FDRY-DHCP-SNOOPING-MIB

All MIBs › FDRY-DHCP-SNOOPING-MIB

Organization: Brocade Communications Systems, Inc.

Last Updated: 2010-07-26

Category: Protocol: DHCP, VPN and Security, Vendor: Foundry/Brocade

Description: Foundry/Brocade FastIron MIB for DHCP snooping configuration and binding table management for IP security on Foundry switches.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is FDRY-DHCP-SNOOPING-MIB?

FDRY-DHCP-SNOOPING-MIB is a Foundry Networks/Brocade (FastIron) vendor MIB for the DHCP Snooping security feature, which filters untrusted DHCP traffic on a subnet and blocks rogue DHCP servers. It exposes global clear/reset operations, per-VLAN DHCP-snooping enable configuration, per-interface trust-value settings (trusted vs. untrusted uplinks), and a binding table recording learned IP-to-MAC address bindings for validated DHCP clients. Its monitoring value is security/configuration status — an operator confirms DHCP snooping is enabled on the correct VLANs, that only intended interfaces (e.g. uplinks to legitimate DHCP servers) are marked trusted, and inspects the binding table to see which hosts have valid leases, which helps detect spoofing or a rogue DHCP server on an untrusted port. It depends on the standard DHCP protocol (RFC 2131) it is snooping on top of, and sits within Brocade/Foundry's private enterprise MIB tree. It is deployed on Foundry/Brocade FastIron switches at the access layer in enterprise networks needing DHCP-based attack mitigation. Engineers can download the FDRY-DHCP-SNOOPING-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in FDRY-DHCP-SNOOPING-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Foundry/Brocade FastIron switch

Monitoring Examples

An operator would poll fdryDhcpSnoopVlanConfigTable/fdryDhcpSnoopVlanConfigEntry keyed by fdryDhcpSnoopVlanVLanId to confirm fdryDhcpSnoopVlanDhcpSnoopEnable is set on the intended VLANs, and check fdryDhcpSnoopIfConfigTable's fdryDhcpSnoopIfTrustValue to ensure only the uplink to the authorized DHCP server is trusted. fdryDhcpSnoopBindTable/fdryDhcpSnoopBindEntry exposes fdryDhcpSnoopBindIpAddr and fdryDhcpSnoopBindMacAddr pairs, letting an admin spot an unexpected or duplicate binding that indicates a rogue DHCP server or spoofing attempt, while fdryDhcpSnoopGlobalClearOper lets them reset snooping state during troubleshooting.

What Can Be Monitored

per-VLAN DHCP snooping enable status
per-interface trust configuration
DHCP binding table (IP-to-MAC)
global snooping clear/reset operations

Imported Objects

From FDRY-DAI-MIB

ArpState
ArpType

From FOUNDRY-SN-AGENT-MIB

DisplayString

From FOUNDRY-SN-SWITCH-GROUP-MIB

snSwitch

MODULE-IDENTITY

From IF-MIB

ifIndex

OBJECT-TYPE

From Q-BRIDGE-MIB

VlanIndex

From SNMPv2-SMI

IpAddress
MODULE-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

MacAddress
TEXTUAL-CONVENTION
TruthValue

OIDs

OID symbolic	OID numeric	Type	Access	Description
fdryDhcpSnoopMIB	1.3.6.1.4.1.1991.1.1.3.36			Management Information for configuration of DHCP Snooping feature. DHCP Snooping is a security feature which enables the device to filter untrusted DHCP packets in a subnet. It can also stop unauthorized DHCP serves and prevent errors due to user mis-configuration servers. Copyright 1996-2010 Brocade Communications Systems, Inc. All rights reserved. This Brocade Communications Systems SNMP Management Information Base Specification embodies Brocade Communications Systems' confidential and proprietary intellectual property. Brocade Communications Systems retains all title and ownership in the Specification, including any revisions. This Specification is supplied AS IS, and Brocade Communications Systems makes no warranty, either express or implied, as to the use, operation, condition, or performance of the specification, and any unintended consequence it may on the user environment.
fdryDhcpSnoopGlobalObjects	1.3.6.1.4.1.1991.1.1.3.36.1
CLE fdryDhcpSnoopGlobalClearOper	1.3.6.1.4.1.1991.1.1.3.36.1.1	ClearAction	read-write	valid(0) - this value is always returned when the variable is read. clear(1) - setting the variable to this value clears all entries in the DHCP binding database.
fdryDhcpSnoopVlan	1.3.6.1.4.1.1991.1.1.3.36.2
fdryDhcpSnoopVlanConfigTable	1.3.6.1.4.1.1991.1.1.3.36.2.1		not-accessible	A table provides the mechanism to control DHCP Snooping per VLAN. When a VLAN is created in a device supporting this table, a corresponding entry of this table will be added.
fdryDhcpSnoopVlanConfigEntry	1.3.6.1.4.1.1991.1.1.3.36.2.1.1		not-accessible	A row instance contains the configuration to enable or disable DHCP Snooping at the existing VLAN.
VLA fdryDhcpSnoopVlanVLanId	1.3.6.1.4.1.1991.1.1.3.36.2.1.1.1	VlanIndex	not-accessible	This object indicates the VLAN number on which DHCP Snooping feature is configured.
T/F fdryDhcpSnoopVlanDhcpSnoopEnable	1.3.6.1.4.1.1991.1.1.3.36.2.1.1.2	TruthValue	read-write	This object indicates whether DHCP Snooping is enabled in this VLAN. If this object is set to 'true', DHCP Snooping is enabled. If this object is set to 'false', DHCP Snooping is disabled.
fdryDhcpSnoopInterface	1.3.6.1.4.1.1991.1.1.3.36.3
fdryDhcpSnoopIfConfigTable	1.3.6.1.4.1.1991.1.1.3.36.3.1		not-accessible	A table provides the mechanism to configure the trust state for DHCP Snooping purpose at each physical interface.
fdryDhcpSnoopIfConfigEntry	1.3.6.1.4.1.1991.1.1.3.36.3.1.1		not-accessible	A row instance contains the configuration to enable or disable trust state for DHCP Snooping at each physical interface capable of this feature.
T/F fdryDhcpSnoopIfTrustValue	1.3.6.1.4.1.1991.1.1.3.36.3.1.1.1	TruthValue	read-write	This object indicates whether the interface is trusted for DHCP Snooping. If this object is set to 'true', the interface is trusted. DHCP packets coming to this interface will be forwarded without checking. If this object is set to 'false', the interface is not trusted. DHCP packets received on this interface will be subjected to DHCP checks.
fdryDhcpSnoopBind	1.3.6.1.4.1.1991.1.1.3.36.4
fdryDhcpSnoopBindTable	1.3.6.1.4.1.1991.1.1.3.36.4.1		not-accessible	A table provides the information of DHCP snooping binding database learnt by the device
fdryDhcpSnoopBindEntry	1.3.6.1.4.1.1991.1.1.3.36.4.1.1		not-accessible	A row instance contains the information of DHCP snoonping entry.
IP fdryDhcpSnoopBindIpAddr	1.3.6.1.4.1.1991.1.1.3.36.4.1.1.1	IpAddress	not-accessible	The device IP address.
MAC fdryDhcpSnoopBindMacAddr	1.3.6.1.4.1.1991.1.1.3.36.4.1.1.2	MacAddress	read-only	The device MAC address.
ARP fdryDhcpSnoopBindType	1.3.6.1.4.1.1991.1.1.3.36.4.1.1.3	ArpType	read-only	The type of the ARP entry
ARP fdryDhcpSnoopBindState	1.3.6.1.4.1.1991.1.1.3.36.4.1.1.4	ArpState	read-only	The state of the ARP entry
STR fdryDhcpSnoopBindPort	1.3.6.1.4.1.1991.1.1.3.36.4.1.1.5	DisplayString	read-only	The port of the ARP entry
VLA fdryDhcpSnoopBindVlanId	1.3.6.1.4.1.1991.1.1.3.36.4.1.1.6	VlanIndex	read-only	This object indicates the VLAN number on which DHCP snooping feature is configured.
CLE fdryDhcpSnoopBindClearOper	1.3.6.1.4.1.1991.1.1.3.36.4.1.1.7	ClearAction	read-write	valid(0) - this value is always returned when the variable is read. clear(1) - setting the variable to this value clears this entry in the DHCP binding database.

RFC description

Brocade DHCP snooping security MIB for filtering untrusted DHCP packets and preventing rogue DHCP server attacks.

Start monitoring Brocade/Foundry FastIron switch (DHCP Snooping) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download FDRY-DHCP-SNOOPING-MIB

What Is FDRY-DHCP-SNOOPING-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description