H3C-DHCP-SNOOP2-MIB

All MIBs › H3C-DHCP-SNOOP2-MIB

Organization: Hangzhou H3C Technologies Co., Ltd.

Last Updated: 2013-04-15

Category: Protocol: DHCP, Vendor: H3C/HH3C

Description: H3C MIB version 2 for DHCP snooping, monitoring DHCP binding tables and filtering unauthorized DHCP traffic.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is H3C-DHCP-SNOOP2-MIB?

This is an H3C vendor MIB, version 2 of their DHCP Snooping management module, used to configure and monitor the DHCP snooping security feature that filters unauthorized/rogue DHCP server traffic and builds a trusted IP-to-MAC-to-VLAN binding database. It exposes configuration data (enable state, binding database name, refresh interval), operational counters (packets sent/received/dropped), and the DHCP snooping binding table itself with per-entry IP address and VLAN information. It is useful for monitoring the software-level security status of the switch's DHCP snooping feature — rising h3cDhcpSnoop2PktDropNum indicates DHCP packets being blocked from untrusted ports (potentially a rogue DHCP server or a legitimate misconfigured trunk), while the binding table lets an administrator verify a specific client's lease is correctly tracked. This is a self-contained H3C proprietary security MIB, though it would typically be deployed alongside H3C's VLAN and interface MIBs since bindings are indexed by VLAN. It is typically deployed on H3C switches in enterprise/campus access-layer networks where DHCP snooping is enabled to prevent rogue DHCP servers and IP spoofing. Engineers can download the H3C-DHCP-SNOOP2-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in H3C-DHCP-SNOOP2-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

H3C switch (access layer)

Monitoring Examples

An administrator would poll h3cDhcpSnoop2Enabled to confirm the feature is active and check h3cDhcpSnoop2PktDropNum against h3cDhcpSnoop2PktRcvNum to gauge what fraction of DHCP traffic is being filtered as untrusted; walking h3cDhcpSnoop2BindTable/h3cDhcpSnoop2BindEntry and reading h3cDhcpSnoop2BindIpAddr with h3cDhcpSnoop2BindVlanId confirms a specific client's DHCP-assigned IP is correctly bound to its VLAN, and a missing expected binding would indicate that client's DHCP request was dropped or spoofed.

What Can Be Monitored

DHCP snooping enable state
DHCP packets sent/received/dropped counters
DHCP binding table (IP-to-VLAN)
binding database refresh interval

Imported Objects

From HUAWEI-3COM-OID-MIB

h3cCommon

OBJECT-IDENTITY

From IF-MIB

InterfaceIndexOrZero
ifIndex	OBJECT-TYPE

From INET-ADDRESS-MIB

InetAddressIPv4

From SNMPv2-SMI

Counter64
MODULE-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

MacAddress
RowStatus
TruthValue

OIDs

OID symbolic	OID numeric	Type	Access	Description
h3cDhcpSnoop2	1.3.6.1.4.1.2011.10.2.124			DHCP SNOOPING MIB 2
h3cDhcpSnoop2ScalarObjects	1.3.6.1.4.1.2011.10.2.124.1
h3cDhcpSnoop2ConfigGroup	1.3.6.1.4.1.2011.10.2.124.1.1
T/F h3cDhcpSnoop2Enabled	1.3.6.1.4.1.2011.10.2.124.1.1.1	TruthValue	read-write	If the value of this object is set to 'true', DHCP snooping is enabled.
OCT h3cDhcpSnoop2BindDbName	1.3.6.1.4.1.2011.10.2.124.1.1.2	OCTET STRING	read-write	Name of the file that used to store binding information. If the value of the object is set to a zero-length string, the configuration will be removed.
U32 h3cDhcpSnoop2BindRefreshIntvl	1.3.6.1.4.1.2011.10.2.124.1.1.3	Unsigned32	read-write	The refresh interval of the binding information in seconds.
INT h3cDhcpSnoop2BindRefresh	1.3.6.1.4.1.2011.10.2.124.1.1.4	INTEGER	read-write	If the value of this object is set to 'on', the binding information will be refreshed immediately.
h3cDhcpSnoop2StatisticsGroup	1.3.6.1.4.1.2011.10.2.124.1.2
C64 h3cDhcpSnoop2PktSentNum	1.3.6.1.4.1.2011.10.2.124.1.2.1	Counter64	read-only	The total number of the packets send by DHCP snooping.
C64 h3cDhcpSnoop2PktRcvNum	1.3.6.1.4.1.2011.10.2.124.1.2.2	Counter64	read-only	The total number of the packets received by DHCP snooping.
C64 h3cDhcpSnoop2PktDropNum	1.3.6.1.4.1.2011.10.2.124.1.2.3	Counter64	read-only	The total number of the packets dropped by DHCP snooping.
h3cDhcpSnoop2Tables	1.3.6.1.4.1.2011.10.2.124.2
h3cDhcpSnoop2BindTable	1.3.6.1.4.1.2011.10.2.124.2.1		not-accessible	The table containing information of DHCP clients listened by DHCP snooping.
h3cDhcpSnoop2BindEntry	1.3.6.1.4.1.2011.10.2.124.2.1.1		not-accessible	An entry containing information of DHCP clients.
ADR h3cDhcpSnoop2BindIpAddr	1.3.6.1.4.1.2011.10.2.124.2.1.1.1	InetAddressIPv4	not-accessible	DHCP client's IP addresses collected by DHCP snooping.
U32 h3cDhcpSnoop2BindVlanId	1.3.6.1.4.1.2011.10.2.124.2.1.1.2	Unsigned32	not-accessible	DHCP client's VLAN ID collected by DHCP snooping.
U32 h3cDhcpSnoop2BindSecVlanId	1.3.6.1.4.1.2011.10.2.124.2.1.1.3	Unsigned32	not-accessible	DHCP client's second VLAN ID collected by DHCP snooping. 65535 means no second VLAN.
MAC h3cDhcpSnoop2BindMacAddr	1.3.6.1.4.1.2011.10.2.124.2.1.1.4	MacAddress	read-only	DHCP client's MAC address collected by DHCP snooping.
U32 h3cDhcpSnoop2BindLease	1.3.6.1.4.1.2011.10.2.124.2.1.1.5	Unsigned32	read-only	Left lease time in seconds collected by DHCP snooping. The value of this object cannot be 0.
NUM h3cDhcpSnoop2BindPortIndex	1.3.6.1.4.1.2011.10.2.124.2.1.1.6	InterfaceIndexOrZero	read-only	DHCP client's port index collected by DHCP snooping. The value of zero means unknown port.
ROW h3cDhcpSnoop2BindRowStatus	1.3.6.1.4.1.2011.10.2.124.2.1.1.7	RowStatus	read-create	RowStatus. Only destroy action is allow to use.
h3cDhcpSnoop2IfConfigTable	1.3.6.1.4.1.2011.10.2.124.2.2		not-accessible	A table is used to configure DHCP snooping functions on ports.
h3cDhcpSnoop2IfConfigEntry	1.3.6.1.4.1.2011.10.2.124.2.2.1		not-accessible	An entry containing DHCP snooping configurations of ports.
INT h3cDhcpSnoop2IfTrustStatus	1.3.6.1.4.1.2011.10.2.124.2.2.1.1	INTEGER	read-write	Trusted status of the port.
T/F h3cDhcpSnoop2IfCheckMac	1.3.6.1.4.1.2011.10.2.124.2.2.1.2	TruthValue	read-write	If the value is 'true', MAC address of DHCP packets received on the port will be checked.
T/F h3cDhcpSnoop2IfCheckRequest	1.3.6.1.4.1.2011.10.2.124.2.2.1.3	TruthValue	read-write	If the value is 'true', DHCP request packets will be checked.
U32 h3cDhcpSnoop2IfRateLimit	1.3.6.1.4.1.2011.10.2.124.2.2.1.4	Unsigned32	read-write	The rate limit in Kbps. If the value is 0, there is no rate limit on the port.
T/F h3cDhcpSnoop2IfRecordBind	1.3.6.1.4.1.2011.10.2.124.2.2.1.5	TruthValue	read-write	If the value is 'true', information of DHCP packets received on the port will be recorded.
U32 h3cDhcpSnoop2IfMaxLearnNum	1.3.6.1.4.1.2011.10.2.124.2.2.1.6	Unsigned32	read-write	The maximum number of binding entries that could be learned on the port. If the value is 0, it means that there is no threshold on the port.
T/F h3cDhcpSnoop2IfOpt82Enable	1.3.6.1.4.1.2011.10.2.124.2.2.1.7	TruthValue	read-write	If DHCP snooping supports option 82 functions, the value is 'true'. If DHCP snooping does NOT support option 82 functions, the value is 'false'.
INT h3cDhcpSnoop2IfOpt82Strategy	1.3.6.1.4.1.2011.10.2.124.2.2.1.8	INTEGER	read-write	The strategy of DHCP snooping handling option 82. 'drop' indicates DHCP snooping discarding the request packet including option 82. 'keep' indicates DHCP snooping accepting the request packet without any change of the option 82. 'replace' indicates DHCP snooping accepting the request packet on condition that it generates a new option 82 to replace the original one.
INT h3cDhcpSnoop2IfOpt82CIDMode	1.3.6.1.4.1.2011.10.2.124.2.2.1.9	INTEGER	read-write	The mode of filling in the circuit ID suboption of DHCP option 82. 'normal' is the standard mode. 'verbose' is the detailed mode. 'userDefine' is the user-defined mode. If the value of this object is set to 'userDefine', h3cDhcpSnoop2IfOpt82CIDStr must also be set.
INT h3cDhcpSnoop2IfOpt82CIDNodeType	1.3.6.1.4.1.2011.10.2.124.2.2.1.10	INTEGER	read-write	Type of access node identifier that is used to fill in the circuit ID suboption of option 82 when the value of h3cDhcpSnoop2IfOption82CIDMode is set to 'verbose'. The SET operation of this object must be with the SET operation of h3cDhcpSnoop2IfOpt82CIDMode. 'invalid' indicates that the node identifier is NOT used to fill in the circuit ID suboption of option 82. If the value of h3cDhcpSnoop2IfOpt82CIDMode is NOT 'verbose', the value of this object is set to 'invalid' automatically. Otherwise the value of this object cannot be set to 'invalid'. 'mac' indicates that the node identifier is filled in with the bridge MAC of DHCP snooping device. If the value of h3cDhcpSnoop2IfOpt82CIDMode is set to 'verbose', the default value of this object is 'mac'. 'sysname' indicates that the node identifier is filled in with the sysname of the DHCP snooping. 'userDefine' indicates the node identifier is filled in with the string defined by the object of h3cDhcpSnoop2IfOpt82CIDNodeStr. If the value is set to 'userDefine', the value of h3cDhcpSnoop2IfOpt82CIDNodeStr must also be set to a non-zero length string.
OCT h3cDhcpSnoop2IfOpt82CIDNodeStr	1.3.6.1.4.1.2011.10.2.124.2.2.1.11	OCTET STRING	read-write	The string defined by user to fill in the node identifier in the verbose mode. If the value of h3cDhcpSnoop2IfOpt82CIDMode is NOT 'verbose', or the value of h3cDhcpSnoop2IfOpt82CIDNodeType is NOT 'userDefine', it is set to a zero-length string automatically. Otherwise it must be set to a non-zero length string. The SET operation of this object must be with the SET operation of h3cDhcpSnoop2IfOpt82CIDMode and h3cDhcpSnoop2IfOpt82CIDNodeType.
OCT h3cDhcpSnoop2IfOpt82CIDStr	1.3.6.1.4.1.2011.10.2.124.2.2.1.12	OCTET STRING	read-write	The string defined by user to fill in the circuit ID suboption of option 82 in the user-define mode. If the value of h3cDhcpSnoop2IfOpt82CIDMode is NOT 'userDefine', it is set to a zero-length string automatically. Otherwise it must be set to a non-zero length string. The SET operation of this object must be with the SET operation of h3cDhcpSnoop2IfOpt82CIDMode.
INT h3cDhcpSnoop2IfOpt82CIDFormat	1.3.6.1.4.1.2011.10.2.124.2.2.1.13	INTEGER	read-write	The format of the circuit ID suboption of DHCP option 82. 'hex' is the hex format. 'ascii' is the ascii format. 'undefine' is the undefine format. If the value of h3cDhcpSnoop2IfOpt82CIDMode is 'normal', this object is set with 'hex' automatically and cannot be set with 'undefine'. If the value of h3cDhcpSnoop2IfOpt82CIDMode is 'verbose', the default value of this object is 'undefine'. If the value of h3cDhcpSnoop2IfOpt82CIDMode is 'userDefine', this object is set with 'ascii' automatically and cannot be set with other value. The SET operation of this object must be with the SET operation of h3cDhcpSnoop2IfOpt82CIDMode.
INT h3cDhcpSnoop2IfOpt82RIDMode	1.3.6.1.4.1.2011.10.2.124.2.2.1.14	INTEGER	read-write	The mode of filling in the remote ID suboption of DHCP option 82. 'normal' is the standard mode. 'userDefine' is the user-defined mode. 'sysname' is the sysname mode. If the value of this object is set to 'userDefine', h3cDhcpSnoop2IfOpt82RIDStr must also be set.
OCT h3cDhcpSnoop2IfOpt82RIDStr	1.3.6.1.4.1.2011.10.2.124.2.2.1.15	OCTET STRING	read-write	The string defined by user to fill in the remote ID in the user-defined mode. If the value of h3cDhcpSnoop2IfOpt82RIDMode is NOT 'userDefine', this object is set with a zero-length string automatically. Otherwise it must be set with a non-zero length string. The SET operation of this object must be with the SET operation of h3cDhcpSnoop2IfOpt82RIDMode.
INT h3cDhcpSnoop2IfOpt82RIDFormat	1.3.6.1.4.1.2011.10.2.124.2.2.1.16	INTEGER	read-write	The format of DHCP option 82 remote ID in 'normal' mode. 'hex' is the hex format. 'ascii' is the ascii format. If the value of h3cDhcpSnoop2IfOpt82RIDMode is 'sysname' or 'userDefine', this object is set with 'ascii' automatically and cannot be set with other value. If the value of h3cDhcpSnoop2IfOpt82RIDMode is 'normal', the default value of this object is 'hex'. The SET operation of this object must be with the SET operation of h3cDhcpSnoop2IfOpt82RIDMode.
h3cDhcpSnoop2IfVlanCIDTable	1.3.6.1.4.1.2011.10.2.124.2.3		not-accessible	A table containing the information of the circuit ID suboption of DHCP option 82 in VLAN.
h3cDhcpSnoop2IfVlanCIDEntry	1.3.6.1.4.1.2011.10.2.124.2.3.1		not-accessible	An entry containing the information of the circuit ID suboption of DHCP option 82 in VLAN.
U32 h3cDhcpSnoop2IfVlanCIDVlanIndex	1.3.6.1.4.1.2011.10.2.124.2.3.1.1	Unsigned32	not-accessible	VLAN ID.
OCT h3cDhcpSnoop2IfVlanCIDStr	1.3.6.1.4.1.2011.10.2.124.2.3.1.2	OCTET STRING	read-create	The string defined by user to fill in the circuit ID suboption of option 82.
ROW h3cDhcpSnoop2IfVlanCIDRowStatus	1.3.6.1.4.1.2011.10.2.124.2.3.1.3	RowStatus	read-create	Operation status of this table entry. Three actions are used: active, createAndGo, destroy.
h3cDhcpSnoop2IfVlanRIDTable	1.3.6.1.4.1.2011.10.2.124.2.4		not-accessible	A table containing the information of the remote ID suboption of DHCP option 82 in VLAN.
h3cDhcpSnoop2IfVlanRIDEntry	1.3.6.1.4.1.2011.10.2.124.2.4.1		not-accessible	An entry containing the information of the remote ID suboption of DHCP option 82 in VLAN.
U32 h3cDhcpSnoop2IfVlanRIDVlanIndex	1.3.6.1.4.1.2011.10.2.124.2.4.1.1	Unsigned32	not-accessible	VLAN ID.
INT h3cDhcpSnoop2IfVlanRIDMode	1.3.6.1.4.1.2011.10.2.124.2.4.1.2	INTEGER	read-create	The mode of filling in the remote ID suboption of DHCP option 82 in VLAN. 'sysname' indicates using the device sysname to fill in the suboption. 'userDefine' indicates using the string defined by h3cDhcpSnoop2IfVlanRIDStr to fill in the suboption. If the value of this object is set to 'userDefine', h3cDhcpSnoop2IfVlanRIDStr must also be set.
OCT h3cDhcpSnoop2IfVlanRIDStr	1.3.6.1.4.1.2011.10.2.124.2.4.1.3	OCTET STRING	read-create	The string used to fill in the remote ID suboption. If the value of h3cDhcpSnoop2IfVlanRIDMode is NOT 'userDefine', this object is set with a zero-length string automatically. Otherwise it must be set with a non-zero length string. The SET operation of this object must be with the SET operation of h3cDhcpSnoop2IfVlanRIDMode.
ROW h3cDhcpSnoop2IfVlanRIDRowStatus	1.3.6.1.4.1.2011.10.2.124.2.4.1.4	RowStatus	read-create	Operation status of this table entry. Three actions are used: active, createAndGo, destroy.

RFC description

Vendor-specific MIB for DHCP snooping version 2 in H3C network switches, manages per-interface DHCP binding table and trust configuration.

Start monitoring H3C access-layer switch (DHCP Snooping v2) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download H3C-DHCP-SNOOP2-MIB

What Is H3C-DHCP-SNOOP2-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description