DOS-PREV-MIB

All MIBs › DOS-PREV-MIB

Organization: D-Link Corp.

Last Updated: 2011-01-24

Category: Domain: Security

Description: Manages Denial-of-Service prevention rules and rate limiting policies to protect network infrastructure.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is DOS-PREV-MIB?

DOS-PREV-MIB is a private enterprise MIB used to configure Denial-of-Service prevention rules and rate-limiting policies on a network device such as a switch or router. It exposes configuration-oriented data covering DoS protection rule sets, thresholds, and rate-limiting policy parameters rather than general interface or environmental statistics. Where it does surface runtime state, it supports fault and security-event monitoring by letting an administrator see whether protection rules are active and whether traffic is currently being rate-limited, which is a useful software-status indicator of an ongoing attack. It likely depends on the device's base interface MIB (e.g. IF-MIB) to associate DoS policies with specific physical or logical ports. It is typically deployed on edge switches, routers, or security appliances where operators need to configure and audit automated DoS mitigation. Engineers can download the DOS-PREV-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in DOS-PREV-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

D-Link networking device (DoS prevention/rate-limiting) — Identified as D-Link via the module's own ORGANIZATION field ('D-Link Corp.') and its DLINK-ID-REC-MIB import (D-Link's product-identification OID branch), not a generic unattributed switch/router as previously described.

Monitoring Examples

No object or table names were provided in the source data for this module, so no specific data objects can be cited with confidence. The module description indicates its purpose is purely to configure DoS prevention settings on the device, implying most of its content is configuration rather than counters. If runtime counters exist, an admin would watch for rate-limit or rule-trigger counters climbing sharply as an indicator of an active denial-of-service attempt, but the exact object names cannot be confirmed from the available data.

What Can Be Monitored

DoS prevention rule status
rate-limiting policy thresholds
attack mitigation trigger events

Imported Objects

From DLINK-ID-REC-MIB

dlink-common-mgmt

From SNMPv2-SMI

Integer32
IpAddress
MODULE-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DisplayString
MacAddress
RowStatus
TEXTUAL-CONVENTION
TruthValue

OIDs

OID symbolic	OID numeric	Type	Access	Description
swDoSMgmtMIB	1.3.6.1.4.1.171.12.59			The MIB module for configuring the DoS prevention settings of the device.
swDoSCtrl	1.3.6.1.4.1.171.12.59.1
INT swDoSTrapLog	1.3.6.1.4.1.171.12.59.1.1	INTEGER	read-write	This object indicates the status of the DoS prevention trap log.
INT swDoSClearCounters	1.3.6.1.4.1.171.12.59.1.2	INTEGER	read-write	This object clears the DoS prevention frame counters.
swDoSCtrlTable	1.3.6.1.4.1.171.12.59.1.3		not-accessible	A table that holds the DoS prevention settings of the device.
swDoSCtrlEntry	1.3.6.1.4.1.171.12.59.1.3.1		not-accessible	A list of DoS prevention settings of the device.
INT swDoSCtrlType	1.3.6.1.4.1.171.12.59.1.3.1.1	INTEGER	read-only	This object indicates the DoS prevention type.
INT swDoSCtrlState	1.3.6.1.4.1.171.12.59.1.3.1.2	INTEGER	read-write	This object indicates the status of the DoS prevention type.
INT swDoSCtrlActionType	1.3.6.1.4.1.171.12.59.1.3.1.3	INTEGER	read-write	This object indicates the action for the DoS prevention type. If this object is set to 'mirror' and swDoSCtrlState is set to 'enable', the configuration will not take effect until a valid mirror port is specified. If mirror port is not valid the behavior will be the same as 'drop'
INT swDoSCtrlMirrorPort	1.3.6.1.4.1.171.12.59.1.3.1.4	INTEGER	read-write	This object indicates the port to which the attack packet will be forwarded. A value of 0 means that the DoS prevention action type is either not set to 'mirror'. or the 'mirror' DoS action is not active. When swDoSCtrlActionType is set to 'mirror' with swDoSCtrlState set to 'enable', setting this value to a valid port number will activate the 'mirror' DoS action.
INT swDoSCtrlMirrorPriority	1.3.6.1.4.1.171.12.59.1.3.1.5	INTEGER	read-write	This object configures the priority of the detected packet. Valid priority values are from 0 to 7. The value 8 indicates that there will be no change in the priority of the DoS attack packet as it is forwarded to the mirror port. A valid mirror port must first be specified in order to set this value.
INT swDoSCtrlMirrorRxRate	1.3.6.1.4.1.171.12.59.1.3.1.6	INTEGER	read-write	This object indicates the rate of reception of DoS attack packets. The valid values are 64 to 1024000. A value of 0 indicates that the rate has no limit. The default value is 0. A valid mirror port must first be specified in order to set this value.
INT swDoSCtrlFrameCount	1.3.6.1.4.1.171.12.59.1.3.1.7	INTEGER	read-only	This object indicates the number of frames detected under the DoS prevention type. A valid mirror port must first be specified in order to set this value.
INT swDoSTrapState	1.3.6.1.4.1.171.12.59.1.4	INTEGER	read-write	This object indicates the status of the DoS prevention trap.
INT swDoSLogState	1.3.6.1.4.1.171.12.59.1.5	INTEGER	read-write	This object indicates the status of the DoS prevention log.
STR swDoSFunctionVersion	1.3.6.1.4.1.171.12.59.1.6	DisplayString	read-only	This object indicates the function version.
swDoSNotify	1.3.6.1.4.1.171.12.59.4
swDoSNotifyPrefix	1.3.6.1.4.1.171.12.59.4.0
NTF swDoSAttackDetected	1.3.6.1.4.1.171.12.59.4.0.1			This trap is sent when the specific DoS packet is received and trap is enabled.
swDoSNotifyVarBindings	1.3.6.1.4.1.171.12.59.4.1
IP swDoSNotifyVarIpAddr	1.3.6.1.4.1.171.12.59.4.1.1	IpAddress	accessible-for-notify	If the DoS packet is from the end station, represent the IP address of attacker; otherwise represent the router's IP
STR swDoSNotifyVarPortNumber	1.3.6.1.4.1.171.12.59.4.1.2	DisplayString	accessible-for-notify	This object indicates the attacked portNum with a string, For example, if the device is in standalone mode, and the port number is 23, the string should be 23. If the device is in stack mode, and the unit ID is 2, and the port number is 3, the string should be 2:3.

RFC description

Denial-of-Service (DoS) attack detection and prevention with counter controls and alarm notifications.

Start monitoring D-Link networking device (DoS prevention/rate-limiting) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download DOS-PREV-MIB

What Is DOS-PREV-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description