CABH-SEC-MIB

All MIBs › CABH-SEC-MIB

Organization: CableLabs Broadband Access Department

Last Updated: 2004-08-06

Category: DOCSIS and Cable

Description: Manages CableLabs CableHome security features including firewall policies and access control for residential gateway devices on cable networks.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is CABH-SEC-MIB?

CABH-SEC-MIB is a CableLabs CableHome specification MIB that governs the Security Portal Services of a residential cable gateway device, sitting in the cable/DOCSIS technology area alongside other CableHome MIBs. It exposes configuration data for firewall policy file management (URL, hash, enable state), firewall event logging/enable flags, and intrusion/attack alert thresholds. In monitoring terms, this MIB is primarily used to check the operational and software status of the gateway's security subsystem: whether the current firewall policy file was successfully downloaded and applied (operational status, current version, last successful URL), and whether attack-detection thresholds and event types have tripped. It builds on the broader CableHome (CABH) MIB family and DOCSIS/cable modem management framework, and typically depends on associated CableHome device and event MIBs for full context. It is deployed on residential/small-business cable gateway (eRouter/eSAFE) devices managed by an MSO's provisioning and monitoring back office. Engineers can download the CABH-SEC-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in CABH-SEC-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

CableHome residential cable gateway
DOCSIS eRouter/cable modem gateway

Monitoring Examples

An operator can poll cabhSecFwPolicyFileOperStatus and cabhSecFwPolicyFileCurrentVersion to confirm that a pushed firewall policy (identified by cabhSecFwPolicyFileURL and validated via cabhSecFwPolicyFileHash) was successfully applied on the gateway, falling back to cabhSecFwPolicySuccessfulFileURL to see the last known-good policy if the newest push failed. Enabling cabhSecFwEventType1Enable/Type2/Type3 lets the operator control which classes of firewall events are logged, while cabhSecFwEventAttackAlertThreshold and cabhSecFwEventAttackAlertPeriod define when a burst of blocked packets escalates to an attack notification. A sudden change in operational status to a failure value, or a spike in attack alerts within the configured period, signals a misconfigured policy push or an active intrusion attempt against the subscriber's gateway.

What Can Be Monitored

firewall policy file operational status
firewall policy file current version
firewall event type enable flags
attack alert threshold
attack alert period
last successful policy file URL

Imported Objects

From CLAB-DEF-MIB

clabProjCableHome

OBJECT-IDENTITY

From DOCS-BPI2-MIB

X509Certificate

From DOCS-CABLE-DEVICE-MIB

docsDevFilterIpEntry

OBJECT-TYPE

From IF-MIB

InterfaceIndexOrZero

From INET-ADDRESS-MIB

InetAddress
InetPortNumber

From RMON2-MIB

ZeroBasedCounter32

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Counter32
MODULE-IDENTITY
OBJECT-TYPE
Unsigned32
zeroDotZero

From SNMPv2-TC

DateAndTime
RowStatus
TimeStamp
TruthValue
VariablePointer

How to Use in IPNetwork Monitor

Example using cabhSec2FwLocalFilterIpMatches OID:

Select a CableHome-compliant residential gateway (cable modem/router) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type cabhSec2FwLocalFilterIpMatches into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. Counts the number of times this filter was matched. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
cabhSec2Compliance	1.3.6.1.4.1.4491.2.4.2.4.1.2			The compliance statement for CableHome 1.1 Security.
cabhSec2FwBase	1.3.6.1.4.1.4491.2.4.2.5.4.1
T/F cabhSec2FwClearLocalRuleset	1.3.6.1.4.1.4491.2.4.2.5.4.1.12	TruthValue	read-write	If set to 'true', the PS MUST clear all entries in the cabhSec2FwLocalFilterIpTable. Reading this value always returns false.
T/F cabhSec2FwClearPreviousRuleset	1.3.6.1.4.1.4491.2.4.2.5.4.1.6	TruthValue	read-write	If set to 'true', the PS MUST clear all entries in the docsDevFilterIpTable. Reading this value always returns false.
INT cabhSec2FwConfiguredRulesetPriority	1.3.6.1.4.1.4491.2.4.2.5.4.1.11	INTEGER	read-write	This object defines which Configured Ruleset filter rule has priority when a conflict exists between a filter rule in the docsDevFilterIpTable and a filter rule in the cabhSec2FwLocalFilterIpTable as indicated by the following options: docsDevFilterIpTable (1) � indicates that filter rules in the docsDevFilterIpTable have priority over any conflicting filters that may exist in the cabhSec2FwLocalFilterIpTable. cabhSec2FwLocalFilterIpTable (2) � indicates that filter rules in the cabhSec2FwLocalFilterIpTable have priority over any conflicting filters that may exist in the docsDevFilterIpTable.
INT cabhSec2FwEnable	1.3.6.1.4.1.4491.2.4.2.5.4.1.1	INTEGER	read-write	This parameter indicates whether to enable or disable the firewall.
cabhSec2FwEvent	1.3.6.1.4.1.4491.2.4.2.5.4.2
cabhSec2FwEventControlEntry	1.3.6.1.4.1.4491.2.4.2.5.4.2.1.1		not-accessible	Allows configuration of the reporting mechanisms for a particular type of attack.
cabhSec2FwEventControlTable	1.3.6.1.4.1.4491.2.4.2.5.4.2.1		not-accessible	This table controls the reporting of the Firewall Attacks events
NUM cabhSec2FwEventCount	1.3.6.1.4.1.4491.2.4.2.5.4.2.1.1.5	ZeroBasedCounter32	read-only	Indicates the current count up to the cabhSec2FwEventThreshold value by type as assigned by cabhSec2FwEventType.
INT cabhSec2FwEventEnable	1.3.6.1.4.1.4491.2.4.2.5.4.2.1.1.2	INTEGER	read-write	Enables or disables counting and logging of firewall events by type as assigned by cabhSec2FwEventType.
U32 cabhSec2FwEventInterval	1.3.6.1.4.1.4491.2.4.2.5.4.2.1.1.4	Unsigned32	read-write	Indicates the time interval in hours to count and log occurrences of a firewall event type as assigned in cabhSec2FwEventType. If this MIB has a value of zero then there is no interval assigned and the PS will not count or log events.
TIM cabhSec2FwEventLastSetToFactory	1.3.6.1.4.1.4491.2.4.2.5.4.1.9	TimeStamp	read-only	The value of sysUpTime when cabhSec2FwEventSetToFactory was Last set to true. Zero if never reset.
TIM cabhSec2FwEventLogLastReset	1.3.6.1.4.1.4491.2.4.2.5.4.2.1.1.7	TimeStamp	read-only	The value of sysUpTime when cabhSec2FwEventLogReset was last set to true. Zero if never reset.
T/F cabhSec2FwEventLogReset	1.3.6.1.4.1.4491.2.4.2.5.4.2.1.1.6	TruthValue	read-write	Setting this object to true clears the log table for the specified event type. Reading this object always returns false.
T/F cabhSec2FwEventSetToFactory	1.3.6.1.4.1.4491.2.4.2.5.4.1.8	TruthValue	read-write	If set to 'true', entries in cabhSec2FwEventControlEntry are set to their default values. Reading this value always returns false.
U32 cabhSec2FwEventThreshold	1.3.6.1.4.1.4491.2.4.2.5.4.2.1.1.3	Unsigned32	read-write	Number of attacks to count before sending the appropriate event by type as assigned by cabhSec2FwEventType.
INT cabhSec2FwEventType	1.3.6.1.4.1.4491.2.4.2.5.4.2.1.1.1	INTEGER	not-accessible	Classification of the different types of attacks. Type 1 logs all attempts from both LAN and WAN clients to traverse the Firewall that violate the Security Policy. Type 2 logs identified Denial of Service attack attempts. Type 3 logs all changes made to the cabhSec2FwPolicyFileURL, cabhSec2FwPolicyFileCurrentVersion or cabhSec2FwPolicyFileEnable objects. Type 4 logs all failed attempts to modify cabhSec2FwPolicyFileURL and cabhSec2FwPolicyFileEnable objects. Type 5 logs allowed inbound packets from the WAN. Type 6 logs allowed outbound packets from the LAN.
T/F cabhSec2FwFactoryDefaultFilterContinue	1.3.6.1.4.1.4491.2.4.2.5.4.4.2.1.14	TruthValue	read-only	This value is always set to true so the PS MUST continue scanning and applying rules.
INT cabhSec2FwFactoryDefaultFilterControl	1.3.6.1.4.1.4491.2.4.2.5.4.4.2.1.2	INTEGER	read-only	If set to deny(1), all packets matching this filter will be discarded. If set to allow(2), all packets matching this filter will be accepted. The cabhSec2FwFactoryDefaultFilterContinue object is Set to true, and therefore the PS MUST continue to scan the table for other matches to apply the match with the highest cabhSec2FwFactoryDefaultFilterIndex value.
IP cabhSec2FwFactoryDefaultFilterDaddr	1.3.6.1.4.1.4491.2.4.2.5.4.4.2.1.7	InetAddress	read-only	The destination IP address, or portion thereof, that is to be matched for this filter. The destination address is first masked (and'ed) against cabhSec2FwFactoryDefaultFilterDmask before being compared to this value. A value of 0 for this object and 0 for the mask matches all IP addresses.
U32 cabhSec2FwFactoryDefaultFilterDestPortHigh	1.3.6.1.4.1.4491.2.4.2.5.4.4.2.1.13	Unsigned32	read-only	If cabhSec2FwFactoryDefaultFilterProtocol is udp or tcp, this is the inclusive upper bound of the transport-layer destination port range that is to be matched, otherwise it is ignored during matching.
U32 cabhSec2FwFactoryDefaultFilterDestPortLow	1.3.6.1.4.1.4491.2.4.2.5.4.4.2.1.12	Unsigned32	read-only	If cabhSec2FwFactoryDefaultFilterProtocol is udp or tcp, this is the inclusive lower bound of the transport-layer destination port range that is to be matched, otherwise it is ignored during matching.
INT cabhSec2FwFactoryDefaultFilterDirection	1.3.6.1.4.1.4491.2.4.2.5.4.4.2.1.4	INTEGER	read-only	This value represents direction in relationship to the assigned cabhSec2FwFactoryDefaultFilterIfIndex in this particular rule, meaning that the PS MUST represent traffic direction as follows: inbound(1)traffic, outbound(2) traffic, or both(3)inbound and outbound traffic.
IP cabhSec2FwFactoryDefaultFilterDmask	1.3.6.1.4.1.4491.2.4.2.5.4.4.2.1.8	InetAddress	read-only	A bit mask that is to be applied to the destination address prior to matching. This mask is not necessarily the same as a subnet mask, but 1's bits must be leftmost and contiguous.
cabhSec2FwFactoryDefaultFilterEntry	1.3.6.1.4.1.4491.2.4.2.5.4.4.2.1		not-accessible	Contains the firewall factory default ruleset.
NUM cabhSec2FwFactoryDefaultFilterIfIndex	1.3.6.1.4.1.4491.2.4.2.5.4.4.2.1.3	InterfaceIndexOrZero	read-only	The index number assigned to this object MUST match to the IfIndex numbering assigned in the ifTable from the Interfaces Group MIB [RFC 2863], and as specified in CH 1.1 Spec, Table 6-16 Numbering Interfaces in the ifTable. If the value is zero, the filter applies to all interfaces. This object MUST be specified to create a row in this table.
U32 cabhSec2FwFactoryDefaultFilterIndex	1.3.6.1.4.1.4491.2.4.2.5.4.4.2.1.1	Unsigned32	not-accessible	Index used to order the application of filters. The filter with the lowest index is always applied first.
U32 cabhSec2FwFactoryDefaultFilterProtocol	1.3.6.1.4.1.4491.2.4.2.5.4.4.2.1.9	Unsigned32	read-only	The protocol value that is to be matched. For example: icmp is 1, tcp is 6, udp is 17. A value of 65535 matches ANY protocol.
IP cabhSec2FwFactoryDefaultFilterSaddr	1.3.6.1.4.1.4491.2.4.2.5.4.4.2.1.5	InetAddress	read-only	The source IP address, or portion thereof, that is to be matched for this filter. The source address is first masked (and'ed) against cabhSec2FwFactoryDefaultFilterSmask before being compared to this value. A value of 0 for this object and 0 for the mask matches all IP addresses.
IP cabhSec2FwFactoryDefaultFilterSmask	1.3.6.1.4.1.4491.2.4.2.5.4.4.2.1.6	InetAddress	read-only	A bit mask that is to be applied to the source address prior to matching. This mask is not necessarily the same as a subnet mask, but 1's bits must be leftmost and contiguous.
U32 cabhSec2FwFactoryDefaultFilterSourcePortHigh	1.3.6.1.4.1.4491.2.4.2.5.4.4.2.1.11	Unsigned32	read-only	If cabhSec2FwFactoryDefaultFilterProtocol is udp or tcp, this is the inclusive upper bound of the transport-layer source port range that is to be matched, otherwise it is ignored during matching.
U32 cabhSec2FwFactoryDefaultFilterSourcePortLow	1.3.6.1.4.1.4491.2.4.2.5.4.4.2.1.10	Unsigned32	read-only	If cabhSec2FwFactoryDefaultFilterProtocol is udp or tcp, this is the inclusive lower bound of the transport-layer source port range that is to be matched, otherwise it is ignored during matching.
cabhSec2FwFactoryDefaultFilterTable	1.3.6.1.4.1.4491.2.4.2.5.4.4.2		not-accessible	Contains the firewall factory default ruleset as defined by the CableLabs CableHome 1.1 Specification.
cabhSec2FwFilter	1.3.6.1.4.1.4491.2.4.2.5.4.4
STR cabhSec2FwFilterScheduleDescr	1.3.6.1.4.1.4491.2.4.2.5.4.4.1.1.4	SnmpAdminString	read-create	A filter rule description configured by the cable operator or subscriber.
BIT cabhSec2FwFilterScheduleDOW	1.3.6.1.4.1.4491.2.4.2.5.4.4.1.1.3	Bits	read-create	If the day of week bit associated with the PS given day is '1', this object criteria matches.
U32 cabhSec2FwFilterScheduleEndTime	1.3.6.1.4.1.4491.2.4.2.5.4.4.1.1.2	Unsigned32	read-create	The end time for matching the filter rule for the days indicated in cabhSec2FwFilterScheduleDOW. The filter rule associated with this end time MUST not be disabled until the minute following the time indicated by this MIB object. If the time period is for two days, identified by cabhSec2FwFilterScheduleEndTime being less than cabhSec2FwFilterScheduleStartTime, then the cabhSec2FwFilterScheduleDOW settings do not apply to this MIB object. Time is represented in the same manner as in cabhSec2FwFilterScheduleStartTime. An attempt to set this object to an invalid military time value, e.g., 1182, returns 'wrongValue' error.
cabhSec2FwFilterScheduleEntry	1.3.6.1.4.1.4491.2.4.2.5.4.4.1.1		not-accessible	Extended values for entries of docsDevFilterIpTable. If the PS has not aqcuire ToD the entire docsDevFilterIpEntry rule set is ignored. Note: A filter time period may include two days (e.g from 10 PM to 4 AM). A filter time period that includes two days is identified by the absolute value of the cabhSec2FwFilterScheduleEndTime being less than the absolute value of the cabhSec2FwFilterScheduleStartTime. The cabhSec2FwFilterScheduleDOW setting and the cabhSec2FwFilterScheduleStartTime value indicate what day and time the filter becomes active. The cabhSec2FwFilterScheduleEndTime indicates when the filter becomes inactive on the second day. The maximum filter time period that includes two days is 24 hours. If cabhSec2FwFilterScheduleStartTime is less than or equal to the cabhSec2FwFilterScheduleEndTime the time period of the filter falls in the same day.
U32 cabhSec2FwFilterScheduleStartTime	1.3.6.1.4.1.4491.2.4.2.5.4.4.1.1.1	Unsigned32	read-create	The start time for matching the filter ruleset in the specified days indicated in cabhSec2FwFilterScheduleDOW. Time is represented in Military Time, e.g., 8:30 AM is represented as 830 and 11:45 PM as 2345. An attempt to set this object to an invalid military time value, e.g., 1182, returns 'wrongValue' error.
cabhSec2FwFilterScheduleTable	1.3.6.1.4.1.4491.2.4.2.5.4.4.1		not-accessible	Extends the filtering matching parameters of docsDevFilterIpTable defined in RFC 2669 for CableHome Residential Gateways to include time day intervals and days of the week.
T/F cabhSec2FwLocalFilterIpContinue	1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.16	TruthValue	read-only	This value is always set to true so the PS MUST continue scanning and applying rules.
INT cabhSec2FwLocalFilterIpControl	1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.3	INTEGER	read-create	If set to deny(1), all packets matching this filter will be discarded. If set to allow(2), all packets matching this filter will be accepted. The cabhSec2FwLocalFilterIpContinue object is Set to true, and therefore the PS MUST continue to scan the table for other matches to apply the match with the highest cabhSec2FwLocalFilterIpIndex value.
IP cabhSec2FwLocalFilterIpDaddr	1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.8	InetAddress	read-create	The destination IP address, or portion thereof, that is to be matched for this filter. The destination address is first masked (and'ed) against cabhSec2FwLocalFilterIpDmask before being compared to this value. A value of 0 for this object and 0 for the mask matches all IP addresses.
STR cabhSec2FwLocalFilterIpDescr	1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.20	SnmpAdminString	read-create	A filter rule description configured by the cable operator or subscriber.
U32 cabhSec2FwLocalFilterIpDestPortHigh	1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.14	Unsigned32	read-create	If cabhSec2FwLocalFilterIpProtocol is udp or tcp, this is the inclusive upper bound of the transport-layer destination port range that is to be matched, otherwise it is ignored during matching.
U32 cabhSec2FwLocalFilterIpDestPortLow	1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.13	Unsigned32	read-create	If cabhSec2FwLocalFilterIpProtocol is udp or tcp, this is the inclusive lower bound of the transport-layer destination port range that is to be matched, otherwise it is ignored during matching.
INT cabhSec2FwLocalFilterIpDirection	1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.5	INTEGER	read-create	This value represents direction in relationship to the assigned cabhSec2FwLocalFilterIpIfIndex in this particular rule, meaning that the PS MUST represent traffic direction as follows: inbound(1)traffic, outbound(2) traffic, or both(3)inbound and outbound traffic.
IP cabhSec2FwLocalFilterIpDmask	1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.9	InetAddress	read-create	A bit mask that is to be applied to the destination address prior to matching. This mask is not necessarily the same as a subnet mask, but 1's bits must be leftmost and contiguous.
BIT cabhSec2FwLocalFilterIpDOW	1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.19	Bits	read-create	If the day of week bit associated with the PS given day is '1', this object criteria matches.
U32 cabhSec2FwLocalFilterIpEndTime	1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.18	Unsigned32	read-create	The end time for matching the filter ruleset for the days indicated in cabhSec2FwLocalFilterIpDOW. The filter rule associated with this end time MUST not be disabled until the minute following the time indicated by this MIB object. If the time period is for two days, identified by cabhSec2FwLocalFilterIpEndTime being less than cabhSec2FwLocalFilterIpStartTime, then the cabhSec2FwLocalFilterIpDOW settings do not apply to this MIB object. Time is represented in the same manner as in cabhSec2FwLocalFilterIpStartTime. An attempt to set this object to an invalid military time value, e.g., 1182, returns 'wrongValue' error.
cabhSec2FwLocalFilterIpEntry	1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1		not-accessible	Contains a configured filter rule for the PS firewall. If the PS has not aqcuired ToD, entries that do not have default time settings are ignored. Note, that a filter time period may include two days (e.g from 10 PM to 4 AM). A filter time period that includes two days is identified by the absolute value of the cabhSec2FwLocalFilterIpEndTime being less then the absolute value of the cabhSec2FwLocalFilterIpStartTime. The cabhSec2FwLocalFilterIpDOW setting and the cabhSec2FwLocalFilterIpStartTime value indicate what day and time the filter becomes active. The cabhSec2FwLocalFilterIpEndTime indicates when the filter becomes inactive on the second day. The maximum filter time period that includes two days is 24 hours. If cabhSec2FwLocalFilterIpStartTime is less than or equal to the cabhSec2FwLocalFilterIpEndTime the time period of the filter falls in the same day.
NUM cabhSec2FwLocalFilterIpIfIndex	1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.4	InterfaceIndexOrZero	read-create	The index number assigned to this object MUST match to the IfIndex numbering assigned in the ifTable from the Interfaces Group MIB [RFC 2863], and as specified in CH 1.1 Spec, Table 6-16 Numbering Interfaces in the ifTable.
U32 cabhSec2FwLocalFilterIpIndex	1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.1	Unsigned32	not-accessible	Index used to order the application of filters. The filter with the lowest index is always applied first.
C32 cabhSec2FwLocalFilterIpMatchesEx	1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.15	Counter32	read-only	Counts the number of times this filter was matched. This object is initialized to 0 at boot, or at row creation, and is reset only upon reboot.
U32 cabhSec2FwLocalFilterIpProtocol	1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.10	Unsigned32	read-create	The protocol value that is to be matched. For example: icmp is 1, tcp is 6, udp is 17. A value of 65535 matches ANY protocol.
IP cabhSec2FwLocalFilterIpSaddr	1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.6	InetAddress	read-create	The source IP address, or portion thereof, that is to be matched for this filter. The source address is first masked (and'ed) against cabhSec2FwLocalFilterIpSmask before being compared to this value. A value of 0 for this object and 0 for the mask matches all IP addresses.
IP cabhSec2FwLocalFilterIpSmask	1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.7	InetAddress	read-create	A bit mask that is to be applied to the source address prior to matching. This mask is not necessarily the same as a subnet mask, but 1's bits must be leftmost and contiguous.
U32 cabhSec2FwLocalFilterIpSourcePortHigh	1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.12	Unsigned32	read-create	If cabhSec2FwLocalFilterIpProtocol is udp or tcp, this is the inclusive upper bound of the transport-layer source port range that is to be matched, otherwise it is ignored during matching.
U32 cabhSec2FwLocalFilterIpSourcePortLow	1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.11	Unsigned32	read-create	If cabhSec2FwLocalFilterIpProtocol is udp or tcp, this is the inclusive lower bound of the transport-layer source port range that is to be matched, otherwise it is ignored during matching.
U32 cabhSec2FwLocalFilterIpStartTime	1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.17	Unsigned32	read-create	The start time for matching the filter ruleset in the specified days indicated in cabhSec2FwLocalFilterIpDOW. Time is represented in Military Time, e.g., 8:30 AM is represented as 830 and 11:45 PM as 2345. An attempt to set this object to an invalid military time value, e.g., 1182, returns 'wrongValue' error.
ROW cabhSec2FwLocalFilterIpStatus	1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.2	RowStatus	read-create	Controls and reflects the status of rows in this table. Creation of the rows may be done via either create-and-wait or create-and-go, but the filter is not applied until this object is set to (or changes to) active. There is no restriction in changing any object in a row while this object is set to active.
cabhSec2FwLocalFilterIpTable	1.3.6.1.4.1.4491.2.4.2.5.4.4.3		not-accessible	Contains a configured filtering Ruleset for the PS firewall.
cabhSec2FwLog	1.3.6.1.4.1.4491.2.4.2.5.4.3
cabhSec2FwLogEntry	1.3.6.1.4.1.4491.2.4.2.5.4.3.1.1		not-accessible	Each entry contains the log of firewall events
U32 cabhSec2FwLogEventId	1.3.6.1.4.1.4491.2.4.2.5.4.3.1.1.4	Unsigned32	read-only	The assigned event ID.
INT cabhSec2FwLogEventPriority	1.3.6.1.4.1.4491.2.4.2.5.4.3.1.1.3	INTEGER	read-only	The priority level of this event as defined by CableHome Specification. If a priority is not assigned in the CableHome specification for a particular event then the vendor or cable operator may assign priorities. These are ordered from most serious (emergency)to least serious (debug).
INT cabhSec2FwLogEventType	1.3.6.1.4.1.4491.2.4.2.5.4.3.1.1.2	INTEGER	read-only	Classification of the different types of attacks. Type 1 logs all attempts from both LAN and WAN clients to traverse the Firewall that violate the Security Policy. Type 2 logs identified Denial of Service attack attempts. Type 3 logs all changes made to the cabhSec2FwPolicyFileURL, cabhSec2FwPolicyFileCurrentVersion or cabhSec2FwPolicyFileEnable objects. Type 4 logs all failed attempts to modify cabhSec2FwPolicyFileURL and cabhSec2FwPolicyFileEnable objects. Type 5 logs allowed inbound packets from the WAN. Type 6 logs allowed outbound packets from the LAN.
U32 cabhSec2FwLogIndex	1.3.6.1.4.1.4491.2.4.2.5.4.3.1.1.1	Unsigned32	not-accessible	A sequence number for the specific events under a cabhSec2FwEventType.
IP cabhSec2FwLogIpDestAddr	1.3.6.1.4.1.4491.2.4.2.5.4.3.1.1.8	InetAddress	read-only	The Destination IP Address of the packet logged.
INE cabhSec2FwLogIpDestPort	1.3.6.1.4.1.4491.2.4.2.5.4.3.1.1.10	InetPortNumber	read-only	The Source IP Port of the packet logged.
U32 cabhSec2FwLogIpProtocol	1.3.6.1.4.1.4491.2.4.2.5.4.3.1.1.6	Unsigned32	read-only	The IP Protocol.
IP cabhSec2FwLogIpSourceAddr	1.3.6.1.4.1.4491.2.4.2.5.4.3.1.1.7	InetAddress	read-only	The Source IP Address of the packet logged.
INE cabhSec2FwLogIpSourcePort	1.3.6.1.4.1.4491.2.4.2.5.4.3.1.1.9	InetPortNumber	read-only	The Source IP Port of the packet logged.
STR cabhSec2FwLogMatchingFilterDescr	1.3.6.1.4.1.4491.2.4.2.5.4.3.1.1.16	SnmpAdminString	read-only	When applicable, cabhSec2FwLogMatchingFilterDesc contains the description value found in the cabhSec2FwFilterScheduleDesc MIB object or the cabhSec2FwLocalFilterIpDesc MIB object of the last filter rule matched that caused the event to be generated.
U32 cabhSec2FwLogMatchingFilterTableIndex	1.3.6.1.4.1.4491.2.4.2.5.4.3.1.1.15	Unsigned32	read-only	When applicable, cabhSec2FwLogMatchingFilterTableIndex indicates the filter table index if the last filter rule matched that caused the event to be generated. If the value is 0, the event was not caused by a filter rule match.
INT cabhSec2FwLogMatchingFilterTableName	1.3.6.1.4.1.4491.2.4.2.5.4.3.1.1.14	INTEGER	read-only	When applicable, cabhSec2FwLogMatchingFilterTableName indicates the filter table name containing the last filter rule matched that caused the event to be generated.
U32 cabhSec2FwLogMessageType	1.3.6.1.4.1.4491.2.4.2.5.4.3.1.1.11	Unsigned32	read-only	The ICMP defined types.
NUM cabhSec2FwLogMIBPointer	1.3.6.1.4.1.4491.2.4.2.5.4.3.1.1.13	VariablePointer	read-only	Identifies if the cabhSec2FwPolicyFileURL or the cabhSec2FwEnable MIB object changed or an attempt was made to change it.
U32 cabhSec2FwLogReplayCount	1.3.6.1.4.1.4491.2.4.2.5.4.3.1.1.12	Unsigned32	read-only	The number of identical attack packets that were seen by the firewall based on cabhSec2FwLogIpProtocol, cabhSec2FwLogIpSourceAddr, cabhSec2FwLogIpDestAddr, cabhSec2FwLogIpSourcePort, cabhSec2FwLogIpDestPort and cabhSec2FwLogMessageType.
cabhSec2FwLogTable	1.3.6.1.4.1.4491.2.4.2.5.4.3.1		not-accessible	Contains a log of packet information as related to events enabled by the cable operator. The types are defined in the CableHome 1.1 specification and require various objects to be included in the log. The following is a description for what is expected in the log for each type Type 1, Type 2, Type 5 and Type 6 table MUST include cabhSec2FwEventType, cabhSec2FwEventPriority, cabhSec2FwEventId, cabhSec2FwLogTime, cabhSec2FwIpProtocol, cabhSec2FwIpSourceAddr, cabhSec2FwIpDestAddr, cabhSec2FwIpSourcePort, cabhSec2FwIpDestPort, cabhSec2Fw, cabhSec2FwReplayCount. The other values not used by Types 1, 2, 5 and 6 are default values. Type 3 and Type 4 MUST include cabhSec2FwEventType, cabhSec2FwEventPriority, cabhSec2FwEventId, cabhSec2FwLogTime, cabhSec2FwIpSourceAddr, cabhSec2FwLogMIBPointer. The other values not used by type 3 and 4 are default values. When applicable, Type 1, Type 5,and Type 6 MUST also include cabhSec2FwLogMatchingFilterTableName, cabhSec2FwLogMatchingFilterTableIndex, cabhSec2FwLogMatchingFilterDescr.
DAT cabhSec2FwLogTime	1.3.6.1.4.1.4491.2.4.2.5.4.3.1.1.5	DateAndTime	read-only	The time that this entry was created by the PS.
cabhSec2FwObjects	1.3.6.1.4.1.4491.2.4.2.5.4
STR cabhSec2FwPolicyFileCurrentVersion	1.3.6.1.4.1.4491.2.4.2.5.4.1.5	SnmpAdminString	read-write	A label set by the cable operator that can be used to track various versions of configured rulesets. Once the label is set and configured rules are changed, it may not accurately reflect the version of configured rules running on the box. If this object has never been configured, it MUST contain an empty string.
OCT cabhSec2FwPolicyFileHash	1.3.6.1.4.1.4491.2.4.2.5.4.1.3	OCTET STRING	read-write	Hash of the contents of the firewall configuration file. For the SHA-1 authentication algorithm the length of the hash is 160 bits. This hash value is encoded in binary format.
INT cabhSec2FwPolicyFileOperStatus	1.3.6.1.4.1.4491.2.4.2.5.4.1.4	INTEGER	read-only	InProgress(1) indicates a firewall configuration file download is underway. Complete(2) indicates the firewall configuration file was downloaded and processed successfully. Failed(3) indicates that the last attempted firewall configuration file download or processing failed.
STR cabhSec2FwPolicyFileURL	1.3.6.1.4.1.4491.2.4.2.5.4.1.2	SnmpAdminString	read-write	A policy rule set file download is triggered when the value used to SET this object is different than the value in the cabhSec2FwPolicySuccessfulFileURL object.
INT cabhSec2FwPolicySelection	1.3.6.1.4.1.4491.2.4.2.5.4.1.7	INTEGER	read-write	This object allows for selection of the filtering policy as defined by the following options: factoryDefault (1) The firewall filters against the Factory Default Ruleset in the cabhSec2FwFactoryDefaultFilterTable. configuredRulesetBoth (2) The firewall filters against the Configured Ruleset defined by both the docsDevFilterIpTable and the cabhSec2FwLocalFilterIpTable. factoryDefaultAndConfiguredRulesetBoth (3) The firewall filters against the CableHome specified Factory Default Ruleset in the cabhSec2FwFactoryDefaultFilterTable and the Configured Ruleset in the docsDevFilterIpTable and the cabhSec2FwLocalFilterIpTable. configuredRulesetDocsDevFilterIpTable(4) The firewall filters against the Configured Ruleset defined by the docsDevFilterIpTable. configuredRulesetCabhSec2FwLocalFilterIpTable (5) The firewall filters against the Configured Ruleset defined by the cabhSec2FwLocalFilterIpTable. factoryDefaultAndDocsDevFilterIpTable (6) The firewall filters against the Factory Default Ruleset and the Configured Ruleset defined by the DocsDevFilterIpTable. factoryDefaultAndCabhSec2FwLocalFilterIpTable (7) The firewall filters against the Factory Default Ruleset and the Configured Ruleset defined by the cabhSec2FwLocalFilterIpTable.
STR cabhSec2FwPolicySuccessfulFileURL	1.3.6.1.4.1.4491.2.4.2.5.4.1.10	SnmpAdminString	read-only	Contains the location of the last successful downloaded policy rule set file in the format pointed in the reference. If a successful download has not yet occurred, this MIB object should report empty string.
cabhSec2Group	1.3.6.1.4.1.4491.2.4.2.4.2.4			Group of objects in CableHome 1.1 Firewall MIB.
cabhSecCertGroup	1.3.6.1.4.1.4491.2.4.2.4.2.2			Group of objects in CableHome gateway for PS Certificate.
cabhSecCertObjects	1.3.6.1.4.1.4491.2.4.2.2
X50 cabhSecCertPsCert	1.3.6.1.4.1.4491.2.4.2.2.1	X509Certificate	read-only	The X509 DER-encoded PS certificate.
cabhSecCompliance	1.3.6.1.4.1.4491.2.4.2.4.1.1			The compliance statement for CableHome Security.
cabhSecCompliances	1.3.6.1.4.1.4491.2.4.2.4.1
cabhSecConformance	1.3.6.1.4.1.4491.2.4.2.4
cabhSecFwBase	1.3.6.1.4.1.4491.2.4.2.1.1
INT cabhSecFwEventAttackAlertPeriod	1.3.6.1.4.1.4491.2.4.2.1.2.5	INTEGER	read-write	Indicates the period to be used (in hours) for the cabhSecFwEventAttackAlertThreshold. This MIB variable should always keep track of the last x hours of events meaning that if the variable is set to track events for 10 hours then when the 11th hour is reached, the 1st hour of events is deleted from the tracking log. A default value is set to zero, meaning zero time, so that this MIB variable will not track any events unless configured.
INT cabhSecFwEventAttackAlertThreshold	1.3.6.1.4.1.4491.2.4.2.1.2.4	INTEGER	read-write	If the number of type 1 or 2 hacker attacks exceeds this threshold in the period define by cabhSecFwEventAttackAlertPeriod, a firewall message event MUST be logged with priority level 4.
INT cabhSecFwEventType1Enable	1.3.6.1.4.1.4491.2.4.2.1.2.1	INTEGER	read-write	This object enables or disables logging of type 1 firewall event messages. Type 1 event messages report attempts from both private and public clients to traverse the firewall that violate the Security Policy.
INT cabhSecFwEventType2Enable	1.3.6.1.4.1.4491.2.4.2.1.2.2	INTEGER	read-write	This object enables or disables logging of type 2 firewall event messages. Type 2 event messages report identified Denial of Service attack attempts.
INT cabhSecFwEventType3Enable	1.3.6.1.4.1.4491.2.4.2.1.2.3	INTEGER	read-write	Enables or disables logging of type 3 firewall event messages. Type 3 event messages report changes made to the following firewall management parameters: cabhSecFwPolicyFileURL, cabhSecFwPolicyFileCurrentVersion, cabhSecFwPolicyFileEnable
cabhSecFwLogCtl	1.3.6.1.4.1.4491.2.4.2.1.2
cabhSecFwObjects	1.3.6.1.4.1.4491.2.4.2.1
STR cabhSecFwPolicyFileCurrentVersion	1.3.6.1.4.1.4491.2.4.2.1.1.5	SnmpAdminString	read-only	The rule set version currently operating in the PS device. This object should be in the syntax used by the individual vendor to identify software versions. Any PS element MUST return a string descriptive of the current rule set file load. If this is not applicable, this object MUST contain an empty string.
INT cabhSecFwPolicyFileEnable	1.3.6.1.4.1.4491.2.4.2.1.1.1	INTEGER	read-write	This parameter indicates whether or not to enable the firewall functionality.
OCT cabhSecFwPolicyFileHash	1.3.6.1.4.1.4491.2.4.2.1.1.3	OCTET STRING	read-write	Hash of the contents of the rules set file, calculated and sent to the PS prior to sending the rules set file. For the SHA-1 authentication algorithm the length of the hash is 160 bits. This hash value is encoded in binary format.
INT cabhSecFwPolicyFileOperStatus	1.3.6.1.4.1.4491.2.4.2.1.1.4	INTEGER	read-only	inProgress(1) indicates a firewall configuration file download is underway. complete (2) indicates the firewall configuration file downloaded and configured successfully. completeFromMgt(3) This state is deprecated. failed(4) indicates the last attempted firewall configuration file download or processing failed ordinarily due to TFTP timeout.
STR cabhSecFwPolicyFileURL	1.3.6.1.4.1.4491.2.4.2.1.1.2	SnmpAdminString	read-write	A policy rule set file download is triggered when the value used to SET this object is different than the value in the cabhSecFwPolicySuccessfulFileURL object.
STR cabhSecFwPolicySuccessfulFileURL	1.3.6.1.4.1.4491.2.4.2.1.1.6	SnmpAdminString	read-only	Contains the location of the last successful downloaded policy rule set file in the format pointed in the reference. If a successful download has never occurred, this MIB object MUST report empty string.
cabhSecGroup	1.3.6.1.4.1.4491.2.4.2.4.2.1			Group of objects in CableHome 1.0 Firewall MIB.
cabhSecGroups	1.3.6.1.4.1.4491.2.4.2.4.2
cabhSecKerbBase	1.3.6.1.4.1.4491.2.4.2.5.3.1
cabhSecKerbGroup	1.3.6.1.4.1.4491.2.4.2.4.2.3			Group of objects in CableHome gateway for Kerberos.
cabhSecKerbObjects	1.3.6.1.4.1.4491.2.4.2.5.3
U32 cabhSecKerbPKINITGracePeriod	1.3.6.1.4.1.4491.2.4.2.5.3.1.1	Unsigned32	read-write	The PKINIT Grace Period is needed by the PS to know when it should start retrying to get a new ticket. The PS MUST obtain a new Kerberos ticket (with a PKINIT exchange)this many minutes before the old ticket expires.
U32 cabhSecKerbTGSGracePeriod	1.3.6.1.4.1.4491.2.4.2.5.3.1.2	Unsigned32	read-write	The TGS Grace Period is needed by the PS to know when it should start retrying to get a new ticket. The PS MUST obtain a new Kerberos ticket (with a TGS Request) this many minutes before the old ticket expires.
U32 cabhSecKerbUnsolicitedKeyMaxRetries	1.3.6.1.4.1.4491.2.4.2.5.3.1.4	Unsigned32	read-write	The number of retries the PS is allowed for AP-REQ/REP key management exchange initiation with the NMS. This is the maximum number of retries before the PS gives up attempting to establish an SNMPv3 security association with NMS.
U32 cabhSecKerbUnsolicitedKeyMaxTimeout	1.3.6.1.4.1.4491.2.4.2.5.3.1.3	Unsigned32	read-write	This timeout applies to PS initiated AP-REQ/REP key management exchange with NMS. The maximum timeout is the value which may not be exceeded in the exponential backoff algorithm.
cabhSecMib	1.3.6.1.4.1.4491.2.4.2			This MIB module supplies the basic management objects for the Security Portal Services.
cabhSecMibObjects	1.3.6.1.4.1.4491.2.4.2.5
cabhSecNotification	1.3.6.1.4.1.4491.2.4.2.3

RFC description

CableHome security portal firewall, certificate, and Kerberos management for cable broadband gateways.

Start monitoring CableHome-compliant residential gateways (cable modem/router) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download CABH-SEC-MIB