HH3C-AFC-MIB

Description: Manages H3C Adaptive Flow Control (AFC) settings for bandwidth and queue management on network interfaces.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

HH3C-AFC-MIB is a vendor-specific H3C MIB for the Abnormal Flow Clean (AFC) system, a DDoS detection and mitigation feature that identifies attack traffic and applies cleaning policies. It exposes objects identifying the target IP under attack, the classified attack type, the mitigation policy applied, and threshold/speed parameters used to detect when traffic against a target exceeds normal bounds. This MIB is used to monitor security-relevant faults, specifically active DDoS attack events and how the system's clean/mitigation policy is responding, functioning much like a trap-oriented fault-detection MIB rather than a general hardware-health one. It is a private H3C MIB with no stated dependency on IETF DDoS standards, instead relying on H3C's proprietary AFC notification framework (hh3cAFCNotify). It is typically deployed on H3C anti-DDoS appliances or routers/switches with integrated traffic-cleaning capability at network edges needing DDoS protection. Network engineers evaluating or troubleshooting this functionality can download the HH3C-AFC-MIB file directly to load it into their MIB browser.

An administrator would watch for hh3cAFCNotify traps carrying hh3cDDosAttackTargetIP and hh3cDDosAttackType to identify which internal host is under attack and what kind of DDoS pattern (e.g., SYN flood, UDP flood) was detected. The hh3cDDosAttackThreshold and hh3cDDosAttackSpeed objects reveal the traffic rate that triggered detection versus the configured threshold, quantifying how far over the limit the attack traffic rose. hh3cDDosAttackPolicy shows which mitigation action (e.g., rate-limit, block) the AFC system applied in response. A trap showing attack speed far exceeding threshold with a passive policy applied would indicate the mitigation response may be insufficient for the attack's severity.

Abnormal Flow Clean system monitoring for DDoS attack detection including land, smurf, fraggle, synflood, and various protocol attack types.