ENTERASYS-ANTI-SPOOF-MIB

All MIBs › ENTERASYS-ANTI-SPOOF-MIB

Organization: Enterasys Networks, Inc.

Last Updated: 2013-01-15

Category: Domain: Security, VPN and Security, Vendor: Enterasys/Cabletron

Description: Enterasys Networks MIB for configuring IP/MAC anti-spoofing protection to prevent address impersonation attacks.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is ENTERASYS-ANTI-SPOOF-MIB?

ENTERASYS-ANTI-SPOOF-MIB is an Enterasys Networks proprietary MIB configuring anti-spoofing protection (extending the standard P-BRIDGE-MIB) on Enterasys switches. Its objects cover a global system state, maximum class/threshold indices, SNMP-notification enable and interval, a duplicate-IP control setting, and supported action/threshold/binding types, alongside a class table (name, timeout), a threshold table (value, action mask, quarantine-action value, threshold type), and a per-port configuration table including DHCP mode and DHCP MAC-verification. As a configuration/security MIB it lets an administrator confirm anti-spoofing thresholds and quarantine actions are configured as intended, and audit duplicate-IP detection settings. It is deployed on Enterasys Networks managed switches. Engineers can download the ENTERASYS-ANTI-SPOOF-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in ENTERASYS-ANTI-SPOOF-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Enterasys Networks managed switches

Monitoring Examples

An administrator checks etsysAntiSpoofThresholdActionQuarantineValue to confirm what action a switch takes when a host exceeds its configured anti-spoofing threshold.

What Can Be Monitored

anti-spoofing threshold/action configuration
duplicate-IP detection

Imported Objects

From ENTERASYS-MIB-NAMES

etsysModules

OBJECT-IDENTITY

From IF-MIB

InterfaceIndex
InterfaceIndexOrZero
ifIndex	OBJECT-TYPE

From INET-ADDRESS-MIB

InetAddress
InetAddressType

From P-BRIDGE-MIB

EnabledStatus

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Integer32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

MacAddress
TEXTUAL-CONVENTION
TruthValue

How to Use in IPNetwork Monitor

Example using etsysAntiSpoofUntrustedTrafficPacketCounter OID:

Select an Enterasys Networks switch (legacy, later Extreme Networks) (anti-spoofing/DHCP verification) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type etsysAntiSpoofUntrustedTrafficPacketCounter into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. This counter is used to measure the number of DHCP server packets received on this port. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
etsysAntiSpoofMIB	1.3.6.1.4.1.5624.1.2.96			This MIB module defines a portion of the SNMP MIB under the Enterasys Networks enterprise OID pertaining to configuration of the anti-spoofing feature.
etsysAntiSpoofObjects	1.3.6.1.4.1.5624.1.2.96.1
etsysAntiSpoofNotificationBranch	1.3.6.1.4.1.5624.1.2.96.1.0
NTF etsysAntiSpoofClassNotification	1.3.6.1.4.1.5624.1.2.96.1.0.1			This notification indicates that a Anti Spoof class has reached a threshold limit.
NTF etsysAntiSpoofDuplicateIpNotification	1.3.6.1.4.1.5624.1.2.96.1.0.2			This notification indicates that a duplicate IP condition has occurred.
etsysAntiSpoofSystemBranch	1.3.6.1.4.1.5624.1.2.96.1.1
ENA etsysAntiSpoofSystemState	1.3.6.1.4.1.5624.1.2.96.1.1.1	EnabledStatus	read-write	When enabled(1), all objects in this MIB are fully active. When disabled(2), this object overrides all other object settings in this MIB without affecting their values. Maintaining the value of this object across agent reboots is REQUIRED.
U32 etsysAntiSpoofMaxClassIndex	1.3.6.1.4.1.5624.1.2.96.1.1.2	Unsigned32	read-only	The maximum number of class indexes available in the system.
U32 etsysAntiSpoofMaxClassThresholdIndex	1.3.6.1.4.1.5624.1.2.96.1.1.3	Unsigned32	read-only	The maximum number of threshold indexes able to be associated with a particular class.
ENA etsysAntiSpoofSystemSnmpNotifications	1.3.6.1.4.1.5624.1.2.96.1.1.4	EnabledStatus	read-write	The current state of the SNMP Notification functionality in the Anti Spoofing feature. enabled (1) - Anti-Spoofing will generate SNMP Notifications for user IP address or port changes that exceed the configured limits. The Anti-Spoofing feature MUST be enabled for SNMP Notifications to be generated. disabled (2) - Anti-Spoofing will not generate SNMP Notifications under any conditions. A notification is generated when a value is first detected above its respective configured limit. That notification SHOULD NOT be generated again until the configured notification timeout period has elapsed. Agents are not required to generate SNMP Notifications for conditions that exist when this object is set to enabled. SNMP Notifications MAY only be generated after additional IP address changes are detected that exceed the configured limits for the user. Maintaining the value of this object across agent reboots is REQUIRED.
U32 etsysAntiSpoofSystemNotificationInterval	1.3.6.1.4.1.5624.1.2.96.1.1.5	Unsigned32	read-write	The number of seconds to wait before generating another notification of the same type for the same user. This allows notification generation to be throttled in the case of a user who continually changes IP addresses. A value of zero indicates that the entity SHOULD NOT suppress any notifications related to the Anti-Spoofing feature. Maintaining the value of this object across agent reboots is REQUIRED.
ENA etsysAntiSpoofDuplicateIpControl	1.3.6.1.4.1.5624.1.2.96.1.1.6	EnabledStatus	read-write	When this is set to enabled(1) any IP changes will be checked across the system to ensure that the newly configured IP address is not already present. If the IP is present in the system then a syslog and or trap will be issued. When set to disabled(2) this check will not occur.
ANT etsysAntiSpoofSupportedActionTypes	1.3.6.1.4.1.5624.1.2.96.1.1.7	AntiSpoofPortAction	read-only	This object specifies that anti-spoofing action types that the device supports. A bit will be set for each corresponding type that is supported.
BIT etsysAntiSpoofSupportedThresholdTypes	1.3.6.1.4.1.5624.1.2.96.1.1.8	Bits	read-only	This object specifies that anti-spoofing threshold types that the device supports. A bit will be set for each corresponding type that is supported.
BIT etsysAntiSpoofSupportedBindingTypes	1.3.6.1.4.1.5624.1.2.96.1.1.9	Bits	read-only	This object specifies that anti-spoofing binding types that the device supports. A bit will be set for each corresponding type that is supported.
etsysAntiSpoofClassBranch	1.3.6.1.4.1.5624.1.2.96.1.2
etsysAntiSpoofClassTable	1.3.6.1.4.1.5624.1.2.96.1.2.1		not-accessible	Provides for the configuring of each of the classes present in Anti-Spoofing. Maintaining the value of the objects in this table across agent reboots is REQUIRED.
etsysAntiSpoofClassEntry	1.3.6.1.4.1.5624.1.2.96.1.2.1.1		not-accessible	An entry containing per class properties.
U32 etsysAntiSpoofClassIndex	1.3.6.1.4.1.5624.1.2.96.1.2.1.1.1	Unsigned32	not-accessible	The index of class that this row represents. This index has a value between one(1) and etsysAntiSpoofMaxClassIndex.
STR etsysAntiSpoofClassName	1.3.6.1.4.1.5624.1.2.96.1.2.1.1.2	SnmpAdminString	read-write	Administratively assigned textual description of this class.
U32 etsysAntiSpoofClassTimeout	1.3.6.1.4.1.5624.1.2.96.1.2.1.1.3	Unsigned32	read-write	The number of seconds to wait before administratively resetting the counters of the bindings which are based on this class associated with this class. A value of zero indicates that the counters will not be reset automatically.
etsysAntiSpoofThresholdTable	1.3.6.1.4.1.5624.1.2.96.1.2.2		not-accessible	Provides for the configuration of the Anti-Spoofing feature's various thresholds. Maintaining the value of the objects in this table across agent reboots is REQUIRED.
etsysAntiSpoofThresholdEntry	1.3.6.1.4.1.5624.1.2.96.1.2.2.1		not-accessible	An entry providing per class, per threshold configuration.
U32 etsysAntiSpoofThresholdIndex	1.3.6.1.4.1.5624.1.2.96.1.2.2.1.1	Unsigned32	not-accessible	The index of the threshold that this row represents. This index has a value between one(1) and etsysAntiSpoofMaxClassThresholdIndex.
U32 etsysAntiSpoofThresholdValue	1.3.6.1.4.1.5624.1.2.96.1.2.2.1.2	Unsigned32	read-write	The threshold at which the action defined by the class is taken. A value of zero(0) indicates that the threshold actions will never take place.
ANT etsysAntiSpoofThresholdActionMask	1.3.6.1.4.1.5624.1.2.96.1.2.2.1.3	AntiSpoofPortAction	read-write	The action(s) that will be taken when the threshold in the class represented by this row is reached.
I32 etsysAntiSpoofThresholdActionQuarantineValue	1.3.6.1.4.1.5624.1.2.96.1.2.2.1.4	Integer32	read-write	A value that delineates the policy quarantine index to which the user will be assigned. This value is only used if the quarantineUser(2) bit is set in the etsysAntiSpoofThresholdActionMask.
ANT etsysAntiSpoofThresholdType	1.3.6.1.4.1.5624.1.2.96.1.2.2.1.5	AntiSpoofThresholdType	read-write	The class type associated with this entry.
etsysAntiSpoofPortBranch	1.3.6.1.4.1.5624.1.2.96.1.3
etsysAntiSpoofPortConfigTable	1.3.6.1.4.1.5624.1.2.96.1.3.1		not-accessible	A table of per port information and configuration for Anti-Spoofing.
etsysAntiSpoofPortConfigEntry	1.3.6.1.4.1.5624.1.2.96.1.3.1.1		not-accessible	An entry containing per port Anti-Spoofing data.
ENA etsysAntiSpoofDHCPMode	1.3.6.1.4.1.5624.1.2.96.1.3.1.1.1	EnabledStatus	read-write	This object allows for the enabling or disabling of DHCP Snooping functionality on a per-port basis.
ENA etsysAntiSpoofDHCPMacVerify	1.3.6.1.4.1.5624.1.2.96.1.3.1.1.2	EnabledStatus	read-write	This object allows for the enabling or disabling of DHCP-Snooping to verify the source address MAC with chaddr in DHCP packets on incoming client messages.
ANT etsysAntiSpoofArpInspection	1.3.6.1.4.1.5624.1.2.96.1.3.1.1.3	AntiSpoofInspectionType	read-write	When set to enabled(1), dynamic ARP inspection is allowed on this port. When set to disabled(2), dynamic ARP inspection is not allowed on this port. When set to inspectionOnly(3), dynamic ARP inspection will occur but will not be used to create bindings.
ANT etsysAntiSpoofIpInspection	1.3.6.1.4.1.5624.1.2.96.1.3.1.1.4	AntiSpoofInspectionType	read-write	When set to enabled(1), dynamic IP inspection is allowed on this port. When set to disabled(2), dynamic IP inspection is not allowed on this port. When set to inspectionOnly(3), dynamic IP inspection will occur but will not be used to create bindings.
U32 etsysAntiSpoofPortClassIndex	1.3.6.1.4.1.5624.1.2.96.1.3.1.1.5	Unsigned32	read-write	This value represents the class index to be used for the given port. The special case value of zero(0) indicates that no class index will be used for this port.
C32 etsysAntiSpoofUntrustedTrafficPacketCounterEx	1.3.6.1.4.1.5624.1.2.96.1.3.1.1.6	Counter32	read-only	This counter is used to measure the number of DHCP server packets received on this port. This counter will only increment when the etsysAntiSpoofPortType is set to untrusted(3).
etsysAntiSpoofPortTypeTable	1.3.6.1.4.1.5624.1.2.96.1.3.2		not-accessible	A table containing port type information for each port in the system that supports anti-spoofing.
etsysAntiSpoofPortTypeEntry	1.3.6.1.4.1.5624.1.2.96.1.3.2.1		not-accessible	An entry containing per port anti-spoofing configuration data.
ANT etsysAntiSpoofPortType	1.3.6.1.4.1.5624.1.2.96.1.3.2.1.1	AntiSpoofPortType	read-write	This object specifies the port type to be used for this port. The port type indicates how DHCP traffic is handled.
etsysAntiSpoofBindingBranch	1.3.6.1.4.1.5624.1.2.96.1.4
etsysAntiSpoofStationBindingTable	1.3.6.1.4.1.5624.1.2.96.1.4.1		not-accessible	A table containing information pertaining to the current active bindings set up through Anti-Spoofing.
etsysAntiSpoofStationBindingEntry	1.3.6.1.4.1.5624.1.2.96.1.4.1.1		not-accessible	An entry containing per binding data.
OID etsysAntiSpoofStationBindingEntryIndex	1.3.6.1.4.1.5624.1.2.96.1.4.1.1.1	EtsysInstanceOID	not-accessible	The unique index for this columnar row.
MAC etsysAntiSpoofStationBindingEntryMacAddr	1.3.6.1.4.1.5624.1.2.96.1.4.1.1.2	MacAddress	read-only	The MAC address of the binding.
IPt etsysAntiSpoofStationBindingEntryInetAddrType	1.3.6.1.4.1.5624.1.2.96.1.4.1.1.3	InetAddressType	read-only	The IP address type of the binding.
IP etsysAntiSpoofStationBindingEntryInetAddr	1.3.6.1.4.1.5624.1.2.96.1.4.1.1.4	InetAddress	read-only	The IP address of the binding.
NUM etsysAntiSpoofStationBindingEntryIfIndex	1.3.6.1.4.1.5624.1.2.96.1.4.1.1.5	InterfaceIndex	read-only	The port that this binding currently resides on.
C32 etsysAntiSpoofStationBindingEntryInetCounter	1.3.6.1.4.1.5624.1.2.96.1.4.1.1.6	Counter32	read-only	The number of times the IP address has changed for this binding.
T/F etsysAntiSpoofStationBindingEntryClearInetCounter	1.3.6.1.4.1.5624.1.2.96.1.4.1.1.7	TruthValue	read-write	When set to true(1), this object will clear the IP counter associated with this binding. Setting this object to a value of false(2) has no effect. This object MUST always return a value of false(2).
C32 etsysAntiSpoofStationBindingEntryPortCounter	1.3.6.1.4.1.5624.1.2.96.1.4.1.1.8	Counter32	read-only	The number of times the port has changed for this binding.
T/F etsysAntiSpoofStationBindingEntryClearPortCounter	1.3.6.1.4.1.5624.1.2.96.1.4.1.1.9	TruthValue	read-write	When set to true(1), this object will clear the port counter associated with this binding. Setting this object to a value of false(2) has no effect. This object MUST always return a value of false(2).
T/F etsysAntiSpoofStationBindingEntryClearBinding	1.3.6.1.4.1.5624.1.2.96.1.4.1.1.10	TruthValue	read-write	When set to true(1), this object will clear the current binding. Allowing a new binding to be created with the same MAC/IP address and clearing all counter information. Setting this object to a value of false(2) has no effect. This object MUST always return a value of false(2).
ANT etsysAntiSpoofStationBindingEntryBindingType	1.3.6.1.4.1.5624.1.2.96.1.4.1.1.11	AntiSpoofBindingType	read-only	This indicates which binding type (DHCP, ARP, or IP inspection) was used to create the entry.
U32 etsysAntiSpoofStationBindingEntryDurationTime	1.3.6.1.4.1.5624.1.2.96.1.4.1.1.12	Unsigned32	read-only	The amount of time, in seconds, that this binding has been operational for.
U32 etsysAntiSpoofStationBindingEntryExpirationTime	1.3.6.1.4.1.5624.1.2.96.1.4.1.1.13	Unsigned32	read-only	The amount of time, in seconds, from its creation, that this binding will be operational for before being destroyed. A value of zero(0) indicates that this binding will not expire.
etsysAntiSpoofMacBindingTable	1.3.6.1.4.1.5624.1.2.96.1.4.2		not-accessible	A table indicating whether a given binding is accessible. This table is indexed first by MAC, then by IP, and finally by port. In this way a user may quickly determine which bindings are active for a given station address and look up those entries in the etsysAntiSpoofStationBindingTable.
etsysAntiSpoofMacBindingEntry	1.3.6.1.4.1.5624.1.2.96.1.4.2.1		not-accessible	An entry containing per binding data.
NUM etsysAntiSpoofStationBindingInterface	1.3.6.1.4.1.5624.1.2.96.1.4.2.1.1	InterfaceIndexOrZero	not-accessible	The current interface index that the IP/MAC binding resides on.
OID etsysAntiSpoofMacStationBindingIndex	1.3.6.1.4.1.5624.1.2.96.1.4.2.1.2	EtsysInstanceOID	read-only	A unique identifier for this entry to be used as indexing in the etsysAntiSpoofStationBindingTable.
T/F etsysAntiSpoofMacBindingClearBinding	1.3.6.1.4.1.5624.1.2.96.1.4.2.1.3	TruthValue	read-write	When set to true(1), this object will clear the current binding, allowing a new binding to be created with the same MAC/IP address and clearing all counter information. If the etsysAntiSpoofStationBindingInterface index specified in the SET operation is zero (0) it will remove the MAC/IP binding regardless of the current port it is associated with. Specifying an etsysAntiSpoofStationBindingInterface index value between 1..2147483647 will only remove the binding if it currently resides on that specific interface. Setting this object to a value of false(2) has no effect. This object MUST always return a value of false(2).
etsysAntiSpoofIpBindingTable	1.3.6.1.4.1.5624.1.2.96.1.4.3		not-accessible	A table indicating whether a given binding is accessible. This table is indexed first by IP, then by MAC, and finally by port. In this way a user may quickly determine which bindings are active for a given station address and look up those entries in the etsysAntiSpoofStationBindingTable.
etsysAntiSpoofIpBindingEntry	1.3.6.1.4.1.5624.1.2.96.1.4.3.1		not-accessible	An entry containing per binding data.
OID etsysAntiSpoofIpStationBindingIndex	1.3.6.1.4.1.5624.1.2.96.1.4.3.1.1	EtsysInstanceOID	read-only	A unique identifier for this entry to be used as indexing in the etsysAntiSpoofStationBindingTable.
T/F etsysAntiSpoofIpBindingClearBinding	1.3.6.1.4.1.5624.1.2.96.1.4.3.1.2	TruthValue	read-write	When set to true(1), this object will clear the current binding, allowing a new binding to be created with the same MAC/IP address and clearing all counter information. If the etsysAntiSpoofStationBindingInterface index specified in the SET operation is zero (0) it will remove the MAC/IP binding regardless of the current port it is associated with. Specifying an etsysAntiSpoofStationBindingInterface index value between 1..2147483647 will only remove the binding if it currently resides on that specific interface. Setting this object to a value of false(2) has no effect. This object MUST always return a value of false(2).
etsysAntiSpoofPortBindingTable	1.3.6.1.4.1.5624.1.2.96.1.4.4		not-accessible	A table indicating whether a given binding is accessible. This table is indexed first by port, then by MAC, and finally by IP. In this way a user may quickly determine which bindings are active for a given station address and look up those entries in the etsysAntiSpoofStationBindingTable.
etsysAntiSpoofPortBindingEntry	1.3.6.1.4.1.5624.1.2.96.1.4.4.1		not-accessible	An entry containing per binding data.
OID etsysAntiSpoofPortStationBindingIndex	1.3.6.1.4.1.5624.1.2.96.1.4.4.1.1	EtsysInstanceOID	read-only	A unique identifier for this entry to be used as indexing in the etsysAntiSpoofStationBindingTable.
T/F etsysAntiSpoofPortBindingClearBinding	1.3.6.1.4.1.5624.1.2.96.1.4.4.1.2	TruthValue	read-write	When set to true(1), this object will clear the current binding, allowing a new binding to be created with the same MAC/IP address and clearing all counter information. If the etsysAntiSpoofStationBindingInterface index specified in the SET operation is zero (0) it will remove the MAC/IP binding regardless of the current port it is associated with. Specifying an etsysAntiSpoofStationBindingInterface index value between 1..2147483647 will only remove the binding if it currently resides on that specific interface. Setting this object to a value of false(2) has no effect. This object MUST always return a value of false(2).
etsysAntiSpoofConformance	1.3.6.1.4.1.5624.1.2.96.2
etsysAntiSpoofGroups	1.3.6.1.4.1.5624.1.2.96.2.1
etsysAntiSpoofSystemGroup	1.3.6.1.4.1.5624.1.2.96.2.1.1			The scalar group for all devices supporting Anti-Spoofing.
etsysAntiSpoofClassGroup	1.3.6.1.4.1.5624.1.2.96.2.1.2			The base level class group for all devices supporting Anti-Spoofing.
etsysAntiSpoofThresholdGroup	1.3.6.1.4.1.5624.1.2.96.2.1.3			The base level threshold group for all devices supporting Anti-Spoofing.
etsysAntiSpoofPortGroup	1.3.6.1.4.1.5624.1.2.96.2.1.4			This group of objects for all devices supporting per interface Anti-Spoofing settings.
etsysAntiSpoofStationBindingGroup	1.3.6.1.4.1.5624.1.2.96.2.1.5			The group for all devices which support bindings for Anti-Spoofing.
etsysAntiSpoofMacBindingGroup	1.3.6.1.4.1.5624.1.2.96.2.1.6			The group for all devices which support MAC bindings for Anti-Spoofing.
etsysAntiSpoofIpBindingGroup	1.3.6.1.4.1.5624.1.2.96.2.1.7			The group for all devices which support IP bindings for Anti-Spoofing.
etsysAntiSpoofPortBindingGroup	1.3.6.1.4.1.5624.1.2.96.2.1.8			The group for all devices which support IP bindings for Anti-Spoofing.
etsysAntiSpoofNotificationGroup	1.3.6.1.4.1.5624.1.2.96.2.1.9			The group of class notifications for Anti-Spoof.
etsysAntiSpoofCompliances	1.3.6.1.4.1.5624.1.2.96.2.2
etsysAntiSpoofCompliance	1.3.6.1.4.1.5624.1.2.96.2.2.1			The compliance statement for devices that support Anti-Spoof.

RFC description

Enterasys Networks MIB for managing anti-spoofing security features on their network devices. Provides SNMP objects for configuring and monitoring anti-spoofing protection mechanisms, IP source validation, and MAC address verification on Enterasys switches.

Start monitoring Enterasys Networks switch (legacy, later Extreme Networks) (anti-spoofing/DHCP verification) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download ENTERASYS-ANTI-SPOOF-MIB