CISCO-HARDWARE-IP-VERIFY-MIB

All MIBs › CISCO-HARDWARE-IP-VERIFY-MIB

Organization: Cisco Systems, Inc.

Last Updated: 2012-09-04

Category: Cisco Devices, VPN and Security

Description: Provides management objects for monitoring hardware-based IP source verification (uRPF) statistics on Cisco platforms.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is CISCO-HARDWARE-IP-VERIFY-MIB?

CISCO-HARDWARE-IP-VERIFY-MIB manages a hardware-accelerated Intrusion Detection System (IDS) feature on Cisco switching/routing platforms that performs IP source address verification, commonly known as unicast Reverse Path Forwarding (uRPF), along with related packet integrity checks. It exposes a table of configured verification check types (such as source IP validity, CRC, or Don't-Fragment bit checks) and their operational status, plus counters of packets dropped by each check. The MIB is used to monitor the security-enforcement software/hardware status of the device, since a rising drop counter for a particular check type indicates either an active spoofing/attack attempt being blocked or a misconfiguration causing legitimate traffic loss. It complements Cisco's broader security and IDS-related MIBs but has no dependency on a specific IETF standard. It is deployed on Cisco routers and switches with hardware-based packet verification/uRPF capability, typically at network edges to guard against IP spoofing. Engineers can download the CISCO-HARDWARE-IP-VERIFY-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in CISCO-HARDWARE-IP-VERIFY-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Cisco router or switch with hardware-based IP source verification (uRPF)

Monitoring Examples

A security operator would poll chivIpVerifyTable/chivIpVerifyEntry to see each chivIpVerifyCheckTypeName (e.g. source IP or DF-bit check) and confirm chivIpVerifyCheckStatus is enabled on critical interfaces. A sudden spike in chivIpVerifyPacketsDropped for a given check type would flag either an ongoing spoofed-traffic attack or a misconfigured uRPF policy dropping legitimate packets. ciscoHardwareIpVerifyMIBNotifs traps can alert on threshold-crossing drop rates in near real time.

What Can Be Monitored

IP verification check status per type
packets dropped by verification check
check type configuration
spoofing/attack indicators

Imported Objects

From CISCO-SMI

ciscoMgmt

OBJECT-IDENTITY

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Counter64
MODULE-IDENTITY
OBJECT-TYPE

How to Use in IPNetwork Monitor

Example using chivIpVerifyPacketsDropped OID:

Select a Cisco router or switch with hardware-based IP source verification (uRPF) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type chivIpVerifyPacketsDropped into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. This object indicates the number of packets which has been dropped. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter64-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases between polls, since a rising count of errors, failures, or discards often points to a real underlying problem. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
ciscoHardwareIpVerifyMIB	1.3.6.1.4.1.9.9.804			This MIB module defines management objects for configuration and monitoring of the Intrusion Detection System (IDS) that checks for IP packet verification. The following terms are used throughout the MIB: IDS: Intrusion Detection System CRC: Cyclic Redundancy Check DF: Don't Fragment
ciscoHardwareIpVerifyMIBNotifs	1.3.6.1.4.1.9.9.804.0
ciscoHardwareIpVerifyMIBObjects	1.3.6.1.4.1.9.9.804.1
chivIpVerifyTable	1.3.6.1.4.1.9.9.804.1.1		not-accessible	A list of IDS check configuration and statistical information for each IP type and each IDS check type on the management device.
chivIpVerifyEntry	1.3.6.1.4.1.9.9.804.1.1.1		not-accessible	An entry contains the IDS packet check configuration information and the associated counters.
INT chivIpVerifyCheckIpType	1.3.6.1.4.1.9.9.804.1.1.1.1	INTEGER	not-accessible	This object indicates the IP address type for IDS packet check.
INT chivIpVerifyCheckTypeName	1.3.6.1.4.1.9.9.804.1.1.1.2	INTEGER	not-accessible	This object indicates the IDS packet check type which can be configured on the device. Each check type is a specific criteria. Those IP packets that matches the certain criteria are dropped. addressSrcBroadcast(1) Drop the IPv4 packet if the source address is a broadcast IPv4 address. addressSrcMulticast(2) Drop the IPv4 packet if the source address is a multicast IPv4 address. addressDestZero(3) Drop the IPv4 packet if the destination address is 0.0.0.0. addressIdentical(4) Drop the IPv4 packet if the source IPv4 address is identical to destination IPv4 address. addressSrcReserved(5) Drop the IPv4 packet if the source address is a reserved IPv4 address. addressClassE(6) Drop the IPv4 packet if either the source address or destination address is a class E IPv4 address. checksum(7) Drops the IPv4 packet if its checksum is invalid. protocol(8) Drop the IPv4 packet if the packet fragment has an invalid IP protocol number fragment(9) Drop the IPv4 packet if the packet fragment has a nonzero offset and the DF bit is active. lengthMinimum(10) Drop the IPv4 packet if the Ethernet frame length is less than the IP packet length plus four octets (the CRC length). lengthConsistent(11) Drop the IPv4 or IPv6 packet where the Ethernet frame size is greater than or equal to the IP packet length plus the Ethernet header. lengthMaximumFragment(12) Drop the IPv4 or IPv6 packet if the maximum fragment offset is greater than 65536. lengthMaximumUdp(13) Drop the IPv4 or IPv6 packet if the IP payload length is less than the UDP packet length. lengthMaximumTcp(14) Drop the IPv4 or IPv6 packet if the TCP length is greater than the IP payload length. tcpFlags(15) Drop the IPv4 packet if verification of TCP packet header fails. tcpTinyFlags(16) Drop the IPv4 or IPv6 packet if the IP fragment offset is 1, or if the IP fragment offset is 0 and the IP payload length is less than 16. version(17) Drop the IPv4 packet if the Ethertype is not set to 4 (IPv4); and drops the IPv6 packet if the Ethertype is not set to 6 (IPv6).
INT chivIpVerifyCheckStatus	1.3.6.1.4.1.9.9.804.1.1.1.3	INTEGER	read-write	This object specifies the IDS packet check configuration status.
C64 chivIpVerifyPacketsDroppedEx	1.3.6.1.4.1.9.9.804.1.1.1.4	Counter64	read-only	This object indicates the number of packets which has been dropped.
ciscoHardwareIpVerifyMIBConform	1.3.6.1.4.1.9.9.804.2
ciscoHardwareIpVerifyMIBCompliances	1.3.6.1.4.1.9.9.804.2.1
ciscoHardwareIpVerifyMIBCompliance	1.3.6.1.4.1.9.9.804.2.1.1			The compliance statement for the CISCO-HARDWARE-IP-VERIFY-MIB.
ciscoHardwareIpVerifyMIBGroups	1.3.6.1.4.1.9.9.804.2.2
ciscoHardwareIpVerifyMIBStatisticGroup	1.3.6.1.4.1.9.9.804.2.2.1			A collection of objects that provides configuration and statistical information for IDS packet check.

RFC description

Configures and monitors Intrusion Detection System (IDS) for IP packet verification including CRC and fragmentation checks.

Start monitoring Cisco router or switch with hardware-based IP source verification (uRPF) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download CISCO-HARDWARE-IP-VERIFY-MIB