CISCO-MAC-NOTIFICATION-MIB

All MIBs › CISCO-MAC-NOTIFICATION-MIB

Organization: Cisco Systems, Inc.

Last Updated: 2007-06-11

Category: Cisco Devices, Device Management

Description: Configures and manages the MAC notification feature, which informs monitoring devices when MAC addresses are learned or removed from the forwarding database.

IPNetwork Monitor uses several OIDs from this MIB in network discovery and polling the applicable devices. Start monitoring CISCO-MAC-NOTIFICATION-MIB with a free 30-day trial of IPNetwork Monitor.

What Is CISCO-MAC-NOTIFICATION-MIB?

CISCO-MAC-NOTIFICATION-MIB is a Cisco enterprise MIB for the MAC notification feature on Cisco switches, which informs network management stations when MAC addresses are learned or removed from the device's forwarding database (bridge table). It exposes global enable/interval configuration, counters for MAC addresses learnt and removed, notification-sent counters, and a history table logging individual MAC-change events with timestamps. This is a software/network-event monitoring MIB: it lets operators detect endpoint churn (devices connecting/disconnecting or moving between ports) by tracking cmnMacAddressesLearnt/cmnMacAddressesRemoved and reviewing cmnHistoryTable entries, which is useful for security monitoring (detecting unauthorized devices) and network change diagnosis rather than hardware health. It is closely related to the standard BRIDGE-MIB forwarding database concept, building notification on top of it. It is deployed on Cisco Catalyst switches in enterprise LANs where MAC-level endpoint tracking or port-security auditing is required. Engineers can download the CISCO-MAC-NOTIFICATION-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in CISCO-MAC-NOTIFICATION-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Cisco Catalyst switch
Cisco LAN switch

Monitoring Examples

An administrator would poll cmnMacAddressesLearnt and cmnMacAddressesRemoved counters over time to detect unusual endpoint churn on a switch, then walk cmnHistoryTable/cmnHistoryEntry to read cmnHistMacChangedMsg and cmnHistTimestamp for the specific MAC addresses and ports involved. A spike in learnt addresses on a single port combined with cmnNotificationsSent traps firing would suggest an unauthorized hub or switch was plugged in, generating many new MAC entries. cmnHistTableMaxLength governs how many historical entries are retained before older ones are overwritten.

What Can Be Monitored

MAC addresses learnt/removed counts
MAC change history log
notification sent count
notification interval configuration

Imported Objects

From CISCO-QOS-PIB-MIB

Percent

From CISCO-SMI

ciscoMgmt

OBJECT-IDENTITY

From CISCO-VTP-MIB

VlanIndex

From ENTITY-MIB

entPhysicalIndex

OBJECT-TYPE

From IF-MIB

ifIndex

OBJECT-TYPE

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Integer32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

MacAddress
TEXTUAL-CONVENTION
TimeStamp
TruthValue

How to Use in IPNetwork Monitor

Example using cmnMacAddressesLearnt OID:

Select a Cisco Catalyst/LAN switch (MAC notification) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type cmnMacAddressesLearnt into the Find box to locate it in the OID tree, then select it and click OK. Indicates the number of MAC addresses learnt by the device. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
ciscoMacNotificationMIB	1.3.6.1.4.1.9.9.215			This MIB module is for configuration of the MAC notification feature. MAC notification is a mechanism to inform monitoring devices when there are MAC addresses learnt or removed from the forwarding database of the monitored devices.
ciscoMacNotificationMIBObjects	1.3.6.1.4.1.9.9.215.1
cmnGlobalObjects	1.3.6.1.4.1.9.9.215.1.1
T/F cmnGlobalFeatureEnabled	1.3.6.1.4.1.9.9.215.1.1.1	TruthValue	read-write	Indicates whether the MAC notification feature is currently running in the device. Setting this object to false(2) disables the MAC notification feature globally thus disabling the feature at each interface. Setting this object to true(1) will start the MAC notification feature running in the device. If the feature is already running, setting to true(1) has no effect. Once the MAC notification is enabled, whether the feature is running at each interface is controlled by the cmnIfConfigTable.
U32 cmnNotificationInterval	1.3.6.1.4.1.9.9.215.1.1.2	Unsigned32	read-write	This object specifies the maximum interval of time between cmnMacChangedNotifications being generated by the device. If the value of cmnNotificationsEnabled is true(1), the device will send out the generated cmnMacChangedNotifications and archive the MAC change notification events in the cmnHistoryTable. If the value of cmnNotificationEnabled is false(2), the device will not send out the generated cmnMacChangedNotifications but it will archive these events in the cmnHistoryTable. If the value of this object is equal to 0, the device will generate cmnMacChangedNotifications and archive the MAC change notification events in the cmnHistoryTable as soon as there is MAC address learnt or removed by the device. If the value of this object is greater than 0, the device will wait for a period of time equal to the value of this object before generate the cmnMacChangedNotifications and archive the MAC change notification events in the cmnHistoryTable.
C32 cmnMacAddressesLearntEx	1.3.6.1.4.1.9.9.215.1.1.3	Counter32	read-only	Indicates the number of MAC addresses learnt by the device.
C32 cmnMacAddressesRemoved	1.3.6.1.4.1.9.9.215.1.1.4	Counter32	read-only	Indicates the number of MAC addresses removed from the forwarding database.
T/F cmnNotificationsEnabled	1.3.6.1.4.1.9.9.215.1.1.5	TruthValue	read-write	Indicates whether cmnMacChangedNotification notifications will or will not be sent when there are MAC addresses learnt or removed from the device's forwarding database. Disabling notifications does not prevent the MAC address info from being added to the cmnHistoryTable.
C32 cmnNotificationsSent	1.3.6.1.4.1.9.9.215.1.1.6	Counter32	read-only	Indicates the number of cmnMacChangedNotifications sent out by the device.
U32 cmnHistTableMaxLength	1.3.6.1.4.1.9.9.215.1.1.7	Unsigned32	read-write	The upper limit on the number of entries that the cmnHistoryTable may contain. A value of 0 will prevent any history from being retained. When this table is full, the oldest entry will be deleted and a new one will be created.
cmnHistoryTable	1.3.6.1.4.1.9.9.215.1.1.8		not-accessible	This table will archive the MAC change notification events generated by this device. The MAC change notification events are archived here even if cmnMacChangesNotifications are not actually sent.
cmnHistoryEntry	1.3.6.1.4.1.9.9.215.1.1.8.1		not-accessible	A MAC change notification message that was previously generated by this device. Each entry is indexed by a message index.
U32 cmnHistIndex	1.3.6.1.4.1.9.9.215.1.1.8.1.1	Unsigned32	not-accessible	An index that uniquely identifies a MAC change notification event previously generated by the device. This index starts at 1 and increases by one when a MAC change notification is generated. When it reaches the maximum value, the agent wraps the value back to 1.
OCT cmnHistMacChangedMsg	1.3.6.1.4.1.9.9.215.1.1.8.1.2	OCTET STRING	read-only	This object contains the information of a MAC change notification event. It consists of several tuples packed together in the format of '...'. Each tuple consist of 11 octets in the format of '' where is of size 1 octet and supports the following values 0 - End of MIB object. 1 - MAC learnt. 2 - MAC removed. is VLAN number of the VLAN which the MAC address is belonged to and has size of 2 octet. is the Layer2 Mac Address and has size of 6 octets. is the value of dot1dBasePort for the interface from which the MAC address is learnt and has size of 2 octets.
TIM cmnHistTimestamp	1.3.6.1.4.1.9.9.215.1.1.8.1.3	TimeStamp	read-only	The value of sysUpTime when the cmnMacChangedNotification containing the information denoted by the cmnHistMacChangedMsg object in this entry was generated.
cmnInterfaceObjects	1.3.6.1.4.1.9.9.215.1.2
cmnIfConfigTable	1.3.6.1.4.1.9.9.215.1.2.1		not-accessible	This table enables or disables the generation of notification at each interface when MAC address is learnt or removed.
cmnIfConfigEntry	1.3.6.1.4.1.9.9.215.1.2.1.1		not-accessible	Each entry contains the configuration for enabling the MAC notification at each interface that supports this feature.
T/F cmnMacAddrLearntEnable	1.3.6.1.4.1.9.9.215.1.2.1.1.1	TruthValue	read-write	Indicates whether this interface is enabled to send cmnMacChangedNotification when it learns a new MAC address. This variable has no effect when the value of cmnGlobalFeatureEnabled object is false(2). Setting this object to true(1) enables the sending of cmnMacChangedNotification when this interface learns a new MAC address. Setting this object to false(2) disables the sending of cmnMacChangedNotification when this interface learns a new MAC address.
T/F cmnMacAddrRemovedEnable	1.3.6.1.4.1.9.9.215.1.2.1.1.2	TruthValue	read-write	Indicates whether this interface is enabled to send cmnMacChangedNotification when a MAC address which it learnt previously is removed from the forwarding table. This variable has no effect when the value of cmnGlobalFeatureEnabled object is false(2). Setting this object to true(1) enables the sending of cmnMacChangedNotification when a MAC address which this interface learnt previously is removed from the forwarding table. Setting this object to false(2) disables the sending of cmnMacChangedNotification when a MAC address which this interface learnt previously is removed from the forwarding table.
cmnMACMoveObjects	1.3.6.1.4.1.9.9.215.1.3
T/F cmnMACMoveFeatureEnabled	1.3.6.1.4.1.9.9.215.1.3.1	TruthValue	read-write	Specifies whether the MAC Move notification feature is currently running in the device. Setting this object to false(2) disables the MAC Move notification feature globally. Setting this object to true(1) will start the MAC Move notification feature running in the device.
T/F cmnMACMoveNotificationsEnabled	1.3.6.1.4.1.9.9.215.1.3.2	TruthValue	read-write	Specifies whether cmnMacMoveNotification notifications will or will not be sent when a MAC move is detected by the MAC move notification feature. Setting this object to false(2) will not send the cmnMacMoveNotification notifications. Setting this object to true(1) will send the cmnMacMoveNotification notifications.
MAC cmnMACMoveAddress	1.3.6.1.4.1.9.9.215.1.3.3	MacAddress	read-only	Indicates the MAC address that is moved between cmnMACMoveFromPortId and cmnMACMoveToPortId on cmnMACMoveVlanNumber. This object is instantiated only when cmnMACMoveFeatureEnabled value is set to true(1) and a MAC move is detected by the MAC move notification feature.
VLA cmnMACMoveVlanNumber	1.3.6.1.4.1.9.9.215.1.3.4	VlanIndex	read-only	Indicates the VLAN on which the cmnMACMoveAddress is moved from cmnMACMoveFromPortId to cmnMACMoveToPortId. This object is instantiated only when cmnMACMoveFeatureEnabled value is set to true(1) and a MAC move is detected by the MAC move notification feature.
I32 cmnMACMoveFromPortId	1.3.6.1.4.1.9.9.215.1.3.5	Integer32	read-only	The value of dot1dBasePort for the bridge port from which the cmnMACMoveAddress is moved to cmnMACMoveToPortId on cmnMACMoveVlanNumber. This object is instantiated only when cmnMACMoveFeatureEnabled value is set to true(1) and a MAC move is detected by the MAC move notification feature.
I32 cmnMACMoveToPortId	1.3.6.1.4.1.9.9.215.1.3.6	Integer32	read-only	The value of dot1dBasePort for the bridge port to which the cmnMACMoveAddress is moved from cmnMACMoveFromPortId on cmnMACMoveVlanNumber. This object is instantiated only when cmnMACMoveFeatureEnabled value is set to true(1) and a MAC move is detected by the MAC move notification feature.
TIM cmnMACMoveTime	1.3.6.1.4.1.9.9.215.1.3.7	TimeStamp	read-only	The value of sysUpTime when a cmnMACMoveAddress is moved between cmnMACMoveFromPortId and cmnMACMACMoveToPortId. This object is instantiated only when cmnMACMoveFeatureEnabled value is set to true(1) and a MAC move is detected by the MAC move notification feature.
cmnMACThresholdObjects	1.3.6.1.4.1.9.9.215.1.4
T/F cmnMACThresholdFeatureEnabled	1.3.6.1.4.1.9.9.215.1.4.1	TruthValue	read-write	Specifies whether the MAC Threshold notification feature is currently running in the device. Setting this object to false(2) disables the MAC Threshold notification feature globally. Setting this object to true(1) will start the MAC Threshold notification feature running in the device.
PER cmnMACThresholdLimit	1.3.6.1.4.1.9.9.215.1.4.2	Percent	read-write	Indicate the threshold limit of the forwarding table utilization.
U32 cmnMACThresholdInterval	1.3.6.1.4.1.9.9.215.1.4.3	Unsigned32	read-write	Interval at which forwarding table utilization is compared against cmnMACThresholdLimit.
T/F cmnMACThresholdNotifEnabled	1.3.6.1.4.1.9.9.215.1.4.4	TruthValue	read-write	Specifies whether cmnMacThresholdExceedNotif notifications will or will not be sent when the forwarding table utilization exceeds or equals to cmnMACThresholdLimit value. cmnMacThresholdExceedNotif notification is not sent when cmnMACThresholdLimit is set to zero.
cmnUtilizationTable	1.3.6.1.4.1.9.9.215.1.4.5		not-accessible	cmnUtilizationTable specifies the forwarding table utilization information. This table is instantiated only when cmnMACThresholdFeatureEnabled value is set to true(1). Entries in this table are updated at the end of every cmnMACThresholdInterval.
cmnUtilizationEntry	1.3.6.1.4.1.9.9.215.1.4.5.1		not-accessible	A conceptual row containing forwarding table utilization maintained by switching engine (identified by entPhysicalIndex). Each switching engine managed by this MIB module can have at least one entry in this table.
U32 cmnUtilizationEntries	1.3.6.1.4.1.9.9.215.1.4.5.1.1	Unsigned32	read-only	Indicates the number of entries present in the forwarding table for the given entPhysicalIndex calculated at the end of cmnMACThresholdInterval.
PER cmnUtilizationUtilization	1.3.6.1.4.1.9.9.215.1.4.5.1.2	Percent	read-only	Indicates the utilization of the forwarding table for the given entPhysicalIndex calculated at the end of cmnMACThresholdInterval.
TIM cmnUtilizationTimeStamp	1.3.6.1.4.1.9.9.215.1.4.5.1.3	TimeStamp	read-only	Indicates the sysUptime at which the cmnUtilizationUtilization is updated.
cmnMIBNotificationPrefix	1.3.6.1.4.1.9.9.215.2
cmnMIBNotifications	1.3.6.1.4.1.9.9.215.2.0
NTF cmnMacChangedNotification	1.3.6.1.4.1.9.9.215.2.0.1			This notification is generated when there is enough MAC address information to fully occupy a maximum size SNMP trap message. This notification is also generated when there is at least one MAC address changed or removed and the amount of time elapsed from the previous notification is greater than the maximum wait time denoted by cmnNotificationInterval object. If there are more MAC addresses information than can fit into one cmmHistTrapContent object, then multiple notifications will be generated.
NTF cmnMacMoveNotification	1.3.6.1.4.1.9.9.215.2.0.2			cmnMacMoveNotification is generated when a MAC address is moved between two interfaces.
NTF cmnMacThresholdExceedNotif	1.3.6.1.4.1.9.9.215.2.0.3			cmnMacThresholdExceedNotif is sent when cmnUtilizationUtilization exceeds or equals to the cmnMACThresholdLimit for a given entPhysicalIndex. cmnMacThresholdExceedNotif is not sent when cmnMACThresholdLimit is set to zero
cmnMIBConformance	1.3.6.1.4.1.9.9.215.3
cmnMIBCompliances	1.3.6.1.4.1.9.9.215.3.1
cmnMIBCompliance	1.3.6.1.4.1.9.9.215.3.1.1			The compliance statement for the CISCO-MAC-NOTIFICATION-MIB.
cmnMIBComplianceVer1	1.3.6.1.4.1.9.9.215.3.1.2			The compliance statement for the CISCO-MAC-NOTIFICATION-MIB.
cmnMIBGroups	1.3.6.1.4.1.9.9.215.3.2
cmnGlobalGroup	1.3.6.1.4.1.9.9.215.3.2.1			A collection of objects providing the global configuration and information for MAC notification.
cmnInterfaceGroup	1.3.6.1.4.1.9.9.215.3.2.2			A collection of objects providing the configuration information for MAC notification at each interface.
cmnNotificationGroup	1.3.6.1.4.1.9.9.215.3.2.3			The notification generated by the CISCO-MAC-NOTIFICATION-MIB.
cmnMACMoveGroup	1.3.6.1.4.1.9.9.215.3.2.5			A collection of objects providing the global configuration and information for MAC Move notification feature.
cmnMACThresholdGroup	1.3.6.1.4.1.9.9.215.3.2.6			A collection of objects providing the global configuration and information for MAC Threshold notification feature.
cmnMACMoveNotifGroup	1.3.6.1.4.1.9.9.215.3.2.7			A collection of objects providing the notification information for MAC Move notification feature.
cmnMACThresholdNotifGroup	1.3.6.1.4.1.9.9.215.3.2.8			A collection of objects providing the notification information for MAC Threshold notification feature.

RFC description

Cisco MAC notification MIB for MAC address learning/removal tracking, MAC move detection, and forwarding database monitoring.

Start monitoring Cisco Catalyst/LAN switch (MAC notification) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download CISCO-MAC-NOTIFICATION-MIB