H3C-MAC-INFORMATION-MIB

All MIBs › H3C-MAC-INFORMATION-MIB

Organization: Hangzhou H3C Technologies Co., Ltd.

Last Updated: 2007-12-28

Category: Technology: Switching/L2, Vendor: H3C/HH3C

Description: H3C MIB for MAC address information reporting notifying changes in MAC-to-port mappings for security monitoring.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is H3C-MAC-INFORMATION-MIB?

H3C-MAC-INFORMATION-MIB is an H3C proprietary MIB supporting the "MAC Information" feature, which reports changes in MAC-address-to-port learning on a switch to a remote monitoring station, primarily for network security and access tracking. It exposes global enable/mode settings, per-interface tables, and counters for learned and removed (aged-out) MAC addresses, plus counts of how many notifications have been sent via trap or syslog. Its monitoring value is squarely software/service-status: tracking the rate of MAC learn/remove events, cache utilization, and whether the notification pipeline is keeping up, which can reveal MAC flapping, port-security violations, or a notification queue overflow. It has no significant dependency on other standard MIBs beyond general SNMP notification conventions, functioning as a self-contained H3C feature. It is deployed on H3C access/aggregation switches where administrators need near-real-time visibility into MAC address churn for security monitoring or troubleshooting. Engineers can download the H3C-MAC-INFORMATION-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in H3C-MAC-INFORMATION-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

H3C access/aggregation switches

Monitoring Examples

An administrator would enable h3cMACInformationEnabled and set h3cMACInformationcSendInterval, then monitor h3cMACInformationLearntMACNum and h3cMACInformationRemovedMACNum to detect abnormal MAC churn (e.g., spoofing or a loop causing rapid learn/remove cycles) on a specific port via h3cMACInfomationIfTable/h3cMACInfomationIfEntry. Comparing h3cMACInformationTrapSendNum against h3cMACInformationSyslogSendNum shows whether both notification channels are firing consistently. If h3cMACInformationCacheLen stays pinned at its maximum, the device's internal MAC-event cache is likely overflowing faster than it can be reported, meaning events may be dropped.

What Can Be Monitored

MAC learn/remove counts
per-interface MAC learning activity
MAC information cache length
trap notification count
syslog notification count
MAC information feature enable state

Imported Objects

From HUAWEI-3COM-OID-MIB

h3cCommon

OBJECT-IDENTITY

From IF-MIB

ifIndex

OBJECT-TYPE

From SNMPv2-SMI

Counter32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

TEXTUAL-CONVENTION

How to Use in IPNetwork Monitor

Example using h3cMACInformationLearntMACNum OID:

Select an H3C access/aggregation switch (MAC address learn/remove notifications) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type h3cMACInformationLearntMACNum into the Find box to locate it in the OID tree, then select it and click OK. The number of MAC addresses that learnt by the device since the h3cMACInformationEnabled is set to enabled(1) and h3cMACLearntEnable is set to enabled(1) at least on one interface. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
h3cMACInformation	1.3.6.1.4.1.2011.10.2.87			This MIB file is to provide the definition of the MAC Information general configuration. MAC Information feature is used to make that the changed MAC information in the monitored device is knowable in remote monitoring device.
h3cMACInformationObjects	1.3.6.1.4.1.2011.10.2.87.1
h3cMACInformationMibGlobal	1.3.6.1.4.1.2011.10.2.87.1.1
INT h3cMACInformationEnabled	1.3.6.1.4.1.2011.10.2.87.1.1.1	INTEGER	read-write	The value is a global setting. The feature will not work until the value is set to enabled(1). If the value is set to disabled(2), the feature will stop working even there are interfaces that have been enabled the feature.
U32 h3cMACInformationcSendInterval	1.3.6.1.4.1.2011.10.2.87.1.1.2	Unsigned32	read-write	The maximum interval that the device generate syslogs or traps. The unit is second.
C32 h3cMACInformationLearntMACNumEx	1.3.6.1.4.1.2011.10.2.87.1.1.3	Counter32	read-only	The number of MAC addresses that learnt by the device since the h3cMACInformationEnabled is set to enabled(1) and h3cMACLearntEnable is set to enabled(1) at least on one interface. If the h3cMACInformationEnabled is set to disabled(2), the object will always return 0.
C32 h3cMACInformationRemovedMACNum	1.3.6.1.4.1.2011.10.2.87.1.1.4	Counter32	read-only	The number of MAC addresses that removed by the device since the h3cMACInformationEnabled is set to enabled(1) and h3cMACRemovedEnable is set to enabled(1) at least on one interface. If the h3cMACInformationEnabled is set to disabled(2), the object will always return 0.
C32 h3cMACInformationTrapSendNum	1.3.6.1.4.1.2011.10.2.87.1.1.5	Counter32	read-only	The number of traps that have been generated. This object is valid only when the h3cMACInfomationWorkMode is set to trap(1). If the h3cMACInfomationWorkMode is set to syslog(2), the object will always return 0.
C32 h3cMACInformationSyslogSendNum	1.3.6.1.4.1.2011.10.2.87.1.1.6	Counter32	read-only	The number of syslogs that have been generated. This object is valid only when the h3cMACInfomationWorkMode is set to syslog(2). If the h3cMACInfomationWorkMode is set to trap(1), the object will always return 0.
U32 h3cMACInformationCacheLen	1.3.6.1.4.1.2011.10.2.87.1.1.7	Unsigned32	read-write	The maximum queue lenth used to cache the changed MAC addresses information in the monitored device. If the value is set to 0, syslog or trap will generate as soon as there is a MAC address learnt or removed.
H3C h3cMACInfomationWorkMode	1.3.6.1.4.1.2011.10.2.87.1.1.8	H3cMACInfoWorkMode	read-write	The working mode of MAC Information feature. If the object is set to trap(1), the device will use trap mode to notify the MAC address information and all properties of trap interrelated is valid. If the object is set to syslog(2), the device will use syslog mode to notify the MAC address information and all properties of trap interrelated is invalid.
h3cMACInformationMIBTableTroop	1.3.6.1.4.1.2011.10.2.87.1.2
h3cMACInfomationIfTable	1.3.6.1.4.1.2011.10.2.87.1.2.1		not-accessible	The table is used to enable or disable the MAC Information feature on interfaces.
h3cMACInfomationIfEntry	1.3.6.1.4.1.2011.10.2.87.1.2.1.1		not-accessible	The entry of h3cMACInfomationIfTable.
INT h3cMACLearntEnable	1.3.6.1.4.1.2011.10.2.87.1.2.1.1.1	INTEGER	read-write	If the object is set to enabled(1) on interface, the device will cache the MAC address information that learnt on the interface.
INT h3cMACRemovedEnable	1.3.6.1.4.1.2011.10.2.87.1.2.1.1.2	INTEGER	read-write	If the object is set to enable(1) on interface, the device will cache the MAC address information that removed on the interface.
h3cMACInformationMibTrap	1.3.6.1.4.1.2011.10.2.87.1.3
h3cMACInformationTraps	1.3.6.1.4.1.2011.10.2.87.1.3.0
NTF h3cMACInformationChangedTrap	1.3.6.1.4.1.2011.10.2.87.1.3.0.1			When the cached number of MAC address information is reached the value specified by h3cMACInformationCacheLen, trap is generated and is sent to the remote monitoring device. The trap is also generated when the amount of time elapsed since the previous notification is greater than the interval value specified by h3cMACInformationcSendInterval and there is at least one cached MAC address information learnt or removed. The object is valid only when h3cMACInfomationWorkMode is set to trap(1). When the h3cMACInfomationWorkMode is set to syslog(2), No trap will be generated even h3cMACInformationEnabled is set to enabled(1) and the feature is enabled on interface.
h3cMACInformationTrapObjects	1.3.6.1.4.1.2011.10.2.87.1.3.2
U32 h3cMACInfoTrapIndex	1.3.6.1.4.1.2011.10.2.87.1.3.2.1	Unsigned32	accessible-for-notify	The sequence number of trap information. When it reaches the maximum value, it should be set to 1.
U32 h3cMACInfoTrapCount	1.3.6.1.4.1.2011.10.2.87.1.3.2.2	Unsigned32	accessible-for-notify	The cell number of the current trap information. The trap message may consists of more than one MAC address information. Each of the one MAC address information in one trap is called cell.
OCT h3cMACInfoTrapMsg	1.3.6.1.4.1.2011.10.2.87.1.3.2.3	OCTET STRING	accessible-for-notify	This object is the MAC information that learnt or removed in the monitored device. It can consists of more than one MAC information in the object. This object is in the format of '...'. Each cell consists of 12 octets in the format of ''. is the reason type of MAC address changed and have size of 1 octet. It only supports the following values. 1 - MAC learnt. 2 - MAC removed. is the vlan number that correspond to the MAC address in MAC address table and has size of 2 octet. is the MAC address and has size of 6 octets. is the MAC address type and has size of 1 octet. It only supports the following values. 0 - Unknown 1 - Learnt 2 - Config dynamic 3 - Config static 4 - Blackhole 5 - Security 6 - 802.1x 7 - MAC authentication 8 - Voice VLAN 9 - WAPI is the index of the interface where the MAC address is learnt or removed and has size of 2 octets.
h3cMACInformationMibTrapExt	1.3.6.1.4.1.2011.10.2.87.1.4
h3cMACInformationTrapsExt	1.3.6.1.4.1.2011.10.2.87.1.4.0
NTF h3cMACInformationChangedTrapExt	1.3.6.1.4.1.2011.10.2.87.1.4.0.1			When the cached number of MAC address information is reached the value specified by h3cMACInformationCacheLen, trap is generated and is sent to the remote monitoring device. The trap is also generated when the amount of time elapsed since the previous notification is greater than the interval value specified by h3cMACInformationcSendInterval and there is at least one cached MAC address information learnt or removed. The object is valid only when h3cMACInfomationWorkMode is set to trap(1). When the h3cMACInfomationWorkMode is set to syslog(2), No trap will be generated even h3cMACInformationEnabled is set to enabled(1) and the feature is enabled on interface.
h3cMACInformationTrapObjectsExt	1.3.6.1.4.1.2011.10.2.87.1.4.2
U32 h3cMACInfoTrapVerExt	1.3.6.1.4.1.2011.10.2.87.1.4.2.1	Unsigned32	accessible-for-notify	The version of trap information.
U32 h3cMACInfoTrapIndexExt	1.3.6.1.4.1.2011.10.2.87.1.4.2.2	Unsigned32	accessible-for-notify	The sequence number of trap information. When it reaches the maximum value, it should be set to 1.
U32 h3cMACInfoTrapCountExt	1.3.6.1.4.1.2011.10.2.87.1.4.2.3	Unsigned32	accessible-for-notify	The cell number of the current trap information. The trap message may consists of more than one MAC address information. Each of the one MAC address information in one trap is called cell.
OCT h3cMACInfoTrapMsgExt	1.3.6.1.4.1.2011.10.2.87.1.4.2.4	OCTET STRING	accessible-for-notify	This object is the MAC information that learnt or removed in the monitored device. It can consists of more than one MAC information in the object. This object is in the format of '...'. Each cell consists of 14 octets in the format of ''. is the reason type of MAC address changed and have size of 1 octet. It only supports the following values. 1 - MAC learnt. 2 - MAC removed. is the vlan number that correspond to the MAC address in MAC address table and has size of 2 octet. is the MAC address and has size of 6 octets. is the MAC address type and has size of 1 octet. It only supports the following values. 0 - Unknown 1 - Learnt 2 - Config dynamic 3 - Config static 4 - Blackhole 5 - Security 6 - 802.1x 7 - MAC authentication 8 - Voice VLAN 9 - WAPI is the index of the interface where the MAC address is learnt or removed and has size of 4 octets.

RFC description

Monitors MAC address changes and reports MAC information events via traps and syslog on H3C network switches.

Start monitoring H3C access/aggregation switch (MAC address learn/remove notifications) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download H3C-MAC-INFORMATION-MIB