All MIBs › HH3C-ARP-RATELIMIT-MIB
Organization: Hangzhou H3C Technologies Co., Ltd.
Last Updated: 2013-10-14
Category: Domain: Security, Vendor: H3C/HH3C
Description: Configures ARP packet rate limiting on H3C device interfaces to protect against ARP flood attacks.
Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.
What Is HH3C-ARP-RATELIMIT-MIB?
HH3C-ARP-RATELIMIT-MIB configures and monitors ARP packet rate limiting on H3C switches and routers, a security/stability feature that throttles the rate of ARP packets punted to the device's CPU to defend against ARP flood attacks. It exposes a per-interface rate-limit configuration table along with trap objects that fire when the configured ARP rate threshold is exceeded. Although titled a rate-limit MIB, the module's current implementation is explicitly monitoring-only per its description, so its practical value is in fault/event detection, specifically alerting on ARP traffic anomalies, giving indirect insight into CPU protection health during an ARP-based attack. It is an H3C-proprietary module built on the device's internal CPU-protection subsystem and is not derived from an external standard. It is deployed on H3C access and aggregation switches/routers in environments concerned with ARP spoofing or broadcast-storm style attacks. Engineers can download the HH3C-ARP-RATELIMIT-MIB file directly to load it into their MIB browser.
IPNetwork Monitor allows you to monitor SNMP objects defined in HH3C-ARP-RATELIMIT-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.
Supported Devices
- H3C switches
- H3C routers
- H3C switches and routers
Monitoring Examples
An administrator would configure hh3cARPRatelimitValue in the hh3cARPRatelimitConfigTable per interface, and then watch for hh3cARPRatelimitTrapCount and hh3cARPRatelimitTrapMsg in traps carrying hh3cARPRatelimitTrapVer when the configured rate is exceeded. A spike in hh3cARPRatelimitTrapCount on a specific interface would indicate that interface is receiving an abnormal volume of ARP traffic, consistent with an ARP flood or spoofing attempt. Because the feature is monitoring-only in this version, the trap is the primary observable signal rather than any enforcement counter.
What Can Be Monitored
- ARP rate limit threshold per interface
- ARP rate-limit trap occurrence count
- ARP rate-limit trap message detail
- ARP rate-limit trap protocol version
Imported Objects
From HH3C-OID-MIB
| hh3cCommon | OBJECT-IDENTITY |
From IF-MIB
| ifIndex | OBJECT-TYPE |
From SNMPv2-SMI
| MODULE-IDENTITY | |
| NOTIFICATION-TYPE | |
| OBJECT-TYPE | |
| Unsigned32 |
OIDs
RFC description
Monitors and controls ARP packet rate delivery to CPU. Manages ARP rate limit configuration and thresholds on network devices.
Start monitoring H3C switches and routers with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.