ARUBAWIRED-MACNOTIFY-MIB

All MIBs › ARUBAWIRED-MACNOTIFY-MIB

Organization: HPE/Aruba Networking Division

Last Updated: 2021-03-24

Description: MIB for SNMP trap notifications of dynamic MAC address table events (learn, age, move, remove) on HPE/Aruba wired switches

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is ARUBAWIRED-MACNOTIFY-MIB?

ARUBAWIRED-MACNOTIFY-MIB is an HPE Aruba proprietary MIB for ArubaOS-CX wired switches that generates SNMP trap notifications for dynamic MAC address table events. It exposes a MAC change table recording the action (learn, move, age, or remove), the MAC address involved, and the port on which the event occurred, alongside grouping objects for data, traps, and system configuration. Rather than classic hardware telemetry, this MIB monitors switch software/control-plane behavior: rapid or repeated MAC learn/move events on the same address can reveal a network loop, MAC spoofing, or an unauthorized device attaching to the network, all of which point to an unhealthy or misconfigured switching topology. It complements the standard bridge/forwarding-table MIBs (such as the IEEE 802.1 bridge MIB family) by adding real-time notification semantics on top of the underlying MAC table. It is deployed in enterprise and campus wired switch networks, monitored by an NMS for security auditing and topology-change alerting. Engineers can download the ARUBAWIRED-MACNOTIFY-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in ARUBAWIRED-MACNOTIFY-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Aruba CX series wired switches
ArubaOS-CX network switches

Monitoring Examples

An NMS subscribes to traps driven by macNotifyChangeTable/macNotifyChangeTableEntry, inspecting arubaWiredMacNotifyAction, arubaWiredMacNotifyMacAddress, and arubaWiredMacNotifyFromPortId for each event. A burst of "move" actions for the same arubaWiredMacNotifyMacAddress across different arubaWiredMacNotifyFromPortId values within seconds indicates MAC flapping, typically caused by a loop or a duplicated/rogue device. The macNotifyTrapsGroups and macNotifySystemGroups objects control which of these events actually generate traps, letting an admin tune sensitivity versus noise.

What Can Be Monitored

MAC address learn/move/age/remove events
MAC address to port mapping changes
MAC flapping detection
trap notification configuration

Imported Objects

From ARUBAWIRED-NETWORKING-OID

wndFeatures

OBJECT-IDENTITY

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Integer32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

MacAddress

OIDs

OID symbolic	OID numeric	Type	Access	Description
macNotify	1.3.6.1.4.1.47196.4.1.1.3.19			This MIB module describes the MAC notification objects that are sent when dynamic MAC events occur: learn, move, age, remove.
arubaWiredMacNotifyNotificationObjects	1.3.6.1.4.1.47196.4.1.1.3.19.0
NTF arubaWiredMacNotifyMacAddressTableChange	1.3.6.1.4.1.47196.4.1.1.3.19.0.1			The arubaWiredMacNotifyMacAddressTableChange notification signifies that arubaWiredMacNotifyEnable is enabled and either a MAC address table change learn / remove / age / moved occurred on a configured arubaWiredMacNotifyTrapConfig interface.
arubaWiredMacNotifyConfigObjects	1.3.6.1.4.1.47196.4.1.1.3.19.1
INT arubaWiredMacNotifyEnable	1.3.6.1.4.1.47196.4.1.1.3.19.1.1	INTEGER	read-write	Indicates whether the SNMP entity is permitted to generate learned, moved or removed arubaWiredMacNotifyMacAddressTableChange trap notifications. Default is disabled.
arubaWiredMacNotifyConformance	1.3.6.1.4.1.47196.4.1.1.3.19.2
arubaWiredMacNotify	1.3.6.1.4.1.47196.4.1.1.3.19.3
macNotifyChangeTable	1.3.6.1.4.1.47196.4.1.1.3.19.3.1		not-accessible	The table structure that holds the entries for the change events that occur in the MAC table.
macNotifyChangeTableEntry	1.3.6.1.4.1.47196.4.1.1.3.19.3.1.1		not-accessible	MAC entry that holds information about a MAC table change
INT arubaWiredMacNotifyAction	1.3.6.1.4.1.47196.4.1.1.3.19.3.1.1.1	INTEGER	accessible-for-notify	Indicate the dynamic MAC address table change action for arubaWiredMacNotifyMacAddress: learned, moved, removed or aged.
MAC arubaWiredMacNotifyMacAddress	1.3.6.1.4.1.47196.4.1.1.3.19.3.1.1.2	MacAddress	accessible-for-notify	The MAC address that has been learned, moved, removed or aged in the MAC address table.
I32 arubaWiredMacNotifyFromPortId	1.3.6.1.4.1.47196.4.1.1.3.19.3.1.1.3	Integer32	accessible-for-notify	The related from port index of the MAC address arubaWiredMacNotifyMacAddress. Port index will be determined by the action in arubaWiredMacNotifyAction. Action: Learned: The value will be zero Moved: The port from which the MAC was moved Removed: The port from which MAC was removed Aged: The port on which the MAC has aged
I32 arubaWiredMacNotifyToPortId	1.3.6.1.4.1.47196.4.1.1.3.19.3.1.1.4	Integer32	accessible-for-notify	The related port index of the MAC address arubaWiredMacNotifyMacAddress. Port index will be determined by the action in arubaWiredMacNotifyAction. Action: Learned: The actual port the MAC was learned Moved: The port to which the MAC was moved Removed: The value will be zero Aged: The value will be zero
I32 arubaWiredMacNotifyVlanId	1.3.6.1.4.1.47196.4.1.1.3.19.3.1.1.5	Integer32	accessible-for-notify	The related VLAN ID of the MAC address arubaWiredMacNotifyMacAddress. VLAN ID will be determined by the action in arubaWiredMacNotifyAction. Action: Learned: VLAN that the arubaWiredMacNotifyToPortId belongs to Moved: VLAN that the arubaWiredMacNotifyToPortId belongs to Removed: VLAN that arubaWiredMacNotifyFromPortId belongs to Aged: VLAN that arubaWiredMacNotifyFromPortId belongs to
macNotifyConformance	1.3.6.1.4.1.47196.4.1.1.3.19.4
macNotifyDataGroups	1.3.6.1.4.1.47196.4.1.1.3.19.4.1
macNotifyDataGroup	1.3.6.1.4.1.47196.4.1.1.3.19.4.1.1			Information for MAC-Notify Traps.
macNotifyTrapsGroup	1.3.6.1.4.1.47196.4.1.1.3.19.4.1.2			Trap definition for MAC-Notify.
macNotifySystemGroup	1.3.6.1.4.1.47196.4.1.1.3.19.4.1.3			Information for MAC-Notify System configurations.
macNotifyTrapsGroups	1.3.6.1.4.1.47196.4.1.1.3.19.4.2
macNotifySystemGroups	1.3.6.1.4.1.47196.4.1.1.3.19.4.3
macNotifyCompliance	1.3.6.1.4.1.47196.4.1.1.3.19.4.4
macNotifyComplianceGroups	1.3.6.1.4.1.47196.4.1.1.3.19.4.4.1			The compliance statement for device support of MAC-Notify. This supports 32-bit Path Cost values and the more restricted bridge and port priorities.

RFC description

MAC table event notifications for dynamic MAC learn, move, age, and remove events on Aruba switches.

Start monitoring Aruba CX network switches with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download ARUBAWIRED-MACNOTIFY-MIB

What Is ARUBAWIRED-MACNOTIFY-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description