ENTERASYS-FLOW-LIMITING-MIB

All MIBs › ENTERASYS-FLOW-LIMITING-MIB

Organization: Enterasys Networks, Inc

Last Updated: 2004-07-26

Category: Technology: QoS, Vendor: Enterasys/Cabletron

Description: Enterasys Networks MIB for the flow limiting feature that controls per-port traffic flow rates and detection thresholds.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is ENTERASYS-FLOW-LIMITING-MIB?

ENTERASYS-FLOW-LIMITING-MIB is a vendor-specific MIB from Enterasys Networks (later Extreme Networks) that supports the Flow Limiting security feature on Enterasys switches. It exposes configuration and runtime data for classifying and rate-limiting traffic flows per port, including flow classes, per-class action limits, and system-wide flow/setup-rate capacity. Its monitoring value is centered on software/feature status: whether flow limiting is globally enabled, whether SNMP notifications are turned on, how many flows have triggered configured action limits, and whether ports have been automatically shut down in response to a flow-limit violation (a fault condition worth alerting on). It is part of the Enterasys enterprise MIB tree and is used alongside standard interface MIBs (IF-MIB) since flow-limiting actions apply to specific switch ports. It is typically deployed on Enterasys/Extreme campus and data-center switches as a defense against flooding attacks or misbehaving hosts. Engineers can download the ENTERASYS-FLOW-LIMITING-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in ENTERASYS-FLOW-LIMITING-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Enterasys/Extreme Networks switch

Monitoring Examples

An administrator would poll etsysFlowLimitingSystemState to confirm the feature is active and etsysFlowLimitingSystemMaxSupportedFlowCount/etsysFlowLimitingSystemMaxSupportedSetupRate to understand platform capacity. Walking etsysFlowLimitingClassTable/etsysFlowLimitingClassEntry reveals per-class settings such as etsysFlowLimitingClassType and etsysFlowLimitingClassFlowCountActionLimit1, while etsysFlowLimitingClassFlowCountActionTaken1 shows whether that limit has actually been exceeded. If etsysFlowLimitingSystemInterfaceShutdown indicates a port was disabled, combined with a spike in etsysFlowLimitingClassFlowCountActionTaken1, this reveals a flooding event or a worm-like traffic pattern that triggered automatic port shutdown.

What Can Be Monitored

flow limiting system state
SNMP notification enable status
maximum supported flow count/setup rate
per-class flow count action limits
flow count actions taken
automatic port shutdown due to flow limit

Imported Objects

From ENTERASYS-MIB-NAMES

etsysModules

OBJECT-IDENTITY

From IF-MIB

ifIndex	OBJECT-TYPE
ifName	OBJECT-TYPE

From P-BRIDGE-MIB

EnabledStatus

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Gauge32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
TimeTicks
Unsigned32

From SNMPv2-TC

TEXTUAL-CONVENTION
TruthValue

How to Use in IPNetwork Monitor

Example using etsysFlowLimitingIntfFlowCountCurrent OID:

Select an Enterasys Networks switch (legacy, later Extreme Networks) (Flow Limiting security feature) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type etsysFlowLimitingIntfFlowCountCurrent into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. The current number of flows active on this interface. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Gauge32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline (in flows), since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
etsysFlowLimitingMIB	1.3.6.1.4.1.5624.1.2.43			This MIB module defines the portion of the SNMP enterprise MIBs under Enterasys Networks' enterprise OID pertaining to the Flow Limiting feature.
etsysFlowLimitingObjects	1.3.6.1.4.1.5624.1.2.43.1
etsysFlowLimitingNotificationBranch	1.3.6.1.4.1.5624.1.2.43.1.0
NTF etsysFlowlimitingFlowCountActionLimit1	1.3.6.1.4.1.5624.1.2.43.1.0.1			An etsysFlowlimitingFlowCountActionLimit1 notification indicates that the number of flows on the interface has exceeded the currently configured limit in the associated etsysFlowLimitingClassFlowCountActionLimit1 for the interface.
NTF etsysFlowlimitingFlowCountActionLimit2	1.3.6.1.4.1.5624.1.2.43.1.0.2			An etsysFlowlimitingFlowCountActionLimit2 notification indicates that the number of flows on the interface has exceeded the currently configured limit in the associated etsysFlowLimitingClassFlowCountActionLimit2 for the interface.
NTF etsysFlowLimitingSetupRateNotifyLimit	1.3.6.1.4.1.5624.1.2.43.1.0.3			An etsysFlowLimitingSetupRateNotifyLimit notification indicates that the flow setup rate on the interface has exceeded the currently configured limit for generating a notification.
NTF etsysFlowLimitingSetupRateActionLimit	1.3.6.1.4.1.5624.1.2.43.1.0.4			An etsysFlowLimitingSetupRateExceeded notification indicates that the flow setup rate on the interface has exceeded the currently configured limit for taking an action.
NTF etsysFlowlimitingFlowCountActionLimit1V2	1.3.6.1.4.1.5624.1.2.43.1.0.5			An etsysFlowlimitingFlowCountActionLimit1 notification indicates that the number of flows on the interface has exceeded the currently configured limit in the associated etsysFlowLimitingClassFlowCountActionLimit1 for the interface.
NTF etsysFlowlimitingFlowCountActionLimit2V2	1.3.6.1.4.1.5624.1.2.43.1.0.6			An etsysFlowlimitingFlowCountActionLimit2 notification indicates that the number of flows on the interface has exceeded the currently configured limit in the associated etsysFlowLimitingClassFlowCountActionLimit2 for the interface.
NTF etsysFlowLimitingSetupRateNotifyLimitV2	1.3.6.1.4.1.5624.1.2.43.1.0.7			An etsysFlowLimitingSetupRateNotifyLimit notification indicates that the flow setup rate on the interface has exceeded the currently configured limit for generating a notification.
NTF etsysFlowLimitingSetupRateActionLimitV2	1.3.6.1.4.1.5624.1.2.43.1.0.8			An etsysFlowLimitingSetupRateExceeded notification indicates that the flow setup rate on the interface has exceeded the currently configured limit for taking an action.
etsysFlowLimitingSystemBranch	1.3.6.1.4.1.5624.1.2.43.1.1
ENA etsysFlowLimitingSystemState	1.3.6.1.4.1.5624.1.2.43.1.1.1	EnabledStatus	read-write	The current state of the active part of the Flow Limiting feature. enabled (1) - All aspects of Flow Limiting are operational. disabled (2) - Flow Limiting is configurable but no actions are taken, no notifications are generated and no interfaces will be disabled. All statistical information is still gathered and available. When this object is set to disabled the Flow Limiting feature MUST release its control on all interfaces. Any interfaces that had been operationally held in the 'down' state MUST be allowed to attain their currently correct operational state. Any flows created by the Flow Limiting feature MUST be removed. Maintaining the value of this object across agent reboots is REQUIRED.
ENA etsysFlowLimitingSystemSnmpNotifications	1.3.6.1.4.1.5624.1.2.43.1.1.2	EnabledStatus	read-write	The current state of the SNMP Notification functionality in the Flow Limiting feature. enabled (1) - Flow Limiting will generate SNMP Notifications for flow counts and setup rates that exceed the configured limits. The Flow Limiting feature MUST be enabled for SNMP Notifications to be generated. disabled (2) - Flow Limiting will not generate SNMP Notifications under any conditions. A notification is generated when a value is first detected above its respective configured limit. That notification MUST NOT be generated again until the respective value has transitioned through its respective limit in both directions. Agents are not required to generate SNMP Notifications for conditions that exist when this object is set to enabled. SNMP Notifications MAY only be generated after additional flow setups are detected that exceed the configured limits on that interface. Maintaining the value of this object across agent reboots is REQUIRED.
ENA etsysFlowLimitingSystemInterfaceShutdown	1.3.6.1.4.1.5624.1.2.43.1.1.3	EnabledStatus	read-write	The current state of the interface shutdown functionality in the Flow Limiting feature. enabled (1) - Flow Limiting will shutdown an interface when the conditions on that interface exceed the configured values, one of the specified actions is to disable the interface, and the Flow Limiting feature is enabled. disabled (2) - Flow Limiting will not shutdown any interface under any conditions. When this object is set to disabled the Flow Limiting feature MUST release its control on all interfaces. Any interfaces that had been operationally held in the 'down' state MUST be allowed to attain their currently correct operational state. Agents are not required to shutdown interfaces for conditions that exist when this object is set to enabled. Interfaces MAY only be shutdown after additional flow setups are detected that exceed the configured limits on that interface. Maintaining the value of this object across agent reboots is REQUIRED.
U32 etsysFlowLimitingSystemNotificationInterval	1.3.6.1.4.1.5624.1.2.43.1.1.4	Unsigned32	read-write	The number of seconds to wait before generating another notification of the same type for the same interface. This allows notification generation to be throttled in the case of a flow counter or rate that is repeatedly transitioning across a threshold. A value of zero indicates that the entity should not suppress any notifications related to the Flow Limiting feature. Maintaining the value of this object across agent reboots is REQUIRED.
T/F etsysFlowLimitingSystemClearStats	1.3.6.1.4.1.5624.1.2.43.1.1.5	TruthValue	read-write	When set to true(1) the following objects in all rows of the etsysFlowLimitingInterfaceTable MUST be set to zero: etsysFlowLimitingIntfFlowCountMaxTime etsysFlowLimitingIntfFlowCountEvents etsysFlowLimitingIntfSetupRateMax etsysFlowLimitingIntfSetupRateMaxTime etsysFlowLimitingIntfSetupRateCurrent etsysFlowLimitingIntfSetupRateEvents and the etsysFlowLimitingIntfFlowCountMax objects MUST be set to the value of their respective etsysFlowLimitingIntfFlowCountCurrent objects. Setting this object to false(2) will have no effect. When read this object will always return false(2). Maintaining the value of this object across agent reboots is NOT RECOMMENDED.
U32 etsysFlowLimitingSystemMaxSupportedFlowCount	1.3.6.1.4.1.5624.1.2.43.1.1.6	Unsigned32	read-only	The maximum number of flows supported on this entity.
U32 etsysFlowLimitingSystemMaxSupportedSetupRate	1.3.6.1.4.1.5624.1.2.43.1.1.7	Unsigned32	read-only	The maximum flow setup rate supported on this entity.
etsysFlowLimitingClassBranch	1.3.6.1.4.1.5624.1.2.43.1.2
etsysFlowLimitingClassTable	1.3.6.1.4.1.5624.1.2.43.1.2.1		not-accessible	Provides for the configuration of the Flow Limiting features various interface classes. Maintaining the value of the objects in this table across agent reboots is REQUIRED.
etsysFlowLimitingClassEntry	1.3.6.1.4.1.5624.1.2.43.1.2.1.1		not-accessible	Provides an override to the default thresholds configured for the interface class corresponding to the row. This table MUST be populated with default values that are reasonable for the entity. The default values for all leaves in the 'unspecified' class MUST be zero.
NUM etsysFlowLimitingClassType	1.3.6.1.4.1.5624.1.2.43.1.2.1.1.1	FlowLmtIntfClass	not-accessible	The class of interface that this row represents.
U32 etsysFlowLimitingClassFlowCountActionLimit1	1.3.6.1.4.1.5624.1.2.43.1.2.1.1.2	Unsigned32	read-write	When the number of active flows on an associated interface reaches this level the Flow Limiting feature will invoke the action(s) specified by the etsysFlowLimitingClassFlowCountActionTaken1 object. A value of zero indicates that this limit is disabled. While this limit is disabled the associated action MUST NOT be taken.
NUM etsysFlowLimitingClassFlowCountActionTaken1	1.3.6.1.4.1.5624.1.2.43.1.2.1.1.3	FlowLmtIntfAction	read-write	The action(s) to be taken on an associated interface when the number of active flows on that interface reach the value of etsysFlowLimitingClassFlowCountActionLimit1.
U32 etsysFlowLimitingClassFlowCountActionLimit2	1.3.6.1.4.1.5624.1.2.43.1.2.1.1.4	Unsigned32	read-write	When the number of active flows on an associated interface reaches this level the Flow Limiting feature will invoke the action(s) specified by the etsysFlowLimitingClassFlowCountActionTaken2 object. A value of zero indicates that this limit is disabled. While this limit is disabled the associated action MUST NOT be taken.
NUM etsysFlowLimitingClassFlowCountActionTaken2	1.3.6.1.4.1.5624.1.2.43.1.2.1.1.5	FlowLmtIntfAction	read-write	The action(s) to be taken on an associated interface when the number of active flows on that interface reach the value of etsysFlowLimitingClassFlowCountActionLimit2.
U32 etsysFlowLimitingClassSetupRateNotifyLimit	1.3.6.1.4.1.5624.1.2.43.1.2.1.1.6	Unsigned32	read-write	The flow setup rate on an associated interface at which the Flow Limiting feature will generate an etsysFlowlimitingSetupRateNotifyLimit notification. A value of zero indicates that this limit is disabled. While this limit is disabled the associated notification MUST NOT be generated.
U32 etsysFlowLimitingClassSetupRateActionLimit	1.3.6.1.4.1.5624.1.2.43.1.2.1.1.7	Unsigned32	read-write	The flow setup rate on an associated interface at which the Flow Limiting feature will invoke the action(s) specified by the etsysFlowLimitingClassSetupRateActionTaken object. A value of zero indicates that this limit is disabled. While this limit is disabled the associated action MUST NOT be taken.
NUM etsysFlowLimitingClassSetupRateActionTaken	1.3.6.1.4.1.5624.1.2.43.1.2.1.1.8	FlowLmtIntfAction	read-write	The action(s) to be taken on an associated interface when the flow setup rate on that interface reachs the value of the etsysFlowLimitingClassSetupRateActionLimit object.
etsysFlowLimitingInterfaceBranch	1.3.6.1.4.1.5624.1.2.43.1.3
etsysFlowLimitingInterfaceTable	1.3.6.1.4.1.5624.1.2.43.1.3.1		not-accessible	A table that provides for the configuration, status, and statistics related to, the Flow Limiting feature on a per interface basis.
etsysFlowLimitingInterfaceEntry	1.3.6.1.4.1.5624.1.2.43.1.3.1.1		not-accessible	The configuration, status, and statistics related to, the Flow Limiting feature for an individual interface.
NUM etsysFlowLimitingIntfClassType	1.3.6.1.4.1.5624.1.2.43.1.3.1.1.1	FlowLmtIntfClass	read-write	The Flow Limiting interface class associated with this interface. The class defines the flow limits and actions to be taken when those limits are exceeded. When the value of this object changes and flow limiting is currently enabled, both globally and on this interface, the agent MUST perform the following steps prior to enforcing the new limits: 1) If the interface had been operationally held in the 'down' state due to prior flow conditions it MUST be allowed to attain its currently correct operational state. 2) Any flows created by the Flow Limiting feature for this interface must be removed. 3) The respective etsysFlowLimitingIntfFlowCountEvents and etsysFlowLimitingIntfSetupRateEvents objects MUST be set to zero. 4) etsysFlowLimitingIntfStatus and etsysFlowLimitingIntfReason MUST be set to operational(1) and noAction(1) respectively. Maintaining the value of this object across agent reboots is REQUIRED.
ENA etsysFlowLimitingIntfFlowLimitingState	1.3.6.1.4.1.5624.1.2.43.1.3.1.1.2	EnabledStatus	read-write	The enable state of Flow Limiting on this interface. Setting this object to disabled(2) will disable the active part of the Flow Limiting feature as defined for the etsysFlowLimitingSystemState object on this interface. When the value of this object changes from enabled(1) to disabled(2) the agent MUST: 1) Release its control on this interface. If it had been operationally held in the 'down' state it MUST be allowed to attain its currently correct operational state. 2) Remove any flows created by the Flow Limiting feature for this interface. 3) The respective etsysFlowLimitingIntfFlowCountEvents and etsysFlowLimitingIntfSetupRateEvents objects MUST be set to zero. 4) etsysFlowLimitingIntfStatus and etsysFlowLimitingIntfReason MUST be set to operational(1) and noAction(1) respectively. Maintaining the value of this object across agent reboots is REQUIRED.
INT etsysFlowLimitingIntfStatus	1.3.6.1.4.1.5624.1.2.43.1.3.1.1.3	INTEGER	read-write	The current status of the interface with respect to Flow Limiting. A read of operational(1) indicates that the Flow Limiting feature has not taken any action to operationally limit this interface. A read of disabled(2) indicates that the Flow Limiting feature has taken action to operationally disable this interface due to ... A read of droppingExcessFlows(3) indicates that this interface ... A read of creatingDiscardFlows(4) indicates that this interface ... Setting this object to operational(1) when it is disabled(2) will cause Flow Limiting to release it's control that is keeping this interface operationally disabled. Any other write of this object will have no effect. Maintaining the value of this object across agent reboots is NOT RECOMMENDED.
INT etsysFlowLimitingIntfReason	1.3.6.1.4.1.5624.1.2.43.1.3.1.1.4	INTEGER	read-only	The reason the last action was taken on this interface by the Flow Limiting feature. Maintaining the value of this object across agent reboots is NOT RECOMMENDED.
T/F etsysFlowLimitingIntfClearStats	1.3.6.1.4.1.5624.1.2.43.1.3.1.1.5	TruthValue	read-write	When set to true(1) the following objects in this row MUST be set to zero: etsysFlowLimitingIntfFlowCountMaxTime etsysFlowLimitingIntfFlowCountEvents etsysFlowLimitingIntfSetupRateMax etsysFlowLimitingIntfSetupRateMaxTime etsysFlowLimitingIntfSetupRateCurrent etsysFlowLimitingIntfSetupRateEvents and the etsysFlowLimitingIntfFlowCountMax object MUST be set to the value of the etsysFlowLimitingIntfFlowCountCurrent object. Setting this object to false(2) will have no effect. When read this object will always return false(2).
G32 etsysFlowLimitingIntfFlowCountCurrentEx	1.3.6.1.4.1.5624.1.2.43.1.3.1.1.6	Gauge32	read-only	The current number of flows active on this interface. This information is always available and current.
G32 etsysFlowLimitingIntfFlowCountMax	1.3.6.1.4.1.5624.1.2.43.1.3.1.1.7	Gauge32	read-only	The maximum number of flows that have been active on this interface since the last agent reset. This information is always available and current.
TIK etsysFlowLimitingIntfFlowCountMaxTime	1.3.6.1.4.1.5624.1.2.43.1.3.1.1.8	TimeTicks	read-only	The TimeTicks since the maximum number of flows was recorded. This information is always available and current.
G32 etsysFlowLimitingIntfFlowCountEvents	1.3.6.1.4.1.5624.1.2.43.1.3.1.1.9	Gauge32	read-only	The number of times that the number of flows on this interface exceeded any associated limit.
G32 etsysFlowLimitingIntfSetupRateCurrent	1.3.6.1.4.1.5624.1.2.43.1.3.1.1.10	Gauge32	read-only	The current flow setup rate on this interface. This information is always available and current.
G32 etsysFlowLimitingIntfSetupRateMax	1.3.6.1.4.1.5624.1.2.43.1.3.1.1.11	Gauge32	read-only	The maximum flow setup rate on this interface since the last agent reset. This information is always available and current.
TIK etsysFlowLimitingIntfSetupRateMaxTime	1.3.6.1.4.1.5624.1.2.43.1.3.1.1.12	TimeTicks	read-only	The TimeTicks since the maximum flow setup rate was recorded. This information is always available and current.
G32 etsysFlowLimitingIntfSetupRateEvents	1.3.6.1.4.1.5624.1.2.43.1.3.1.1.13	Gauge32	read-only	The number of times that the setup rate on this interface exceeded any associated limit.
NUM etsysFlowLimitingIntfFlowProcessingLayer	1.3.6.1.4.1.5624.1.2.43.1.3.1.1.14	FlowLmtIntfLayer	read-only	The highest OSI layer at which flows are processed. This is used to give an indication of how much detail is contained in the flows created on the interface. An interface reporting that flows being processed at L4 will create flows that have information from L2, L3, and L4. In general, interfaces reporting processing at L4 would be expected to have a higher number of flows than interfaces reporting processing at L2 assuming all else equal.
etsysFlowLimitingConformance	1.3.6.1.4.1.5624.1.2.43.2
etsysFlowLimitingGroups	1.3.6.1.4.1.5624.1.2.43.2.1
etsysFlowLimitingSystemGroup	1.3.6.1.4.1.5624.1.2.43.2.1.1			A collection of objects providing global configuration, statistics, and status for the Flow Limiting feature.
etsysFlowLimitingInterfaceGroup	1.3.6.1.4.1.5624.1.2.43.2.1.2			A collection of objects providing interface based configuration and status of the Flow Limiting feature.
etsysFlowLimitingFlowCountGroup	1.3.6.1.4.1.5624.1.2.43.2.1.3			A collection of objects related to understanding and limiting the number of flows on individual interfaces.
etsysFlowLimitingSetupRateGroup	1.3.6.1.4.1.5624.1.2.43.2.1.4			A collection of objects related to understanding and limiting interface flow setup rates on individual interfaces.
etsysFlowLimitingFlowCountNotificationGroup	1.3.6.1.4.1.5624.1.2.43.2.1.5			A collection of notifications related to the number of flows on individual interfaces.
etsysFlowLimitingSetupRateNotificationGroup	1.3.6.1.4.1.5624.1.2.43.2.1.6			A collection of notifications related to flow setup rates on individual interfaces.
etsysFlowLimitingInterfaceGroupV2	1.3.6.1.4.1.5624.1.2.43.2.1.7			A collection of objects providing interface based configuration and status of the Flow Limiting feature.
etsysFlowLimitingFlowCountNotificationGroupV2	1.3.6.1.4.1.5624.1.2.43.2.1.8			A collection of notifications related to the number of flows on individual interfaces.
etsysFlowLimitingSetupRateNotificationGroupV2	1.3.6.1.4.1.5624.1.2.43.2.1.9			A collection of notifications related to flow setup rates on individual interfaces.
etsysFlowLimitingCompliances	1.3.6.1.4.1.5624.1.2.43.2.2
etsysFlowLimitingCompliance	1.3.6.1.4.1.5624.1.2.43.2.2.1			The compliance statement for devices that support Flow Limiting.
etsysFlowLimitingComplianceV2	1.3.6.1.4.1.5624.1.2.43.2.2.2			The compliance statement for devices that support Flow Limiting.
etsysFlowLimitingComplianceV3	1.3.6.1.4.1.5624.1.2.43.2.2.3			The compliance statement for devices that support Flow Limiting.

RFC description

Manages flow limiting features on Enterasys network devices to control traffic flow and generate flow threshold notifications.

Start monitoring Enterasys Networks switch (legacy, later Extreme Networks) (Flow Limiting security feature) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download ENTERASYS-FLOW-LIMITING-MIB