ERICSSON-ROUTER-SYS-SECURITY-MIB

All MIBs › ERICSSON-ROUTER-SYS-SECURITY-MIB

Organization: Ericsson AB

Last Updated: 2015-01-14

Category: Domain: Security, Vendor: Ericsson

Description: Manages system-level security parameters including login policies, access restrictions, and audit logging on Ericsson routers.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is ERICSSON-ROUTER-SYS-SECURITY-MIB?

ERICSSON-ROUTER-SYS-SECURITY-MIB is an Ericsson vendor MIB defining system- and network-level security monitoring objects for Ericsson SmartEdge/SM/SSR router platforms, scoped per SNMP context (community string or v3 context). It exposes threshold-based counters for detecting malicious or anomalous packet activity, along with configurable measurement intervals and high/low alert thresholds. This is a software-status and fault-monitoring MIB: it tracks accumulating and delta counts of malicious packets, compares them against configured thresholds, and fires notifications when a threshold is crossed, letting operators detect an active attack or abuse condition on the router in near-real time. It is a self-contained Ericsson extension not layered on a specific external security standard, though it follows standard SNMP notification/threshold conventions. It is deployed by network security and NOC teams monitoring Ericsson router platforms for denial-of-service or malformed-packet attack indicators. Engineers can download the ERICSSON-ROUTER-SYS-SECURITY-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in ERICSSON-ROUTER-SYS-SECURITY-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Ericsson SmartEdge (SE) Multi-service Edge Router
Ericsson SM Metro Ethernet platform
Ericsson Smart Service Router (SSR)

Monitoring Examples

A security operations team would poll eriRouterMaliciousPktsCounter and eriRouterMaliciousPktsDelta over eriRouterMeasurementInterval windows to watch for a sudden spike in malicious packets, comparing the values against eriRouterMaliciousPktsThresholdHi and eriRouterMaliciousPktsThresholdLow to decide whether an eriRouterSysSecNotifications trap should have fired. eriRouterThresholdNotifyTime records when the last threshold-crossing notification was generated, helping correlate a security alert with the exact packet-count anomaly, while eriRouterSysSecNotifyEnable is checked to confirm notifications are actually enabled on the router before relying on them for alerting.

What Can Be Monitored

malicious packet counters
packet-rate delta over measurement interval
high/low alert thresholds
threshold-crossing notification status

Imported Objects

From ERICSSON-ROUTER-SMI

eriRouterModules

OBJECT-IDENTITY

From ERICSSON-ROUTER-TC

EriRouterUnsigned64

From HCNUM-TC

CounterBasedGauge64

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Counter64
Gauge32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE

From SNMPv2-TC

DateAndTime

How to Use in IPNetwork Monitor

Example using eriRouterMaliciousPktsCounter OID:

Select an Ericsson router or metro Ethernet platform as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type eriRouterMaliciousPktsCounter into the Find box to locate it in the OID tree, then select it and click OK. It reports a count of all malicious pkts. This includes but is not limited to malformed IP packets, malformed layer 4 IP, packets filtered by ACLs for specific faults, IP packets identified as attempting to spoof a system, and IP packets which failed reassembly. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter64-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases between polls, since a rising count of errors, failures, or discards often points to a real underlying problem. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
eriRouterSysSecurityMib	1.3.6.1.4.1.193.218.5.54			This MIB module defines attributes and notifications related to system and network level security issues. All mib objects defined in the module are viewed within the context identified in the SNMP protocol (i.e. the community string in v1/v2c or the contextName in v3).
eriRouterSysSecNotifications	1.3.6.1.4.1.193.218.5.54.0
NTF eriRouterMaliciousPktThresholdHiExceeded	1.3.6.1.4.1.193.218.5.54.0.1			This notification signifies that one of the delta values is equal to or greater than the corresponding high threshold value. The specific delta value is the last object in the notification varbind list.
NTF eriRouterMaliciousPktThresholdLowExceeded	1.3.6.1.4.1.193.218.5.54.0.2			This notification signifies that one of the delta values is less than or equal to the corresponding low threshold value. The specific delta value is the last object in the notification varbind list.
eriRouterSysSecObjects	1.3.6.1.4.1.193.218.5.54.1
eriRouterSysSecThresholdObjects	1.3.6.1.4.1.193.218.5.54.1.1
BIT eriRouterSysSecNotifyEnable	1.3.6.1.4.1.193.218.5.54.1.1.1	Bits	read-write	The bit mask to enable/disable notifications for crossing specific threshold.
G32 eriRouterMeasurementInterval	1.3.6.1.4.1.193.218.5.54.1.1.2	Gauge32	read-write	Data is sampled at the start and end of a specified interval. The difference between the start and end values \|end - start\| is called the delta value. When setting the interval, care should be taken that the interval should be short enough that the sampled variable is very unlikely to increase or decrease by more than range of the variable.
ERI eriRouterMaliciousPktsThresholdHi	1.3.6.1.4.1.193.218.5.54.1.1.3	EriRouterUnsigned64	read-write	When the current sampling interval delta value of the malicious packets counter is greater than or equal to this threshold, and the delta value at the last sampling interval was less than this threshold, a single high threshold exceeded event will be generated. A single high threshold exceeded event will also be generated if the first sampling interval delta value of the malicious IP packets counter is greater than or equal to this threshold. After a high threshold exceeded event is generated, another such event will not be generated until the delta value falls below this threshold and reaches the eriRouterMaliciousPktsThresholdLow, generating a low threshold exceeded event. In other words there cannot be successive high threshold events without an intervening low threshold event.
ERI eriRouterMaliciousPktsThresholdLow	1.3.6.1.4.1.193.218.5.54.1.1.4	EriRouterUnsigned64	read-write	When the current sampling interval delta value of the malicious packets counter is less than or equal to this threshold, and the delta value at the last sampling interval was greater than this threshold, a single low threshold exceeded event will be generated. In addition, a high threshold exceeded event must occur before a low threshold exceeded event can be generated.
eriRouterSysSecStatsObjects	1.3.6.1.4.1.193.218.5.54.1.2
C64 eriRouterMaliciousPktsCounterEx	1.3.6.1.4.1.193.218.5.54.1.2.1	Counter64	read-only	A count of all malicious pkts. This includes but is not limited to malformed IP packets, malformed layer 4 IP, packets filtered by ACLs for specific faults, IP packets identified as attempting to spoof a system, and IP packets which failed reassembly.
NUM eriRouterMaliciousPktsDelta	1.3.6.1.4.1.193.218.5.54.1.2.2	CounterBasedGauge64	accessible-for-notify	The delta value of eriRouterMaliciousPktsCounter at the most recently completed measurement interval.
eriRouterSysSecNotifyObjects	1.3.6.1.4.1.193.218.5.54.1.4
DAT eriRouterThresholdNotifyTime	1.3.6.1.4.1.193.218.5.54.1.4.1	DateAndTime	accessible-for-notify	The DateAndTime of the notification.
eriRouterSysSecConformance	1.3.6.1.4.1.193.218.5.54.2
eriRouterSysSecCompliances	1.3.6.1.4.1.193.218.5.54.2.1
eriRouterSysSecCompliance	1.3.6.1.4.1.193.218.5.54.2.1.1			The compliance statement for support of this mib module.
eriRouterSysSecGroups	1.3.6.1.4.1.193.218.5.54.2.2
eriRouterMaliciousPktGroup	1.3.6.1.4.1.193.218.5.54.2.2.1			Set of objects for the group.
eriRouterSysSecNotifyObjectsGroup	1.3.6.1.4.1.193.218.5.54.2.2.4			Set of objects for the group.
eriRouterSysSecNotificationGroup	1.3.6.1.4.1.193.218.5.54.2.2.5			Set of notifications for the group.

RFC description

Defines system and network level security attributes and notifications for Ericsson routers, including malicious packet detection.

Start monitoring Ericsson routers and metro Ethernet platforms with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download ERICSSON-ROUTER-SYS-SECURITY-MIB