DLINKSW-IP-SOURCE-GUARD-MIB

All MIBs › DLINKSW-IP-SOURCE-GUARD-MIB

Organization: D-Link Corp.

Last Updated: 2013-07-18

Category: Security

Description: Configures IP Source Guard bindings to prevent IP spoofing on D-Link switches.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is DLINKSW-IP-SOURCE-GUARD-MIB?

This is a D-Link proprietary MIB configuring IP Source Guard on D-Link switches, a security feature that filters traffic per port based on a binding table of legitimate IP-to-MAC-to-VLAN mappings (typically learned from DHCP snooping) to prevent IP spoofing. It exposes configuration for enabling IP Source Guard per port and the associated binding table entries. For monitoring, an admin checks whether IP Source Guard is enabled on the expected access ports and reviews the binding table to confirm legitimate hosts are correctly bound; a port with the feature unexpectedly disabled, or traffic being dropped due to a missing binding entry, indicates either a misconfiguration or a genuine spoofing attempt being blocked. It builds on the same DHCP-snooping binding-table concept used by IP Source Guard implementations across the industry, without importing a single common IETF MIB. It is deployed on D-Link switches at the access layer to prevent IP address spoofing from connected end hosts. Engineers can download the DLINKSW-IP-SOURCE-GUARD-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in DLINKSW-IP-SOURCE-GUARD-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

D-Link managed switch

Monitoring Examples

No sample object names were provided for this module, so specific OIDs cannot be cited here. Based on its description, a realistic scenario is checking per-port IP Source Guard enable state and reviewing the IP-to-MAC-to-VLAN binding table, to catch a port where the feature was disabled or where a legitimate host's binding entry is missing and its traffic is being incorrectly dropped.

What Can Be Monitored

per-port IP Source Guard enable state
IP-to-MAC-to-VLAN binding table entries

Imported Objects

From DLINK-ID-REC-MIB

dlinkIndustrialCommon

OBJECT-IDENTITY

From DLINKSW-TC-MIB

Dlink2kVlanList

From IF-MIB

InterfaceIndex
ifIndex	OBJECT-TYPE

From INET-ADDRESS-MIB

InetAddressIPv4

From Q-BRIDGE-MIB

VlanId

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

MODULE-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

MacAddress
RowStatus

OIDs

OID symbolic	OID numeric	Type	Access	Description
dlinkSwIpSourceGuardMIB	1.3.6.1.4.1.171.26.132			The MIB module is for configuration of IP Source Guard feature.
dIpSourceGuardMIBNotifs	1.3.6.1.4.1.171.26.132.0
dIpSourceGuardMIBObjects	1.3.6.1.4.1.171.26.132.1
dIpsgBindings	1.3.6.1.4.1.171.26.132.1.1
dIpsgStaticBindingsTable	1.3.6.1.4.1.171.26.132.1.1.1		not-accessible	A table provides the manual bindings information. e.g. VLAN MAC Address IP Address Interface ---- ----------------- ---------- --------- 2000 00.01.02.03.04.05 172.18.1.1 8 3000 00.05.06.07.08.09 10.1.1.1 3 4094 00.10.20.30.40.55 1.1.1.1 5 4094 00.10.20.30.40.55 1.1.1.1 6 4094 00.10.20.30.40.55 1.1.1.1 8
dIpsgStaticBindingsEntry	1.3.6.1.4.1.171.26.132.1.1.1.1		not-accessible	An entry defines a manual binding.
VLA dIpsgStaticBindingsVlan	1.3.6.1.4.1.171.26.132.1.1.1.1.1	VlanId	not-accessible	This object indicates the VLAN to which a host belongs.
MAC dIpsgStaticBindingsMacAddress	1.3.6.1.4.1.171.26.132.1.1.1.1.2	MacAddress	not-accessible	This object indicates the MAC address of a host.
ADR dIpsgStaticBindingsIpAddress	1.3.6.1.4.1.171.26.132.1.1.1.1.3	InetAddressIPv4	not-accessible	This object indicates the allocated IP address of host.
NUM dIpsgStaticBindingsInterface	1.3.6.1.4.1.171.26.132.1.1.1.1.4	InterfaceIndex	not-accessible	This object indicates the ifIndex value of the interface where a host connects to.
ROW dIpsgStaticBindingsRowStatus	1.3.6.1.4.1.171.26.132.1.1.1.1.99	RowStatus	read-create	This object is used to manage the creation and deletion of rows in this table.
dIpsgSrcGuard	1.3.6.1.4.1.171.26.132.1.2
dIpsgIfSrcGuardConfigTable	1.3.6.1.4.1.171.26.132.1.2.1		not-accessible	A table provides the mechanism to enable or disable IP Source Guard at every interface capable of this feature. When DHCP Snooping is enabled at an interface, a list of IP addresses is obtained through DHCP Snooping for this particular interface. If IP Source Guard is enabled, only traffic from these IP addresses is allowed to pass through the interface.
dIpsgIfSrcGuardConfigEntry	1.3.6.1.4.1.171.26.132.1.2.1.1		not-accessible	A row instance contains the configuration to enable or disable IP Source Guard as well as the configuration of the filter type at each interface capable of IP Source Guard feature.
INT dIpsgIfSrcGuardFilterType	1.3.6.1.4.1.171.26.132.1.2.1.1.1	INTEGER	read-write	This object indicates the traffic filter type applied at this interface. 'disable' - indicates that IP Source Guard feature is disabled. 'ip' - the validation is based on source IP address and VLAN only. 'ipMac' - the validation is based on the source MAC address, VLAN and IP address.
dIpsgIfSrcGuardAddrTable	1.3.6.1.4.1.171.26.132.1.2.2		not-accessible	A table provides the information on IP addresses used for IP Source Guard purpose at every interface capable of this feature.
dIpsgIfSrcGuardAddrEntry	1.3.6.1.4.1.171.26.132.1.2.2.1		not-accessible	An entry defines a binding information that is used to guard the IP traffic. The binding entry may be either manually configured or automatically learned via DHCP snooping.
U32 dIpsgIfSrcGuardIndex	1.3.6.1.4.1.171.26.132.1.2.2.1.1	Unsigned32	not-accessible	This object is used to index the dIpsgIfSrcGuardAddrTable. This index is for SNMP purposes only, and has no intrinsic meaning.
INT dIpsgIfSrcGuardFilterMode	1.3.6.1.4.1.171.26.132.1.2.2.1.2	INTEGER	read-only	This object indicates the Source Guard filter mode at this interface. active(1) indicates that the Source Guard feature is active at this interface. inactiveTrustPort(2) indicates that the Source Guard feature is inactive because this interface is a DHCP Snooping trust interface and all IP traffic is permitted. In this case, dIpsgIfSrcGuardIpFilterAction is 'permitAllIpAdress'. inactiveNoSnoopingVlan(3) indicates that the Source Guard feature is inactive because this interface does not have a VLAN which has DHCP Snooping enabled and no IP source verify entry is active. In this case, all IP traffic is denied and dIpsgIfSrcGuardIpFilterAction is 'denyAllIpAddress'. If this object is not 'active', the entry is a special entry: traffic from any VLANs on the interface has the same behavior indicated by dIpsgIfSrcGuardIpFilterAction and both dIpsgIfSrcGuardVlansFirst2K and dIpsgIfSrcGuardVlansSecond2K are empty.
ADR dIpsgIfSrcGuardIpAddress	1.3.6.1.4.1.171.26.132.1.2.2.1.3	InetAddressIPv4	read-only	This object indicates the IP address of the entry. A special value of '0.0.0.0' indicates this object is meaningless.
INT dIpsgIfSrcGuardIpFilterAction	1.3.6.1.4.1.171.26.132.1.2.2.1.4	INTEGER	read-only	This object indicates the IP Source Guard action applied at this interface with respect to IP traffic. permitIpAddress(1) - indicates that matching IP traffic will be allowed to go through. What is matching traffic depends on the value of dIpsgIfSrcGuardMacFilterAction. permitAllIpAdress(2) indicates that all IP traffic coming to this interface will be allowed. In this case, dIpsgIfSrcGuardIpAddress is 0.0.0.0. denyAllIpAdress(3) indicates that all IP traffic coming to this interface will be dropped. In this case, dIpsgIfSrcGuardIpAddress is 0.0.0.0. When this object is not 'permitIpAddress', the value of dIpsgIfSrcGuardMacFilterAction is meaningless.
MAC dIpsgIfSrcGuardMacAddress	1.3.6.1.4.1.171.26.132.1.2.2.1.5	MacAddress	read-only	This object indicates the MAC address of the entry. A special value of '000000000000'H indicates this object is meaningless.
INT dIpsgIfSrcGuardMacFilterAction	1.3.6.1.4.1.171.26.132.1.2.2.1.6	INTEGER	read-only	This object indicates the Source Guard action applied when the traffic matching the entry: allowMacAddress(1) - indicates that the IP traffic (compared source IP and source MAC with dIpsgIfSrcGuardIpAddress and dIpsgIfSrcGuardMacAddress respectively) will be allowed to go through. permitAllMacAddresses(2) - If dIpsgIfSrcGuardIpFilterAction is 'permitIpAddress', this value indicates that all the IP matching traffic (compared source IP with dIpsgIfSrcGuardIpAddress only) will be allowed to go through. When dIpsgIfSrcGuardIpFilterAction is 'permitAllIpAdress' or 'denyAllIpAdress', this object is meaningless. When dIpsgIfSrcGuardMacFilterAction is 'permitAllMacAddresses', dIpsgIfSrcGuardMacAddress is meaningless and '000000000000'H is used to indicate it.
DLI dIpsgIfSrcGuardVlansFirst2K	1.3.6.1.4.1.171.26.132.1.2.2.1.7	Dlink2kVlanList	read-only	This object specifies the VLANs the entry is applied to in a string of octets containing one bit per VLAN for VLANs 1 to 2048. If the bit is set to '1', then the IP Source Guard is enabled on the VLAN.
DLI dIpsgIfSrcGuardVlansSecond2K	1.3.6.1.4.1.171.26.132.1.2.2.1.8	Dlink2kVlanList	read-only	This object specifies the VLANs the entry is applied to in a string of octets containing one bit per VLAN for VLANs 2049 to 4094. If the bit is set to '1', then the IP Source Guard is enabled on the VLAN.
dIpSourceGuardMIBConformance	1.3.6.1.4.1.171.26.132.2
dIpsgMIBCompliances	1.3.6.1.4.1.171.26.132.2.1
dIpsgMIBCompliance	1.3.6.1.4.1.171.26.132.2.1.1			The compliance statement for the DLINKSW-IP-SOURCE-GUARD-MIB.
dIpsgMIBGroups	1.3.6.1.4.1.171.26.132.2.2
dIpsgStaticBindingsGroup	1.3.6.1.4.1.171.26.132.2.2.1			A collection of objects which are used to configure as well as show information regarding the static binding data for IP Source Guard.
dIpsgVerifySrcInfoGroup	1.3.6.1.4.1.171.26.132.2.2.2			A collection of objects which are used to show information regarding interface IP source guard purpose.
dIpsgVerifySrcInfoExtGroup	1.3.6.1.4.1.171.26.132.2.2.3			A collection of objects which are used to indicate additional information regarding the IP source guard feature.
dIpsgIfSrcGuardTrafficFilterGroup	1.3.6.1.4.1.171.26.132.2.2.4			A collection of objects which are used to configure the type of traffic to be filtered by IP source guard feature.

RFC description

D-Link IP Source Guard MIB for DHCP snooping and IP-MAC-VLAN binding enforcement.

Start monitoring D-Link managed switch (IP Source Guard) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download DLINKSW-IP-SOURCE-GUARD-MIB

What Is DLINKSW-IP-SOURCE-GUARD-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description