ELTEX-MES-BRIDGE-SECURITY

All MIBs › ELTEX-MES-BRIDGE-SECURITY

Category: Domain: Security, Vendor: Eltex

Description: Eltex MES bridge security MIB for managing port-based security features including dynamic ARP inspection and IP source guard.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is ELTEX-MES-BRIDGE-SECURITY?

ELTEX-MES-BRIDGE-SECURITY is an Eltex vendor-private MIB that manages Layer 2 bridge security features on Eltex MES-series Carrier Ethernet switches, organized under the eltMesBridgeSecurity subtree with dedicated branches for eltMesIpDhcpSnoop, eltMesPppoeIa, eltMesIpv6DhcpGuard, eltMesIpv6RaGuard, and eltMesIpArpInspect. It defines DHCP Snooping / PPPoE Intermediate Agent option-82 configuration objects such as eltIpDhcpOpt82CircuitIdSuboptionsCombination and eltIpDhcpOpt82PortCircuitId/RemoteId in the eltIpDhcpOpt82PortTable, plus per-port DHCP snooping rate-limit objects (using the EltDHCPSnoopRateLimitType convention) in eltIpDhcpSnoopPortTable, alongside separate control branches for IPv6 DHCP Guard, IPv6 RA Guard, and dynamic ARP inspection. This is a security-configuration MIB rather than a traffic-counter MIB, so monitoring it verifies that anti-spoofing and access-control features (DHCP snooping, ARP inspection, RA/DHCPv6 guard) remain enabled and correctly parameterized on each access port. It depends on IF-MIB for ifIndex/InterfaceIndex references, Q-BRIDGE-MIB for VlanId/PortList types, and the RADLAN-BRIDGE-SECURITY MIB for shared ARP-inspection objects, and is deployed on Eltex MES access/aggregation switches; administrators can download the ELTEX-MES-BRIDGE-SECURITY file to configure and audit these Layer 2 security controls.

IPNetwork Monitor allows you to monitor SNMP objects defined in ELTEX-MES-BRIDGE-SECURITY. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Eltex MES series Carrier Ethernet switches

Monitoring Examples

An operator polls eltIpDhcpOpt82PortTable to confirm eltIpDhcpOpt82PortRowStatus is active(1) and the configured eltIpDhcpOpt82PortCircuitId matches provisioning records on subscriber-facing ports; a port unexpectedly showing a rate-limit value of 0 in the DHCP snooping table alongside eltMesIpArpInspect disabled would indicate the port has lost its anti-spoofing protections.

What Can Be Monitored

DHCP snooping per-port rate limit
PPPoE Intermediate Agent option-82 circuit/remote ID config
DHCPv6 Guard and RA Guard state
dynamic ARP inspection settings
option-82 suboption format/type
per-port DHCP snooping row status

Imported Objects

From ELTEX-MES

eltMes	MODULE-IDENTITY
eltMesBridgeSecurity	OBJECT-IDENTITY

From IF-MIB

InterfaceIndex
ifIndex	OBJECT-TYPE

From Q-BRIDGE-MIB

PortList
VlanId

From RADLAN-BRIDGE-SECURITY

rlIpArpInspectEnableVlanEntry

OBJECT-TYPE

From SNMPv2-SMI

Counter32
IpAddress
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
TimeTicks
Unsigned32

From SNMPv2-TC

DisplayString
MacAddress
RowStatus
TEXTUAL-CONVENTION
TruthValue

How to Use in IPNetwork Monitor

Example using eltPppoeIaPortStatsRxPADI OID:

Select an Eltex MES-series Carrier Ethernet switch (DHCP snooping/PPPoE IA/ARP inspection/RA guard) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type eltPppoeIaPortStatsRxPADI into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. It reports the total number of received PADI packets. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
eltIpArpInspectEnableVlanEntry	1.3.6.1.4.1.35265.1.23.112.7.2.1		not-accessible	Augment for Ip ARP Inspection enabled VLAN entry.
eltIpArpInspectEnableVlanTable	1.3.6.1.4.1.35265.1.23.112.7.2		not-accessible	Augment for Ip ARP Inspection enabled VLAN table.
IP eltIpArpInspectLastDropIP	1.3.6.1.4.1.35265.1.23.112.7.1.1.5	IpAddress	read-only	Sender IP Address of last dropped ARP packet.
MAC eltIpArpInspectLastDropMac	1.3.6.1.4.1.35265.1.23.112.7.1.1.6	MacAddress	read-only	Sender MAC Address of last dropped ARP packet.
TIK eltIpArpInspectLastDropTime	1.3.6.1.4.1.35265.1.23.112.7.1.1.7	TimeTicks	read-only	Time of last dropped ARP packet (system uptime in seconds).
POR eltIpArpInspectPortClearCountersAction	1.3.6.1.4.1.35265.1.23.112.7.3	PortList	read-write	Clear for ports in PortSet (set to zero) Arp Inspection counters: eltIpArpInspectPortNumOfArpForwarded , eltIpArpInspectPortNumOfArpDropped and eltIpArpInspectPortNumOfArpMismatched
INT eltIpArpInspectPortIndex	1.3.6.1.4.1.35265.1.23.112.7.1.1.1	INTEGER	not-accessible	An Ip ARP Inspection entry interface index.
C32 eltIpArpInspectPortNumOfArpDropped	1.3.6.1.4.1.35265.1.23.112.7.1.1.3	Counter32	read-only	Number of dropped ARP packets that were not validated by ARP inspection (mismatch , not-found and dropped for any reason)
C32 eltIpArpInspectPortNumOfArpForwarded	1.3.6.1.4.1.35265.1.23.112.7.1.1.2	Counter32	read-only	Total number of forwarded ARP packets that were validated by ARP inspection
C32 eltIpArpInspectPortNumOfArpMismatched	1.3.6.1.4.1.35265.1.23.112.7.1.1.4	Counter32	read-only	Number of dropped ARP packets that were not validated by ARP inspection and inconsistency was found for IP and MAC (mismatch)
eltIpArpInspectPortStatEntry	1.3.6.1.4.1.35265.1.23.112.7.1.1		not-accessible	An Ip Arp Inspection port entry.
eltIpArpInspectPortStatTable	1.3.6.1.4.1.35265.1.23.112.7.1		not-accessible	An Ip Arp Inspection port table.
IP eltIpArpInspectVlanLastDropIP	1.3.6.1.4.1.35265.1.23.112.7.2.1.1	IpAddress	read-only	Sender IP Address of last dropped ARP packet.
MAC eltIpArpInspectVlanLastDropMac	1.3.6.1.4.1.35265.1.23.112.7.2.1.2	MacAddress	read-only	Sender MAC Address of last dropped ARP packet.
TIK eltIpArpInspectVlanLastDropTime	1.3.6.1.4.1.35265.1.23.112.7.2.1.3	TimeTicks	read-only	Time of last dropped ARP packet (system uptime in seconds).
STR eltIpDhcpOpt82AccessNodeIdentifier	1.3.6.1.4.1.35265.1.23.112.1.14	DisplayString	read-write	Specifies an access node identifier used by PPPoE IA.
ELT eltIpDhcpOpt82CircuitIdSuboptionsCombination	1.3.6.1.4.1.35265.1.23.112.1.15	EltOpt82CombinationType	read-write	Specifies circuit id suboptions that will be inserted to a PPPoED client packet.
ELT eltIpDhcpOpt82CircuitIdSuboptionsDelimeter	1.3.6.1.4.1.35265.1.23.112.1.16	EltOpt82DelimiterType	read-write	Specifies a char symbol that will delimit circuit id suboptions.
ELT eltIpDhcpOpt82PortCircuitId	1.3.6.1.4.1.35265.1.23.112.1.17.1.2	EltCircuitIdType	read-write	A DHCP interface entry curcuit id
eltIpDhcpOpt82PortEntry	1.3.6.1.4.1.35265.1.23.112.1.17.1		not-accessible	A DHCP interface configuration entry.
ELT eltIpDhcpOpt82PortRemoteId	1.3.6.1.4.1.35265.1.23.112.1.17.1.3	EltRemoteIdType	read-write	A DHCP interface entry remote id
ROW eltIpDhcpOpt82PortRowStatus	1.3.6.1.4.1.35265.1.23.112.1.17.1.4	RowStatus	read-only	Session row status.
eltIpDhcpOpt82PortTable	1.3.6.1.4.1.35265.1.23.112.1.17		not-accessible	A DHCP interface configuration table.
STR eltIpDhcpOpt82RemoteIdentifier	1.3.6.1.4.1.35265.1.23.112.1.19	DisplayString	read-write	Specifies global Remote Identifier suboption for Option 82.
ELT eltIpDhcpOpt82SuboptionType	1.3.6.1.4.1.35265.1.23.112.1.18	EltOpt82SuboptionType	read-write	Specifies global format of option 82 suboptions.
eltIpDhcpSnoopPortEntry	1.3.6.1.4.1.35265.1.23.112.1.20.1		not-accessible	A DHCP interface configuration entry.
ELT eltIpDhcpSnoopPortRateLimit	1.3.6.1.4.1.35265.1.23.112.1.20.1.2	EltDHCPSnoopRateLimitType	read-write	A DHCP Snooping Limit Rate.
ROW eltIpDhcpSnoopPortRowStatus	1.3.6.1.4.1.35265.1.23.112.1.20.1.3	RowStatus	read-only	Session row status.
eltIpDhcpSnoopPortTable	1.3.6.1.4.1.35265.1.23.112.1.20		not-accessible	A DHCP Snooping Rate Limiting configuration table on L2 interfaces.
NTF eltIpDhcpSnoopRateLimitTrap	1.3.6.1.4.1.35265.1.23.112.1.0.1			A eltIpDhcpSnoopRateLimitTrap is generated when interface reached the rate limit.
INT eltIpv6DhcpGuardAcl	1.3.6.1.4.1.35265.1.23.112.2.3.1.3	INTEGER	read-write	Set ipv6 ACL index.
INT eltIpv6DhcpGuardEnable	1.3.6.1.4.1.35265.1.23.112.2.1	INTEGER	read-write	Specifies a system DHCPv6 Guard enable state.
eltIpv6DhcpGuardEnableEntry	1.3.6.1.4.1.35265.1.23.112.2.2.1		not-accessible	An Ip Dhcp Snooping enabled VLAN entry.
eltIpv6DhcpGuardEnableTable	1.3.6.1.4.1.35265.1.23.112.2.2		not-accessible	An Ip DHCPv6 Guard enabled VLAN table.
ROW eltIpv6DhcpGuardEnableVlanRowStatus	1.3.6.1.4.1.35265.1.23.112.2.2.1.2	RowStatus	read-write	Entry status. A valid status is CreateandGo and Delete.
VLA eltIpv6DhcpGuardEnableVlanTag	1.3.6.1.4.1.35265.1.23.112.2.2.1.1	VlanId	not-accessible	A DHCP Snoop entry vlan tag.
eltIpv6DhcpGuardEntry	1.3.6.1.4.1.35265.1.23.112.2.3.1		not-accessible	An Ip Dhcp Snooping enabled VLAN entry.
INT eltIpv6DhcpGuardIfIndex	1.3.6.1.4.1.35265.1.23.112.2.3.1.1	INTEGER	read-write	Interface index.
STR eltIpv6DhcpGuardPrefList	1.3.6.1.4.1.35265.1.23.112.2.3.1.4	DisplayString	read-write	Set ipv6 prefix list name.
ELT eltIpv6DhcpGuardRole	1.3.6.1.4.1.35265.1.23.112.2.3.1.2	EltIpv6DhcpGuardRoleType	read-write	Set port role of client/server.
ROW eltIpv6DhcpGuardRowStatus	1.3.6.1.4.1.35265.1.23.112.2.3.1.6	RowStatus	read-write	Entry status. A valid status is CreateandGo and Delete.
eltIpv6DhcpGuardTable	1.3.6.1.4.1.35265.1.23.112.2.3		not-accessible	An Ip DHCPv6 Guard enabled VLAN table.
INT eltIpv6DhcpGuardTrusted	1.3.6.1.4.1.35265.1.23.112.2.3.1.5	INTEGER	read-write	Port is trusted.
INT eltIpv6RaGuardAcl	1.3.6.1.4.1.35265.1.23.112.3.3.1.3	INTEGER	read-write	Set ipv6 ACL index.
INT eltIpv6RaGuardEnable	1.3.6.1.4.1.35265.1.23.112.3.1	INTEGER	read-write	Specifies a system IPv RA Guard enable state.
eltIpv6RaGuardEnableEntry	1.3.6.1.4.1.35265.1.23.112.3.2.1		not-accessible	An Ip Dhcp Snooping enabled VLAN entry.
eltIpv6RaGuardEnableTable	1.3.6.1.4.1.35265.1.23.112.3.2		not-accessible	An Ip DHCPv6 Guard enabled VLAN table.
ROW eltIpv6RaGuardEnableVlanRowStatus	1.3.6.1.4.1.35265.1.23.112.3.2.1.2	RowStatus	read-write	Entry status. A valid status is CreateandGo and Delete.
VLA eltIpv6RaGuardEnableVlanTag	1.3.6.1.4.1.35265.1.23.112.3.2.1.1	VlanId	not-accessible	A DHCP Snoop entry vlan tag.
eltIpv6RaGuardEntry	1.3.6.1.4.1.35265.1.23.112.3.3.1		not-accessible	An Ip ND RA Guard table entry.
INT eltIpv6RaGuardIfIndex	1.3.6.1.4.1.35265.1.23.112.3.3.1.1	INTEGER	read-write	Interface index.
STR eltIpv6RaGuardPrefList	1.3.6.1.4.1.35265.1.23.112.3.3.1.4	DisplayString	read-write	Set ipv6 prefix list name.
ELT eltIpv6RaGuardRole	1.3.6.1.4.1.35265.1.23.112.3.3.1.2	EltIpv6RaGuardRoleType	read-write	Set port role of router/host.
ROW eltIpv6RaGuardRowStatus	1.3.6.1.4.1.35265.1.23.112.3.3.1.6	RowStatus	read-write	Entry status. A valid status is CreateandGo and Delete.
eltIpv6RaGuardTable	1.3.6.1.4.1.35265.1.23.112.3.3		not-accessible	An Ip ND RA Guard table.
INT eltIpv6RaGuardTrusted	1.3.6.1.4.1.35265.1.23.112.3.3.1.5	INTEGER	read-write	Port is trusted.
INT eltIpv6RelayAgentEnable	1.3.6.1.4.1.35265.1.23.112.4	INTEGER	read-write	Lightweight DHCPv6 Relay Agent (rfc 6221)
eltMesIpArpInspect	1.3.6.1.4.1.35265.1.23.112.7
eltMesIpDhcpSnoop	1.3.6.1.4.1.35265.1.23.112.1
eltMesIpDhcpSnoopNotif	1.3.6.1.4.1.35265.1.23.112.1.0
eltMesIpv6DhcpGuard	1.3.6.1.4.1.35265.1.23.112.2
eltMesIpv6RaGuard	1.3.6.1.4.1.35265.1.23.112.3
eltMesPppoeIa	1.3.6.1.4.1.35265.1.23.112.6
STR eltPppoeIaAccessNodeIdentifier	1.3.6.1.4.1.35265.1.23.112.6.2	DisplayString	read-write	Specifies an access node identifier used by PPPoE IA.
ELT eltPppoeIaCircuitIdSuboptionsCombination	1.3.6.1.4.1.35265.1.23.112.6.3	EltOpt82CombinationType	read-write	Specifies circuit id suboptions that will be inserted to a PPPoED client packet.
ELT eltPppoeIaCircuitIdSuboptionsDelimeter	1.3.6.1.4.1.35265.1.23.112.6.4	EltOpt82DelimiterType	read-write	Specifies a char symbol that will delimit circuit id suboptions.
T/F eltPppoeIaClearCountersAction	1.3.6.1.4.1.35265.1.23.112.6.7	TruthValue	read-write	If true, clear (set to zero) counters on all ports.
INT eltPppoeIaEnable	1.3.6.1.4.1.35265.1.23.112.6.1	INTEGER	read-write	Specifies a system PPPoE Intermediate Agent enable state.
STR eltPppoeIaGenericErrorMessage	1.3.6.1.4.1.35265.1.23.112.6.5	DisplayString	read-write	Specifies a generic error message sent to client if packet is too large.
ELT eltPppoeIaPortCircuitId	1.3.6.1.4.1.35265.1.23.112.6.6.1.4	EltCircuitIdType	read-write	A PPPoE Intermediate Agent interface entry curcuit id.
T/F eltPppoeIaPortEnabled	1.3.6.1.4.1.35265.1.23.112.6.6.1.2	TruthValue	read-write	A PPPoE Intermediate Agent interface entry enabled state.
eltPppoeIaPortEntry	1.3.6.1.4.1.35265.1.23.112.6.6.1		not-accessible	A PPPoE Intermediate Agent interface entry.
ELT eltPppoeIaPortRemoteId	1.3.6.1.4.1.35265.1.23.112.6.6.1.5	EltRemoteIdType	read-write	A PPPoE Intermediate Agent interface entry remote id.
ROW eltPppoeIaPortRowStatus	1.3.6.1.4.1.35265.1.23.112.6.6.1.17	RowStatus	read-write	A PPPoE Intermediate Agent interface entry row status.
T/F eltPppoeIaPortStatsClearCountersAction	1.3.6.1.4.1.35265.1.23.112.6.6.1.16	TruthValue	read-write	If true, clear (set to zero) all PPPoE Intermediate Agent interface counters.
C32 eltPppoeIaPortStatsDroppedMalformed	1.3.6.1.4.1.35265.1.23.112.6.6.1.15	Counter32	read-only	Total number of dropped malformed PPPoED packets.
C32 eltPppoeIaPortStatsDroppedRequestToUntrusted	1.3.6.1.4.1.35265.1.23.112.6.6.1.14	Counter32	read-only	Total number of dropped client PPPoED packets from trusted ports.
C32 eltPppoeIaPortStatsDroppedResponseFromUntrusted	1.3.6.1.4.1.35265.1.23.112.6.6.1.13	Counter32	read-only	Total number of dropped server PPPoED packets from untrusted ports.
C32 eltPppoeIaPortStatsRxPADIEx	1.3.6.1.4.1.35265.1.23.112.6.6.1.7	Counter32	read-only	Total number of received PADI packets.
C32 eltPppoeIaPortStatsRxPADO	1.3.6.1.4.1.35265.1.23.112.6.6.1.8	Counter32	read-only	Total number of received PADO packets.
C32 eltPppoeIaPortStatsRxPADR	1.3.6.1.4.1.35265.1.23.112.6.6.1.9	Counter32	read-only	Total number of received PADR packets.
C32 eltPppoeIaPortStatsRxPADS	1.3.6.1.4.1.35265.1.23.112.6.6.1.10	Counter32	read-only	Total number of received PADS packets.
C32 eltPppoeIaPortStatsRxPADT	1.3.6.1.4.1.35265.1.23.112.6.6.1.11	Counter32	read-only	Total number of received PADT packets.
C32 eltPppoeIaPortStatsTxGenError	1.3.6.1.4.1.35265.1.23.112.6.6.1.12	Counter32	read-only	Total number of transmitted PPPoED generic error messages.
T/F eltPppoeIaPortStripVendorTag	1.3.6.1.4.1.35265.1.23.112.6.6.1.6	TruthValue	read-write	A PPPoE Intermediate Agent interface entry enable stripping vendor tag.
eltPppoeIaPortTable	1.3.6.1.4.1.35265.1.23.112.6.6		not-accessible	A PPPoE Intermediate Agent interface table.
T/F eltPppoeIaPortTrusted	1.3.6.1.4.1.35265.1.23.112.6.6.1.3	TruthValue	read-write	A PPPoE Intermediate Agent interface entry trusted state.
eltPppoeIaSessionEntry	1.3.6.1.4.1.35265.1.23.112.6.8.1		not-accessible	A PPPoE Intermediate Agent session entry.
ELT eltPppoeIaSessionID	1.3.6.1.4.1.35265.1.23.112.6.8.1.4	EltPppoeIaSessionIDType	read-only	Session ID.
MAC eltPppoeIaSessionMACAddress	1.3.6.1.4.1.35265.1.23.112.6.8.1.2	MacAddress	read-only	Session MAC address.
NUM eltPppoeIaSessionPort	1.3.6.1.4.1.35265.1.23.112.6.8.1.3	InterfaceIndex	read-only	Session interface index.
ROW eltPppoeIaSessionRowStatus	1.3.6.1.4.1.35265.1.23.112.6.8.1.6	RowStatus	read-only	Session row status.
eltPppoeIaSessionTable	1.3.6.1.4.1.35265.1.23.112.6.8		not-accessible	A PPPoE Intermediate Agent sessions table.
U32 eltPppoeIaSessionTimer	1.3.6.1.4.1.35265.1.23.112.6.8.1.5	Unsigned32	read-only	Session timer.
VLA eltPppoeIaSessionVLANTag	1.3.6.1.4.1.35265.1.23.112.6.8.1.1	VlanId	read-only	Session VLAN ID.

RFC description

Manages bridge security features: DHCP snooping, IPv6 DHCP guard, IPv6 RA guard, PPPoE IA, and ARP inspect.

Start monitoring Eltex MES-series Carrier Ethernet switch (DHCP snooping/PPPoE IA/ARP inspection/RA guard) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download ELTEX-MES-BRIDGE-SECURITY