HH3C-DOT11-SAVI-MIB

All MIBs › HH3C-DOT11-SAVI-MIB

Organization: New H3C Tech. Co., Ltd.

Last Updated: 2020-07-15

Category: Domain: Security, Technology: Wireless, Vendor: H3C/HH3C

Description: Manages 802.11 Source Address Validation Improvement (SAVI) to bind wireless clients to verified IP/MAC pairs.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is HH3C-DOT11-SAVI-MIB?

HH3C-DOT11-SAVI-MIB is an H3C enterprise MIB implementing Source Address Validation Improvement (SAVI) for wireless LANs, a security feature that binds each wireless client's verified IP address to its MAC address and association to prevent IP/MAC spoofing. It exposes per-service SAVI configuration (IP version, service name, validation status), filtering-entry tables mapping IP/MAC pairs, and count tables tracking bound entries. Its monitoring value is a software/security-feature status check: confirming SAVI services are validly configured and active, and reviewing the filtering table to see which client IP/MAC bindings are currently enforced, useful for spotting spoofing attempts or clients being unexpectedly blocked. It builds on standard SAVI concepts (an IETF security architecture) as applied to the H3C WLAN stack. Typical deployment is on H3C wireless controllers/APs in security-conscious enterprise or campus WLAN deployments. Engineers can download the HH3C-DOT11-SAVI-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in HH3C-DOT11-SAVI-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

H3C wireless controller/AP with SAVI support

Monitoring Examples

An admin would check hh3cDot11SAVIServiceTable (via hh3cDot11SAVIServiceIPVersion/hh3cDot11SAVIServiceValidStatus) to confirm a SAVI service is validly configured, then inspect hh3cDot11SAVIFilteringTable entries (hh3cDot11SAVIFilteringIpAddress/hh3cDot11SAVIFilteringMacAddr) to see bound client pairs. A client whose traffic is dropped despite a valid DHCP lease might show up missing from hh3cDot11SAVICountTable, pointing to a SAVI binding failure.

What Can Be Monitored

SAVI service validation status
IP version per SAVI service
bound client IP/MAC filtering entries
SAVI binding entry count

Imported Objects

From HH3C-DOT11-REF-MIB

Hh3cDot11ObjectIDType
Hh3cDot11RadioScopeType
hh3cDot11	MODULE-IDENTITY

From INET-ADDRESS-MIB

InetAddress
InetAddressType
InetVersion

From SNMPv2-SMI

Counter64
MODULE-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

MacAddress
TruthValue

How to Use in IPNetwork Monitor

Example using hh3cDot11SAVICountFilterPkts OID:

Select an H3C wireless controller/AP with SAVI support (source address validation) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type hh3cDot11SAVICountFilterPkts into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. The count of dropped packets. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter64-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases between polls, since a rising count of errors, failures, or discards often points to a real underlying problem. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
hh3cDot11SAVI	1.3.6.1.4.1.25506.2.75.20			The MIB Module for managing SAVI objects in WLAN scenario.
hh3cDot11SAVIObjects	1.3.6.1.4.1.25506.2.75.20.1
hh3cDot11SAVIServiceTable	1.3.6.1.4.1.25506.2.75.20.1.1		not-accessible	The table containing SAVI running parameters of each Service.
hh3cDot11SAVIServiceEntry	1.3.6.1.4.1.25506.2.75.20.1.1.1		not-accessible	An entry containing SAVI running parameters of a Service.
INE hh3cDot11SAVIServiceIPVersion	1.3.6.1.4.1.25506.2.75.20.1.1.1.1	InetVersion	not-accessible	The IP version.
OCT hh3cDot11SAVIServiceServiceName	1.3.6.1.4.1.25506.2.75.20.1.1.1.2	OCTET STRING	not-accessible	The service name.
T/F hh3cDot11SAVIServiceValidStatus	1.3.6.1.4.1.25506.2.75.20.1.1.1.3	TruthValue	read-write	The validation status of the interface. Setting this attribute to true, the interface will check source address.
hh3cDot11SAVIFilteringTable	1.3.6.1.4.1.25506.2.75.20.1.2		not-accessible	The filtering table is used to filter packets.
hh3cDot11SAVIFilteringEntry	1.3.6.1.4.1.25506.2.75.20.1.2.1		not-accessible	An entry containing the filtering parameters. Entries are keyed on the anchor.
IPt hh3cDot11SAVIFilteringIpType	1.3.6.1.4.1.25506.2.75.20.1.2.1.1	InetAddressType	not-accessible	IP address type of the source IP.
OCT hh3cDot11SAVIFilteringServName	1.3.6.1.4.1.25506.2.75.20.1.2.1.2	OCTET STRING	not-accessible	The service name.
IP hh3cDot11SAVIFilteringIpAddress	1.3.6.1.4.1.25506.2.75.20.1.2.1.3	InetAddress	not-accessible	The source IP address.
MAC hh3cDot11SAVIFilteringMacAddr	1.3.6.1.4.1.25506.2.75.20.1.2.1.4	MacAddress	read-only	The source MAC address.
hh3cDot11SAVICountTable	1.3.6.1.4.1.25506.2.75.20.1.3		not-accessible	The table containing count of packets dropped because of validation failure.
hh3cDot11SAVICountEntry	1.3.6.1.4.1.25506.2.75.20.1.3.1		not-accessible	An entry containing count of packets dropped because of validation failure for each Service.
INE hh3cDot11SAVICountIPVersion	1.3.6.1.4.1.25506.2.75.20.1.3.1.1	InetVersion	not-accessible	The IP version.
OCT hh3cDot11SAVICountServiceString	1.3.6.1.4.1.25506.2.75.20.1.3.1.2	OCTET STRING	not-accessible	The service name.
C64 hh3cDot11SAVICountFilterPktsEx	1.3.6.1.4.1.25506.2.75.20.1.3.1.3	Counter64	read-only	The count of dropped packets.
hh3cDot11SAVIStatisTable	1.3.6.1.4.1.25506.2.75.20.1.4		not-accessible	The table containing the SAVI statistics.
hh3cDot11SAVIStatisEntry	1.3.6.1.4.1.25506.2.75.20.1.4.1		not-accessible	An entry containing the SAVI statistics for each AP.
HH3 hh3cDot11SAVIStatisAPID	1.3.6.1.4.1.25506.2.75.20.1.4.1.1	Hh3cDot11ObjectIDType	not-accessible	To uniquely identify an AP
HH3 hh3cDot11SAVIStatisRadioID	1.3.6.1.4.1.25506.2.75.20.1.4.1.2	Hh3cDot11RadioScopeType	not-accessible	Represents each radio.
C64 hh3cDot11SAVIStatisCount	1.3.6.1.4.1.25506.2.75.20.1.4.1.3	Counter64	read-only	The count of Packets dropped because of validation failure.
C64 hh3cDot11SAVIStatisBytes	1.3.6.1.4.1.25506.2.75.20.1.4.1.4	Counter64	read-only	The bytes of packets dropped because of validation failure.
C64 hh3cDot11SAVIBindingCount	1.3.6.1.4.1.25506.2.75.20.1.4.1.5	Counter64	read-only	The count of binding entries.

RFC description

SAVI (Source Address Validation Improvement) management for wireless LAN scenarios.

Start monitoring H3C wireless controller/AP with SAVI support (source address validation) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download HH3C-DOT11-SAVI-MIB