EXTREME-IP-SECURITY-MIB

All MIBs › EXTREME-IP-SECURITY-MIB

Organization: Extreme Networks, Inc.

Last Updated: 2005-02-14

Category: Domain: Security, VPN and Security, Vendor: Extreme Networks

Description: Extreme Networks MIB for IP security features including Dynamic ARP Inspection, IP source guard, and DHCP snooping configurations.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is EXTREME-IP-SECURITY-MIB?

EXTREME-IP-SECURITY-MIB is an Extreme Networks vendor MIB covering IP-layer security features on Extreme switches, including Dynamic ARP Inspection (DAI), IP Source Guard, and DHCP snooping. It exposes configuration and status data for these anti-spoofing and access-control mechanisms, such as which ports/VLANs have these features enabled and their binding/violation state. Its monitoring value centers on security/software feature status rather than physical hardware sensors: an operator can check whether DHCP snooping or IP source guard bindings are correctly populated and whether ARP inspection is dropping unexpected packets, functioning as fault/anomaly monitoring for the security subsystem. It builds on standard Layer 2/3 security concepts (DHCP snooping, ARP inspection) as implemented in Extreme's switch software, with no explicit dependency noted on external IETF security MIBs in the available extract. It is typically deployed on Extreme access-layer switches in environments requiring protection against ARP spoofing, rogue DHCP servers, and IP address spoofing, typically after an EXTREME-IP-SECURITY-MIB download is compiled into the network's SNMP management platform.

IPNetwork Monitor allows you to monitor SNMP objects defined in EXTREME-IP-SECURITY-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Extreme Networks access-layer Ethernet switch

Monitoring Examples

No specific object/table names were provided in the extract for this MIB, so specific object names cannot be cited without invention. In general use, an administrator would check per-port/VLAN enablement status for Dynamic ARP Inspection, IP Source Guard, and DHCP snooping, along with binding-table entries, to confirm the security features are active and to spot dropped-packet counts indicating an attempted spoofing attack.

What Can Be Monitored

Dynamic ARP Inspection status
IP Source Guard bindings
DHCP snooping status/bindings

Imported Objects

From EXTREME-BASE-MIB

extremeAgent

OBJECT-IDENTITY

From INET-ADDRESS-MIB

InetAddress
InetAddressType
InetPortNumber

From SNMPv2-SMI

Counter64
Integer32
IpAddress
MODULE-IDENTITY
OBJECT-TYPE

From SNMPv2-TC

DisplayString
MacAddress
RowStatus
TEXTUAL-CONVENTION

OIDs

OID symbolic	OID numeric	Type	Access	Description
extremeIpSecurity	1.3.6.1.4.1.1916.1.34			Extreme IP Security MIB
extremeIpSecurityTraps	1.3.6.1.4.1.1916.1.34.1
extremeIpSecurityTrapsPrefix	1.3.6.1.4.1.1916.1.34.1.0
NTF extremeIpSecurityViolation	1.3.6.1.4.1.1916.1.34.1.0.1			For vlans/ports on which one or more of the IP Security features have been enabled, this trap will be generated when a packet received on that vlan/port is in violation of the configured IP Security protections
I32 extremeIpSecurityVlanIfIndex	1.3.6.1.4.1.1916.1.34.1.1	Integer32	accessible-for-notify	The ifIndex of the VLAN on which the violating packet was received.
STR extremeIpSecurityVlanDescr	1.3.6.1.4.1.1916.1.34.1.2	DisplayString	accessible-for-notify	The description(name) of the VLAN on which the violating packet was received.
I32 extremeIpSecurityPortIfIndex	1.3.6.1.4.1.1916.1.34.1.3	Integer32	accessible-for-notify	The ifIndex of the port on which the violating packet was received.
IP extremeIpSecurityIpAddr	1.3.6.1.4.1.1916.1.34.1.4	IpAddress	accessible-for-notify	Source IP address of the violating packet
MAC extremeIpSecurityMacAddress	1.3.6.1.4.1.1916.1.34.1.5	MacAddress	accessible-for-notify	Source MAC address from the ethernet header of the violating packet
INT extremeIpSecurityViolationType	1.3.6.1.4.1.1916.1.34.1.6	INTEGER	accessible-for-notify	The type of IP Security violation that occurred - rogueDhcpServerPacket(1) A rogue DHCP server packet was received. - badIpMacBindingInArpPacket(2) The IP-MAC binding received in the ARP packet does not exist in the DHCP Bindings table or is incorrect. - badIpInArpPacket(3) The Source IP address in the ARP payload is invalid. - badMacInArpPacket(4) One of the MAC addresses in the ARP payload does not match with its counterpart in the ethernet header. - bcastSenderIpInArpPacket(5) The Sender IP address in the ARP payload is Broadcast. - bcastTargetIpInArpPacket(6) The Target IP address in the ARP payload is Broadcast.
extremeIpSecurityAnomalyTraps	1.3.6.1.4.1.1916.1.34.2
extremeIpSecurityAnomalyTrapsPrefix	1.3.6.1.4.1.1916.1.34.2.0
NTF extremeIpSecurityAnomalyIpViolation	1.3.6.1.4.1.1916.1.34.2.0.1			For ports on which the protocol anomaly protection IP features has been enabled, this trap will be generated when a packet received on that port if the packet's source IP == destination IP
NTF extremeIpSecurityAnomalyL4PortViolation	1.3.6.1.4.1.1916.1.34.2.0.2			For ports on which the protocol anomaly protection L4port features has been enabled, this trap will be generated when a packet received on that port if 1) the packet is a TCP or UDP packetr. AND 2) its source L4 port == destination port
NTF extremeIpSecurityAnomalyTcpFlagViolation	1.3.6.1.4.1.1916.1.34.2.0.3			For ports on which the protocol anomaly protection TCP flags features has been enabled, this trap will be generated when a TCP packet received on that port if 1) (TCP flag SYN is set) and (its TCP source port < 1024). OR 2) (TCP flag == 0) and (TCP seq # == 0). OR 3) (TCP flag FIN/URG/PSH bits sre set) and (TCP seq # == 0). OR 4) Both TCP iflag SYN and FIN are set
NTF extremeIpSecurityAnomalyTcpFragmentViolation	1.3.6.1.4.1.1916.1.34.2.0.4			For ports on which the protocol anomaly protection TCP fragment features has been enabled, this trap will be generated when a packet received on that port if 1) the packet is a TCP, and its size of the TCP header is less than pre-configured value; or 2) the packet is a TCP and it is a IP fragmented packet (IP offset != 0)
NTF extremeIpSecurityAnomalyIcmpViolation	1.3.6.1.4.1.1916.1.34.2.0.5			For ports on which the protocol anomaly protection ICMP features has been enabled, this trap will be generated when an ICMP packet received on that port if 1) the size of ICMP (IP payload) is large thant pre-configured value; or 2) it is a fragmented IP/ICMP packet (IP offset != 0)
I32 esAnomalyPortIfIndex	1.3.6.1.4.1.1916.1.34.2.1	Integer32	accessible-for-notify	The ifIndex of the port on which the violating packet was received.
I32 esAnomalyVlanIfIndex	1.3.6.1.4.1.1916.1.34.2.2	Integer32	accessible-for-notify	The ifIndex of the VLAN on which the violating packet was received.
STR esAnomalyVlanDescr	1.3.6.1.4.1.1916.1.34.2.3	DisplayString	accessible-for-notify	The description(name) of the VLAN on which the violating packet was received.
MAC esAnomalySrcMacAddress	1.3.6.1.4.1.1916.1.34.2.4	MacAddress	accessible-for-notify	Source MAC address in the violating packet
MAC esAnomalyDestMacAddress	1.3.6.1.4.1.1916.1.34.2.5	MacAddress	accessible-for-notify	Destination MAC address in the violating packet
IPt esAnomalySrcIpAddrType	1.3.6.1.4.1.1916.1.34.2.6	InetAddressType	accessible-for-notify	source IP address type: ipv4 or ipv6
IP esAnomalySrcIpAddr	1.3.6.1.4.1.1916.1.34.2.7	InetAddress	accessible-for-notify	source IP address in the violating packet
IPt esAnomalyDestIpAddrType	1.3.6.1.4.1.1916.1.34.2.8	InetAddressType	accessible-for-notify	destination IP address type: ipv4 or ipv6
IP esAnomalyDestIpAddr	1.3.6.1.4.1.1916.1.34.2.9	InetAddress	accessible-for-notify	destination IP address in the violating packet
IPP esAnomalyIpProto	1.3.6.1.4.1.1916.1.34.2.10	IpProtocol	accessible-for-notify	IP protocol in the violating packet
INE esAnomalySrcL4Port	1.3.6.1.4.1.1916.1.34.2.11	InetPortNumber	accessible-for-notify	tcp/udp source port number in the violating packet
INE esAnomalyDestL4Port	1.3.6.1.4.1.1916.1.34.2.12	InetPortNumber	accessible-for-notify	tcp/udp destination port in the violating packet
HEX esAnomalyTcpFlag	1.3.6.1.4.1.1916.1.34.2.13	HexOctet	accessible-for-notify	TCP flags in the violating packet
I32 esAnomalyTcpSeq	1.3.6.1.4.1.1916.1.34.2.14	Integer32	accessible-for-notify	TCP sequence number in the violating packet
I32 esAnomalyTcpHdrSize	1.3.6.1.4.1.1916.1.34.2.15	Integer32	accessible-for-notify	TCP Header size in the violating packet
TCP esAnomalyTcpFlagReason	1.3.6.1.4.1.1916.1.34.2.16	TcpFlagAnomalyReason	accessible-for-notify	TCP flag anomaly reason code
ICM esAnomalyIcmpReason	1.3.6.1.4.1.1916.1.34.2.17	IcmpAnomalyReason	accessible-for-notify	ICMP anomaly reason code
VLA esAnomalyVlanTag	1.3.6.1.4.1.1916.1.34.2.18	VlanTag	accessible-for-notify	the vlan tag in the violating packet
TCP esAnomalyTcpFragmentReason	1.3.6.1.4.1.1916.1.34.2.19	TcpFragmentAnomalyReason	accessible-for-notify	TCP fragment anomaly reason code

RFC description

IP security violation monitoring for Extreme Networks switches, tracking unauthorized access attempts and source IP/MAC violations.

Start monitoring Extreme Networks access-layer Ethernet switch (DAI/IP Source Guard/DHCP snooping) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download EXTREME-IP-SECURITY-MIB

What Is EXTREME-IP-SECURITY-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description