BEGEMOT-PF-MIB

All MIBs › BEGEMOT-PF-MIB

Organization: NixSys BVBA

Last Updated: 2005-01-24

Category: Net-SNMP and Linux, VPN and Security

Description: Manages FreeBSD PF (Packet Filter) firewall rules, state tables, and traffic counters via bsnmpd.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is BEGEMOT-PF-MIB?

BEGEMOT-PF-MIB is the Begemot family MIB exposing FreeBSD's PF (Packet Filter) firewall through the bsnmpd SNMP agent. It provides overall firewall running/enabled status, runtime and debug-level scalars, a host identifier, packet-level error/drop counters (bad offset, fragment, short packet, normalization events, memory drops), and state-table size and search-rate statistics. This directly monitors firewall software health and performance: whether PF is active, how many stateful connections it is tracking, and whether it is dropping packets due to malformed traffic or memory pressure - key indicators of both correctness and resource strain under load. It is specific to the FreeBSD/bsnmpd implementation rather than tied to an IETF standard, though its state-table concepts parallel other firewall/NAT MIBs. It is deployed on FreeBSD-based firewalls and routers running pf, common in BSD-based network appliances and router distributions. Network engineers evaluating or troubleshooting this functionality can download the BEGEMOT-PF-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in BEGEMOT-PF-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

FreeBSD-based firewalls/routers running pf

Monitoring Examples

An administrator polls pfStatusRunning to confirm the firewall is active, watches pfStateTableCount against a configured limit to detect state-table exhaustion, and monitors pfCounterMemDrop and pfCounterFragment for rising values. A spike in pfCounterMemDrop combined with pfStateTableCount near its maximum indicates the firewall is dropping new connections due to memory or state exhaustion, likely from a connection flood or denial-of-service attack.

What Can Be Monitored

firewall running status
runtime/debug level
state table count
state table search rate
packet error counters (fragment, short, bad offset, normalize, memory drop)

Imported Objects

From BEGEMOT-MIB

begemot

MODULE-IDENTITY

From SNMPv2-SMI

Counter64
Integer32
MODULE-IDENTITY
OBJECT-TYPE
TimeTicks
Unsigned32

From SNMPv2-TC

TruthValue

How to Use in IPNetwork Monitor

Example using pfCounterMatch OID:

Select a FreeBSD hosts/appliances running the Begemot bsnmpd SNMP agent as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type pfCounterMatch into the Find box to locate it in the OID tree, then select it and click OK. It reports the number of packets that matched a filter rule. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter64-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
begemotPf	1.3.6.1.4.1.12325.1.200			The Begemot MIB for the pf packet filter.
begemotPfObjects	1.3.6.1.4.1.12325.1.200.1
pfAltq	1.3.6.1.4.1.12325.1.200.1.10
U32 pfAltqQueueBandwidth	1.3.6.1.4.1.12325.1.200.1.10.2.1.5	Unsigned32	read-only	Bandwitch assigned to this queue.
OCT pfAltqQueueDescr	1.3.6.1.4.1.12325.1.200.1.10.2.1.2	OCTET STRING	read-only	The name of the queue.
pfAltqQueueEntry	1.3.6.1.4.1.12325.1.200.1.10.2.1		not-accessible	An entry in the pfAltqQueueTable table.
I32 pfAltqQueueIndex	1.3.6.1.4.1.12325.1.200.1.10.2.1.1	Integer32	not-accessible	A unique value, greater than zero, for each queue.
I32 pfAltqQueueLimit	1.3.6.1.4.1.12325.1.200.1.10.2.1.7	Integer32	read-only	Maximum number of packets in the queue.
U32 pfAltqQueueNumber	1.3.6.1.4.1.12325.1.200.1.10.1	Unsigned32	read-only	The number of queues in the active set.
OCT pfAltqQueueParent	1.3.6.1.4.1.12325.1.200.1.10.2.1.3	OCTET STRING	read-only	Name of the queue's parent if it has one.
I32 pfAltqQueuePriority	1.3.6.1.4.1.12325.1.200.1.10.2.1.6	Integer32	read-only	Priority level of the queue.
INT pfAltqQueueScheduler	1.3.6.1.4.1.12325.1.200.1.10.2.1.4	INTEGER	read-only	Scheduler algorithm implemented by this queue.
pfAltqQueueTable	1.3.6.1.4.1.12325.1.200.1.10.2		not-accessible	Table containing the rules that are active on this system.
pfCounter	1.3.6.1.4.1.12325.1.200.1.2
C64 pfCounterBadOffset	1.3.6.1.4.1.12325.1.200.1.2.2	Counter64	read-only	Number of packets with bad offset.
C64 pfCounterFragment	1.3.6.1.4.1.12325.1.200.1.2.3	Counter64	read-only	Number of fragmented packets.
C64 pfCounterMatchEx	1.3.6.1.4.1.12325.1.200.1.2.1	Counter64	read-only	Number of packets that matched a filter rule.
C64 pfCounterMemDrop	1.3.6.1.4.1.12325.1.200.1.2.6	Counter64	read-only	Number of packets dropped due to memory limitations.
C64 pfCounterNormalize	1.3.6.1.4.1.12325.1.200.1.2.5	Counter64	read-only	Number of normalized packets.
C64 pfCounterShort	1.3.6.1.4.1.12325.1.200.1.2.4	Counter64	read-only	Number of short packets.
pfInterfaces	1.3.6.1.4.1.12325.1.200.1.8
C64 pfInterfacesIf4BytesInBlock	1.3.6.1.4.1.12325.1.200.1.8.2.1.8	Counter64	read-only	The number of IPv4 bytes blocked coming in on this interface.
C64 pfInterfacesIf4BytesInPass	1.3.6.1.4.1.12325.1.200.1.8.2.1.7	Counter64	read-only	The number of IPv4 bytes passed coming in on this interface.
C64 pfInterfacesIf4BytesOutBlock	1.3.6.1.4.1.12325.1.200.1.8.2.1.10	Counter64	read-only	The number of IPv4 bytes blocked going out on this interface.
C64 pfInterfacesIf4BytesOutPass	1.3.6.1.4.1.12325.1.200.1.8.2.1.9	Counter64	read-only	The number of IPv4 bytes passed going out on this interface.
C64 pfInterfacesIf4PktsInBlock	1.3.6.1.4.1.12325.1.200.1.8.2.1.12	Counter64	read-only	The number of IPv4 packets blocked coming in on this interface.
C64 pfInterfacesIf4PktsInPass	1.3.6.1.4.1.12325.1.200.1.8.2.1.11	Counter64	read-only	The number of IPv4 packets passed coming in on this interface.
C64 pfInterfacesIf4PktsOutBlock	1.3.6.1.4.1.12325.1.200.1.8.2.1.14	Counter64	read-only	The number of IPv4 packets blocked going out on this interface.
C64 pfInterfacesIf4PktsOutPass	1.3.6.1.4.1.12325.1.200.1.8.2.1.13	Counter64	read-only	The number of IPv4 packets passed going out on this interface.
C64 pfInterfacesIf6BytesInBlock	1.3.6.1.4.1.12325.1.200.1.8.2.1.16	Counter64	read-only	The number of IPv6 bytes blocked coming in on this interface.
C64 pfInterfacesIf6BytesInPass	1.3.6.1.4.1.12325.1.200.1.8.2.1.15	Counter64	read-only	The number of IPv6 bytes passed coming in on this interface.
C64 pfInterfacesIf6BytesOutBlock	1.3.6.1.4.1.12325.1.200.1.8.2.1.18	Counter64	read-only	The number of IPv6 bytes blocked going out on this interface.
C64 pfInterfacesIf6BytesOutPass	1.3.6.1.4.1.12325.1.200.1.8.2.1.17	Counter64	read-only	The number of IPv6 bytes passed going out on this interface.
C64 pfInterfacesIf6PktsInBlock	1.3.6.1.4.1.12325.1.200.1.8.2.1.20	Counter64	read-only	The number of IPv6 packets blocked coming in on this interface.
C64 pfInterfacesIf6PktsInPass	1.3.6.1.4.1.12325.1.200.1.8.2.1.19	Counter64	read-only	The number of IPv6 packets passed coming in on this interface.
C64 pfInterfacesIf6PktsOutBlock	1.3.6.1.4.1.12325.1.200.1.8.2.1.22	Counter64	read-only	The number of IPv6 packets blocked going out on this interface.
C64 pfInterfacesIf6PktsOutPass	1.3.6.1.4.1.12325.1.200.1.8.2.1.21	Counter64	read-only	The number of IPv6 packets passed going out on this interface.
OCT pfInterfacesIfDescr	1.3.6.1.4.1.12325.1.200.1.8.2.1.2	OCTET STRING	read-only	The name of the interface.
pfInterfacesIfEntry	1.3.6.1.4.1.12325.1.200.1.8.2.1		not-accessible	An entry in the pfInterfacesIfTable containing information about a particular network interface in the machine.
I32 pfInterfacesIfIndex	1.3.6.1.4.1.12325.1.200.1.8.2.1.1	Integer32	not-accessible	A unique value, greater than zero, for each interface.
I32 pfInterfacesIfNumber	1.3.6.1.4.1.12325.1.200.1.8.1	Integer32	read-only	The number of network interfaces on this system.
U32 pfInterfacesIfRefsRule	1.3.6.1.4.1.12325.1.200.1.8.2.1.6	Unsigned32	read-only	The number of rules referencing this interface.
U32 pfInterfacesIfRefsState	1.3.6.1.4.1.12325.1.200.1.8.2.1.5	Unsigned32	read-only	The number of state and/or source track entries referencing this interface.
pfInterfacesIfTable	1.3.6.1.4.1.12325.1.200.1.8.2		not-accessible	Table of network interfaces, indexed on pfInterfacesIfNumber.
INT pfInterfacesIfType	1.3.6.1.4.1.12325.1.200.1.8.2.1.3	INTEGER	read-only	Indicates whether the interface is a group inteface, an interface instance, or whether it has been removed or destroyed.
TIK pfInterfacesIfTZero	1.3.6.1.4.1.12325.1.200.1.8.2.1.4	TimeTicks	read-only	Time since statistics were last reset or since the interface was loaded.
pfLimits	1.3.6.1.4.1.12325.1.200.1.5
U32 pfLimitsFrags	1.3.6.1.4.1.12325.1.200.1.5.3	Unsigned32	read-only	Maximum number of 'scrub' rules in the ruleset.
U32 pfLimitsSrcNodes	1.3.6.1.4.1.12325.1.200.1.5.2	Unsigned32	read-only	Maximum number of 'sticky-address' or 'source-track' rules in the ruleset.
U32 pfLimitsStates	1.3.6.1.4.1.12325.1.200.1.5.1	Unsigned32	read-only	Maximum number of 'keep state' rules in the ruleset.
pfLogInterface	1.3.6.1.4.1.12325.1.200.1.7
C64 pfLogInterfaceIp4BytesIn	1.3.6.1.4.1.12325.1.200.1.7.2	Counter64	read-only	Number of IPv4 bytes passed in on the loginterface.
C64 pfLogInterfaceIp4BytesOut	1.3.6.1.4.1.12325.1.200.1.7.3	Counter64	read-only	Number of IPv4 bytes passed out on the loginterface.
C64 pfLogInterfaceIp4PktsInDrop	1.3.6.1.4.1.12325.1.200.1.7.5	Counter64	read-only	Number of IPv4 packets dropped coming in on the loginterface.
C64 pfLogInterfaceIp4PktsInPass	1.3.6.1.4.1.12325.1.200.1.7.4	Counter64	read-only	Number of IPv4 packets passed in on the loginterface.
C64 pfLogInterfaceIp4PktsOutDrop	1.3.6.1.4.1.12325.1.200.1.7.7	Counter64	read-only	Number of IPv4 packets dropped going out on the loginterface.
C64 pfLogInterfaceIp4PktsOutPass	1.3.6.1.4.1.12325.1.200.1.7.6	Counter64	read-only	Number of IPv4 packets passed out on the loginterface.
C64 pfLogInterfaceIp6BytesIn	1.3.6.1.4.1.12325.1.200.1.7.8	Counter64	read-only	Number of IPv6 bytes passed in on the loginterface.
C64 pfLogInterfaceIp6BytesOut	1.3.6.1.4.1.12325.1.200.1.7.9	Counter64	read-only	Number of IPv6 bytes passed out on the loginterface.
C64 pfLogInterfaceIp6PktsInDrop	1.3.6.1.4.1.12325.1.200.1.7.11	Counter64	read-only	Number of IPv6 packets dropped coming in on the loginterface.
C64 pfLogInterfaceIp6PktsInPass	1.3.6.1.4.1.12325.1.200.1.7.10	Counter64	read-only	Number of IPv6 packets passed in on the loginterface.
C64 pfLogInterfaceIp6PktsOutDrop	1.3.6.1.4.1.12325.1.200.1.7.13	Counter64	read-only	Number of IPv6 packets dropped going out on the loginterface.
C64 pfLogInterfaceIp6PktsOutPass	1.3.6.1.4.1.12325.1.200.1.7.12	Counter64	read-only	Number of IPv6 packets passed out on the loginterface.
OCT pfLogInterfaceName	1.3.6.1.4.1.12325.1.200.1.7.1	OCTET STRING	read-only	The name of the interface configured with 'set loginterface'. If no interface has been configured, the object will be empty.
pfSrcNodes	1.3.6.1.4.1.12325.1.200.1.4
U32 pfSrcNodesCount	1.3.6.1.4.1.12325.1.200.1.4.1	Unsigned32	read-only	Number of entries in the source tracking table.
C64 pfSrcNodesInserts	1.3.6.1.4.1.12325.1.200.1.4.3	Counter64	read-only	Number of entries inserted into the source tracking table.
C64 pfSrcNodesRemovals	1.3.6.1.4.1.12325.1.200.1.4.4	Counter64	read-only	Number of entries removed from the source tracking table.
C64 pfSrcNodesSearches	1.3.6.1.4.1.12325.1.200.1.4.2	Counter64	read-only	Number of searches against the source tracking table.
pfStateTable	1.3.6.1.4.1.12325.1.200.1.3
U32 pfStateTableCount	1.3.6.1.4.1.12325.1.200.1.3.1	Unsigned32	read-only	Number of entries in the state table.
C64 pfStateTableInserts	1.3.6.1.4.1.12325.1.200.1.3.3	Counter64	read-only	Number of entries inserted into the state table.
C64 pfStateTableRemovals	1.3.6.1.4.1.12325.1.200.1.3.4	Counter64	read-only	Number of entries removed from the state table.
C64 pfStateTableSearches	1.3.6.1.4.1.12325.1.200.1.3.2	Counter64	read-only	Number of searches against the state table.
pfStatus	1.3.6.1.4.1.12325.1.200.1.1
INT pfStatusDebug	1.3.6.1.4.1.12325.1.200.1.1.3	INTEGER	read-only	Indicates the debug level at which pf is running.
OCT pfStatusHostId	1.3.6.1.4.1.12325.1.200.1.1.4	OCTET STRING	read-only	The (unique) host identifier of the machine running pf.
T/F pfStatusRunning	1.3.6.1.4.1.12325.1.200.1.1.1	TruthValue	read-only	True if pf is currently enabled.
TIK pfStatusRuntime	1.3.6.1.4.1.12325.1.200.1.1.2	TimeTicks	read-only	Indicates how long pf has been enabled. If pf is not currently enabled, indicates how long it has been disabled. If pf has not been enabled or disabled since the system was started, the value will be 0.
pfTables	1.3.6.1.4.1.12325.1.200.1.9
C64 pfTablesAddrBytesInBlock	1.3.6.1.4.1.12325.1.200.1.9.3.1.6	Counter64	read-only	The number of inbound bytes blocked as a result of this entry.
C64 pfTablesAddrBytesInPass	1.3.6.1.4.1.12325.1.200.1.9.3.1.5	Counter64	read-only	The number of inbound bytes passed as a result of this entry.
C64 pfTablesAddrBytesOutBlock	1.3.6.1.4.1.12325.1.200.1.9.3.1.8	Counter64	read-only	The number of outbound bytes blocked as a result of this entry.
C64 pfTablesAddrBytesOutPass	1.3.6.1.4.1.12325.1.200.1.9.3.1.7	Counter64	read-only	The number of outbound bytes passed as a result of this entry.
pfTablesAddrEntry	1.3.6.1.4.1.12325.1.200.1.9.3.1		not-accessible	An entry in the pfTablesAddrTable containing information about a particular entry in a table.
I32 pfTablesAddrIndex	1.3.6.1.4.1.12325.1.200.1.9.3.1.1	Integer32	not-accessible	A unique value, greater than zero, for each address.
I32 pfTablesAddrMask	1.3.6.1.4.1.12325.1.200.1.9.3.1.3	Integer32	read-only	The CIDR netmask of this particular table entry.
IP pfTablesAddrNet	1.3.6.1.4.1.12325.1.200.1.9.3.1.2	IpAddress	read-only	The IP address of this particular table entry.
C64 pfTablesAddrPktsInBlock	1.3.6.1.4.1.12325.1.200.1.9.3.1.10	Counter64	read-only	The number of inbound packets blocked as a result of this entry.
C64 pfTablesAddrPktsInPass	1.3.6.1.4.1.12325.1.200.1.9.3.1.9	Counter64	read-only	The number of inbound packets passed as a result of this entry.
C64 pfTablesAddrPktsOutBlock	1.3.6.1.4.1.12325.1.200.1.9.3.1.12	Counter64	read-only	The number of outbound packets blocked as a result of this entry.
C64 pfTablesAddrPktsOutPass	1.3.6.1.4.1.12325.1.200.1.9.3.1.11	Counter64	read-only	The number of outbound packets passed as a result of this entry.
pfTablesAddrTable	1.3.6.1.4.1.12325.1.200.1.9.3		not-accessible	Table of addresses from every table on the system.
TIK pfTablesAddrTZero	1.3.6.1.4.1.12325.1.200.1.9.3.1.4	TimeTicks	read-only	The time passed since this entry's statistics were last cleared, or the time passed since this entry was loaded into the table, whichever is sooner.
C64 pfTablesTblBytesInBlock	1.3.6.1.4.1.12325.1.200.1.9.2.1.10	Counter64	read-only	The number of bytes blocked coming in matching the table.
C64 pfTablesTblBytesInPass	1.3.6.1.4.1.12325.1.200.1.9.2.1.9	Counter64	read-only	The number of bytes passed in matching the table.
C64 pfTablesTblBytesInXPass	1.3.6.1.4.1.12325.1.200.1.9.2.1.11	Counter64	read-only	The number of bytes statefully passed in where the state entry refers to the table, but the table no longer contains the address in question.
C64 pfTablesTblBytesOutBlock	1.3.6.1.4.1.12325.1.200.1.9.2.1.13	Counter64	read-only	The number of bytes blocked going out matching the table.
C64 pfTablesTblBytesOutPass	1.3.6.1.4.1.12325.1.200.1.9.2.1.12	Counter64	read-only	The number of bytes passed out matching the table.
C64 pfTablesTblBytesOutXPass	1.3.6.1.4.1.12325.1.200.1.9.2.1.14	Counter64	read-only	The number of bytes statefully passed out where the state entry refers to the table, but the table no longer contains the address in question.
I32 pfTablesTblCount	1.3.6.1.4.1.12325.1.200.1.9.2.1.3	Integer32	read-only	The number of addresses in the table.
OCT pfTablesTblDescr	1.3.6.1.4.1.12325.1.200.1.9.2.1.2	OCTET STRING	read-only	The name of the table.
pfTablesTblEntry	1.3.6.1.4.1.12325.1.200.1.9.2.1		not-accessible	Any entry in the pfTablesTblTable containing information about a particular table on the system.
C64 pfTablesTblEvalMatch	1.3.6.1.4.1.12325.1.200.1.9.2.1.7	Counter64	read-only	The number of evaluations returning a match.
C64 pfTablesTblEvalNoMatch	1.3.6.1.4.1.12325.1.200.1.9.2.1.8	Counter64	read-only	The number of evaluations not returning a match.
I32 pfTablesTblIndex	1.3.6.1.4.1.12325.1.200.1.9.2.1.1	Integer32	not-accessible	A unique value, greater than zero, for each table.
I32 pfTablesTblNumber	1.3.6.1.4.1.12325.1.200.1.9.1	Integer32	read-only	The number of tables on this system.
C64 pfTablesTblPktsInBlock	1.3.6.1.4.1.12325.1.200.1.9.2.1.16	Counter64	read-only	The number of packets blocked coming in matching the table.
C64 pfTablesTblPktsInPass	1.3.6.1.4.1.12325.1.200.1.9.2.1.15	Counter64	read-only	The number of packets passed in matching the table.
C64 pfTablesTblPktsInXPass	1.3.6.1.4.1.12325.1.200.1.9.2.1.17	Counter64	read-only	The number of packets statefully passed in where the state entry refers to the table, but the table no longer contains the address in question.
C64 pfTablesTblPktsOutBlock	1.3.6.1.4.1.12325.1.200.1.9.2.1.19	Counter64	read-only	The number of packets blocked going out matching the table.
C64 pfTablesTblPktsOutPass	1.3.6.1.4.1.12325.1.200.1.9.2.1.18	Counter64	read-only	The number of packets passed out matching the table.
C64 pfTablesTblPktsOutXPass	1.3.6.1.4.1.12325.1.200.1.9.2.1.20	Counter64	read-only	The number of packets statefully passed out where the state entry refers to the table, but the table no longer contains the address in question.
I32 pfTablesTblRefsAnchor	1.3.6.1.4.1.12325.1.200.1.9.2.1.5	Integer32	read-only	The number of anchors referencing this table.
I32 pfTablesTblRefsRule	1.3.6.1.4.1.12325.1.200.1.9.2.1.6	Integer32	read-only	The number of rules referencing this table.
pfTablesTblTable	1.3.6.1.4.1.12325.1.200.1.9.2		not-accessible	Table of tables, index on pfTablesTblIndex.
TIK pfTablesTblTZero	1.3.6.1.4.1.12325.1.200.1.9.2.1.4	TimeTicks	read-only	The time passed since the statistics of this table were last cleared or the time since this table was loaded, whichever is sooner.
pfTimeouts	1.3.6.1.4.1.12325.1.200.1.6
I32 pfTimeoutsAdaptiveEnd	1.3.6.1.4.1.12325.1.200.1.6.18	Integer32	read-only	When reaching this number of state entries, all timeout values become zero, effectively purging all state entries immediately.
I32 pfTimeoutsAdaptiveStart	1.3.6.1.4.1.12325.1.200.1.6.17	Integer32	read-only	When the number of state entries exceeds this value, adaptive scaling begins.
I32 pfTimeoutsFragment	1.3.6.1.4.1.12325.1.200.1.6.15	Integer32	read-only	Seconds before an unassembled fragment is expired.
I32 pfTimeoutsIcmpError	1.3.6.1.4.1.12325.1.200.1.6.11	Integer32	read-only	State after an ICMP error came back in response to an ICMP packet.
I32 pfTimeoutsIcmpFirst	1.3.6.1.4.1.12325.1.200.1.6.10	Integer32	read-only	State after the first packet.
I32 pfTimeoutsInterval	1.3.6.1.4.1.12325.1.200.1.6.16	Integer32	read-only	Interval between purging expired states and fragments.
I32 pfTimeoutsOtherFirst	1.3.6.1.4.1.12325.1.200.1.6.12	Integer32	read-only	State after the first packet.
I32 pfTimeoutsOtherMultiple	1.3.6.1.4.1.12325.1.200.1.6.14	Integer32	read-only	State if both hosts have sent packets.
I32 pfTimeoutsOtherSingle	1.3.6.1.4.1.12325.1.200.1.6.13	Integer32	read-only	State if the source host sends more than one packet but the destination host has never sent one back.
I32 pfTimeoutsSrcNode	1.3.6.1.4.1.12325.1.200.1.6.19	Integer32	read-only	Length of time to retain a source tracking entry after the last state expires.
I32 pfTimeoutsTcpClosed	1.3.6.1.4.1.12325.1.200.1.6.6	Integer32	read-only	State after one endpoint sends an RST.
I32 pfTimeoutsTcpClosing	1.3.6.1.4.1.12325.1.200.1.6.4	Integer32	read-only	State after the first FIN has been sent.
I32 pfTimeoutsTcpEstablished	1.3.6.1.4.1.12325.1.200.1.6.3	Integer32	read-only	The fully established state.
I32 pfTimeoutsTcpFinWait	1.3.6.1.4.1.12325.1.200.1.6.5	Integer32	read-only	State after both FINs have been exchanged and the connection is closed.
I32 pfTimeoutsTcpFirst	1.3.6.1.4.1.12325.1.200.1.6.1	Integer32	read-only	State after the first packet in a connection.
I32 pfTimeoutsTcpOpening	1.3.6.1.4.1.12325.1.200.1.6.2	Integer32	read-only	State before the destination host ever sends a packet.
I32 pfTimeoutsUdpFirst	1.3.6.1.4.1.12325.1.200.1.6.7	Integer32	read-only	State after the first packet.
I32 pfTimeoutsUdpMultiple	1.3.6.1.4.1.12325.1.200.1.6.9	Integer32	read-only	State if both hosts have sent packets.
I32 pfTimeoutsUdpSingle	1.3.6.1.4.1.12325.1.200.1.6.8	Integer32	read-only	State if the source host sends more than one packet but the destination host has never sent one back.

RFC description

BEGEMOT (BSD Embedded SNMP) MIB for packet filter (pf) firewall rule and state management on BSD systems.

Start monitoring FreeBSD hosts/appliances running the Begemot bsnmpd SNMP agent with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download BEGEMOT-PF-MIB