CISCO-IP-URPF-MIB :: cipUrpfDropRate

MIB Reference — IPNetwork Monitor · Updated September 14, 2026

All MIBsCISCO-IP-URPF-MIBcipUrpfDropRate

cipUrpfDropRate

Module: CISCO-IP-URPF-MIB

OID (symbolic): CISCO-IP-URPF-MIB::cipUrpfDropRate

OID (numeric): 1.3.6.1.4.1.9.9.451.1.2.1.1.3

Node type: OBJECT-TYPE

Type: Gauge32

Access: read-only

Description: The rate of packet drops of IP version cipUrpfIpVersion packets due to URPF for the managed device. The per-interface drop rate notification is issued on rates exceeding a limit (rising rate). This dropping may indicate an security attack on the network. To determine whether the attack/event is over, the NMS must consult the managed device. This object can be polled to determine the recent drop rate for the managed device as a whole, in addition to querying particular interface objects. This object is the average rate of dropping over the most recent window of time. The rate is computed by dividing the number of packets dropped over a window by the window time in seconds. The window time is specified by cipUrpfDropRateWindow. Each time the drop rate is computed, and at system startup, a snapshot is taken of the latest value of cipUrpfDrops. Subtracting from this the snapshot of cipUrpfDrops at the start of the current window of time gives the number of packets dropped. The drop rate is computed every cipUrpfComputeInterval seconds. As an example, let cipUrpfDropRateWindow be 300 seconds, and cipUrpfComputeInterval 30 seconds. Every 30 seconds, the drop count five minutes previous is subtracted from the current drop count, and the result is divided by 300 to arrive at the drop rate. At device start-up, until the device has been up more than cipUrpfDropRateWindow, when drop rate is computed, the value of cipUrpfDrops is divided by the time the device has been up. After the device has been up for cipUrpfDropRateWindow, when drop rate is computed, the number of packet drops counted from interval start time to the computation time is divided by cipUrpfDropRateWindow. Changes to cipUrpfDropRateWindow are not reflected in this object until the next computation time. The rate from the most recent computation is the value fetched until the subsequent computation is performed.

What is cipUrpfDropRate?

Reports the current rate of packet drops due to failed URPF checks for the given IP version; a rising rate can indicate a spoofing or security attack on the network.

Examples

Walk all instances (SNMPv2c):

snmpwalk -v2c -c public <target> 1.3.6.1.4.1.9.9.451.1.2.1.1.3
snmpwalk -v2c -c public <target> CISCO-IP-URPF-MIB::cipUrpfDropRate

Get a specific instance (index 1):

snmpget -v2c -c public <target> 1.3.6.1.4.1.9.9.451.1.2.1.1.3.1
snmpget -v2c -c public <target> CISCO-IP-URPF-MIB::cipUrpfDropRate.1

Start monitoring Cisco edge/Internet-facing routers (uRPF) with a free 30-day trial of IPNetwork Monitor. Create custom SNMP monitor using the CISCO-IP-URPF-MIB::cipUrpfDropRate OID value, configure state conditions and alerts, and monitor any Cisco edge/Internet-facing routers (uRPF) from a single console.

OID Breakdown

Upper-level ancestors (8 from the standard OID tree / other modules)
Numeric OIDNameModule
1isoLANART-AGENT
1.3orgAirPair-MIB
1.3.6dodAirPair-MIB
1.3.6.1internetAirPair-MIB
1.3.6.1.4privateAirPair-MIB
1.3.6.1.4.1enterprisesAirPair-MIB
1.3.6.1.4.1.9ciscoCAT2600-MIB
1.3.6.1.4.1.9.9ciscoMgmtCISCO-SMI
Numeric OIDNameModule
1.3.6.1.4.1.9.9.451ciscoIpUrpfMIBCISCO-IP-URPF-MIB
1.3.6.1.4.1.9.9.451.1ciscoIpUrpfMIBObjectsCISCO-IP-URPF-MIB
1.3.6.1.4.1.9.9.451.1.2cipUrpfStatisticsCISCO-IP-URPF-MIB
1.3.6.1.4.1.9.9.451.1.2.1cipUrpfTableCISCO-IP-URPF-MIB
1.3.6.1.4.1.9.9.451.1.2.1.1cipUrpfEntryCISCO-IP-URPF-MIB
1.3.6.1.4.1.9.9.451.1.2.1.1.3cipUrpfDropRateCISCO-IP-URPF-MIB