CT-FASTPATH-DHCPSNOOPING-MIB

All MIBs › CT-FASTPATH-DHCPSNOOPING-MIB

Organization: Enterasys Networks, Inc.

Last Updated: 2008-07-23

Category: IP and Core Protocols, VLAN and Bridging, Vendor: Cabletron/Enterasys

Description: Configures DHCP snooping binding tables and trusted port settings on Cabletron FastPath switches.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is CT-FASTPATH-DHCPSNOOPING-MIB?

CT-FASTPATH-DHCPSNOOPING-MIB is a vendor-specific MIB originally authored by LVL7 Systems and maintained by Cabletron/Enterasys Networks for FASTPATH-based switches, modeling the DHCP snooping security feature that filters DHCP traffic based on trusted/untrusted ports and builds a binding table of client MAC-to-IP-to-VLAN assignments. It exposes global and per-VLAN enable state (ctAgentDhcpSnoopingAdminMode, ctAgentDhcpSnoopingVlanConfigTable), per-interface trust and rate-limit configuration (ctAgentDhcpSnoopingIfConfigTable with ctAgentDhcpSnoopingIfTrustEnable and ctAgentDhcpSnoopingIfRateLimit), and both static and dynamic snooping bindings (ctAgentStaticDsBindingTable, ctAgentDynamicDsBindingTable). Validation failure counters in ctAgentDhcpSnoopingStatsTable (MAC verification failures, invalid client/server messages) let an operator detect DHCP spoofing or rogue-server activity on the switch. It depends on Q-BRIDGE-MIB for VLAN indexing and IF-MIB for interface indexing, and is deployed on Cabletron/Enterasys FastPath access switches enforcing edge-port DHCP security. Network engineers can download the CT-FASTPATH-DHCPSNOOPING-MIB file to add DHCP snooping visibility to their SNMP monitoring toolset.

IPNetwork Monitor allows you to monitor SNMP objects defined in CT-FASTPATH-DHCPSNOOPING-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Cabletron/Enterasys FastPath managed switches

Monitoring Examples

An operator polls ctAgentDhcpSnoopingStatsTable for a given interface to watch ctAgentDhcpSnoopingMacVerifyFailures and ctAgentDhcpSnoopingInvalidClientMessages; a rising count on an untrusted port (ctAgentDhcpSnoopingIfTrustEnable false) would flag a client attempting to spoof its MAC address or run a rogue DHCP server, and the ctDhcpSnoopingIntfErrorDisabledTrap notification confirms when a port has been shut down for exceeding its configured ctAgentDhcpSnoopingIfRateLimit.

What Can Be Monitored

DHCP snooping global/per-VLAN enable state
per-port trust and rate-limit configuration
static and dynamic MAC-IP-VLAN binding table entries
MAC verification failure counters
invalid DHCP client/server message counters
port error-disable notifications

Imported Objects

From CTRON-MIB-NAMES

ctDhcpSnoopingExpMib

OBJECT-IDENTITY

From IF-MIB

InterfaceIndex
ifIndex	OBJECT-TYPE

From Q-BRIDGE-MIB

VlanIndex

From SNMPv2-SMI

Counter32
Integer32
IpAddress
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
TimeTicks
Unsigned32

From SNMPv2-TC

DisplayString
MacAddress
PhysAddress
RowPointer
RowStatus
StorageType
TEXTUAL-CONVENTION
TruthValue

How to Use in IPNetwork Monitor

Example using ctAgentDhcpSnoopingMacVerifyFailures OID:

Select a Cabletron/Enterasys FastPath switch (DHCP snooping) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type ctAgentDhcpSnoopingMacVerifyFailures into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. This object indicates the number of failure verifications of client mac address with source mac address. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases between polls, since a rising count of errors, failures, or discards often points to a real underlying problem. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
ctFastPathDHCPSnoopingMIB	1.3.6.1.4.1.52.4.2.35.1			The Enterasys MIB for FASTPATH DHCP Snooping
ctAgentDhcpSnoopingConfigGroup	1.3.6.1.4.1.52.4.2.35.1.1
T/F ctAgentDhcpSnoopingAdminMode	1.3.6.1.4.1.52.4.2.35.1.1.1	TruthValue	read-write	This object indicates whether DHCP Snooping is enabled globally. If this object is set to 'true',admin mode is enabled globally. If this object is set to 'false',admin mode is disabled globally.
T/F ctAgentDhcpSnoopingVerifyMac	1.3.6.1.4.1.52.4.2.35.1.1.2	TruthValue	read-write	This object indicates whether source Mac address in the received DHCP Message needs to be verified or not. If this object is set to 'true',verifyMac is enabled globally. If this object is set to 'false',verifyMac is disabled globally.
ctAgentDhcpSnoopingVlanConfigTable	1.3.6.1.4.1.52.4.2.35.1.1.3		not-accessible	A table provides the mechanism to control DHCP SNOOPING per VLAN. When a VLAN is created in a device supporting this table, a corresponding entry of this table will be added.
ctAgentDhcpSnoopingVlanConfigEntry	1.3.6.1.4.1.52.4.2.35.1.1.3.1		not-accessible	A row instance contains the configuration for DHCP SNOOPING at each existing VLAN.
VLA ctAgentDhcpSnoopingVlanIndex	1.3.6.1.4.1.52.4.2.35.1.1.3.1.1	VlanIndex	not-accessible	This object indicates the VLAN number on which DHCP SNOOPING Inspection feature is configured.
T/F ctAgentDhcpSnoopingVlanEnable	1.3.6.1.4.1.52.4.2.35.1.1.3.1.2	TruthValue	read-write	This object indicates whether DHCP SNOOPING is enabled in this VLAN. If this object is set to 'true', DHCP SNOOPING is enabled. If this object is set to 'false', DHCP SNOOPING is disabled.
ctAgentDhcpSnoopingIfConfigTable	1.3.6.1.4.1.52.4.2.35.1.1.4		not-accessible	A table provides the mechanism to configure the trust state for DHCP snooping purpose at each physical interface capable of this feature.
ctAgentDhcpSnoopingIfConfigEntry	1.3.6.1.4.1.52.4.2.35.1.1.4.1		not-accessible	A row instance contains the configuration for DHCP snooping at each physical interface capable of this feature.
T/F ctAgentDhcpSnoopingIfTrustEnable	1.3.6.1.4.1.52.4.2.35.1.1.4.1.1	TruthValue	read-write	This object indicates whether the interface is trusted for DHCP snooping purpose.
T/F ctAgentDhcpSnoopingIfLogEnable	1.3.6.1.4.1.52.4.2.35.1.1.4.1.2	TruthValue	read-write	This object indicates whether the Logging needs on DHCP snooping validations or not
U32 ctAgentDhcpSnoopingIfRateLimit	1.3.6.1.4.1.52.4.2.35.1.1.4.1.3	Unsigned32	read-write	This object indicates rate limit value for DHCP Snooping purpose. If the incoming rate of DHCP packets exceeds the value of this object for consecutively burst interval seconds, DHCP packets will be dropped.
U32 ctAgentDhcpSnoopingIfBurstInterval	1.3.6.1.4.1.52.4.2.35.1.1.4.1.4	Unsigned32	read-write	This object indicates the burst interval value for rate limiting purpose on this interface.
INT ctAgentDhcpSnoopingStatsReset	1.3.6.1.4.1.52.4.2.35.1.1.6	INTEGER	read-write	Clear the DHCP snooping statistics on all ports. A value of reset(1) is used to reset the statistics. A read on this object will always return the value none(0). The value none(0) cannot be forcibly set by the administrator.
ctAgentDhcpSnoopingStatsTable	1.3.6.1.4.1.52.4.2.35.1.1.7		not-accessible	A table provides the mechanism for statics of DHCP snooping.
ctAgentDhcpSnoopingStatsEntry	1.3.6.1.4.1.52.4.2.35.1.1.7.1		not-accessible	A row instance contains the DHCP snooping statistics per VLAN.
C32 ctAgentDhcpSnoopingMacVerifyFailuresEx	1.3.6.1.4.1.52.4.2.35.1.1.7.1.1	Counter32	read-only	This object indicates the number of failure verifications of client mac address with source mac address
C32 ctAgentDhcpSnoopingInvalidClientMessages	1.3.6.1.4.1.52.4.2.35.1.1.7.1.2	Counter32	read-only	This object indicates the number of invalid DHCP releases and denay messages
C32 ctAgentDhcpSnoopingInvalidServerMessages	1.3.6.1.4.1.52.4.2.35.1.1.7.1.3	Counter32	read-only	This object indicates the number of invalid DHCP server mesaages
ctAgentStaticDsBindingTable	1.3.6.1.4.1.52.4.2.35.1.1.10		not-accessible	A table of the DHCP SNOOPING static entries
ctAgentStaticDsBinding	1.3.6.1.4.1.52.4.2.35.1.1.10.1		not-accessible	Represents a binding in DHCP SNOOPING table
NUM ctAgentStaticDsBindingIfIndex	1.3.6.1.4.1.52.4.2.35.1.1.10.1.1	InterfaceIndex	read-create	Interface on which this DHCP SNOOPING binding is going to be added.
VLA ctAgentStaticDsBindingVlanId	1.3.6.1.4.1.52.4.2.35.1.1.10.1.2	VlanIndex	read-create	VLAN to whcig this DHCP SNOOPING binding is going to be added.
MAC ctAgentStaticDsBindingMacAddr	1.3.6.1.4.1.52.4.2.35.1.1.10.1.3	MacAddress	read-create	MAC address match value for the DHCP SNOOPING Binding.
IP ctAgentStaticDsBindingIpAddr	1.3.6.1.4.1.52.4.2.35.1.1.10.1.4	IpAddress	read-create	IP address match value for the DHCP SNOOPING Binding.
ROW ctAgentStaticDsBindingRowStatus	1.3.6.1.4.1.52.4.2.35.1.1.10.1.5	RowStatus	read-create	The status of this conceptual row. active(1) - this DHCP SNOOPING Binding is active createAndGo(4) - set to this value to create an instance destroy(6) - set to this value to delete an instance
ctAgentDynamicDsBindingTable	1.3.6.1.4.1.52.4.2.35.1.1.11		not-accessible	A table of the DHCP SNOOPING Dynamic entries
ctAgentDynamicDsBinding	1.3.6.1.4.1.52.4.2.35.1.1.11.11		not-accessible	Represents a binding in DHCP SNOOPING table
NUM ctAgentDynamicDsBindingIfIndex	1.3.6.1.4.1.52.4.2.35.1.1.11.11.1	InterfaceIndex	read-only	Interface on which this DHCP SNOOPING binding is going to be added.
VLA ctAgentDynamicDsBindingVlanId	1.3.6.1.4.1.52.4.2.35.1.1.11.11.2	VlanIndex	read-only	VLAN to whcig this DHCP SNOOPING binding is going to be added.
MAC ctAgentDynamicDsBindingMacAddr	1.3.6.1.4.1.52.4.2.35.1.1.11.11.3	MacAddress	read-only	MAC address match value for the DHCP SNOOPING Binding.
IP ctAgentDynamicDsBindingIpAddr	1.3.6.1.4.1.52.4.2.35.1.1.11.11.4	IpAddress	read-only	IP address match value for the DHCP SNOOPING Binding.
NTF ctDhcpSnoopingIntfErrorDisabledTrap	1.3.6.1.4.1.52.4.2.35.1.1.12			Trap is sent once an interface is error disabled by DHCP Snooping when the incoming packet rate exceeded configured rate limit during a burst-interval.

RFC description

Enterasys DHCP snooping MIB for FASTPATH switches, monitoring DHCP server communications and binding information.

Start monitoring Cabletron/Enterasys FastPath switch (DHCP snooping) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download CT-FASTPATH-DHCPSNOOPING-MIB