStreamTable tracks per-stream packet and drop counters (h3cLIStreamPackets, h3cLIStreamDrops, h3cLIStreamHPackets, h3cLIStreamHDrops) and enable state for each intercept type. Notifications h3cLIActive, h3cLITimeOut, and h3cLIFailureInformation alert a manager when an intercept configuration activates, expires, or fails on a particular board in a distributed chassis. This gives compliance/network operations staff a way to confirm an authorized lawful-intercept stream is actually delivering traffic to the mediation device (via non-zero packet counts and zero drops) rather than silently failing. It depends on the A3COM-HUAWEI-OID-MIB for its h3cCommon parent OID and INET-ADDRESS-MIB/IF-MIB for addressing types, and is deployed on H3C routers and switches in carrier or enterprise networks subject to lawful-intercept regulatory requirements. Compliance teams supporting H3C gear can download the A3COM-HUAWEI-LI-MIB file for their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in A3COM-HUAWEI-LI-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

H3C (Hangzhou H3C Technologies) routers and switches

Monitoring Examples

An operator polls h3cLIStreamPackets and h3cLIStreamDrops for an active h3cLIStreamtype to confirm intercepted traffic is reaching the mediation device configured in h3cLIMediationTable; a non-incrementing h3cLIStreamPackets counter, or receipt of an h3cLIFailureInformation notification naming a specific board, indicates the intercept has stopped delivering data on that board.

What Can Be Monitored

intercept stream packet and drop counters
mediation device destination address/port configuration
intercept row status and timeout expiry
per-board intercept activation/failure notifications
DSCP marking applied to intercepted traffic

Imported Objects

From A3COM-HUAWEI-OID-MIB

h3cCommon

OBJECT-IDENTITY

From IF-MIB

InterfaceIndexOrZero

From INET-ADDRESS-MIB

InetAddress
InetAddressPrefixLength
InetAddressType
InetPortNumber

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-SMI

Counter32
Counter64
Integer32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DateAndTime
MacAddress
RowStatus
TruthValue

OIDs

OID symbolic	OID numeric	Type	Access	Description
h3cLI	1.3.6.1.4.1.43.45.1.10.2.111			Lawful Interception MIB
h3cLICommon	1.3.6.1.4.1.43.45.1.10.2.111.1
h3cLITrapBindObjects	1.3.6.1.4.1.43.45.1.10.2.111.1.1
U32 h3cLIBoardInformation	1.3.6.1.4.1.43.45.1.10.2.111.1.1.1	Unsigned32	accessible-for-notify	It is a slot number.
h3cLINotifications	1.3.6.1.4.1.43.45.1.10.2.111.1.2
h3cLINotificationsPrefix	1.3.6.1.4.1.43.45.1.10.2.111.1.2.0
NTF h3cLIActive	1.3.6.1.4.1.43.45.1.10.2.111.1.2.0.1			This Notification is sent when a type of intercepting configuration is changed from inactive to active. The value of the h3cLIStreamtype which identify the actual intercept stream is included in this notification.
NTF h3cLITimeOut	1.3.6.1.4.1.43.45.1.10.2.111.1.2.0.2			When the time specified in h3cLIMediationTimeout arrives, the device notifies the manager corresponding intercept is removed.
NTF h3cLIFailureInformation	1.3.6.1.4.1.43.45.1.10.2.111.1.2.0.3			When interception is configured on distributed device, the configuration perhaps failed on some board. If this happened, this notification will occur.
h3cLIObjects	1.3.6.1.4.1.43.45.1.10.2.111.1.3
I32 h3cLINewIndex	1.3.6.1.4.1.43.45.1.10.2.111.1.3.1	Integer32	read-only	This object will be used as an index value for a new h3cLIMediationEntry. Whenever read, the agent will give a non-used value. This is to reduce the probability of conflict during creation of new h3cLIMediationTable entries.
h3cLIMediationTable	1.3.6.1.4.1.43.45.1.10.2.111.1.3.2		not-accessible	This table describes interception gateway information with which interception device communicates.
h3cLIMediationEntry	1.3.6.1.4.1.43.45.1.10.2.111.1.3.2.1		not-accessible	An entry of configuring mediation device.
I32 h3cLIMediationIndex	1.3.6.1.4.1.43.45.1.10.2.111.1.3.2.1.1	Integer32	not-accessible	h3cLIMediationIndex is a entry identifier. The Mediation Device should be responsible for making sure these are unique. Before creating a new entry, a value for this variable may be obtained by reading h3cLINewIndex to reduce the probability of a value collision.
IPt h3cLIMediationDestAddrType	1.3.6.1.4.1.43.45.1.10.2.111.1.3.2.1.2	InetAddressType	read-write	The type of h3cLIMediationDestAddr.
IP h3cLIMediationDestAddr	1.3.6.1.4.1.43.45.1.10.2.111.1.3.2.1.3	InetAddress	read-write	The IP Address of the Mediation Device to receive intercepted traffic.
INE h3cLIMediationDestPort	1.3.6.1.4.1.43.45.1.10.2.111.1.3.2.1.4	InetPortNumber	read-write	The L4-port number on the Mediation Device to receive intercepted traffic.
NUM h3cLIMediationSrcInterface	1.3.6.1.4.1.43.45.1.10.2.111.1.3.2.1.5	InterfaceIndexOrZero	read-write	The interface on the intercepting device from which to transmit intercepted data. If zero, intercepting device will select an outbound interface according to h3cLIMediationDestAddr.
I32 h3cLIMediationDscp	1.3.6.1.4.1.43.45.1.10.2.111.1.3.2.1.6	Integer32	read-write	The Differentiated Services Code Point the intercepting device applies to the IP packets encapsulating the intercepted traffic.
DAT h3cLIMediationTimeOut	1.3.6.1.4.1.43.45.1.10.2.111.1.3.2.1.7	DateAndTime	read-write	The time at which this row and all related Stream Table rows should be automatically removed, and the intercept function expire.
INT h3cLIMediationTransport	1.3.6.1.4.1.43.45.1.10.2.111.1.3.2.1.8	INTEGER	read-write	The protocol used in transferring intercepted data to the Mediation Device.
T/F h3cLIMediationNotificationEnable	1.3.6.1.4.1.43.45.1.10.2.111.1.3.2.1.9	TruthValue	read-write	This variable controls the generation of any notifications or informs by the MIB agent for this table entry.
ROW h3cLIMediationRowStatus	1.3.6.1.4.1.43.45.1.10.2.111.1.3.2.1.10	RowStatus	read-create	Operation status of this table entry.
h3cLIStreamTable	1.3.6.1.4.1.43.45.1.10.2.111.1.3.3		not-accessible	This table lists the traffic stream's type to be intercepted. The specified filter is defined in h3cLIIPStreamTable, h3cLIMACStreamTable or h3cLIUserStreamTable, according to h3cLIStreamtype. Also it contains counters for packets to be intercepted and dropped by attached type of filter.
h3cLIStreamEntry	1.3.6.1.4.1.43.45.1.10.2.111.1.3.3.1		not-accessible	A single type of data stream to be intercepted.
I32 h3cLIStreamIndex	1.3.6.1.4.1.43.45.1.10.2.111.1.3.3.1.1	Integer32	not-accessible	The index of the stream entry.
INT h3cLIStreamtype	1.3.6.1.4.1.43.45.1.10.2.111.1.3.3.1.2	INTEGER	read-write	Identifies the type of stream, and according to it uses filter table. It can not be changed after a filter table is attached to it. The following types of streams are supported: ip: IP filter. The exact definition is a row in h3cLIIPStreamTable. mac: MAC filter. The exact definition is a row in h3cLIMACStreamTable. userConnecton: User connection filter. The exact definition is a row in h3cLIUserStreamTable.
T/F h3cLIStreamEnable	1.3.6.1.4.1.43.45.1.10.2.111.1.3.3.1.3	TruthValue	read-write	If 'true', the interception is active. And it is set to 'true' only after an additional filter specification has been attached to this stream.
C32 h3cLIStreamPackets	1.3.6.1.4.1.43.45.1.10.2.111.1.3.3.1.4	Counter32	read-only	The numbers of packets that have been intercepted.
C32 h3cLIStreamDrops	1.3.6.1.4.1.43.45.1.10.2.111.1.3.3.1.5	Counter32	read-only	The numbers of packets were dropped in the lawful intercept process.
C64 h3cLIStreamHPackets	1.3.6.1.4.1.43.45.1.10.2.111.1.3.3.1.6	Counter64	read-only	The numbers of packets have been intercepted. This object is a 64-bit version of h3cLIStreamPackets.
C64 h3cLIStreamHDrops	1.3.6.1.4.1.43.45.1.10.2.111.1.3.3.1.7	Counter64	read-only	The numbers of packets were dropped in the lawful intercept process. This object is a 64-bit version of h3cLIStreamDrops.
ROW h3cLIStreamRowStatus	1.3.6.1.4.1.43.45.1.10.2.111.1.3.3.1.8	RowStatus	read-create	Operation status of this table entry.
h3cLIIPStream	1.3.6.1.4.1.43.45.1.10.2.111.2
h3cLIIPStreamObjects	1.3.6.1.4.1.43.45.1.10.2.111.2.1
h3cLIIPStreamTable	1.3.6.1.4.1.43.45.1.10.2.111.2.1.1		not-accessible	This table lists the IPv4 and IPv6 streams to be intercepted. It is associated with h3cLIMediationTable and h3cLIStreamTable.
h3cLIIPStreamEntry	1.3.6.1.4.1.43.45.1.10.2.111.2.1.1.1		not-accessible	A single stream to be intercepted. The first index indicates the Mediation Device. The second index is that of the stream's counter entry in the h3cLIStreamTable. The second index permits multiple classifiers to be used together, such as having an IP address as source or destination.
NUM h3cLIIPStreamInterface	1.3.6.1.4.1.43.45.1.10.2.111.2.1.1.1.1	InterfaceIndexOrZero	read-write	Traffic received or transmitted over this interface will be intercepted. This value must be set when creating a stream entry, either zero, or a valid interface index. If the value is zero, interception accepts any interface. Then at least one additional parameter must be selected, and not be default value.
IPt h3cLIIPStreamAddrType	1.3.6.1.4.1.43.45.1.10.2.111.2.1.1.1.2	InetAddressType	read-write	The type of address, used in packet selection.
IP h3cLIIPStreamDestAddr	1.3.6.1.4.1.43.45.1.10.2.111.2.1.1.1.3	InetAddress	read-write	The Destination address used in packet selection. This address will be consistent with the type specified in h3cLIIPStreamAddrType.
ADR h3cLIIPStreamDestAddrLength	1.3.6.1.4.1.43.45.1.10.2.111.2.1.1.1.4	InetAddressPrefixLength	read-write	The length of the Destination Prefix. A value of zero means all addresses to match. This prefix length will be consistent with the type specified in h3cLIIPStreamAddrType.
IP h3cLIIPStreamSrcAddr	1.3.6.1.4.1.43.45.1.10.2.111.2.1.1.1.5	InetAddress	read-write	The Source Address used in packet selection. This address will be consistent with the type specified in h3cLIIPStreamAddrType.
ADR h3cLIIPStreamSrcAddrLength	1.3.6.1.4.1.43.45.1.10.2.111.2.1.1.1.6	InetAddressPrefixLength	read-write	The length of the Source Prefix. A value of zero means all addresses to match. This prefix length will be consistent with the type specified in h3cLIIPStreamAddrType.
I32 h3cLIIPStreamTosByte	1.3.6.1.4.1.43.45.1.10.2.111.2.1.1.1.7	Integer32	read-write	The value of the TOS byte. If h3cLIIPStreamTosByte&(~h3cLIIPStreamTosByteMask)!=0, configuration is rejected.
I32 h3cLIIPStreamTosByteMask	1.3.6.1.4.1.43.45.1.10.2.111.2.1.1.1.8	Integer32	read-write	This value is ANDed with the value of the TOS byte in a packet and compared with h3cLIIPStreamTosByte. If the values are equal, the comparison is equal. If both the mask and the TosByte value are zero, the result is to always accept.
I32 h3cLIIPStreamFlowId	1.3.6.1.4.1.43.45.1.10.2.111.2.1.1.1.9	Integer32	read-write	The flow identifier in an IPv6 header. -1 indicates that the Flow Id is unused.
I32 h3cLIIPStreamProtocol	1.3.6.1.4.1.43.45.1.10.2.111.2.1.1.1.10	Integer32	read-write	The IP protocol to match against the IPv4 protocol number or the IPv6 Next- Header number in the packet.
INE h3cLIIPStreamDestL4PortMin	1.3.6.1.4.1.43.45.1.10.2.111.2.1.1.1.11	InetPortNumber	read-write	The minimum value that the layer-4 destination port number in the packet must have in order to match. This value must be equal to or less than the value specified for this entry in h3cLIIPStreamDestL4PortMax. If both h3cLIIPStreamDestL4PortMin and h3cLIIPStreamDestL4PortMax are at their default values, the port number is effectively unused. If h3cLIIPStreamDestL4PortMin is equal to h3cLIIPStreamDestL4PortMax, only one port number to be intercepted.
INE h3cLIIPStreamDestL4PortMax	1.3.6.1.4.1.43.45.1.10.2.111.2.1.1.1.12	InetPortNumber	read-write	The maximum value that the layer-4 destination port number in the packet must have in order to match this classifier entry. This value must be equal to or greater than the value specified for this entry in h3cLIIPStreamDestL4PortMin. If both h3cLIIPStreamDestL4PortMin and h3cLIIPStreamDestL4PortMax are at their default values, the port number is effectively unused. If h3cLIIPStreamDestL4PortMin is equal to h3cLIIPStreamDestL4PortMax, only one port number to be intercepted.
INE h3cLIIPStreamSrcL4PortMin	1.3.6.1.4.1.43.45.1.10.2.111.2.1.1.1.13	InetPortNumber	read-write	The minimum value that the layer-4 destination port number in the packet must have in order to match. This value must be equal to or less than the value specified for this entry in h3cLIIPStreamSrcL4PortMax. If both h3cLIIPStreamSrcL4PortMin and h3cLIIPStreamSrcL4PortMax are at their default values, the port number is effectively unused. If h3cLIIPStreamSrcL4PortMin is equal to h3cLIIPStreamSrcL4PortMax, only one port number to be intercepted.
INE h3cLIIPStreamSrcL4PortMax	1.3.6.1.4.1.43.45.1.10.2.111.2.1.1.1.14	InetPortNumber	read-write	The maximum value that the layer-4 destination port number in the packet must have in order to match this classifier entry. This value must be equal to or greater than the value specified for this entry in h3cLIIPStreamSrcL4PortMin. If both h3cLIIPStreamSrcL4PortMin and h3cLIIPStreamSrcL4PortMax are at their default values, the port number is effectively unused. If h3cLIIPStreamSrcL4PortMin is equal to h3cLIIPStreamSrcL4PortMax, only one port number to be intercepted.
STR h3cLIIPStreamVRF	1.3.6.1.4.1.43.45.1.10.2.111.2.1.1.1.15	SnmpAdminString	read-write	It is the name of a Virtual Routing and Forwarding (VRF) of a VPN.
ROW h3cLIIPStreamRowStatus	1.3.6.1.4.1.43.45.1.10.2.111.2.1.1.1.18	RowStatus	read-create	Operation status of this table entry.
h3cLIMACStream	1.3.6.1.4.1.43.45.1.10.2.111.3
h3cLIMACStreamObjects	1.3.6.1.4.1.43.45.1.10.2.111.3.1
h3cLIMACStreamTable	1.3.6.1.4.1.43.45.1.10.2.111.3.1.1		not-accessible	This table lists the IEEE 802 streams to be intercepted. It is associated with h3cLIMediationTable and h3cLIStreamTable.
h3cLIMACStreamEntry	1.3.6.1.4.1.43.45.1.10.2.111.3.1.1.1		not-accessible	A single stream to be intercepted. The first index indicates the Mediation Device. The second index is that of the stream's counter entry in the h3cLIStreamTable. The second index permits multiple classifiers to be used together, such as having an MAC address as source or destination.
BIT h3cLIMACStreamFields	1.3.6.1.4.1.43.45.1.10.2.111.3.1.1.1.1	Bits	read-write	This object displays what attributes will be compared to identify traffic. interface: indicates that traffic on the stated interface is to be intercepted dstMacAddress: indicates that traffic destined to a given address should be intercepted srcMacAddress: indicates that traffic sourced from a given address should be intercepted ethernetPid: indicates that traffic with a stated Ethernet Protocol Identifier should be intercepted dSap: indicates that traffic with an certain 802.2 LLC Destination SAP should be intercepted sSap: indicates that traffic with an certain 802.2 LLC Source SAP should be intercepted At least one of the bits has to be set in order to activate an entry. If multiple bits are set, traffic to be intercepted must be satisfied with all set attributes.
NUM h3cLIMACStreamInterface	1.3.6.1.4.1.43.45.1.10.2.111.3.1.1.1.2	InterfaceIndexOrZero	read-write	Traffic received or transmitted over this interface will be intercepted. This value must be set when creating a stream entry, either zero, or a valid interface index. If the value is zero, interception accepts any interface. Additional parameter must be selected together.
MAC h3cLIMACStreamDestAddr	1.3.6.1.4.1.43.45.1.10.2.111.3.1.1.1.3	MacAddress	read-write	The Destination address used in packet selection.
MAC h3cLIMACStreamSrcAddr	1.3.6.1.4.1.43.45.1.10.2.111.3.1.1.1.4	MacAddress	read-write	The Source Address used in packet selection.
U32 h3cLIMACStreamEthPid	1.3.6.1.4.1.43.45.1.10.2.111.3.1.1.1.5	Unsigned32	read-write	The value of the Ethernet Protocol Identifier in the Ethernet traffic or IEEE 802.2 SNAP traffic.
U32 h3cLIMACStreamDSap	1.3.6.1.4.1.43.45.1.10.2.111.3.1.1.1.6	Unsigned32	read-write	The value of the IEEE 802.2 Destination SAP.
U32 h3cLIMACStreamSSap	1.3.6.1.4.1.43.45.1.10.2.111.3.1.1.1.7	Unsigned32	read-write	The value of the IEEE 802.2 Source SAP.
ROW h3cLIMACStreamRowStatus	1.3.6.1.4.1.43.45.1.10.2.111.3.1.1.1.8	RowStatus	read-create	Operation status of this table entry.
h3cLIUserStream	1.3.6.1.4.1.43.45.1.10.2.111.4
h3cLIUserStreamObjects	1.3.6.1.4.1.43.45.1.10.2.111.4.1
h3cLIUserStreamTable	1.3.6.1.4.1.43.45.1.10.2.111.4.1.1		not-accessible	This table lists the user connection streams to be intercepted. It is associated with h3cLIMediationTable and h3cLIStreamTable.
h3cLIUserStreamEntry	1.3.6.1.4.1.43.45.1.10.2.111.4.1.1.1		not-accessible	A single stream to be intercepted. The first index indicates the Mediation Device. The second index is that of the stream's counter entry in the h3cLIStreamTable. This permits multiple classifiers to be used together.
OCT h3cLIUserStreamAcctSessID	1.3.6.1.4.1.43.45.1.10.2.111.4.1.1.1.1	OCTET STRING	read-write	This is the RADIUS attribute 44 acct-session-ID. The string must be set, and the length not be zero.
ROW h3cLIUserStreamRowStatus	1.3.6.1.4.1.43.45.1.10.2.111.4.1.1.1.2	RowStatus	read-create	Operation status of this table entry.

RFC description

3Com Huawei Lawful Interception MIB for managing network traffic interception. Defines SNMP objects for configuring lawful interception policies based on IP addresses, MAC addresses, VPN instances, and other traffic criteria on 3Com Huawei network equipment.

Start monitoring H3C routers and switches with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download A3COM-HUAWEI-LI-MIB

What Is A3COM-HUAWEI-LI-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description