CT-FASTPATH-DYNAMIC-ARP-INSPECTION-MIB

All MIBs › CT-FASTPATH-DYNAMIC-ARP-INSPECTION-MIB

Organization: Enterasys Networks, Inc.

Last Updated: 2008-07-23

Category: IP and Core Protocols, VLAN and Bridging, Vendor: Cabletron/Enterasys

Description: Manages dynamic ARP inspection policy and violation statistics on Cabletron FastPath switching platforms.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is CT-FASTPATH-DYNAMIC-ARP-INSPECTION-MIB?

CT-FASTPATH-DYNAMIC-ARP-INSPECTION-MIB is an Enterasys (formerly Cabletron) FastPath switch platform MIB implementing Dynamic ARP Inspection, a Layer 2 security feature that validates ARP packets against trusted bindings to prevent ARP spoofing and man-in-the-middle attacks. It exposes configuration data for enabling DAI per VLAN/port, trust settings, and violation/statistics counters for dropped or invalid ARP packets. Its role in device monitoring is primarily security/fault-oriented software status: administrators track ARP inspection violation counts and per-port trust status to detect active spoofing attempts or misconfigured trust boundaries. It builds on standard Enterasys/Cabletron switching MIB conventions and typically works alongside DHCP snooping MIBs, since DAI validates ARP against DHCP-snooping-learned bindings. It is deployed on Enterasys/Cabletron FastPath switches in enterprise/campus networks as part of Layer 2 security hardening, typically starting with a CT-FASTPATH-DYNAMIC-ARP-INSPECTION-MIB download to load the module into an SNMP management tool.

IPNetwork Monitor allows you to monitor SNMP objects defined in CT-FASTPATH-DYNAMIC-ARP-INSPECTION-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Enterasys/Cabletron FastPath switch

Monitoring Examples

No object names were supplied for this module. DAI MIBs of this kind typically expose per-port/VLAN enable status and ARP violation counters, letting an administrator identify a port with a spike in dropped ARP packets indicating a spoofing attempt, but specific object names cannot be confirmed without the source MIB.

What Can Be Monitored

DAI enable/disable status per VLAN/port
ARP inspection violation count
trusted port configuration
dropped ARP packet statistics

Imported Objects

From CTRON-MIB-NAMES

ctDynamicArpInspectionExpMib

OBJECT-IDENTITY

From IF-MIB

ifIndex

OBJECT-TYPE

From Q-BRIDGE-MIB

VlanIndex

From SNMPv2-SMI

Counter32
Integer32
IpAddress
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
TimeTicks
Unsigned32

From SNMPv2-TC

DisplayString
MacAddress
PhysAddress
RowPointer
RowStatus
StorageType
TEXTUAL-CONVENTION
TruthValue

How to Use in IPNetwork Monitor

Example using ctAgentDaiVlanPktsForwarded OID:

Select an Enterasys/Cabletron FastPath switch (Dynamic ARP Inspection) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type ctAgentDaiVlanPktsForwarded into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. It reports the number of valid ARP packets forwarded by DAI. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
ctFastPathDynamicArpInspectionMIB	1.3.6.1.4.1.52.4.2.36.1			The Enterasys MIB for FASTPATH Dynamic ARP INspection
ctAgentDaiConfigGroup	1.3.6.1.4.1.52.4.2.36.1.1
T/F ctAgentDaiSrcMacValidate	1.3.6.1.4.1.52.4.2.36.1.1.1	TruthValue	read-write	This object indicates whether Sender MAC validation in the ARP packets is enabled. If this object is set to 'true', validation is enabled. If this object is set to 'false', validation is disabled.
T/F ctAgentDaiDstMacValidate	1.3.6.1.4.1.52.4.2.36.1.1.2	TruthValue	read-write	This object indicates whether Target MAC validation in the ARP Response packets is enabled. If this object is set to 'true', validation is enabled. If this object is set to 'false', validation is disabled.
T/F ctAgentDaiIPValidate	1.3.6.1.4.1.52.4.2.36.1.1.3	TruthValue	read-write	This object indicates whether IP address validation in the ARP packets is enabled. If this object is set to 'true', validation is enabled. If this object is set to 'false', validation is disabled.
ctAgentDaiVlanConfigTable	1.3.6.1.4.1.52.4.2.36.1.1.4		not-accessible	A table provides the mechanism to control Dynamic ARP Inspection per VLAN. When a VLAN is created in a device supporting this table, a corresponding entry of this table will be added.
ctAgentDaiVlanConfigEntry	1.3.6.1.4.1.52.4.2.36.1.1.4.1		not-accessible	A row instance contains the configuration for Dynamic ARP Inspection at each existing VLAN.
VLA ctAgentDaiVlanIndex	1.3.6.1.4.1.52.4.2.36.1.1.4.1.1	VlanIndex	not-accessible	This object indicates the VLAN number on which Dynamic ARP Inspection feature is configured.
T/F ctAgentDaiVlanDynArpInspEnable	1.3.6.1.4.1.52.4.2.36.1.1.4.1.2	TruthValue	read-write	This object indicates whether Dynamic ARP Inspection is enabled in this VLAN. If this object is set to 'true', Dynamic ARP Inspection is enabled. If this object is set to 'false', Dynamic ARP Inspection is disabled.
T/F ctAgentDaiVlanLoggingEnable	1.3.6.1.4.1.52.4.2.36.1.1.4.1.3	TruthValue	read-write	This object indicates whether the Dynamic ARP Inspection logging is enabled on this VlAN. If this object is set to 'true', Dynamic ARP Inspection logging is enabled. If this object is set to 'false', Dynamic ARP Inspection loging is disabled.
STR ctAgentDaiVlanArpAclName	1.3.6.1.4.1.52.4.2.36.1.1.4.1.4	DisplayString	read-write	This object indicates the ARP ACL name set for this VLAN.
T/F ctAgentDaiVlanArpAclStaticFlag	1.3.6.1.4.1.52.4.2.36.1.1.4.1.5	TruthValue	read-write	This object indicates whether the ARP ACL set for this VLAN has static flag set. If this object is set to 'true', static flag is enabled. If this object is set to 'false', static flag is disabled.
INT ctAagentDaiStatsReset	1.3.6.1.4.1.52.4.2.36.1.1.5	INTEGER	read-write	Clear the DAI statistics on all vlans. A value of reset(1) is used to reset the statistics. A read on this object will always return the value none(0). The value none(0) cannot be forcibly set by the administrator.
ctAgentDaiVlanStatsTable	1.3.6.1.4.1.52.4.2.36.1.1.6		not-accessible	A table provides the mechanism to control Dynamic ARP Inspection per VLAN. When a VLAN is created in a device supporting this table, a corresponding entry of this table will be added.
ctAgentDaiVlanStatsEntry	1.3.6.1.4.1.52.4.2.36.1.1.6.1		not-accessible	A row instance contains the Dynamic ARP Inspection statistics per VLAN.
VLA ctAgentDaiVlanStatsIndex	1.3.6.1.4.1.52.4.2.36.1.1.6.1.1	VlanIndex	not-accessible	This object indicates the VLAN number on which Dynamic ARP Inspection statistics are retrieved.
C32 ctAgentDaiVlanPktsForwardedEx	1.3.6.1.4.1.52.4.2.36.1.1.6.1.2	Counter32	read-only	Number of valid ARP packets forwarded by DAI.
C32 ctAgentDaiVlanPktsDropped	1.3.6.1.4.1.52.4.2.36.1.1.6.1.3	Counter32	read-only	Number of invalid ARP packets dropped by DAI.
C32 ctAgentDaiVlanDhcpDrops	1.3.6.1.4.1.52.4.2.36.1.1.6.1.4	Counter32	read-only	Number of ARP packets that were dropped by DAI as there is no matching DHCP Snooping binding entry found.
C32 ctAgentDaiVlanDhcpPermits	1.3.6.1.4.1.52.4.2.36.1.1.6.1.5	Counter32	read-only	Number of ARP packets that were forwarded by DAI as there is a matching DHCP Snooping binding entry found.
C32 ctAgentDaiVlanAclDrops	1.3.6.1.4.1.52.4.2.36.1.1.6.1.6	Counter32	read-only	Number of ARP packets that were dropped by DAI as there is no matching ARP ACL rule found for this Vlan and the static flag is set on this vlan.
C32 ctAgentDaiVlanAclPermits	1.3.6.1.4.1.52.4.2.36.1.1.6.1.7	Counter32	read-only	Number of ARP packets that were permitted by DAI as there is a matching ARP ACL rule found for this Vlan.
C32 ctAgentDaiVlanSrcMacFailures	1.3.6.1.4.1.52.4.2.36.1.1.6.1.8	Counter32	read-only	Number of ARP packets that were dropped by DAI as the sender mac address in ARP packet didn't match the source mac in ethernet header.
C32 ctAgentDaiVlanDstMacFailures	1.3.6.1.4.1.52.4.2.36.1.1.6.1.9	Counter32	read-only	Number of ARP packets that were dropped by DAI as the target mac address in ARP reply packet didn't match the destination mac in ethernet header.
C32 ctAgentDaiVlanIpValidFailures	1.3.6.1.4.1.52.4.2.36.1.1.6.1.10	Counter32	read-only	Number of ARP packets that were dropped by DAI as the sender IP address in ARP packet or target IP address in ARP reply packet is invalid. Invalid addresses include 0.0.0.0, 255.255.255.255, IP multicast addresses, class E addresses (240.0.0.0/4), loopback addresses (127.0.0.0/8).
ctAgentDaiIfConfigTable	1.3.6.1.4.1.52.4.2.36.1.1.7		not-accessible	A table provides the mechanism to configure the trust state for Dynamic ARP Inspection purpose at each physical interface capable of this feature.
ctAgentDaiIfConfigEntry	1.3.6.1.4.1.52.4.2.36.1.1.7.1		not-accessible	A row instance contains the configuration for Dynamic ARP Inspection at each physical interface capable of this feature.
T/F ctAgentDaiIfTrustEnable	1.3.6.1.4.1.52.4.2.36.1.1.7.1.1	TruthValue	read-write	This object indicates whether the interface is trusted for Dynamic ARP Inspection purpose. If this object is set to 'true', the interface is trusted. ARP packets coming to this interface will be forwarded without checking. If this object is set to 'false', the interface is not trusted. ARP packets coming to this interface will be subjected to ARP inspection.
U32 ctAgentDaiIfRateLimit	1.3.6.1.4.1.52.4.2.36.1.1.7.1.2	Unsigned32	read-write	This object indicates rate limit value for Dynamic ARP Inspection purpose. If the incoming rate of ARP packets exceeds the value of this object for consecutively burst interval seconds, ARP packets will be dropped.
U32 ctAgentDaiIfBurstInterval	1.3.6.1.4.1.52.4.2.36.1.1.7.1.3	Unsigned32	read-write	This object indicates the burst interval value for rate limiting purpose on this interface.

RFC description

The Enterasys MIB for FASTPATH Dynamic ARP Inspection security feature.

Start monitoring Enterasys/Cabletron FastPath switch (Dynamic ARP Inspection) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download CT-FASTPATH-DYNAMIC-ARP-INSPECTION-MIB