H3C-LI-MIB

All MIBs › H3C-LI-MIB

Organization: Hangzhou H3C Tech. Co., Ltd.

Last Updated: 2009-08-25

Category: VPN and Security, Vendor: H3C/HH3C

Description: H3C MIB for Lawful Intercept (LI) management configuring and monitoring lawful intercept sessions on H3C devices.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is H3C-LI-MIB?

H3C-LI-MIB is an H3C-specific MIB implementing Lawful Intercept (LI) management, allowing authorized configuration of intercept mediation sessions that duplicate targeted traffic to a law-enforcement collection point. It exposes board/hardware identification for the intercept-capable module and a mediation table defining each intercept session's destination address/port, source interface, DSCP marking, timeout, and transport method. As a monitoring MIB it is used less for general hardware health and more for confirming that lawful-intercept sessions are correctly configured and active (mediation destination reachable, correct source interface bound) plus surfacing intercept-related events through h3cLINotifications; h3cLIBoardInformation does provide a hardware-identity/status data point for the intercept processing board. It has no explicit stated MIB dependency, being a self-contained, highly access-restricted proprietary feature. It is typically deployed on H3C carrier/service-provider-grade routers and switches subject to legal intercept/compliance requirements, and access to this MIB is normally tightly restricted. Engineers can download the H3C-LI-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in H3C-LI-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

H3C carrier/service-provider routers and switches

Monitoring Examples

Polling h3cLIMediationTable / h3cLIMediationEntry indexed by h3cLIMediationIndex shows the configured h3cLIMediationDestAddr/h3cLIMediationDestPort, h3cLIMediationSrcInterface, and h3cLIMediationTransport for each active intercept session, letting an authorized operator confirm mediation traffic is being routed as intended. Checking h3cLIMediationTimeOut and h3cLIMediationDscp confirms session timeout and QoS marking settings. h3cLIBoardInformation gives the identity/status of the hardware board handling intercept processing.

What Can Be Monitored

intercept mediation session configuration
mediation destination address/port
source interface bound to intercept
session timeout and DSCP marking
intercept processing board information

Imported Objects

From HUAWEI-3COM-OID-MIB

h3cCommon

OBJECT-IDENTITY

From IF-MIB

InterfaceIndexOrZero

From INET-ADDRESS-MIB

InetAddress
InetAddressPrefixLength
InetAddressType
InetPortNumber

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-SMI

Counter32
Counter64
Integer32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DateAndTime
MacAddress
RowStatus
TruthValue

OIDs

OID symbolic	OID numeric	Type	Access	Description
h3cLI	1.3.6.1.4.1.2011.10.2.111			Lawful Interception MIB
h3cLICommon	1.3.6.1.4.1.2011.10.2.111.1
h3cLITrapBindObjects	1.3.6.1.4.1.2011.10.2.111.1.1
U32 h3cLIBoardInformation	1.3.6.1.4.1.2011.10.2.111.1.1.1	Unsigned32	accessible-for-notify	It is a slot number.
h3cLINotifications	1.3.6.1.4.1.2011.10.2.111.1.2
h3cLINotificationsPrefix	1.3.6.1.4.1.2011.10.2.111.1.2.0
NTF h3cLIActive	1.3.6.1.4.1.2011.10.2.111.1.2.0.1			This Notification is sent when a type of intercepting configuration is changed from inactive to active. The value of the h3cLIStreamtype which identify the actual intercept stream is included in this notification.
NTF h3cLITimeOut	1.3.6.1.4.1.2011.10.2.111.1.2.0.2			When the time specified in h3cLIMediationTimeout arrives, the device notifies the manager corresponding intercept is removed.
NTF h3cLIFailureInformation	1.3.6.1.4.1.2011.10.2.111.1.2.0.3			When interception is configured on distributed device, the configuration perhaps failed on some board. If this happened, this notification will occur.
h3cLIObjects	1.3.6.1.4.1.2011.10.2.111.1.3
I32 h3cLINewIndex	1.3.6.1.4.1.2011.10.2.111.1.3.1	Integer32	read-only	This object will be used as an index value for a new h3cLIMediationEntry. Whenever read, the agent will give a non-used value. This is to reduce the probability of conflict during creation of new h3cLIMediationTable entries.
h3cLIMediationTable	1.3.6.1.4.1.2011.10.2.111.1.3.2		not-accessible	This table describes interception gateway information with which interception device communicates.
h3cLIMediationEntry	1.3.6.1.4.1.2011.10.2.111.1.3.2.1		not-accessible	An entry of configuring mediation device.
I32 h3cLIMediationIndex	1.3.6.1.4.1.2011.10.2.111.1.3.2.1.1	Integer32	not-accessible	h3cLIMediationIndex is a entry identifier. The Mediation Device should be responsible for making sure these are unique. Before creating a new entry, a value for this variable may be obtained by reading h3cLINewIndex to reduce the probability of a value collision.
IPt h3cLIMediationDestAddrType	1.3.6.1.4.1.2011.10.2.111.1.3.2.1.2	InetAddressType	read-write	The type of h3cLIMediationDestAddr.
IP h3cLIMediationDestAddr	1.3.6.1.4.1.2011.10.2.111.1.3.2.1.3	InetAddress	read-write	The IP Address of the Mediation Device to receive intercepted traffic.
INE h3cLIMediationDestPort	1.3.6.1.4.1.2011.10.2.111.1.3.2.1.4	InetPortNumber	read-write	The L4-port number on the Mediation Device to receive intercepted traffic.
NUM h3cLIMediationSrcInterface	1.3.6.1.4.1.2011.10.2.111.1.3.2.1.5	InterfaceIndexOrZero	read-write	The interface on the intercepting device from which to transmit intercepted data. If zero, intercepting device will select an outbound interface according to h3cLIMediationDestAddr.
I32 h3cLIMediationDscp	1.3.6.1.4.1.2011.10.2.111.1.3.2.1.6	Integer32	read-write	The Differentiated Services Code Point the intercepting device applies to the IP packets encapsulating the intercepted traffic.
DAT h3cLIMediationTimeOut	1.3.6.1.4.1.2011.10.2.111.1.3.2.1.7	DateAndTime	read-write	The time at which this row and all related Stream Table rows should be automatically removed, and the intercept function expire.
INT h3cLIMediationTransport	1.3.6.1.4.1.2011.10.2.111.1.3.2.1.8	INTEGER	read-write	The protocol used in transferring intercepted data to the Mediation Device.
T/F h3cLIMediationNotificationEnable	1.3.6.1.4.1.2011.10.2.111.1.3.2.1.9	TruthValue	read-write	This variable controls the generation of any notifications or informs by the MIB agent for this table entry.
ROW h3cLIMediationRowStatus	1.3.6.1.4.1.2011.10.2.111.1.3.2.1.10	RowStatus	read-create	Operation status of this table entry.
h3cLIStreamTable	1.3.6.1.4.1.2011.10.2.111.1.3.3		not-accessible	This table lists the traffic stream's type to be intercepted. The specified filter is defined in h3cLIIPStreamTable, h3cLIMACStreamTable or h3cLIUserStreamTable, according to h3cLIStreamtype. Also it contains counters for packets to be intercepted and dropped by attached type of filter.
h3cLIStreamEntry	1.3.6.1.4.1.2011.10.2.111.1.3.3.1		not-accessible	A single type of data stream to be intercepted.
I32 h3cLIStreamIndex	1.3.6.1.4.1.2011.10.2.111.1.3.3.1.1	Integer32	not-accessible	The index of the stream entry.
INT h3cLIStreamtype	1.3.6.1.4.1.2011.10.2.111.1.3.3.1.2	INTEGER	read-write	Identifies the type of stream, and according to it uses filter table. It can not be changed after a filter table is attached to it. The following types of streams are supported: ip: IP filter. The exact definition is a row in h3cLIIPStreamTable. mac: MAC filter. The exact definition is a row in h3cLIMACStreamTable. userConnecton: User connection filter. The exact definition is a row in h3cLIUserStreamTable.
T/F h3cLIStreamEnable	1.3.6.1.4.1.2011.10.2.111.1.3.3.1.3	TruthValue	read-write	If 'true', the interception is active. And it is set to 'true' only after an additional filter specification has been attached to this stream.
C32 h3cLIStreamPackets	1.3.6.1.4.1.2011.10.2.111.1.3.3.1.4	Counter32	read-only	The numbers of packets that have been intercepted.
C32 h3cLIStreamDrops	1.3.6.1.4.1.2011.10.2.111.1.3.3.1.5	Counter32	read-only	The numbers of packets were dropped in the lawful intercept process.
C64 h3cLIStreamHPackets	1.3.6.1.4.1.2011.10.2.111.1.3.3.1.6	Counter64	read-only	The numbers of packets have been intercepted. This object is a 64-bit version of h3cLIStreamPackets.
C64 h3cLIStreamHDrops	1.3.6.1.4.1.2011.10.2.111.1.3.3.1.7	Counter64	read-only	The numbers of packets were dropped in the lawful intercept process. This object is a 64-bit version of h3cLIStreamDrops.
ROW h3cLIStreamRowStatus	1.3.6.1.4.1.2011.10.2.111.1.3.3.1.8	RowStatus	read-create	Operation status of this table entry.
h3cLIIPStream	1.3.6.1.4.1.2011.10.2.111.2
h3cLIIPStreamObjects	1.3.6.1.4.1.2011.10.2.111.2.1
h3cLIIPStreamTable	1.3.6.1.4.1.2011.10.2.111.2.1.1		not-accessible	This table lists the IPv4 and IPv6 streams to be intercepted. It is associated with h3cLIMediationTable and h3cLIStreamTable.
h3cLIIPStreamEntry	1.3.6.1.4.1.2011.10.2.111.2.1.1.1		not-accessible	A single stream to be intercepted. The first index indicates the Mediation Device. The second index is that of the stream's counter entry in the h3cLIStreamTable. The second index permits multiple classifiers to be used together, such as having an IP address as source or destination.
NUM h3cLIIPStreamInterface	1.3.6.1.4.1.2011.10.2.111.2.1.1.1.1	InterfaceIndexOrZero	read-write	Traffic received or transmitted over this interface will be intercepted. This value must be set when creating a stream entry, either zero, or a valid interface index. If the value is zero, interception accepts any interface. Then at least one additional parameter must be selected, and not be default value.
IPt h3cLIIPStreamAddrType	1.3.6.1.4.1.2011.10.2.111.2.1.1.1.2	InetAddressType	read-write	The type of address, used in packet selection.
IP h3cLIIPStreamDestAddr	1.3.6.1.4.1.2011.10.2.111.2.1.1.1.3	InetAddress	read-write	The Destination address used in packet selection. This address will be consistent with the type specified in h3cLIIPStreamAddrType.
ADR h3cLIIPStreamDestAddrLength	1.3.6.1.4.1.2011.10.2.111.2.1.1.1.4	InetAddressPrefixLength	read-write	The length of the Destination Prefix. A value of zero means all addresses to match. This prefix length will be consistent with the type specified in h3cLIIPStreamAddrType.
IP h3cLIIPStreamSrcAddr	1.3.6.1.4.1.2011.10.2.111.2.1.1.1.5	InetAddress	read-write	The Source Address used in packet selection. This address will be consistent with the type specified in h3cLIIPStreamAddrType.
ADR h3cLIIPStreamSrcAddrLength	1.3.6.1.4.1.2011.10.2.111.2.1.1.1.6	InetAddressPrefixLength	read-write	The length of the Source Prefix. A value of zero means all addresses to match. This prefix length will be consistent with the type specified in h3cLIIPStreamAddrType.
I32 h3cLIIPStreamTosByte	1.3.6.1.4.1.2011.10.2.111.2.1.1.1.7	Integer32	read-write	The value of the TOS byte. If h3cLIIPStreamTosByte&(~h3cLIIPStreamTosByteMask)!=0, configuration is rejected.
I32 h3cLIIPStreamTosByteMask	1.3.6.1.4.1.2011.10.2.111.2.1.1.1.8	Integer32	read-write	This value is ANDed with the value of the TOS byte in a packet and compared with h3cLIIPStreamTosByte. If the values are equal, the comparison is equal. If both the mask and the TosByte value are zero, the result is to always accept.
I32 h3cLIIPStreamFlowId	1.3.6.1.4.1.2011.10.2.111.2.1.1.1.9	Integer32	read-write	The flow identifier in an IPv6 header. -1 indicates that the Flow Id is unused.
I32 h3cLIIPStreamProtocol	1.3.6.1.4.1.2011.10.2.111.2.1.1.1.10	Integer32	read-write	The IP protocol to match against the IPv4 protocol number or the IPv6 Next- Header number in the packet.
INE h3cLIIPStreamDestL4PortMin	1.3.6.1.4.1.2011.10.2.111.2.1.1.1.11	InetPortNumber	read-write	The minimum value that the layer-4 destination port number in the packet must have in order to match. This value must be equal to or less than the value specified for this entry in h3cLIIPStreamDestL4PortMax. If both h3cLIIPStreamDestL4PortMin and h3cLIIPStreamDestL4PortMax are at their default values, the port number is effectively unused. If h3cLIIPStreamDestL4PortMin is equal to h3cLIIPStreamDestL4PortMax, only one port number to be intercepted.
INE h3cLIIPStreamDestL4PortMax	1.3.6.1.4.1.2011.10.2.111.2.1.1.1.12	InetPortNumber	read-write	The maximum value that the layer-4 destination port number in the packet must have in order to match this classifier entry. This value must be equal to or greater than the value specified for this entry in h3cLIIPStreamDestL4PortMin. If both h3cLIIPStreamDestL4PortMin and h3cLIIPStreamDestL4PortMax are at their default values, the port number is effectively unused. If h3cLIIPStreamDestL4PortMin is equal to h3cLIIPStreamDestL4PortMax, only one port number to be intercepted.
INE h3cLIIPStreamSrcL4PortMin	1.3.6.1.4.1.2011.10.2.111.2.1.1.1.13	InetPortNumber	read-write	The minimum value that the layer-4 destination port number in the packet must have in order to match. This value must be equal to or less than the value specified for this entry in h3cLIIPStreamSrcL4PortMax. If both h3cLIIPStreamSrcL4PortMin and h3cLIIPStreamSrcL4PortMax are at their default values, the port number is effectively unused. If h3cLIIPStreamSrcL4PortMin is equal to h3cLIIPStreamSrcL4PortMax, only one port number to be intercepted.
INE h3cLIIPStreamSrcL4PortMax	1.3.6.1.4.1.2011.10.2.111.2.1.1.1.14	InetPortNumber	read-write	The maximum value that the layer-4 destination port number in the packet must have in order to match this classifier entry. This value must be equal to or greater than the value specified for this entry in h3cLIIPStreamSrcL4PortMin. If both h3cLIIPStreamSrcL4PortMin and h3cLIIPStreamSrcL4PortMax are at their default values, the port number is effectively unused. If h3cLIIPStreamSrcL4PortMin is equal to h3cLIIPStreamSrcL4PortMax, only one port number to be intercepted.
STR h3cLIIPStreamVRF	1.3.6.1.4.1.2011.10.2.111.2.1.1.1.15	SnmpAdminString	read-write	It is the name of a Virtual Routing and Forwarding (VRF) of a VPN.
ROW h3cLIIPStreamRowStatus	1.3.6.1.4.1.2011.10.2.111.2.1.1.1.18	RowStatus	read-create	Operation status of this table entry.
h3cLIMACStream	1.3.6.1.4.1.2011.10.2.111.3
h3cLIMACStreamObjects	1.3.6.1.4.1.2011.10.2.111.3.1
h3cLIMACStreamTable	1.3.6.1.4.1.2011.10.2.111.3.1.1		not-accessible	This table lists the IEEE 802 streams to be intercepted. It is associated with h3cLIMediationTable and h3cLIStreamTable.
h3cLIMACStreamEntry	1.3.6.1.4.1.2011.10.2.111.3.1.1.1		not-accessible	A single stream to be intercepted. The first index indicates the Mediation Device. The second index is that of the stream's counter entry in the h3cLIStreamTable. The second index permits multiple classifiers to be used together, such as having an MAC address as source or destination.
BIT h3cLIMACStreamFields	1.3.6.1.4.1.2011.10.2.111.3.1.1.1.1	Bits	read-write	This object displays what attributes will be compared to identify traffic. interface: indicates that traffic on the stated interface is to be intercepted dstMacAddress: indicates that traffic destined to a given address should be intercepted srcMacAddress: indicates that traffic sourced from a given address should be intercepted ethernetPid: indicates that traffic with a stated Ethernet Protocol Identifier should be intercepted dSap: indicates that traffic with an certain 802.2 LLC Destination SAP should be intercepted sSap: indicates that traffic with an certain 802.2 LLC Source SAP should be intercepted At least one of the bits has to be set in order to activate an entry. If multiple bits are set, traffic to be intercepted must be satisfied with all set attributes.
NUM h3cLIMACStreamInterface	1.3.6.1.4.1.2011.10.2.111.3.1.1.1.2	InterfaceIndexOrZero	read-write	Traffic received or transmitted over this interface will be intercepted. This value must be set when creating a stream entry, either zero, or a valid interface index. If the value is zero, interception accepts any interface. Additional parameter must be selected together.
MAC h3cLIMACStreamDestAddr	1.3.6.1.4.1.2011.10.2.111.3.1.1.1.3	MacAddress	read-write	The Destination address used in packet selection.
MAC h3cLIMACStreamSrcAddr	1.3.6.1.4.1.2011.10.2.111.3.1.1.1.4	MacAddress	read-write	The Source Address used in packet selection.
U32 h3cLIMACStreamEthPid	1.3.6.1.4.1.2011.10.2.111.3.1.1.1.5	Unsigned32	read-write	The value of the Ethernet Protocol Identifier in the Ethernet traffic or IEEE 802.2 SNAP traffic.
U32 h3cLIMACStreamDSap	1.3.6.1.4.1.2011.10.2.111.3.1.1.1.6	Unsigned32	read-write	The value of the IEEE 802.2 Destination SAP.
U32 h3cLIMACStreamSSap	1.3.6.1.4.1.2011.10.2.111.3.1.1.1.7	Unsigned32	read-write	The value of the IEEE 802.2 Source SAP.
ROW h3cLIMACStreamRowStatus	1.3.6.1.4.1.2011.10.2.111.3.1.1.1.8	RowStatus	read-create	Operation status of this table entry.
h3cLIUserStream	1.3.6.1.4.1.2011.10.2.111.4
h3cLIUserStreamObjects	1.3.6.1.4.1.2011.10.2.111.4.1
h3cLIUserStreamTable	1.3.6.1.4.1.2011.10.2.111.4.1.1		not-accessible	This table lists the user connection streams to be intercepted. It is associated with h3cLIMediationTable and h3cLIStreamTable.
h3cLIUserStreamEntry	1.3.6.1.4.1.2011.10.2.111.4.1.1.1		not-accessible	A single stream to be intercepted. The first index indicates the Mediation Device. The second index is that of the stream's counter entry in the h3cLIStreamTable. This permits multiple classifiers to be used together.
OCT h3cLIUserStreamAcctSessID	1.3.6.1.4.1.2011.10.2.111.4.1.1.1.1	OCTET STRING	read-write	This is the RADIUS attribute 44 acct-session-ID. The string must be set, and the length not be zero.
ROW h3cLIUserStreamRowStatus	1.3.6.1.4.1.2011.10.2.111.4.1.1.1.2	RowStatus	read-create	Operation status of this table entry.

RFC description

H3C Lawful Interception (LI) MIB; defines objects for lawful interception and monitoring capabilities in H3C network devices.

Start monitoring H3C carrier/service-provider router/switch (Lawful Intercept) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download H3C-LI-MIB

What Is H3C-LI-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description