BAY-STACK-DHCP-SNOOPING-MIB

All MIBs › BAY-STACK-DHCP-SNOOPING-MIB

Organization: Nortel Ltd.

Last Updated: 2014-03-20

Category: VPN and Security, Vendor: Avaya

Description: Manages DHCP snooping binding tables and trusted port configuration on Avaya/Nortel ERS switches.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is BAY-STACK-DHCP-SNOOPING-MIB?

BAY-STACK-DHCP-SNOOPING-MIB is a Nortel/Avaya (BayStack/ERS switch family) proprietary MIB that manages DHCP snooping, a security feature that tracks legitimate DHCP client-to-IP bindings and enforces trusted vs. untrusted ports, including DHCP Option 82 relay-agent information insertion. It exposes per-VLAN and per-interface configuration state (enable flags, trust status, Option 82 settings) organized in bsDhcpSnoopingVlanTable and bsDhcpSnoopingIfTable, plus notifications for snooping events. This is primarily a software/security-feature status MIB: it lets an administrator confirm whether DHCP snooping and Option 82 are actually active on the switch, VLAN, and port, and which ports are trusted, which is critical for validating a device's security posture rather than its physical health. It complements standard interface (IF-MIB) and VLAN MIBs by adding a DHCP-snooping-specific security layer on top of them. It is deployed on Avaya/Nortel Ethernet Routing Switch (ERS) products in enterprise access-layer networks to prevent rogue DHCP server attacks, as defined in the BAY-STACK-DHCP-SNOOPING-MIB MIB.

IPNetwork Monitor allows you to monitor SNMP objects defined in BAY-STACK-DHCP-SNOOPING-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Avaya/Nortel Ethernet Routing Switch (ERS)/BayStack switch

Monitoring Examples

An administrator would poll bsDhcpSnoopingVlanEnabled and bsDhcpSnoopingVlanOption82Enabled per entry in bsDhcpSnoopingVlanTable to confirm snooping is active on a given VLAN, then check bsDhcpSnoopingIfTrusted in bsDhcpSnoopingIfTable to verify only uplink ports are marked trusted. If bsDhcpSnoopingIfTrusted is unexpectedly true on an access port, that port could accept rogue DHCP server replies, a real security exposure. bsDhcpSnoopingNotifications would alert on binding violations or attempts by an untrusted port to send DHCP server traffic.

What Can Be Monitored

DHCP snooping enable state (global/VLAN/interface)
Option 82 insertion status
port trust configuration
DHCP snooping binding violations
per-VLAN snooping configuration

Imported Objects

From IF-MIB

InterfaceIndex

From INET-ADDRESS-MIB

InetAddress
InetAddressType
InetPortNumber

From Q-BRIDGE-MIB

VlanIndex

From SNMPv2-SMI

Integer32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DateAndTime
DisplayString
MacAddress
RowStatus
TruthValue

From SYNOPTICS-ROOT-MIB

bayStackMibs

OBJECT-IDENTITY

OIDs

OID symbolic	OID numeric	Type	Access	Description
bayStackDhcpSnoopingMib	1.3.6.1.4.1.45.5.17			This MIB module is used for DHCP snooping configuration settings in Nortel's software and products.
bsDhcpSnoopingNotifications	1.3.6.1.4.1.45.5.17.0
NTF bsDhcpSnoopingBindingTableFull	1.3.6.1.4.1.45.5.17.0.1			This notification is generated when an attempt is made to add a new DHCP binding entry when the binding table is full. The value of bsDhcpSnoopingNotificationClientMACAddr gives the MAC address that could not be added to the binding table. This notification also indicates that additional untrusted DHCP packets will not be added to the binding table and will be dropped.
NTF bsDhcpSnoopingTrap	1.3.6.1.4.1.45.5.17.0.2			This notification is generated when a DHCP packet is dropped.
NTF bsDhcpOption82MaxLengthExceeded	1.3.6.1.4.1.45.5.17.0.3			This notification is generated when the DHCP Option 82 information could not be added to a DHCP packet because the resulting packet would be too long.
NTF bsDhcpSnoopingExtSaveEntryMACConflict	1.3.6.1.4.1.45.5.17.0.4			This notification is generated when a DHCP snooping binding entry is not restored from an external file due to a MAC conflict.
NTF bsDhcpSnoopingExtSaveEntryInvalidInterface	1.3.6.1.4.1.45.5.17.0.5			This notification is generated when a DHCP snooping binding entry is not restored from an external file due to an unexisting interface.
NTF bsDhcpSnoopingExtSaveEntryLeaseExpired	1.3.6.1.4.1.45.5.17.0.6			This notification is generated when a DHCP snooping binding entry is not restored from an external file because the client lease expired.
NTF bsDhcpSnoopingExtSaveEntryParsingFailure	1.3.6.1.4.1.45.5.17.0.7			This notification is generated when a DHCP snooping binding entry is not restored from an external file due to a parsing failure.
NTF bsDhcpSnoopingExtSaveNTP	1.3.6.1.4.1.45.5.17.0.8			This notification is generated when enabling the DHCP snooping external saves feature without synchronizing the switch to a NTP server.
NTF bsDhcpSnoopingExtSaveUSBSyncSuccess	1.3.6.1.4.1.45.5.17.0.9			This notification is generated after successfully saving the DHCP snooping binding table to a USB drive external file.
NTF bsDhcpSnoopingExtSaveTFTPSyncSuccess	1.3.6.1.4.1.45.5.17.0.10			This notification is generated after successfully saving the DHCP snooping binding table to a TFTP server external file.
NTF bsDhcpSnoopingExtSaveUSBSyncFailure	1.3.6.1.4.1.45.5.17.0.11			This notification is generated after unsuccessfully saving the DHCP snooping binding table to a USB drive external file.
NTF bsDhcpSnoopingExtSaveTFTPSyncFailure	1.3.6.1.4.1.45.5.17.0.12			This notification is generated after unsuccessfully saving the DHCP snooping binding table to a TFTP server external file.
NTF bsDhcpSnoopingExtSaveUSBRestoreSuccess	1.3.6.1.4.1.45.5.17.0.13			This notification is generated after successfully restoring the DHCP snooping binding table from a USB drive external file.
NTF bsDhcpSnoopingExtSaveTFTPRestoreSuccess	1.3.6.1.4.1.45.5.17.0.14			This notification is generated after successfully restoring the DHCP snooping binding table from a TFTP server external file.
NTF bsDhcpSnoopingExtSaveUSBRestoreFailure	1.3.6.1.4.1.45.5.17.0.15			This notification is generated after unsuccessfully restoring the DHCP snooping binding table from a USB drive external file.
NTF bsDhcpSnoopingExtSaveTFTPRestoreFailure	1.3.6.1.4.1.45.5.17.0.16			This notification is generated after unsuccessfully restoring the DHCP snooping binding table from a TFTP server external file.
NTF bsDhcpSnoopingExtSaveEntryInvalidVlan	1.3.6.1.4.1.45.5.17.0.17			This notification is generated when a DHCP snooping binding entry is not restored from an external file because VLAN requirements are not met: VLAN must exist, VLAN must be DHCP snooping enabled, binding entry unit/port must be a part of the VLAN.
NTF bsDhcpSnoopingExtSaveSFTPSyncSuccess	1.3.6.1.4.1.45.5.17.0.18			This notification is generated after successfully saving the DHCP snooping binding table to a SFTP server external file.
NTF bsDhcpSnoopingExtSaveSFTPSyncFailure	1.3.6.1.4.1.45.5.17.0.19			This notification is generated after unsuccessfully saving the DHCP snooping binding table to a SFTP server external file.
NTF bsDhcpSnoopingExtSaveSFTPRestoreSuccess	1.3.6.1.4.1.45.5.17.0.20			This notification is generated after successfully restoring the DHCP snooping binding table from a SFTP server external file.
NTF bsDhcpSnoopingExtSaveSFTPRestoreFailure	1.3.6.1.4.1.45.5.17.0.21			This notification is generated after unsuccessfully restoring the DHCP snooping binding table from a SFTP server external file.
NTF bsDhcpSnoopingExtSaveEntryIfTrustedConflict	1.3.6.1.4.1.45.5.17.0.22			This notification is generated when a DHCP snooping binding entry is not restored from an external file on a trusted interface.
NTF bsDhcpSnoopingStaticEntryMACConflict	1.3.6.1.4.1.45.5.17.0.23			This notification is generated when a DHCP packet is dropped because a static entry with the same MAC address was found in the binding table.
bsDhcpSnoopingObjects	1.3.6.1.4.1.45.5.17.1
bsDhcpSnoopingScalars	1.3.6.1.4.1.45.5.17.1.1
T/F bsDhcpSnoopingEnabled	1.3.6.1.4.1.45.5.17.1.1.1	TruthValue	read-write	This object is used to control whether DHCP snooping is enabled globally. When globally enabled, DHCP snooping is enabled or disabled for each individual VLAN in the bsDhcpSnoopingVlanTable.
T/F bsDhcpSnoopingOption82Enabled	1.3.6.1.4.1.45.5.17.1.1.2	TruthValue	read-write	This object is used to control whether DHCP option 82 is enabled globally. When globally enabled, DHCP option 82 is enabled or disabled for each individual VLAN in the bsDhcpSnoopingVlanTable.
bsDhcpSnoopingVlanTable	1.3.6.1.4.1.45.5.17.1.2		not-accessible	This table is used to control DHCP snooping settings per-VLAN.
bsDhcpSnoopingVlanEntry	1.3.6.1.4.1.45.5.17.1.2.1		not-accessible	An entry containing objects for controlling DHCP snooping settings for a VLAN.
VLA bsDhcpSnoopingVlanId	1.3.6.1.4.1.45.5.17.1.2.1.1	VlanIndex	not-accessible	The VLAN ID value of the VLAN.
T/F bsDhcpSnoopingVlanEnabled	1.3.6.1.4.1.45.5.17.1.2.1.2	TruthValue	read-write	This object is used to control whether DHCP snooping is enabled for this VLAN.
T/F bsDhcpSnoopingVlanOption82Enabled	1.3.6.1.4.1.45.5.17.1.2.1.3	TruthValue	read-write	This object is used to control whether DHCP option 82 is enabled for this VLAN.
bsDhcpSnoopingIfTable	1.3.6.1.4.1.45.5.17.1.3		not-accessible	This table is used to control DHCP snooping settings per-interface.
bsDhcpSnoopingIfEntry	1.3.6.1.4.1.45.5.17.1.3.1		not-accessible	An entry containing objects for controlling DHCP snooping settings for an interface.
NUM bsDhcpSnoopingIfIndex	1.3.6.1.4.1.45.5.17.1.3.1.1	InterfaceIndex	not-accessible	The ifIndex value of the interface.
T/F bsDhcpSnoopingIfTrusted	1.3.6.1.4.1.45.5.17.1.3.1.2	TruthValue	read-write	This object is used to control whether this interface is trusted for DHCP snooping purposes.
STR bsDhcpSnoopingIfOption82SubscriberId	1.3.6.1.4.1.45.5.17.1.3.1.3	DisplayString	read-write	This object contains the DHCP option 82 subscriber ID string to be used in sub-option 6. If the value is an empty string, then sub-option 6 is not included in option 82.
bsDhcpSnoopingBindingTable	1.3.6.1.4.1.45.5.17.1.4		not-accessible	This table contains the DHCP bindings that have been learned.
bsDhcpSnoopingBindingEntry	1.3.6.1.4.1.45.5.17.1.4.1		not-accessible	An entry containing a learned DHCP binding.
VLA bsDhcpSnoopingBindingVlanId	1.3.6.1.4.1.45.5.17.1.4.1.1	VlanIndex	not-accessible	The VLAN to which the DHCP client belongs.
MAC bsDhcpSnoopingBindingMacAddress	1.3.6.1.4.1.45.5.17.1.4.1.2	MacAddress	not-accessible	The MAC address of the DHCP client.
IPt bsDhcpSnoopingBindingAddressType	1.3.6.1.4.1.45.5.17.1.4.1.3	InetAddressType	read-create	The type of address contained in the corresponding instance of bsDhcpSnoopingBindingAddress.
IP bsDhcpSnoopingBindingAddress	1.3.6.1.4.1.45.5.17.1.4.1.4	InetAddress	read-create	The internet address assigned to this DHCP client.
NUM bsDhcpSnoopingBindingInterface	1.3.6.1.4.1.45.5.17.1.4.1.5	InterfaceIndex	read-create	The interface to which the DHCP client is connected.
U32 bsDhcpSnoopingBindingLeaseTime	1.3.6.1.4.1.45.5.17.1.4.1.6	Unsigned32	read-create	The lease time of this DHCP client's binding.
ROW bsDhcpSnoopingBindingRowStatus	1.3.6.1.4.1.45.5.17.1.4.1.7	RowStatus	read-create	This object is used only to delete learned DHCP bindings from the table of learned bindings (this does not actually delete the binding, only this system's knowledge of the binding), or to create/modify/delete static binding table entries. Learned entries in this table cannot be created using this object, only deleted. On retrieval, the value for such an entry will always be active(1). Setting it to destroy(6) will delete the DHCP binding from the table of learned bindings. Static binding table entries may be created using this object. All writable objects must also be set before the entry can become valid.
U32 bsDhcpSnoopingBindingTimeToExpiry	1.3.6.1.4.1.45.5.17.1.4.1.8	Unsigned32	read-only	The time to expiry of this DHCP client's binding.
INT bsDhcpSnoopingBindingSource	1.3.6.1.4.1.45.5.17.1.4.1.9	INTEGER	read-only	Indicates the source of this entry. If the entry was learned through DHCP snooping, the type is learned(1). In this case, the only thing that can be set in the entry is to set the RowStatus object to destroy(6) to delete the entry. If the entry was created through a management operation (Set request), the type is static(2). In this case, any writable column can be modified.
bsDhcpSnoopingNotificationObjects	1.3.6.1.4.1.45.5.17.1.5
INE bsDhcpSnoopingNotificationSourcePort	1.3.6.1.4.1.45.5.17.1.5.1	InetPortNumber	accessible-for-notify	This value identifies the source port number of a dropped DHCP packet.
INT bsDhcpSnoopingNotificationMsgType	1.3.6.1.4.1.45.5.17.1.5.2	INTEGER	accessible-for-notify	This value indicates the message type of a dropped DHCP packet.
MAC bsDhcpSnoopingNotificationSourceMACAddr	1.3.6.1.4.1.45.5.17.1.5.3	MacAddress	accessible-for-notify	This value indicates the source MAC Address of a dropped DHCP packet.
MAC bsDhcpSnoopingNotificationClientMACAddr	1.3.6.1.4.1.45.5.17.1.5.4	MacAddress	accessible-for-notify	This value indicates the client MAC Address of a dropped DHCP packet.
MAC bsDhcpSnoopingNotificationsBindingMacAddress	1.3.6.1.4.1.45.5.17.1.5.5	MacAddress	accessible-for-notify	The MAC address of a DHCP client for which some event occurred.
bsDhcpSnoopingExtSave	1.3.6.1.4.1.45.5.17.1.6
T/F bsDhcpSnoopingExtSaveEnabled	1.3.6.1.4.1.45.5.17.1.6.1	TruthValue	read-write	This object is used to control whether the DHCP snooping external save is enabled.
DAT bsDhcpSnoopingExtSaveLastSyncTime	1.3.6.1.4.1.45.5.17.1.6.2	DateAndTime	read-only	This object returns the Coordinated Universal Time (UTC) when the device last backed-up the DHCP snooping binding table.
T/F bsDhcpSnoopingExtSaveSyncFlag	1.3.6.1.4.1.45.5.17.1.6.3	TruthValue	read-only	This object controls whether changes in the DHCP snooping binding table will be synchronized on the external device. A value of true(1) indicates changes will be synchronized at next write. A value of false(2) indicates changes won't be synchronized.
STR bsDhcpSnoopingExtSaveFilename	1.3.6.1.4.1.45.5.17.1.6.4	DisplayString	read-write	Name of the DHCP snooping binding file to be saved or restored externally.
IPt bsDhcpSnoopingExtSaveTftpServerAddressType	1.3.6.1.4.1.45.5.17.1.6.5	InetAddressType	read-write	This object indicates the type of address stored in the related object bsDhcpSnoopingExtSaveTftpServerInetAddress.
IP bsDhcpSnoopingExtSaveTftpServerAddress	1.3.6.1.4.1.45.5.17.1.6.6	InetAddress	read-write	The IP address of the TFTP server on which to save the binding information.
I32 bsDhcpSnoopingExtSaveUsbTargetUnit	1.3.6.1.4.1.45.5.17.1.6.7	Integer32	read-write	This object indicates the unit number of the USB port to be used in file save/restore operations.
I32 bsDhcpSnoopingExtSaveForceRestore	1.3.6.1.4.1.45.5.17.1.6.8	Integer32	read-write	This object is used to force a binding table restore from a previously saved file.
IPt bsDhcpSnoopingExtSaveSftpServerAddressType	1.3.6.1.4.1.45.5.17.1.6.9	InetAddressType	read-write	This object indicates the type of address stored in the related object bsDhcpSnoopingExtSaveSftpServerInetAddress.
IP bsDhcpSnoopingExtSaveSftpServerAddress	1.3.6.1.4.1.45.5.17.1.6.10	InetAddress	read-write	The IP address of the SFTP server on which to save the binding information.

RFC description

DHCP snooping configuration and binding tracking for Nortel switches, including static bindings and option 82 handling.

Start monitoring Avaya/Nortel BayStack Ethernet Routing Switch (ERS) (legacy) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download BAY-STACK-DHCP-SNOOPING-MIB

What Is BAY-STACK-DHCP-SNOOPING-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description