DLINK-3100-BRIDGE-SECURITY

All MIBs › DLINK-3100-BRIDGE-SECURITY

Last Updated: 2006-04-02

Category: Domain: Security, Technology: Bridging, Vendor: D-Link

Description: D-Link 3100 bridge security MIB providing objects for port security, MAC-based access control, and L2 security features.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is DLINK-3100-BRIDGE-SECURITY?

DLINK-3100-BRIDGE-SECURITY is a D-Link private MIB for the 3100 series switches that provides Layer 2 security features: DHCP Snooping, Dynamic ARP Inspection, and IP Source Guard. It exposes configuration and status objects controlling whether these anti-spoofing features are enabled, their static binding tables, and related counters. Its monitoring value is focused on the software/security status of the switch: whether DHCP snooping is actively enforcing trusted/untrusted port rules, how many snooping-learned entries currently exist, and whether option-82 insertion is configured correctly, which are key indicators of the device's security posture rather than physical hardware health. It builds on standard DHCP and ARP concepts and is meant to be used alongside D-Link's other 3100 bridge MIBs (e.g., VLAN and STP objects) for a complete Layer 2 security picture. It is typically deployed in access-layer switches in enterprise networks where DHCP spoofing and ARP poisoning protection are required, making DLINK-3100-BRIDGE-SECURITY SNMP monitoring a key part of Layer 2 security posture verification.

IPNetwork Monitor allows you to monitor SNMP objects defined in DLINK-3100-BRIDGE-SECURITY. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

D-Link 3100 series managed switch

Monitoring Examples

An administrator would poll rlIpDhcpSnoopEnable and rlIpDhcpSnoopCurrentEntiresNumber to confirm DHCP snooping is active and see how many client bindings are currently tracked, flagging an unexpectedly low count as a possible misconfiguration or an unexpectedly high count as a potential attack. rlIpDhcpSnoopStaticTable (rlIpDhcpSnoopStaticEntry, rlIpDhcpSnoopStaticVLANTag) shows manually configured static DHCP snooping bindings for devices with fixed IPs. rlIpDhcpSnoopVerifyMacAddress and rlIpDhcpOpt82InsertionEnable reveal whether MAC verification and DHCP option-82 insertion are enabled, both important anti-spoofing controls, and rlIpArpInspect/rlIpSourceGuard indicate whether the complementary ARP inspection and IP source guard features are active.

What Can Be Monitored

DHCP snooping enable state
current DHCP snooping binding count
static DHCP snooping bindings
option-82 insertion/verification settings
ARP inspection and IP source guard status

Imported Objects

From DLINK-3100-MIB

rnd	MODULE-IDENTITY

From IF-MIB

InterfaceIndex
ifIndex	OBJECT-TYPE

From Q-BRIDGE-MIB

VlanId

From SNMPv2-SMI

Counter32
IpAddress
MODULE-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DisplayString
MacAddress
RowStatus
TEXTUAL-CONVENTION
TruthValue

How to Use in IPNetwork Monitor

Example using rlIpSourceGuardPermittedRuleCounterNumOfStaticRules OID:

Select a D-Link 3100 series switch (DES/DGS-3100), DHCP snooping/ARP inspection/IP source guard as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type rlIpSourceGuardPermittedRuleCounterNumOfStaticRules into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. It reports the number of static rules added by IP Source Guard for the permitted Hosts. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
rlBridgeSecurity	1.3.6.1.4.1.171.10.94.89.89.112			The private MIB module definition for DHCP Snoop, ARP Inspection and Ip source Guard features.
rlIpDhcpSnoop	1.3.6.1.4.1.171.10.94.89.89.112.1
INT rlIpDhcpSnoopMibVersion	1.3.6.1.4.1.171.10.94.89.89.112.1.1	INTEGER	read-only	MIB's version, the current version is 1.
INT rlIpDhcpSnoopEnable	1.3.6.1.4.1.171.10.94.89.89.112.1.2	INTEGER	read-write	Specifies a system DHCP Snoop enable state.
INT rlIpDhcpSnoopFileEnable	1.3.6.1.4.1.171.10.94.89.89.112.1.3	INTEGER	read-write	Specifies a system DHCP Snoop file enable state.
INT rlIpDhcpSnoopClearAction	1.3.6.1.4.1.171.10.94.89.89.112.1.4	INTEGER	read-write	Used to clear DHCP Snoop Table.
INT rlIpDhcpSnoopFileUpdateTime	1.3.6.1.4.1.171.10.94.89.89.112.1.5	INTEGER	read-write	Configures in seconds the period of time between file updates. The valid range is 600 - 86400.
INT rlIpDhcpSnoopVerifyMacAddress	1.3.6.1.4.1.171.10.94.89.89.112.1.6	INTEGER	read-write	Configures on an un-trusted port whether the source MAC address in a DHCP packet matches the client hardware address.
INT rlIpDhcpSnoopCurrentEntiresNumber	1.3.6.1.4.1.171.10.94.89.89.112.1.7	INTEGER	read-only	Contain the current number of DHCP snooping entries for all types.
INT rlIpDhcpOpt82InsertionEnable	1.3.6.1.4.1.171.10.94.89.89.112.1.8	INTEGER	read-write	Specifies a DHCP option 82 insertion enable state.
INT rlIpDhcpOpt82RxOnUntrustedEnable	1.3.6.1.4.1.171.10.94.89.89.112.1.9	INTEGER	read-write	Specifies a DHCP option 82 receive on untrusted port enable state.
rlIpDhcpSnoopStaticTable	1.3.6.1.4.1.171.10.94.89.89.112.1.10		not-accessible	The table specifies all DHCP Snoop Static (configured by user) entries. The entry contains a local IP address of the DHCP client, a Port interface to which a DHCP client is connected to the switch.
rlIpDhcpSnoopStaticEntry	1.3.6.1.4.1.171.10.94.89.89.112.1.10.1		not-accessible	The row definition for this table.
VLA rlIpDhcpSnoopStaticVLANTag	1.3.6.1.4.1.171.10.94.89.89.112.1.10.1.1	VlanId	not-accessible	A DHCP Snoop Static entry vlan tag.
MAC rlIpDhcpSnoopStaticMACAddress	1.3.6.1.4.1.171.10.94.89.89.112.1.10.1.2	MacAddress	not-accessible	A DHCP Snoop Static entry mac address
IP rlIpDhcpSnoopStaticIPAddress	1.3.6.1.4.1.171.10.94.89.89.112.1.10.1.3	IpAddress	read-write	A DHCP Snoop Static entry IP address.
NUM rlIpDhcpSnoopStaticPortInterface	1.3.6.1.4.1.171.10.94.89.89.112.1.10.1.4	InterfaceIndex	read-write	A DHCP Snoop Static entry Port interface.
ROW rlIpDhcpSnoopStaticRowStatus	1.3.6.1.4.1.171.10.94.89.89.112.1.10.1.5	RowStatus	read-write	A status can be destroy, active or createAndGo
rlIpDhcpSnoopTable	1.3.6.1.4.1.171.10.94.89.89.112.1.11		not-accessible	DHCP Snoop entry. Use to add/delete a dynamic entries and to view all entries (dynamic and static)
rlIpDhcpSnoopEntry	1.3.6.1.4.1.171.10.94.89.89.112.1.11.1		not-accessible	The row definition for this table.
VLA rlIpDhcpSnoopVLANTag	1.3.6.1.4.1.171.10.94.89.89.112.1.11.1.1	VlanId	not-accessible	A DHCP Snoop entry vlan tag.
MAC rlIpDhcpSnoopMACAddress	1.3.6.1.4.1.171.10.94.89.89.112.1.11.1.2	MacAddress	not-accessible	A DHCP Snoop entry mac address
RLI rlIpDhcpSnoopType	1.3.6.1.4.1.171.10.94.89.89.112.1.11.1.3	RlIpDhcpSnoopType	read-write	A DHCP Snoop entry type: static or dynamic.
U32 rlIpDhcpSnoopLeaseTime	1.3.6.1.4.1.171.10.94.89.89.112.1.11.1.4	Unsigned32	read-write	A DHCP Snoop lease time. For static entry the lease time is 0xFFFFFFFF
IP rlIpDhcpSnoopIPAddress	1.3.6.1.4.1.171.10.94.89.89.112.1.11.1.5	IpAddress	read-write	The IP address of the DHCP client referred to in this table entry.
NUM rlIpDhcpSnoopPortInterface	1.3.6.1.4.1.171.10.94.89.89.112.1.11.1.6	InterfaceIndex	read-write	Identifies the port Interface ifindex, which connected to DHCP client identified with the entry.
ROW rlIpDhcpSnoopRowStatus	1.3.6.1.4.1.171.10.94.89.89.112.1.11.1.7	RowStatus	read-write	Entry status. A valid status is CreateandGo or Delete.
rlIpDhcpSnoopEnableVlanTable	1.3.6.1.4.1.171.10.94.89.89.112.1.12		not-accessible	An Ip Dhcp Snooping enabled VLAN table.
rlIpDhcpSnoopEnableVlanEntry	1.3.6.1.4.1.171.10.94.89.89.112.1.12.1		not-accessible	An Ip Dhcp Snooping enabled VLAN entry.
VLA rlIpDhcpSnoopEnableVlanTag	1.3.6.1.4.1.171.10.94.89.89.112.1.12.1.1	VlanId	not-accessible	A DHCP Snoop entry vlan tag.
ROW rlIpDhcpSnoopEnableVlanRowStatus	1.3.6.1.4.1.171.10.94.89.89.112.1.12.1.2	RowStatus	read-write	Entry status. A valid status is CreateandGo and Delete.
rlIpDhcpSnoopTrustedPortTable	1.3.6.1.4.1.171.10.94.89.89.112.1.13		not-accessible	DHCP Snoop Trusted ports entry. The entry created when port is configured as trusted.
rlIpDhcpSnoopTrustedPortEntry	1.3.6.1.4.1.171.10.94.89.89.112.1.13.1		not-accessible	The row definition for this table.
ROW rlIpDhcpSnoopTrustedPortRowStatus	1.3.6.1.4.1.171.10.94.89.89.112.1.13.1.2	RowStatus	read-write	Entry status. A valid status is CreateandGo or Delete.
rlIpSourceGuard	1.3.6.1.4.1.171.10.94.89.89.112.2
INT rlIpSourceGuardMibVersion	1.3.6.1.4.1.171.10.94.89.89.112.2.1	INTEGER	read-only	MIB's version, the current version is 1.
INT rlIpSourceGuardEnable	1.3.6.1.4.1.171.10.94.89.89.112.2.2	INTEGER	read-write	FALSE - There is no Ip Source Guard in the system. TRUE - Ip Source Guard is enabled on system.
INT rlIpSourceGuardRetryToInsert	1.3.6.1.4.1.171.10.94.89.89.112.2.3	INTEGER	read-write	When setted to retryToInsertNow all IP Source Guard inactive entries due to resource problem reinserted in the Policy. On get always return noAction.
INT rlIpSourceGuardRetryTime	1.3.6.1.4.1.171.10.94.89.89.112.2.4	INTEGER	read-write	Configures in seconds the period of time the application retries to insert inactive by resource problem rules. The actual range is 10-600. 0 used to sign that the timer is not active.
rlIpSourceGuardPortTable	1.3.6.1.4.1.171.10.94.89.89.112.2.5		not-accessible	IP Source Guard ports entry. The entry created when IP Source Guard enabled on port.
rlIpSourceGuardPortEntry	1.3.6.1.4.1.171.10.94.89.89.112.2.5.1		not-accessible	The row definition for this table.
ROW rlIpSourceGuardPortRowStatus	1.3.6.1.4.1.171.10.94.89.89.112.2.5.1.2	RowStatus	read-write	Entry status. A valid status is CreateAndGo or Delete.
rlIpSourceGuardTable	1.3.6.1.4.1.171.10.94.89.89.112.2.6		not-accessible	IP Source Guard entry. Use to view all entries (dynamic and static)
rlIpSourceGuardEntry	1.3.6.1.4.1.171.10.94.89.89.112.2.6.1		not-accessible	The row definition for this table.
IP rlIpSourceGuardIPAddress	1.3.6.1.4.1.171.10.94.89.89.112.2.6.1.1	IpAddress	not-accessible	The IP address of the Ip Source Guard entry.
VLA rlIpSourceGuardVLANTag	1.3.6.1.4.1.171.10.94.89.89.112.2.6.1.2	VlanId	not-accessible	A Ip Source Guard entry vlan tag.
MAC rlIpSourceGuardMACAddress	1.3.6.1.4.1.171.10.94.89.89.112.2.6.1.3	MacAddress	read-only	A Ip Source Guard entry mac address
RLI rlIpSourceGuardType	1.3.6.1.4.1.171.10.94.89.89.112.2.6.1.4	RlIpSourceGuardType	read-only	A Ip Source Guard entry type: static or dynamic.
RLI rlIpSourceGuardStatus	1.3.6.1.4.1.171.10.94.89.89.112.2.6.1.5	RlIpSourceGuardStatus	read-only	Identifies the status of Ip Source Guard entry.
RLI rlIpSourceGuardFailReason	1.3.6.1.4.1.171.10.94.89.89.112.2.6.1.6	RlIpSourceGuardFailReason	read-only	Identifies the reason for in-activity of Ip Source Guard entry.
rlIpSourceGuardPermittedRuleCounterTable	1.3.6.1.4.1.171.10.94.89.89.112.2.7		not-accessible	The table includes, per vlan, the IP Source Guard permitted rules counters.
rlIpSourceGuardPermittedRuleCounterEntry	1.3.6.1.4.1.171.10.94.89.89.112.2.7.1		not-accessible	The row definition for this table.
VLA rlIpSourceGuardPermittedRuleCounterVLANTag	1.3.6.1.4.1.171.10.94.89.89.112.2.7.1.1	VlanId	not-accessible	Ip Source Guard permitted rules counters entry Vlan tag.
C32 rlIpSourceGuardPermittedRuleCounterNumOfStaticRulesEx	1.3.6.1.4.1.171.10.94.89.89.112.2.7.1.2	Counter32	read-only	Number of static rules added by IP Source Guard for the permitted Hosts
C32 rlIpSourceGuardPermittedRuleCounterNumOfDhcpRules	1.3.6.1.4.1.171.10.94.89.89.112.2.7.1.3	Counter32	read-only	Number of rules added by IP Source Guard for the permitted Hosts, as a result of DHCP Snooping dynamic information.
rlIpArpInspect	1.3.6.1.4.1.171.10.94.89.89.112.3
INT rlIpArpInspectMibVersion	1.3.6.1.4.1.171.10.94.89.89.112.3.1	INTEGER	read-only	MIB's version, the current version is 1.
INT rlIpArpInspectEnable	1.3.6.1.4.1.171.10.94.89.89.112.3.2	INTEGER	read-write	Specifies a system ARP Inspection enable state.
U32 rlIpArpInspectLogInterval	1.3.6.1.4.1.171.10.94.89.89.112.3.3	Unsigned32	read-write	Specify the minimal interval between successive ARP SYSLOG messages. 0 - message is immediately generated. 0xFFFFFFFF - messages would not be generated. A legal range is 0-86400.
INT rlIpArpInspectValidation	1.3.6.1.4.1.171.10.94.89.89.112.3.4	INTEGER	read-write	Defined a specific check on incoming ARP packets: Source MAC: Compare the source MAC address in the Ethernet header against the sender MAC address in the ARP body. This check is performed on both ARP requests and responses. Destination MAC: Compare the destination MAC address in the Ethernet header against the target MAC address in ARP body. This check is performed for ARP responses. IP addresses: Compare the ARP body for invalid and unexpected IP addresses. Addresses include 0.0.0.0, 255.255.255.255, and all IP multicast addresses.
rlIpArpInspectListTable	1.3.6.1.4.1.171.10.94.89.89.112.3.5		not-accessible	The table specifies all ARP Inspection List entries. The entry contains a list name, list IP address, a list Mac address.
rlIpArpInspectListEntry	1.3.6.1.4.1.171.10.94.89.89.112.3.5.1		not-accessible	The row definition for this table.
RLI rlIpArpInspectListName	1.3.6.1.4.1.171.10.94.89.89.112.3.5.1.1	RlIpArpInspectListNameType	not-accessible	The Name of the Access List.
IP rlIpArpInspectListIPAddress	1.3.6.1.4.1.171.10.94.89.89.112.3.5.1.2	IpAddress	not-accessible	ARP Inspection List IP address.
MAC rlIpArpInspectListMACAddress	1.3.6.1.4.1.171.10.94.89.89.112.3.5.1.3	MacAddress	read-write	ARP Inspection List mac address
ROW rlIpArpInspectListRowStatus	1.3.6.1.4.1.171.10.94.89.89.112.3.5.1.4	RowStatus	read-write	A status can be destroy, active or createAndGo
rlIpArpInspectEnableVlanTable	1.3.6.1.4.1.171.10.94.89.89.112.3.6		not-accessible	An Ip ARP Inspection enabled VLAN table.
rlIpArpInspectEnableVlanEntry	1.3.6.1.4.1.171.10.94.89.89.112.3.6.1		not-accessible	An Ip ARP Inspection enabled VLAN entry.
VLA rlIpArpInspectEnableVlanTag	1.3.6.1.4.1.171.10.94.89.89.112.3.6.1.1	VlanId	not-accessible	An Ip ARP Inspection entry vlan tag.
RLI rlIpArpInspectAssignedListName	1.3.6.1.4.1.171.10.94.89.89.112.3.6.1.2	RlIpArpInspectListNameType	read-write	An Ip ARP Inspection assigned ACL name.
ROW rlIpArpInspectEnableVlanRowStatus	1.3.6.1.4.1.171.10.94.89.89.112.3.6.1.3	RowStatus	read-write	Entry status. A valid status is CreateandGo and Delete.
C32 rlIpArpInspectVlanNumOfArpForwarded	1.3.6.1.4.1.171.10.94.89.89.112.3.6.1.4	Counter32	read-only	Total number of forwarded ARP packets, packets which were validated by ARP inspection
C32 rlIpArpInspectVlanNumOfArpDropped	1.3.6.1.4.1.171.10.94.89.89.112.3.6.1.5	Counter32	read-only	Number of dropped ARP packets, which were validated by ARP inspection (mismatch , not-found and dropped for any reason)
C32 rlIpArpInspectVlanNumOfArpMismatched	1.3.6.1.4.1.171.10.94.89.89.112.3.6.1.6	Counter32	read-only	Number of dropped ARP packets, which were validated by ARP inspection and inconsistency was found for IP and MAC (mismatch)
T/F rlIpArpInspectVlanClearCountersAction	1.3.6.1.4.1.171.10.94.89.89.112.3.6.1.7	TruthValue	read-write	If true, clear (set to zero) all Arp Inspection counters: rlIpArpInspectVlanNumOfArpForwarded , rlIpArpInspectVlanNumOfArpDropped and rlIpArpInspectVlanNumOfArpMismatched
rlIpArpInspectTrustedPortTable	1.3.6.1.4.1.171.10.94.89.89.112.3.7		not-accessible	ARP Inspection Trusted ports entry. The entry created when port is configured as trusted.
rlIpArpInspectTrustedPortEntry	1.3.6.1.4.1.171.10.94.89.89.112.3.7.1		not-accessible	The row definition for this table.
ROW rlIpArpInspectTrustedPortRowStatus	1.3.6.1.4.1.171.10.94.89.89.112.3.7.1.2	RowStatus	read-write	Entry status. A valid status is CreateandGo or Delete.
T/F rlIpArpInspectClearCountersAction	1.3.6.1.4.1.171.10.94.89.89.112.3.8	TruthValue	read-write	If true, clear (set to zero) on all vlans: all Arp Inspection counters: rlIpArpInspectVlanNumOfArpForwarded , rlIpArpInspectVlanNumOfArpDropped and rlIpArpInspectVlanNumOfArpMismatched

RFC description

Manages DHCP Snooping, ARP Inspection, and IP Source Guard security features on D-Link bridges.

Start monitoring D-Link 3100 series switch (DES/DGS-3100), DHCP snooping/ARP inspection/IP source guard with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download DLINK-3100-BRIDGE-SECURITY