All MIBs › CISCO-LWAPP-MFP-MIB › ciscoLwappMfpAnomalyDetected1
ciscoLwappMfpAnomalyDetected1
Module: CISCO-LWAPP-MFP-MIB
OID (symbolic): CISCO-LWAPP-MFP-MIB::ciscoLwappMfpAnomalyDetected1
OID (numeric): 1.3.6.1.4.1.9.9.518.0.5
Node type: NOTIFICATION-TYPE
Description: This notification is sent by the agent when the MFP configuration of the WLAN was violated by the radio interface cLApIfSmtDot11Bssid and detected by the radio interface cLApDot11IfSlotId of the AP cLApMacAddress. The violation is indicated by cLMfpEventType.
Through this notification, the controller reports the NMS the occurrence of a total of cLMfpEventTotal volation events, of type cLMfpEventType, upon observing the management frame(s) indicated by cLMfpEventFrames for the last cLMfpEventPeriod time units. When cLMfpEventTotal is 0, it indicates that no further anomalies have recently been detected and that the NMS should clear any alarm raised about the MFP errors.
cLClientLastSourceMacAddress is used only when the controller generates notifications about client-related attacks. The controller will populate zeros as the value for cLClientLastSourceMacAddress when reporting anomalies sourced by infrastructure devices.
This notification is generated by the controller only if MFP has been configured as the protection mechanism through cLMfpProtectType.
Examples
Send this trap to an SNMP manager — replace <manager> with the IP or hostname of your monitoring server (SNMPv2c):
snmptrap -v2c -c public <manager> '' CISCO-LWAPP-MFP-MIB::ciscoLwappMfpAnomalyDetected1 snmptrap -v2c -c public <manager> '' 1.3.6.1.4.1.9.9.518.0.5
Listen for incoming traps on the manager host (-f keeps it in the foreground, -Lo prints to stdout — useful for testing):
snmptrapd -f -Lo -c /dev/null authCommunity log public
Example snmptrapd log entry:
zoo11-linux.zoo [UDP: [192.168.30.111]:52611->[192.168.30.10]:162]: DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (514024835) 59 days, 11:50:48.35 SNMPv2-MIB::snmpTrapOID.0 = OID: CISCO-LWAPP-MFP-MIB::ciscoLwappMfpAnomalyDetected1
Start monitoring Cisco Wireless LAN Controllers (LWAPP-based) with a free 30-day trial of IPNetwork Monitor. Create custom SNMP monitor using the CISCO-LWAPP-MFP-MIB::ciscoLwappMfpAnomalyDetected1 OID value, configure state conditions and alerts, and monitor any Cisco Wireless LAN Controllers (LWAPP-based) from a single console.
OID Breakdown
Upper-level ancestors (8 from the standard OID tree / other modules)
| Numeric OID | Name | Module |
|---|---|---|
| 1 | iso | LANART-AGENT |
| 1.3 | org | AirPair-MIB |
| 1.3.6 | dod | AirPair-MIB |
| 1.3.6.1 | internet | AirPair-MIB |
| 1.3.6.1.4 | private | AirPair-MIB |
| 1.3.6.1.4.1 | enterprises | AirPair-MIB |
| 1.3.6.1.4.1.9 | cisco | CAT2600-MIB |
| 1.3.6.1.4.1.9.9 | ciscoMgmt | CISCO-SMI |
| Numeric OID | Name | Module |
|---|---|---|
| 1.3.6.1.4.1.9.9.518 | ciscoLwappMfpMIB | CISCO-LWAPP-MFP-MIB |
| 1.3.6.1.4.1.9.9.518.0 | ciscoLwappMfpMIBNotifs | CISCO-LWAPP-MFP-MIB |
| 1.3.6.1.4.1.9.9.518.0.5 | ciscoLwappMfpAnomalyDetected1 | CISCO-LWAPP-MFP-MIB |