ATTACK-MIB

Description: Monitors network attack detection and prevention events, reporting intrusion attempt counters and blocked source addresses.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

ATTACK-MIB monitors network attack detection and prevention events, reporting intrusion attempt counters and blocked source addresses on the host device. It exposes a device attack table recording the name, status, and time of each detected attack, alongside trap notifications for new events. Its monitoring emphasis is on the software security function's status: deviceAttackStatus reveals whether a detected attack is still active or has been mitigated, and deviceAttackTime lets an operator correlate detection events with other security logs, functioning as a health indicator for the device's intrusion detection capability rather than its physical hardware. It is a standalone enterprise MIB with no explicit dependency on other standard MIBs evident from its description. It is deployed on security appliances, firewalls, or other IDS-capable network devices positioned at a network perimeter. Engineers can download the ATTACK-MIB file directly to load it into their MIB browser.

deviceAttackTable/deviceAttackEntry, indexed by deviceAttackIndex, exposes deviceAttackName, deviceAttackStatus, and deviceAttackTime. An administrator would poll deviceAttackTable to review recently detected attack types and deviceAttackStatus to confirm whether a given attack is still active or has been mitigated, using deviceAttackTime to correlate the detection event against other security logs.

Security MIB module that monitors and reports network attack events (such as SYN floods) with trap notifications at the beginning and end of detected attacks.