H3C-IDS-MIB

All MIBs › H3C-IDS-MIB

Organization: Huawei-3com Technologies Co., Ltd.

Last Updated: 2005-07-14

Category: VPN and Security, Vendor: H3C/HH3C

Description: H3C MIB for Intrusion Detection System (IDS) management including attack signature rules and detection statistics.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is H3C-IDS-MIB?

H3C-IDS-MIB is an H3C private-enterprise MIB for Intrusion Detection System (IDS) functionality, providing management information about attack-signature rules and detection activity used to identify intruder or attack behavior traversing the device. It is expected to expose security detection configuration (signature/rule enablement) and detection statistics or counters tracking matched attacks, along with likely event notifications. Its monitoring emphasis is security/software-function status rather than hardware sensors: an operator checks whether the detection engine is active and reviews attack counters or alerts to spot ongoing intrusion attempts. It is a self-contained H3C private-enterprise MIB with no explicit dependency on standard IETF security MIBs mentioned in its description. Deployment context is H3C routers, switches, or dedicated security appliances providing built-in intrusion detection at the network edge or core, where H3C-IDS-MIB SNMP monitoring supports ongoing attack-signature and detection-status visibility.

IPNetwork Monitor allows you to monitor SNMP objects defined in H3C-IDS-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

H3C router/switch/security appliance with IDS feature

Monitoring Examples

This excerpt lists no object or table names, so a concrete polling scenario cannot be grounded in confirmed identifiers from the source; the module description only states generally that IDS 'is used to detect intruder activity.' In a typical deployment an operator would poll a detection-engine-enabled flag and per-signature attack counters to spot an ongoing intrusion attempt, but none of these object names are verified here.

What Can Be Monitored

IDS detection engine status
attack signature matches
intrusion detection statistics

Imported Objects

From HUAWEI-3COM-OID-MIB

h3cCommon

OBJECT-IDENTITY

From INET-ADDRESS-MIB

InetAddress
InetAddressType

From SNMPv2-SMI

Integer32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

OIDs

OID symbolic	OID numeric	Type	Access	Description
h3cIds	1.3.6.1.4.1.2011.10.2.47
h3cIDSMib	1.3.6.1.4.1.2011.10.2.47.1			This MIB describes IDS private information. IDS(Instruction Detecting System) is used to detect intruder activity.
h3cIDSTrapGroup	1.3.6.1.4.1.2011.10.2.47.1.1
h3cIDSTrapInfo	1.3.6.1.4.1.2011.10.2.47.1.1.1
U32 h3cIDSTrapIPFragmentQueueLen	1.3.6.1.4.1.2011.10.2.47.1.1.1.1	Unsigned32	accessible-for-notify	The length of IP fragment queue.
U32 h3cIDSTrapStatSessionTabLen	1.3.6.1.4.1.2011.10.2.47.1.1.1.2	Unsigned32	accessible-for-notify	The length of status session table.
IPt h3cIDSTrapIPAddressType	1.3.6.1.4.1.2011.10.2.47.1.1.1.3	InetAddressType	accessible-for-notify	The type of IP Address.
IP h3cIDSTrapIPAddress	1.3.6.1.4.1.2011.10.2.47.1.1.1.4	InetAddress	accessible-for-notify	IP Address.
OCT h3cIDSTrapUserName	1.3.6.1.4.1.2011.10.2.47.1.1.1.5	OCTET STRING	accessible-for-notify	User name.
INT h3cIDSTrapLoginType	1.3.6.1.4.1.2011.10.2.47.1.1.1.6	INTEGER	accessible-for-notify	Login type, including telnet, ssh and web.
INT h3cIDSTrapUpgradeType	1.3.6.1.4.1.2011.10.2.47.1.1.1.7	INTEGER	accessible-for-notify	Upgrade type, including programme(system image), crb(custom rule base, one kind of configuration file), vrb(vendor rule base, one kind of configuration file).
OCT h3cIDSTrapCRLName	1.3.6.1.4.1.2011.10.2.47.1.1.1.8	OCTET STRING	accessible-for-notify	CRL(Certificate Revoke List) name.
OCT h3cIDSTrapCertName	1.3.6.1.4.1.2011.10.2.47.1.1.1.9	OCTET STRING	accessible-for-notify	Certificate name.
U32 h3cIDSTrapDetectRuleID	1.3.6.1.4.1.2011.10.2.47.1.1.1.10	Unsigned32	accessible-for-notify	The rule ID which is a unique identifier for a specified detect rule.
I32 h3cIDSTrapEngineID	1.3.6.1.4.1.2011.10.2.47.1.1.1.11	Integer32	accessible-for-notify	A unique number used to identify an interface.
OCT h3cIDSTrapFileName	1.3.6.1.4.1.2011.10.2.47.1.1.1.12	OCTET STRING	accessible-for-notify	The file name.
U32 h3cIDSTrapCfgLineInFile	1.3.6.1.4.1.2011.10.2.47.1.1.1.13	Unsigned32	accessible-for-notify	The line number in the configuration file.
OCT h3cIDSTrapReasonForError	1.3.6.1.4.1.2011.10.2.47.1.1.1.14	OCTET STRING	accessible-for-notify	The information of the notification. Although the format and content of this object are device specific, they should be defined uniformly in the device.
h3cIDSTrap	1.3.6.1.4.1.2011.10.2.47.1.1.2
h3cIDSTrapPrefix	1.3.6.1.4.1.2011.10.2.47.1.1.2.0
NTF h3cIDSTrapIPFragQueueFull	1.3.6.1.4.1.2011.10.2.47.1.1.2.0.1			This notification will be generated when the IP fragment queue is full. The h3cIDSTrapIPFragmentQueueLen describes the length of current fragment queue. The h3cIDSTrapReasonForError describes reason for error.
NTF h3cIDSTrapStatSessTabFull	1.3.6.1.4.1.2011.10.2.47.1.1.2.0.2			This notification will be generated when the status session table is full. The h3cIDSTrapStatSessionTabLen describes the length of current status session table. The h3cIDSTrapReasonForError describes reason for error.
NTF h3cIDSTrapDetectRuleParseFail	1.3.6.1.4.1.2011.10.2.47.1.1.2.0.3			This notification will be generated when failing to parse the rules for detecting. The h3cIDSTrapDetectRuleID object describes rule ID. The h3cIDSTrapEngineID object identifies an interface the rule applies to. The h3cIDSTrapReasonForError object describes reason for error.
NTF h3cIDSTrapDBConnLost	1.3.6.1.4.1.2011.10.2.47.1.1.2.0.4			This notification will be generated when connecting with database server fails. The h3cIDSTrapIPAddressType object describes the IP address type of database server. The h3cIDSTrapIPAddress object describes the IP address of database server. The h3cIDSTrapReasonForError describes reason of connecting failure.
NTF h3cIDSTrapCRLNeedUpdate	1.3.6.1.4.1.2011.10.2.47.1.1.2.0.5			This notification will be generated when IDS device detects that CRL is out of date. The h3cIDSTrapCRLName object describes the CRL(Certificate Revoke List) name. The h3cIDSTrapReasonForError object describes reason for error.
NTF h3cIDSTrapCertOverdue	1.3.6.1.4.1.2011.10.2.47.1.1.2.0.6			This notification will be generated when IDS device detects that certificate is overdue. The h3cIDSTrapCertName object describes the certificate name. The h3cIDSTrapReasonForError object describes reason for error.
NTF h3cIDSTrapTooManyLoginFail	1.3.6.1.4.1.2011.10.2.47.1.1.2.0.7			This notification will be generated when the login failure times of a user over a certain number. The h3cIDSTrapUserName object describes the user name when logging in. The h3cIDSTrapIPAddressType object describes the IP address type of client. The h3cIDSTrapIPAddress object describes the IP address of client. The h3cIDSTrapLoginType object describes login type, including: telnet, ssh, web. The h3cIDSTrapReasonForError object describes reason for error.
NTF h3cIDSTrapUpgradeError	1.3.6.1.4.1.2011.10.2.47.1.1.2.0.8			This notification will be generated when upgrading fails. The h3cIDSTrapUpgradeType object describes upgrade type, including: programme, vrb. The h3cIDSTrapReasonForError object describes reason for error.
NTF h3cIDSTrapFileAccessError	1.3.6.1.4.1.2011.10.2.47.1.1.2.0.9			This notification will be generated when accessing file fails. The h3cIDSTrapFileName object describes the name of file accessed. The h3cIDSTrapReasonForError object describes reason for error.
NTF h3cIDSTrapConsArithMemLow	1.3.6.1.4.1.2011.10.2.47.1.1.2.0.10			This notification will be generated when memory used by constructing the arithmetic to seek content is lacking. The h3cIDSTrapReasonForError object describes reason for error.
NTF h3cIDSTrapSSRAMOperFail	1.3.6.1.4.1.2011.10.2.47.1.1.2.0.11			This notification will be generated when reading or writing SSRAM of CIE card fails. The h3cIDSTrapReasonForError object describes reason for error.
NTF h3cIDSTrapPacketProcessDisorder	1.3.6.1.4.1.2011.10.2.47.1.1.2.0.12			This notification will be generated when packets processed is in disorder. The h3cIDSTrapReasonForError object describes reason for error.
NTF h3cIDSTrapCfgFileFormatError	1.3.6.1.4.1.2011.10.2.47.1.1.2.0.13			When devices startup and load the configuration file, if format error is found, this notification will be generated. The h3cIDSTrapFileName object describes the name of configuration file. The h3cIDSTrapCfgLineInFile object describes the line number in the file.

RFC description

Monitors intrusion detection system activity including IP fragment queues, session table length and attack events.

Start monitoring H3C router/switch/security appliance (Intrusion Detection System) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download H3C-IDS-MIB

What Is H3C-IDS-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description