All MIBs › EXTREME-IP-SECURITY-MIB › extremeIpSecurityAnomalyTcpFlagViolation
extremeIpSecurityAnomalyTcpFlagViolation
Module: EXTREME-IP-SECURITY-MIB
OID (symbolic): EXTREME-IP-SECURITY-MIB::extremeIpSecurityAnomalyTcpFlagViolation
OID (numeric): 1.3.6.1.4.1.1916.1.34.2.0.3
Node type: NOTIFICATION-TYPE
Description: For ports on which the protocol anomaly protection TCP flags features has been enabled, this trap will be generated when a TCP packet received on that port if 1) (TCP flag SYN is set) and (its TCP source port < 1024). OR 2) (TCP flag == 0) and (TCP seq # == 0). OR 3) (TCP flag FIN/URG/PSH bits sre set) and (TCP seq # == 0). OR 4) Both TCP iflag SYN and FIN are set
Examples
Send this trap to an SNMP manager — replace <manager> with the IP or hostname of your monitoring server (SNMPv2c):
snmptrap -v2c -c public <manager> '' EXTREME-IP-SECURITY-MIB::extremeIpSecurityAnomalyTcpFlagViolation snmptrap -v2c -c public <manager> '' 1.3.6.1.4.1.1916.1.34.2.0.3
Listen for incoming traps on the manager host (-f keeps it in the foreground, -Lo prints to stdout — useful for testing):
snmptrapd -f -Lo -c /dev/null authCommunity log public
Example snmptrapd log entry:
zoo11-linux.zoo [UDP: [192.168.30.111]:63493->[192.168.30.10]:162]: DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (322310149) 37 days, 7:18:21.49 SNMPv2-MIB::snmpTrapOID.0 = OID: EXTREME-IP-SECURITY-MIB::extremeIpSecurityAnomalyTcpFlagViolation
Start monitoring Extreme Networks access-layer Ethernet switch (DAI/IP Source Guard/DHCP snooping) with a free 30-day trial of IPNetwork Monitor. Create custom SNMP monitor using the EXTREME-IP-SECURITY-MIB::extremeIpSecurityAnomalyTcpFlagViolation OID value, configure state conditions and alerts, and monitor any Extreme Networks access-layer Ethernet switch (DAI/IP Source Guard/DHCP snooping) from a single console.
OID Breakdown
Upper-level ancestors (8 from the standard OID tree / other modules)
| Numeric OID | Name | Module |
|---|---|---|
| 1 | iso | LANART-AGENT |
| 1.3 | org | AirPair-MIB |
| 1.3.6 | dod | AirPair-MIB |
| 1.3.6.1 | internet | AirPair-MIB |
| 1.3.6.1.4 | private | AirPair-MIB |
| 1.3.6.1.4.1 | enterprises | AirPair-MIB |
| 1.3.6.1.4.1.1916 | extreme | A3COM51-SS9000SX |
| 1.3.6.1.4.1.1916.1 | extremeAgent | EXTREME-BASE-MIB |
| Numeric OID | Name | Module |
|---|---|---|
| 1.3.6.1.4.1.1916.1.34 | extremeIpSecurity | EXTREME-IP-SECURITY-MIB |
| 1.3.6.1.4.1.1916.1.34.2 | extremeIpSecurityAnomalyTraps | EXTREME-IP-SECURITY-MIB |
| 1.3.6.1.4.1.1916.1.34.2.0 | extremeIpSecurityAnomalyTrapsPrefix | EXTREME-IP-SECURITY-MIB |
| 1.3.6.1.4.1.1916.1.34.2.0.3 | extremeIpSecurityAnomalyTcpFlagViolation | EXTREME-IP-SECURITY-MIB |