ALTIGA-FILTER-STATS-MIB

All MIBs › ALTIGA-FILTER-STATS-MIB

Organization: Cisco Systems, Inc.

Last Updated: 2002-09-05

Category: VPN and Security, Vendor: Altiga

Description: Altiga (Cisco VPN 3000) filter statistics MIB for monitoring packet filter rule hit counters and drop events.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is ALTIGA-FILTER-STATS-MIB?

ALTIGA-FILTER-STATS-MIB is a proprietary MIB from Altiga Networks (Cisco VPN 3000 Series Concentrator) for monitoring packet-filter rule activity per network interface. It exposes per-interface counters for packets filtered, received, and transmitted in both directions, along with counts of malformed packets such as short TCP headers. Monitoring here is focused on network/software traffic health rather than physical sensors: a rising ratio of filtered-to-received packets indicates active ACL drops possibly from a misconfiguration or an attack, while short-TCP-header counters flag malformed or truncated packets suggestive of a scanning or denial-of-service attempt. It is part of the same Altiga proprietary MIB family as the event, L2TP, multilink, and SDI/ACE statistics modules sharing a common enterprise structure. It is deployed on Cisco/Altiga VPN 3000 Concentrators at the network edge, where filter statistics help audit the effectiveness of configured firewall/filter rules, and administrators can download the ALTIGA-FILTER-STATS-MIB file to load it into their monitoring platform.

IPNetwork Monitor allows you to monitor SNMP objects defined in ALTIGA-FILTER-STATS-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Cisco/Altiga VPN 3000 Series concentrator

Monitoring Examples

An administrator would poll alFilterStatsTable indexed by alFilterStatsInterfaceId, comparing alFilterStatsInPktsFiltered against alFilterStatsInPktsRx over the interval since alFilterStatsStartTime, to gauge the drop rate caused by filter rules on that interface. A spike in alFilterStatsInShortTcpHdr or alFilterStatsOutShortTcpHdr signals malformed TCP traffic that could indicate a scanning attempt. Comparing alFilterStatsOutPktsTx against alFilterStatsOutPktsFiltered helps confirm expected traffic is passing while unwanted traffic is being blocked.

What Can Be Monitored

packets filtered inbound/outbound per interface
packets received/transmitted per interface
short/malformed TCP header packet counts
filter statistics collection start time

Imported Objects

From ALTIGA-GLOBAL-REG

alFilterMibModule

OBJECT-IDENTITY

From ALTIGA-MIB

alFilterGroup	OBJECT-IDENTITY
alStatsFilter	OBJECT-IDENTITY

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Integer32
MODULE-IDENTITY
OBJECT-TYPE
TimeTicks

How to Use in IPNetwork Monitor

Example using alFilterStatsInPktsFiltered OID:

Select a Cisco (Altiga) VPN 3000 Series Concentrator (legacy) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type alFilterStatsInPktsFiltered into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. The total number of inbound packets discarded on this interface. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases between polls, since a rising count of errors, failures, or discards often points to a real underlying problem. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
altigaFilterStatsMibModule	1.3.6.1.4.1.3076.1.1.14.2			The Altiga Filter Statistics MIB models counters and objects that are of management interest for filters. Acronyms The following acronyms are used in this document: ICMP: Internet Control Message Protocol MIB: Management Information Base Rx: Received TCP: Transmission Control Protocol Tx: Transmitted UDP: User Datagram Protocol
altigaFilterStatsMibConformance	1.3.6.1.4.1.3076.1.1.14.2.1
altigaFilterStatsMibCompliances	1.3.6.1.4.1.3076.1.1.14.2.1.1
altigaFilterStatsMibCompliance	1.3.6.1.4.1.3076.1.1.14.2.1.1.1			The compliance statement for agents which implement the Altiga Filter Statistics MIB.
altigaFilterStatsGroup	1.3.6.1.4.1.3076.2.1.1.1.9.2			The objects for filter statistics.
alStatsFilterGlobal	1.3.6.1.4.1.3076.2.1.2.9.1
alFilterStatsTable	1.3.6.1.4.1.3076.2.1.2.9.2		not-accessible	The list of filter statistics.
alFilterStatsEntry	1.3.6.1.4.1.3076.2.1.2.9.2.1		not-accessible	An entry in the alFilterStatsTable.
I32 alFilterStatsInterfaceId	1.3.6.1.4.1.3076.2.1.2.9.2.1.1	Integer32	read-only	The primary index of this row, the IP interface ID.
TIK alFilterStatsStartTime	1.3.6.1.4.1.3076.2.1.2.9.2.1.2	TimeTicks	read-only	Start time the filter became active.
C32 alFilterStatsInPktsFilteredEx	1.3.6.1.4.1.3076.2.1.2.9.2.1.3	Counter32	read-only	The total number of inbound packets discarded on this interface.
C32 alFilterStatsOutPktsFiltered	1.3.6.1.4.1.3076.2.1.2.9.2.1.4	Counter32	read-only	The total number of outbound packets discarded on this interface.
C32 alFilterStatsInPktsRx	1.3.6.1.4.1.3076.2.1.2.9.2.1.5	Counter32	read-only	The total number of inbound packets received on this interface.
C32 alFilterStatsOutPktsRx	1.3.6.1.4.1.3076.2.1.2.9.2.1.6	Counter32	read-only	The total number of outbound packets received on this interface. This count includes filtered (dropped) packets.
C32 alFilterStatsInPktsTx	1.3.6.1.4.1.3076.2.1.2.9.2.1.7	Counter32	read-only	The total number of inbound packets forwarded on this interface.
C32 alFilterStatsOutPktsTx	1.3.6.1.4.1.3076.2.1.2.9.2.1.8	Counter32	read-only	The total number of outbound packets forwarded on this interface. This count does not include filtered packets.
C32 alFilterStatsInShortTcpHdr	1.3.6.1.4.1.3076.2.1.2.9.2.1.9	Counter32	read-only	The total number of inbound TCP packets discarded on this interface because the header was incomplete.
C32 alFilterStatsOutShortTcpHdr	1.3.6.1.4.1.3076.2.1.2.9.2.1.10	Counter32	read-only	The total number of outbound TCP packets discarded on this interface because the header was incomplete.
C32 alFilterStatsInShortUdpHdr	1.3.6.1.4.1.3076.2.1.2.9.2.1.11	Counter32	read-only	The total number of inbound UDP packets discarded on this interface because the header was incomplete.
C32 alFilterStatsOutShortUdpHdr	1.3.6.1.4.1.3076.2.1.2.9.2.1.12	Counter32	read-only	The total number of outbound UDP packets discarded on this interface because the header was incomplete.
C32 alFilterStatsInTcpFragDiscard	1.3.6.1.4.1.3076.2.1.2.9.2.1.13	Counter32	read-only	The total number of inbound TCP packets discarded on this interface because packet was fragmented.
C32 alFilterStatsOutTcpFragDiscard	1.3.6.1.4.1.3076.2.1.2.9.2.1.14	Counter32	read-only	The total number of outbound TCP packets discarded on this interface because packet was fragmented.
C32 alFilterStatsInIcmpFragDiscard	1.3.6.1.4.1.3076.2.1.2.9.2.1.15	Counter32	read-only	The total number of inbound ICMP packets discarded on this interface because packet was fragmented.
C32 alFilterStatsOutIcmpFragDiscard	1.3.6.1.4.1.3076.2.1.2.9.2.1.16	Counter32	read-only	The total number of outbound ICMP packets discarded on this interface because packet was fragmented.

RFC description

SNMP MIB for monitoring and managing filter-related statistics on Altiga VPN devices (now Cisco), including tracking of discarded packets and filter processing statistics.

Start monitoring Cisco (Altiga) VPN 3000 Series Concentrators (legacy) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download ALTIGA-FILTER-STATS-MIB