EIP-DNSBLAST-MIB

MIB Reference — IPNetwork Monitor · Updated October 05, 2026

All MIBs › EIP-DNSBLAST-MIB

Organization: EfficientIP

Last Updated: 2015-11-30

Category: Domain: Security

Description: EIP DNS blast MIB for monitoring DNS amplification and DDoS attack metrics on enterprise internet protection platforms.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is EIP-DNSBLAST-MIB?

EIP-DNSBLAST-MIB is an enterprise MIB for EIP's DNSGUARDIAN platform, a DNS security appliance used to defend against DNS amplification attacks, cache poisoning, and other DNS-based DDoS traffic. It exposes per-view DNS statistics -- cache hit/miss counts, cache size, and the volume of DNS packets and bytes sent and received -- organized in the eipDNSGUARDIANViewStatTable, giving a real-time performance and traffic profile of the DNS resolver. This is fundamentally a software/service-health MIB: a sudden spike in received DNS packets/bytes paired with a rise in cache misses is a strong signal of an active DNS flood or amplification attack against the protected view, while cache-hit ratio trends indicate normal resolver efficiency. It appears to be a standalone product MIB with no explicit dependency on other MIBs, defining its own object tree under products/eipDNSGUARDIAN. It is deployed on EIP DNSGUARDIAN appliances sitting in front of authoritative or recursive DNS infrastructure at enterprises and service providers. Engineers can download the EIP-DNSBLAST-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in EIP-DNSBLAST-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

  • EIP DNSGUARDIAN DNS security appliances

Monitoring Examples

An operator would poll eipDNSGUARDIANViewStatTable, indexed by eipDNSGUARDIANViewStatViewID and eipDNSGUARDIANViewStatViewName, watching eipDNSGUARDIANViewStatRecvDNSPacket and eipDNSGUARDIANViewStatRecvDNSByte for sudden spikes. A simultaneous jump in eipDNSGUARDIANViewStatCacheMiss and eipDNSGUARDIANViewStatCacheMissExist alongside falling eipDNSGUARDIANViewStatCacheHit would indicate an ongoing DNS amplification or cache-busting attack against that view. Tracking eipDNSGUARDIANViewStatCacheSize over time also helps confirm the cache isn't being exhausted under load.

What Can Be Monitored

  • DNS cache hit/miss counts
  • DNS cache size
  • DNS packets sent/received
  • DNS bytes sent/received
  • per-view DNS traffic statistics

This MIB depends on

Related MIBs

Imported Objects

From SNMPv2-SMI

Counter64
Gauge32
Integer32
MODULE-IDENTITY
OBJECT-TYPE
enterprises

From SNMPv2-TC

DisplayString
TEXTUAL-CONVENTION

How to Use in IPNetwork Monitor

Example using eipDNSGUARDIANStatCacheHit OID:

Select an EfficientIP DNSGUARDIAN DNS security appliance as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type eipDNSGUARDIANStatCacheHit into the Find box to locate it in the OID tree, then select it and click OK. The number of DNS Guardian cache hits. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter64-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.
OIDs

RFC description

DNSGUARDIAN statistics MIB providing DNS view statistics, cache hit/miss metrics, and DNS transaction data.

Start monitoring EfficientIP DNSGUARDIAN DNS security appliance with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download EIP-DNSBLAST-MIB