CORERO-CMS-MIB

All MIBs › CORERO-CMS-MIB

Organization: Corero Network Security

Last Updated: 2017-06-16

Category: Alarm and Event Management, VPN and Security, Vendor: Corero

Description: Manages Corero CMS DDoS mitigation platform configuration and attack detection statistics.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is CORERO-CMS-MIB?

CORERO-CMS-MIB is a Corero Network Security (enterprise OID 41036) proprietary MIB for the Corero Management Server, reporting DDoS/traffic-anomaly detection rates. Its objects cover excessive-rate indicators (packets from bad clients, proxy-setup rate, new IP addresses, address-table usage, TCP/non-TCP setup rate, failed-proxy rate), block-rate counters broken down by category (all rules, system issue, network/application access-restriction, rate-limit, protocol-validation, integrity-analysis), setup-rate counters (TCP, non-TCP, UDP, ICMP, other-IP), and in-use flow counts (total, TCP, UDP). As a performance/security MIB it lets an administrator watch DDoS-mitigation block rates and active-flow volume on a Corero Network Security appliance. It is deployed on Corero Network Security DDoS-mitigation appliances. Engineers can download the CORERO-CMS-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in CORERO-CMS-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Corero Network Security DDoS-mitigation appliances

Monitoring Examples

An administrator checks allRulesBlockRate and excessiveTcpSetupRate to watch DDoS-mitigation activity on a Corero Network Security appliance.

What Can Be Monitored

DDoS-mitigation block rates and active-flow volume

Imported Objects

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Counter64
Gauge32
IpAddress
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
TimeTicks
Unsigned32
enterprises

From SNMPv2-TC

DisplayString
RowStatus
TEXTUAL-CONVENTION
TestAndIncr
TimeStamp
TruthValue

How to Use in IPNetwork Monitor

Example using externalPortReceivedPackets OID:

Select a Corero Network Security DDoS-mitigation appliance (Management Server) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type externalPortReceivedPackets into the Find box to locate it in the OID tree, then select it and click OK. It reports the number of packets received to the external port. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter64-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
G32 allRulesBlockRate	1.3.6.1.4.1.41036.4.1.1.2.1.1	Gauge32	read-only	All rules block rate (packets/sec)
G32 applicationAccessRestrictionBlockRate	1.3.6.1.4.1.41036.4.1.1.2.1.7	Gauge32	read-only	Application threat access restriction rules block rate is not longer supported in the system
G32 applicationIntegrityAnalysisBlockRate	1.3.6.1.4.1.41036.4.1.1.2.1.10	Gauge32	read-only	Application integrity analysis rules block rate is not longer supported in the system
G32 applicationProtocolValidationBlockRate	1.3.6.1.4.1.41036.4.1.1.2.1.9	Gauge32	read-only	Application threat protocol validation rules block rate is not longer supported in the system
G32 applicationRateLimitBlockRate	1.3.6.1.4.1.41036.4.1.1.2.1.8	Gauge32	read-only	Application threat rate limit rules block rate is not longer supported in the system
corero	1.3.6.1.4.1.41036
coreroCMSMIB	1.3.6.1.4.1.41036.4			Corero Management Server MIB.
coreroCMSMIBCompliance	1.3.6.1.4.1.41036.4.2.1.2			The compliance statement for SNMPv2 entities which implement the SNMPv2 MIB.
coreroCMSMIBCompliances	1.3.6.1.4.1.41036.4.2.1
coreroCMSMIBConformance	1.3.6.1.4.1.41036.4.2
coreroCMSMIBGroups	1.3.6.1.4.1.41036.4.2.2
coreroCMSMIBObjects	1.3.6.1.4.1.41036.4.1
defense	1.3.6.1.4.1.41036.4.1.1
defenseBlockRateStatistics	1.3.6.1.4.1.41036.4.1.1.2.1
defenseGroup	1.3.6.1.4.1.41036.4.2.2.1			A collection of objects providing status and statistics for the site.
defenseInterfaceStatistics	1.3.6.1.4.1.41036.4.1.1.2.4
defenseIpAddressStatistics	1.3.6.1.4.1.41036.4.1.1.2.5
defenseSetupRateStatistics	1.3.6.1.4.1.41036.4.1.1.2.2
defenseStatistics	1.3.6.1.4.1.41036.4.1.1.2
defenseStatus	1.3.6.1.4.1.41036.4.1.1.1
defenseStatusThreatAwareness	1.3.6.1.4.1.41036.4.1.1.1.1
defenseUsageStatistics	1.3.6.1.4.1.41036.4.1.1.2.3
T/F excessiveAddressTableUsage	1.3.6.1.4.1.41036.4.1.1.1.1.4	TruthValue	read-only	Awareness indication for this type of threat.
T/F excessiveFailedProxyRate	1.3.6.1.4.1.41036.4.1.1.1.1.7	TruthValue	read-only	Proxy is no longer supported in the system.
T/F excessiveNewIpAddresses	1.3.6.1.4.1.41036.4.1.1.1.1.3	TruthValue	read-only	Awareness indication for this type of threat.
T/F excessiveNonTcpSetupRate	1.3.6.1.4.1.41036.4.1.1.1.1.6	TruthValue	read-only	Awareness indication for this type of threat.
T/F excessivePacketsFromBadClients	1.3.6.1.4.1.41036.4.1.1.1.1.1	TruthValue	read-only	Awareness indication for this type of threat.
T/F excessiveProxySetupRate	1.3.6.1.4.1.41036.4.1.1.1.1.2	TruthValue	read-only	Proxy is no longer supported in the system.
T/F excessiveTcpSetupRate	1.3.6.1.4.1.41036.4.1.1.1.1.5	TruthValue	read-only	Awareness indication for this type of threat.
G32 externalPortBitReceiveRate	1.3.6.1.4.1.41036.4.1.1.2.4.2	Gauge32	read-only	Receive rate on external ports (Mbits per second)
G32 externalPortBitTransmitRate	1.3.6.1.4.1.41036.4.1.1.2.4.4	Gauge32	read-only	Transmit rate on external ports (Mbits per second)
G32 externalPortPacketReceiveRate	1.3.6.1.4.1.41036.4.1.1.2.4.1	Gauge32	read-only	Receive rate on external ports (packets per second)
G32 externalPortPacketTransmitRate	1.3.6.1.4.1.41036.4.1.1.2.4.3	Gauge32	read-only	Transmit rate on external ports (packets per second)
C64 externalPortReceivedBadCrcPackets	1.3.6.1.4.1.41036.4.1.1.2.4.17	Counter64	read-only	Number of packets received to the external port with an invalid CRC
C64 externalPortReceivedBytes	1.3.6.1.4.1.41036.4.1.1.2.4.11	Counter64	read-only	Number of bytes received to the external port
C64 externalPortReceivedJabberPackets	1.3.6.1.4.1.41036.4.1.1.2.4.21	Counter64	read-only	Number of jabber packets received to the external port
C64 externalPortReceivedOversizedPackets	1.3.6.1.4.1.41036.4.1.1.2.4.19	Counter64	read-only	Number of oversized packets received to the external port
C64 externalPortReceivedPacketsEx	1.3.6.1.4.1.41036.4.1.1.2.4.9	Counter64	read-only	Number of packets received to the external port
C64 externalPortTransmitErrorPackets	1.3.6.1.4.1.41036.4.1.1.2.4.23	Counter64	read-only	Number of errors transmitting packets from the external port
C64 externalPortTransmittedBytes	1.3.6.1.4.1.41036.4.1.1.2.4.12	Counter64	read-only	Number of bytes transmitted from external port
C64 externalPortTransmittedPackets	1.3.6.1.4.1.41036.4.1.1.2.4.10	Counter64	read-only	Number of packets transmitted from the external port
G32 icmpSetupRate	1.3.6.1.4.1.41036.4.1.1.2.2.4	Gauge32	read-only	ICMP protocol flow setup rate (packets/sec)
G32 internalPortBitReceiveRate	1.3.6.1.4.1.41036.4.1.1.2.4.6	Gauge32	read-only	Receive rate on internal ports (Mbits per second)
G32 internalPortBitTransmitRate	1.3.6.1.4.1.41036.4.1.1.2.4.8	Gauge32	read-only	Transmit rate on internal ports (Mbits per second)
G32 internalPortPacketReceiveRate	1.3.6.1.4.1.41036.4.1.1.2.4.5	Gauge32	read-only	Receive rate on internal ports (packets per second)
G32 internalPortPacketTransmitRate	1.3.6.1.4.1.41036.4.1.1.2.4.7	Gauge32	read-only	Transmit rate on internal ports (packets per second)
C64 internalPortReceivedBadCrcPackets	1.3.6.1.4.1.41036.4.1.1.2.4.18	Counter64	read-only	Number of packets received to the internal port with an invalid CRC
C64 internalPortReceivedBytes	1.3.6.1.4.1.41036.4.1.1.2.4.15	Counter64	read-only	Number of bytes received to the internal port
C64 internalPortReceivedJabberPackets	1.3.6.1.4.1.41036.4.1.1.2.4.22	Counter64	read-only	Number of jabber packets received to the internal port
C64 internalPortReceivedOversizedPackets	1.3.6.1.4.1.41036.4.1.1.2.4.20	Counter64	read-only	Number of oversized packets received to the internal port
C64 internalPortReceivedPackets	1.3.6.1.4.1.41036.4.1.1.2.4.13	Counter64	read-only	Number of packets received to the internal port
C64 internalPortTransmitErrorPackets	1.3.6.1.4.1.41036.4.1.1.2.4.24	Counter64	read-only	Number of errors transmitting packets from the internal port
C64 internalPortTransmittedBytes	1.3.6.1.4.1.41036.4.1.1.2.4.16	Counter64	read-only	Number of bytes transmitted from the internal port
C64 internalPortTransmittedPackets	1.3.6.1.4.1.41036.4.1.1.2.4.14	Counter64	read-only	Number of packets transmitted from the internal port
G32 inUseAddresses	1.3.6.1.4.1.41036.4.1.1.2.5.1	Gauge32	read-only	Total number of IP table entries across the devices
G32 inUseFlows	1.3.6.1.4.1.41036.4.1.1.2.3.1	Gauge32	read-only	Total number of flows in use across the devices
G32 inUseIcmpFlows	1.3.6.1.4.1.41036.4.1.1.2.3.4	Gauge32	read-only	Total number of ICMP flows in use across the devices
G32 inUseMaliciousAddresses	1.3.6.1.4.1.41036.4.1.1.2.5.4	Gauge32	read-only	Total number of malicious IP addresses across the devices
G32 inUseOtherFlows	1.3.6.1.4.1.41036.4.1.1.2.3.5	Gauge32	read-only	Total number of non-TCP, non-UDP, non-ICMP flows in use across the devices
G32 inUseSuspiciousAddresses	1.3.6.1.4.1.41036.4.1.1.2.5.3	Gauge32	read-only	Total number of suspicious IP addresses across the devices
G32 inUseTcpFlows	1.3.6.1.4.1.41036.4.1.1.2.3.2	Gauge32	read-only	Total number of TCP flows in use across the devices
G32 inUseTrustedAddresses	1.3.6.1.4.1.41036.4.1.1.2.5.2	Gauge32	read-only	Total number of trusted IP addresses across the devices
G32 inUseUdpFlows	1.3.6.1.4.1.41036.4.1.1.2.3.3	Gauge32	read-only	Total number of UDP flows in use across the devices
G32 inUseUnclassifiedAddresses	1.3.6.1.4.1.41036.4.1.1.2.5.5	Gauge32	read-only	Total number of unclassified IP addresses across the devices
G32 networkAccessRestrictionBlockRate	1.3.6.1.4.1.41036.4.1.1.2.1.3	Gauge32	read-only	Network threat access restriction rules block rate is not longer supported in the system
G32 networkIntegrityAnalysisBlockRate	1.3.6.1.4.1.41036.4.1.1.2.1.6	Gauge32	read-only	Network threat integrity analysis rules block rate is not longer supported in the system
G32 networkProtocolValidationBlockRate	1.3.6.1.4.1.41036.4.1.1.2.1.5	Gauge32	read-only	Network threat protocol validation rules block rate is not longer supported in the system
G32 networkRateLimitBlockRate	1.3.6.1.4.1.41036.4.1.1.2.1.4	Gauge32	read-only	Network thread rate limit rules block rate is not longer supported in the system
G32 nonTcpSetupRate	1.3.6.1.4.1.41036.4.1.1.2.2.2	Gauge32	read-only	Non-TCP protocol aggregate flow setup rate (packets/sec)
G32 otherIpSetupRate	1.3.6.1.4.1.41036.4.1.1.2.2.5	Gauge32	read-only	IP protocols other than TCP and UDP flow setup rate (packets/sec)
C64 pgExternalPortReceivedBadCrcPackets	1.3.6.1.4.1.41036.4.1.1.3.1.1.10	Counter64	read-only	Number of packets received to the external port with an invalid CRC
C64 pgExternalPortReceivedBytes	1.3.6.1.4.1.41036.4.1.1.3.1.1.4	Counter64	read-only	Number of bytes received to the external port
C64 pgExternalPortReceivedJabberPackets	1.3.6.1.4.1.41036.4.1.1.3.1.1.14	Counter64	read-only	Number of jabber packets received to the external port
C64 pgExternalPortReceivedOversizedPackets	1.3.6.1.4.1.41036.4.1.1.3.1.1.12	Counter64	read-only	Number of oversized packets received to the external port
C64 pgExternalPortReceivedPackets	1.3.6.1.4.1.41036.4.1.1.3.1.1.2	Counter64	read-only	Number of packets received to the external port
C64 pgExternalPortTransmitErrorPackets	1.3.6.1.4.1.41036.4.1.1.3.1.1.16	Counter64	read-only	Number of errors transmitting packets from the external port
C64 pgExternalPortTransmittedBytes	1.3.6.1.4.1.41036.4.1.1.3.1.1.5	Counter64	read-only	Number of bytes transmitted from external port
C64 pgExternalPortTransmittedPackets	1.3.6.1.4.1.41036.4.1.1.3.1.1.3	Counter64	read-only	Number of packets transmitted from the external port
C64 pgInternalPortReceivedBadCrcPackets	1.3.6.1.4.1.41036.4.1.1.3.1.1.11	Counter64	read-only	Number of packets received to the internal port with an invalid CRC
C64 pgInternalPortReceivedBytes	1.3.6.1.4.1.41036.4.1.1.3.1.1.8	Counter64	read-only	Number of bytes received to the internal port
C64 pgInternalPortReceivedJabberPackets	1.3.6.1.4.1.41036.4.1.1.3.1.1.15	Counter64	read-only	Number of jabber packets received to the internal port
C64 pgInternalPortReceivedOversizedPackets	1.3.6.1.4.1.41036.4.1.1.3.1.1.13	Counter64	read-only	Number of oversized packets received to the internal port
C64 pgInternalPortReceivedPackets	1.3.6.1.4.1.41036.4.1.1.3.1.1.6	Counter64	read-only	Number of packets received to the internal port
C64 pgInternalPortTransmitErrorPackets	1.3.6.1.4.1.41036.4.1.1.3.1.1.17	Counter64	read-only	Number of errors transmitting packets from the internal port
C64 pgInternalPortTransmittedBytes	1.3.6.1.4.1.41036.4.1.1.3.1.1.9	Counter64	read-only	Number of bytes transmitted from the internal port
C64 pgInternalPortTransmittedPackets	1.3.6.1.4.1.41036.4.1.1.3.1.1.7	Counter64	read-only	Number of packets transmitted from the internal port
OCT pgName	1.3.6.1.4.1.41036.4.1.1.3.1.1.1	OCTET STRING	not-accessible	Protection group name as an Index
protectionGroupEntry	1.3.6.1.4.1.41036.4.1.1.3.1.1		not-accessible	Port Statistic
protectionGroupStatistics	1.3.6.1.4.1.41036.4.1.1.3
protectionGroupTable	1.3.6.1.4.1.41036.4.1.1.3.1		not-accessible	Table containing interface statistics for the Protection Group
G32 systemIssueBlockRate	1.3.6.1.4.1.41036.4.1.1.2.1.2	Gauge32	read-only	System isues rules block rate is not longer supported in the system
G32 tcpSetupRate	1.3.6.1.4.1.41036.4.1.1.2.2.1	Gauge32	read-only	TCP protocol flow setup rate (packets/sec)
C64 totalProxyFailedSetups	1.3.6.1.4.1.41036.4.1.1.2.3.7	Counter64	read-only	Proxy is no longer supported in the system
C64 totalProxySetups	1.3.6.1.4.1.41036.4.1.1.2.3.6	Counter64	read-only	Proxy is no longer supported in the system
G32 udpSetupRate	1.3.6.1.4.1.41036.4.1.1.2.2.3	Gauge32	read-only	UDP protocol flow setup rate (packets/sec)

RFC description

Corero Management Server MIB for DDoS mitigation defense status and interface statistics.

Start monitoring Corero Network Security DDoS-mitigation appliance (Management Server) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download CORERO-CMS-MIB