DLINKSW-DAI-MIB

All MIBs › DLINKSW-DAI-MIB

Organization: D-Link Corp.

Last Updated: 2013-07-18

Category: Security

Description: Manages Dynamic ARP Inspection settings to prevent ARP spoofing on D-Link switches.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is DLINKSW-DAI-MIB?

DLINKSW-DAI-MIB is a D-Link proprietary MIB implementing Dynamic ARP Inspection (DAI), which validates ARP packets against a trusted DHCP-snooping binding table to block ARP-spoofing attacks. Its objects cover an address-validation setting, log-buffer size and clear action, a log-buffer table (interface, VLAN, sender MAC/IP, last-update time, packet count), VLAN-enable bitmap objects (first/second 2K VLAN ranges), a VLAN-configuration table (ARP ACL name/static flag, ACL logging, DHCP-binding logging, row status), and an interface-configuration table (trust enabled). As a configuration/security MIB it lets an administrator confirm which ports are trusted (exempt from inspection) and review the log buffer for blocked spoofed ARP packets. It is deployed on D-Link managed switches. Engineers can download the DLINKSW-DAI-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in DLINKSW-DAI-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

D-Link managed switches (Dynamic ARP Inspection)

Monitoring Examples

An administrator reviews dDaiLogBufferTable to identify a host sending spoofed ARP packets that Dynamic ARP Inspection has blocked and logged on a D-Link switch.

What Can Be Monitored

blocked/logged ARP spoofing attempts
trusted-port configuration

Imported Objects

From DLINK-ID-REC-MIB

dlinkIndustrialCommon

OBJECT-IDENTITY

From DLINKSW-TC-MIB

Dlink2kVlanList

From IF-MIB

InterfaceIndex
ifIndex	OBJECT-TYPE

From INET-ADDRESS-MIB

InetAddressIPv4

From Q-BRIDGE-MIB

VlanId
VlanIdOrNone

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Counter64
Gauge32
Integer32
IpAddress
MODULE-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DateAndTime
DisplayString
MacAddress
RowStatus
TEXTUAL-CONVENTION
TruthValue

How to Use in IPNetwork Monitor

Example using dDaiVlanForwarded OID:

Select a D-Link managed switch (Dynamic ARP Inspection) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type dDaiVlanForwarded into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. This object indicates the number of ARP packets forwarded by Dynamic Arp Inspection feature. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter64-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline (in packets), since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
dlinkSwDynamicArpInspectionMIB	1.3.6.1.4.1.171.26.130			This MIB module defines objects for Dynamic ARP Inspection.
dDaiNotifications	1.3.6.1.4.1.171.26.130.0
dDaiObjects	1.3.6.1.4.1.171.26.130.1
dDaiGlobal	1.3.6.1.4.1.171.26.130.1.1
BIT dDaiAddressValidate	1.3.6.1.4.1.171.26.130.1.1.1	Bits	read-write	This object specifies address validation criteria used by Dynamic ARP Inspection feature. 'srcMacAddress' - indicates that source MAC address in ethernet header is checked against the sender MAC address in ARP packet. When this bit is on, packets with different MAC addresses are classified as invalid packets and are dropped. This checking is done for both ARP request and ARP response packet. 'dstMacAddress' indicates that the destination MAC address in ethernet header is checked against the target MAC address in ARP packet. When this bit is on, packets with different addresses are classified as invalid packets and are dropped. This checking is done for ARP response packet only. 'ip' indicates that the IP addresses in ARP packet are checked for invalid or unexpected IP addresses. Addresses such as 0.0.0.0, 255.255.255.255 and all IP multicast addresses are considered invalid. When this bit is on, both the sender and target IP addresses in the ARP packet are checked. This checking is done for both ARP request and response packet.
U32 dDaiLogBufferSize	1.3.6.1.4.1.171.26.130.1.1.2	Unsigned32	read-write	This object specifies the buffer entry number.
INT dDaiClearLogBuffer	1.3.6.1.4.1.171.26.130.1.1.3	INTEGER	read-write	This object clears all entries in dDaiLoggingBufferTable , when set to 'clear'. No action is taken if this object is set to 'noOp'. When read, the value 'noOp' is returned.
dDaiLogBufferTable	1.3.6.1.4.1.171.26.130.1.1.4		not-accessible	A table provides the information of logged ARP flows for system message generation.
dDaiLogBufferEntry	1.3.6.1.4.1.171.26.130.1.1.4.1		not-accessible	An entry contains logged ARP flow data for system message generation. Entries in the log are cleared once system messages are generated on their behalf. A special entry will be populated for accounting drops of all flows that result in exceeding the number of entries of the log buffer. This special entry only contains packets counter and timestamps information.
U32 dDaiLogBufferIndex	1.3.6.1.4.1.171.26.130.1.1.4.1.1	Unsigned32	not-accessible	This object uniquely identifies a logged ARP flow in the buffer.
NUM dDaiLogBufferInterface	1.3.6.1.4.1.171.26.130.1.1.4.1.2	InterfaceIndex	read-only	This object indicates the interface which sent the logged ARP flow.
VLA dDaiLogBufferVlan	1.3.6.1.4.1.171.26.130.1.1.4.1.3	VlanIdOrNone	read-only	This object indicates the VLAN ID which the logged ARP flow belongs to.
MAC dDaiLogBufferSenderMacAddress	1.3.6.1.4.1.171.26.130.1.1.4.1.4	MacAddress	read-only	This object indicates the sender MAC address of the logged ARP flow. All zeros MAC address value indicates the special entry.
ADR dDaiLogBufferSenderIpAddress	1.3.6.1.4.1.171.26.130.1.1.4.1.5	InetAddressIPv4	read-only	This object indicates the sender Internet address of the logged ARP flow. The type of this address is determined by the value of dDaiLogBufferSenderAddressType object. All zeros IP address value indicates the special entry.
DAT dDaiLogBufferLastUpdate	1.3.6.1.4.1.171.26.130.1.1.4.1.6	DateAndTime	read-only	This object indicates the timestamp when the last packet of this flow was accounted by the system.
G32 dDaiLogBufferPacketsCount	1.3.6.1.4.1.171.26.130.1.1.4.1.7	Gauge32	read-only	This object indicates the number of packets of this ARP flow was accounted by the system.
dDaiVlan	1.3.6.1.4.1.171.26.130.1.2
DLI dDaiVlanCrlFirst2K	1.3.6.1.4.1.171.26.130.1.2.1	Dlink2kVlanList	read-write	This object specifies the Dynamic ARP Inspection enabled VLAN in a string of octets containing one bit per VLAN for VLANs 1 to 2048. If the bit is set to '1', then the VLAN is enabled for Dynamic ARP Inspection.
DLI dDaiVlanCrlSecond2K	1.3.6.1.4.1.171.26.130.1.2.2	Dlink2kVlanList	read-write	This object specifies the Dynamic ARP Inspection enabled VLAN in a string of octets containing one bit per VLAN for VLANs 2049 to 4094. If the bit is set to '1', then the VLAN is enabled for Dynamic ARP Inspection.
dDaiVlanCfgTable	1.3.6.1.4.1.171.26.130.1.2.3		not-accessible	A table contains a list of configuration for Dynamic ARP Inspection per VLAN.
dDaiVlanCfgEntry	1.3.6.1.4.1.171.26.130.1.2.3.1		not-accessible	A row instance contains the Dynamic ARP inspection configuration for a specific VLAN in the device.
VLA dDaiVlanCfgId	1.3.6.1.4.1.171.26.130.1.2.3.1.1	VlanId	not-accessible	This object indicates the VLAN ID of the entry.
STR dDaiVlanFilterArpAclName	1.3.6.1.4.1.171.26.130.1.2.3.1.2	DisplayString	read-create	This object specifies an ARP ACL name that is used to check the validity of the bindings information in ARP body. An empty string indicates that the ARP ACL is not configured on the VLAN.
T/F dDaiVlanFilterArpAclStatic	1.3.6.1.4.1.171.26.130.1.2.3.1.3	TruthValue	read-create	This object indicates whether drop the packet if the IP-to-Ethernet MAC binding pair is not permitted by the arp ACL. This object does not take effect if value of dDaiVlanFilterArpAclName on the row is an empty string. 'true' indicates the implicit denied packet is dropped and ARP packet is not compared against DHCP bindings information. 'false' indicates if ARP packet is not explicitly classified by ARP ACL, it will be compared against DHCP bindings information.
BIT dDaiVlanAclLogging	1.3.6.1.4.1.171.26.130.1.2.3.1.4	Bits	read-create	This object indicates the logging criteria for packets that are dropped or permitted based on ACL matches. 'permit' - indicates that logging is performed when packets is permitted by the configured ACL. 'deny' - indicates that logging is performed when packets is denied by the configured ACL.
BIT dDaiVlanDhcpBindingLogging	1.3.6.1.4.1.171.26.130.1.2.3.1.5	Bits	read-create	This object specifies the logging criteria when ARP packets is compared against DHCP bindings information. 'permit' - indicates that logging is performed for packets that are permitted as a result of comparing with DHCP bindings information. 'deny' - indicates that logging is performed for packets that are denied as a result of comparing with DHCP bindings information.
ROW dDaiVlanCfgRowStatus	1.3.6.1.4.1.171.26.130.1.2.3.1.99	RowStatus	read-create	The status of this conceptual row entry. This object is used to manage creation and deletion of rows in this table.
dDaiInterface	1.3.6.1.4.1.171.26.130.1.3
dDaiIfConfigTable	1.3.6.1.4.1.171.26.130.1.3.1		not-accessible	A table provides the mechanism to configure the trust state for Dynamic ARP Inspection purpose at each interface capable of this feature.
dDaiIfConfigEntry	1.3.6.1.4.1.171.26.130.1.3.1.1		not-accessible	A row instance contains the configuration to enable or disable trust state for Dynamic ARP Inspection at each interface capable of this feature.
T/F dDaiIfTrustEnabled	1.3.6.1.4.1.171.26.130.1.3.1.1.1	TruthValue	read-write	This object indicates whether the interface is trusted for Dynamic ARP Inspection purpose. If this object is set to 'true', the interface is trusted. ARP packets coming to this interface will be forwarded without Dynamic ARP inspection. If this object is set to 'false', the interface is not trusted. ARP packets coming to this interface will be subjected to ARP inspection.
dDaiIfRateLimitTable	1.3.6.1.4.1.171.26.130.1.3.2		not-accessible	A table provides the mechanism to configure the rate limit for Dynamic ARP Inspection purpose at each interface capable of this feature.
dDaiIfRateLimitEntry	1.3.6.1.4.1.171.26.130.1.3.2.1		not-accessible	A row instance contains the configuration of rate limit Dynamic ARP Inspection at each interface capable of this feature.
U32 dDaiIfRateLimit	1.3.6.1.4.1.171.26.130.1.3.2.1.1	Unsigned32	read-write	This object indicates rate limit value for Dynamic ARP Inspection purpose. If the incoming rate of ARP packets exceeds the value of this object, ARP packets will be dropped.
U32 dDaiIfBurstInterval	1.3.6.1.4.1.171.26.130.1.3.2.1.2	Unsigned32	read-write	This object indicates the length of the burst duration of the ARP packets that is allowed. When the rate of ARP packet per second exceeds the limitation and the condition sustain for the configured burst duration, the interface will be put in error disable state.
dDaiStatistics	1.3.6.1.4.1.171.26.130.1.4
dDaiVlanStatsTable	1.3.6.1.4.1.171.26.130.1.4.1		not-accessible	A table lists the Dynamic Arp Inspection statistics per VLAN.
dDaiVlanStatsEntry	1.3.6.1.4.1.171.26.130.1.4.1.1		not-accessible	A row instance contains Dynamic ARP Inspection statistics information for each VLAN.
VLA dDaiVlanStatsIndex	1.3.6.1.4.1.171.26.130.1.4.1.1.1	VlanId	not-accessible	This object indicates the VLAN ID of the entry.
C64 dDaiVlanForwardedEx	1.3.6.1.4.1.171.26.130.1.4.1.1.2	Counter64	read-only	This object indicates the number of ARP packets forwarded by Dynamic Arp Inspection feature.
C64 dDaiVlanDropped	1.3.6.1.4.1.171.26.130.1.4.1.1.3	Counter64	read-only	This object indicates the number of ARP packets dropped by Dynamic ARP Inspection feature.
C64 dDaiVlanAclPermitted	1.3.6.1.4.1.171.26.130.1.4.1.1.4	Counter64	read-only	This object indicates the number of ARP packets permitted by the configured ACL.
C64 dDaiVlanDhcpBindingsPermitted	1.3.6.1.4.1.171.26.130.1.4.1.1.5	Counter64	read-only	This object indicates the number of ARP packets that are permitted by DHCP snooping binding database.
C64 dDaiVlanAclDenied	1.3.6.1.4.1.171.26.130.1.4.1.1.6	Counter64	read-only	This object indicates the number of ARP packets denied by the associating ACL.
C64 dDaiVlanDhcpBindingDenied	1.3.6.1.4.1.171.26.130.1.4.1.1.7	Counter64	read-only	This object indicates the number of ARP packets that are dropped by DHCP snooping binding database.
C64 dDaiVlanSrcMacValidationFailures	1.3.6.1.4.1.171.26.130.1.4.1.1.8	Counter64	read-only	This object indicates the number of ARP packets that fail source MAC address validation.
C64 dDaiVlanDstMacValidationFailures	1.3.6.1.4.1.171.26.130.1.4.1.1.9	Counter64	read-only	This object indicates the number of ARP packets that fail destination MAC address validation.
C64 dDaiVlanIpValidationFailures	1.3.6.1.4.1.171.26.130.1.4.1.1.10	Counter64	read-only	This object indicates the number of ARP packets that fail IP validation.
INT dDaiVlanStatsClear	1.3.6.1.4.1.171.26.130.1.4.1.1.99	INTEGER	read-write	This object clears the counters in the same row when set to 'clear'. No action is taken if this object is set to 'noOp'. When read, the value 'noOp' is returned.
INT dDaiVlanStatsClearAll	1.3.6.1.4.1.171.26.130.1.4.2	INTEGER	read-write	This object clears the counters of all entries in dDaiVlanStatsTable, when set to 'clear'. No action is taken if this object is set to 'noOp'. When read, the value 'noOp' is returned.
dDaiAclCfg	1.3.6.1.4.1.171.26.130.1.5
U32 dDaiArpAccessListNumber	1.3.6.1.4.1.171.26.130.1.5.1	Unsigned32	read-only	This object indicates the number of entries present in the ARP access list table.
dDaiArpAccessListTable	1.3.6.1.4.1.171.26.130.1.5.2		not-accessible	The table contains information about ARP access list.
dDaiArpAccessListEntry	1.3.6.1.4.1.171.26.130.1.5.2.1		not-accessible	An entry defined in dDaiArpAccessListTable. An entry is created/removed when an ARP access list is created/deleted.
STR dDaiArpAccessListName	1.3.6.1.4.1.171.26.130.1.5.2.1.1	DisplayString	not-accessible	The name of the ARP access list.
ROW dDaiArpAccessListRowStatus	1.3.6.1.4.1.171.26.130.1.5.2.1.99	RowStatus	read-create	This object allows the dynamic creation and deletion of an ARP access list.
dDaiArpAccessRuleTable	1.3.6.1.4.1.171.26.130.1.5.3		not-accessible	A table consists of a list of rules for the ARP access list.
dDaiArpAccessRuleEntry	1.3.6.1.4.1.171.26.130.1.5.3.1		not-accessible	An entry is defined dDaiArpAccessRuleTable. The first instance identifier index value identifies the dDaiArpAccessListEntry that a ARP access rule (dDaiArpAccessRuleEntry) belongs to. An entry is removed from this table when its corresponding dDaiArpAccessListEntry is deleted.
I32 dDaiArpAccessRuleSn	1.3.6.1.4.1.171.26.130.1.5.3.1.1	Integer32	not-accessible	Specifies the sequence number of the rule. A lower number represents a higher priority. The special value of 0 means the priority will be automatically determined by the agent.
ROW dDaiArpAccessRuleRowStatus	1.3.6.1.4.1.171.26.130.1.5.3.1.2	RowStatus	read-create	The row status variable, used according to installation and removal conventions for conceptual rows.
DAI dDaiArpAccessRuleAction	1.3.6.1.4.1.171.26.130.1.5.3.1.3	DaiRuleType	read-create	This object indicates the result of the packet examination is to permit or deny.
MAC dDaiArpAccessRuleSenderMacAddr	1.3.6.1.4.1.171.26.130.1.5.3.1.4	MacAddress	read-create	This object indicates the ARP sender MAC address of the entry.
MAC dDaiArpAccessRuleSenderMacMask	1.3.6.1.4.1.171.26.130.1.5.3.1.5	MacAddress	read-create	This object is a mask bitmap to specify a group of source MAC addresses. The bit value 1 indicates the corresponding bit will be checked. The bit value 0 indicates the corresponding bit will be ignored. In other words, when the value of all '00'Hs indicates any ARP sender MAC address is specified. When the value of all 'ff'Hs indicates host ARP sender MAC address is specified.
IP dDaiArpAccessRuleSenderAddr	1.3.6.1.4.1.171.26.130.1.5.3.1.6	IpAddress	read-create	This object indicates the ARP sender IP address of the entry.
IP dDaiArpAccessRuleSenderAddrMask	1.3.6.1.4.1.171.26.130.1.5.3.1.7	IpAddress	read-create	This object is a mask bitmap to specify a group of source IP addresses. The bit value 1 indicates the corresponding bit will be checked. The bit value 0 indicates the corresponding bit will be ignored. In other words, when the value of all '00'Hs indicates any ARP sender address is specified. When the value of all 'ff'Hs indicates host ARP sender address is specified.
dDaiConformance	1.3.6.1.4.1.171.26.130.2
dDaiMIBCompliances	1.3.6.1.4.1.171.26.130.2.1
dDaiMIBCompliance	1.3.6.1.4.1.171.26.130.2.1.1			The compliance statement for DLINKSW-DAI-MIB
dDaiMIBGroups	1.3.6.1.4.1.171.26.130.2.2
dDaiVlanCtrlGroup	1.3.6.1.4.1.171.26.130.2.2.1			A collection of objects providing configuration regarding the Dynamic ARP Inspection feature per VLAN.
dDaiIfConfigGroup	1.3.6.1.4.1.171.26.130.2.2.2			A collection of objects which are used to configure as well as show information regarding the interface trust state for Dynamic ARP Inspection purpose.
dDaiIfRateLimitGroup	1.3.6.1.4.1.171.26.130.2.2.3			A collection of objects which are used to configure as well as show information regarding the rate limit per interface for Dynamic ARP Inspection purpose.
dDaiLoggingConfigGroup	1.3.6.1.4.1.171.26.130.2.2.4			A collection of objects providing logging configuration for Dynamic ARP Inspection feature.
dDaiAddressValidationGroup	1.3.6.1.4.1.171.26.130.2.2.5			A collection of objects providing address validation configuration for Dynamic ARP Inspection feature.
dDaiVlanCfgGroup	1.3.6.1.4.1.171.26.130.2.2.6			A collection of objects providing additional VLAN configuration for Dynamic ARP Inspection feature.
dDaiVlanStatisticsGroup	1.3.6.1.4.1.171.26.130.2.2.7			A collection of objects providing Dynamic ARP Inspection statistics per VLAN.
dDaiLogBufferGroup	1.3.6.1.4.1.171.26.130.2.2.8			A collection of objects providing logging information or control for Dynamic ARP Inspection feature.
dDaiAclGroup	1.3.6.1.4.1.171.26.130.2.2.9			A collection of objects providing ARP access-list configuration.
dDaiClearStatsGroup	1.3.6.1.4.1.171.26.130.2.2.10			A collection of objects providing clear the Dynamic Arp Inspection statistics.

RFC description

D-Link Dynamic ARP Inspection (DAI) security MIB for switch port protection.

Start monitoring D-Link managed switch (Dynamic ARP Inspection) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download DLINKSW-DAI-MIB