HH3C-IDS-MIB

All MIBs › HH3C-IDS-MIB

Organization: Hangzhou H3C Tech. Co., Ltd.

Last Updated: 2005-07-14

Category: Domain: Security, Vendor: H3C/HH3C

Description: Manages H3C Intrusion Detection System (IDS) signatures, events, and attack statistics for network security.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is HH3C-IDS-MIB?

HH3C-IDS-MIB carries H3C's proprietary Intrusion Detection System (IDS) information, covering signatures, detected attack events, and related statistics used to detect intruder activity, per its module description. As an IDS MIB it would typically expose counters for detected attacks by signature/category and configuration state for enabled detection policies, representing security-software status rather than physical hardware. Monitoring would focus on attack-event counts and detection-engine status to reveal active intrusion attempts or a spike in a particular attack signature. It is vendor-specific to H3C and complements general security-event/syslog mechanisms rather than any single IETF standard. It is deployed on H3C security-capable switches/routers or dedicated IDS appliances in enterprise networks; no object names were included in the source data for this module, so specifics beyond the stated purpose cannot be confirmed. Engineers can download the HH3C-IDS-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in HH3C-IDS-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

H3C security-capable switches/routers

Monitoring Examples

No sample objects were provided for this MIB, so a concrete scenario naming real objects cannot be constructed. Based on the description, an admin would typically poll attack/signature counters to detect a spike in intrusion attempts against the device.

What Can Be Monitored

detected attack/signature counters

Imported Objects

From HH3C-OID-MIB

hh3cCommon

OBJECT-IDENTITY

From INET-ADDRESS-MIB

InetAddress
InetAddressType

From SNMPv2-SMI

Integer32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

OIDs

OID symbolic	OID numeric	Type	Access	Description
hh3cIds	1.3.6.1.4.1.25506.2.47
hh3cIDSMib	1.3.6.1.4.1.25506.2.47.1			This MIB describes IDS private information. IDS(Instruction Detecting System) is used to detect intruder activity.
hh3cIDSTrapGroup	1.3.6.1.4.1.25506.2.47.1.1
hh3cIDSTrapInfo	1.3.6.1.4.1.25506.2.47.1.1.1
U32 hh3cIDSTrapIPFragmentQueueLen	1.3.6.1.4.1.25506.2.47.1.1.1.1	Unsigned32	accessible-for-notify	The length of IP fragment queue.
U32 hh3cIDSTrapStatSessionTabLen	1.3.6.1.4.1.25506.2.47.1.1.1.2	Unsigned32	accessible-for-notify	The length of status session table.
IPt hh3cIDSTrapIPAddressType	1.3.6.1.4.1.25506.2.47.1.1.1.3	InetAddressType	accessible-for-notify	The type of IP Address.
IP hh3cIDSTrapIPAddress	1.3.6.1.4.1.25506.2.47.1.1.1.4	InetAddress	accessible-for-notify	IP Address.
OCT hh3cIDSTrapUserName	1.3.6.1.4.1.25506.2.47.1.1.1.5	OCTET STRING	accessible-for-notify	User name.
INT hh3cIDSTrapLoginType	1.3.6.1.4.1.25506.2.47.1.1.1.6	INTEGER	accessible-for-notify	Login type, including telnet, ssh and web.
INT hh3cIDSTrapUpgradeType	1.3.6.1.4.1.25506.2.47.1.1.1.7	INTEGER	accessible-for-notify	Upgrade type, including programme(system image), crb(custom rule base, one kind of configuration file), vrb(vendor rule base, one kind of configuration file).
OCT hh3cIDSTrapCRLName	1.3.6.1.4.1.25506.2.47.1.1.1.8	OCTET STRING	accessible-for-notify	CRL(Certificate Revoke List) name.
OCT hh3cIDSTrapCertName	1.3.6.1.4.1.25506.2.47.1.1.1.9	OCTET STRING	accessible-for-notify	Certificate name.
U32 hh3cIDSTrapDetectRuleID	1.3.6.1.4.1.25506.2.47.1.1.1.10	Unsigned32	accessible-for-notify	The rule ID which is a unique identifier for a specified detect rule.
I32 hh3cIDSTrapEngineID	1.3.6.1.4.1.25506.2.47.1.1.1.11	Integer32	accessible-for-notify	A unique number used to identify an interface.
OCT hh3cIDSTrapFileName	1.3.6.1.4.1.25506.2.47.1.1.1.12	OCTET STRING	accessible-for-notify	The file name.
U32 hh3cIDSTrapCfgLineInFile	1.3.6.1.4.1.25506.2.47.1.1.1.13	Unsigned32	accessible-for-notify	The line number in the configuration file.
OCT hh3cIDSTrapReasonForError	1.3.6.1.4.1.25506.2.47.1.1.1.14	OCTET STRING	accessible-for-notify	The information of the notification. Although the format and content of this object are device specific, they should be defined uniformly in the device.
hh3cIDSTrap	1.3.6.1.4.1.25506.2.47.1.1.2
hh3cIDSTrapPrefix	1.3.6.1.4.1.25506.2.47.1.1.2.0
NTF hh3cIDSTrapIPFragQueueFull	1.3.6.1.4.1.25506.2.47.1.1.2.0.1			This notification will be generated when the IP fragment queue is full. The hh3cIDSTrapIPFragmentQueueLen describes the length of current fragment queue. The hh3cIDSTrapReasonForError describes reason for error.
NTF hh3cIDSTrapStatSessTabFull	1.3.6.1.4.1.25506.2.47.1.1.2.0.2			This notification will be generated when the status session table is full. The hh3cIDSTrapStatSessionTabLen describes the length of current status session table. The hh3cIDSTrapReasonForError describes reason for error.
NTF hh3cIDSTrapDetectRuleParseFail	1.3.6.1.4.1.25506.2.47.1.1.2.0.3			This notification will be generated when failing to parse the rules for detecting. The hh3cIDSTrapDetectRuleID object describes rule ID. The hh3cIDSTrapEngineID object identifies an interface the rule applies to. The hh3cIDSTrapReasonForError object describes reason for error.
NTF hh3cIDSTrapDBConnLost	1.3.6.1.4.1.25506.2.47.1.1.2.0.4			This notification will be generated when connecting with database server fails. The hh3cIDSTrapIPAddressType object describes the IP address type of database server. The hh3cIDSTrapIPAddress object describes the IP address of database server. The hh3cIDSTrapReasonForError describes reason of connecting failure.
NTF hh3cIDSTrapCRLNeedUpdate	1.3.6.1.4.1.25506.2.47.1.1.2.0.5			This notification will be generated when IDS device detects that CRL is out of date. The hh3cIDSTrapCRLName object describes the CRL(Certificate Revoke List) name. The hh3cIDSTrapReasonForError object describes reason for error.
NTF hh3cIDSTrapCertOverdue	1.3.6.1.4.1.25506.2.47.1.1.2.0.6			This notification will be generated when IDS device detects that certificate is overdue. The hh3cIDSTrapCertName object describes the certificate name. The hh3cIDSTrapReasonForError object describes reason for error.
NTF hh3cIDSTrapTooManyLoginFail	1.3.6.1.4.1.25506.2.47.1.1.2.0.7			This notification will be generated when the login failure times of a user over a certain number. The hh3cIDSTrapUserName object describes the user name when logging in. The hh3cIDSTrapIPAddressType object describes the IP address type of client. The hh3cIDSTrapIPAddress object describes the IP address of client. The hh3cIDSTrapLoginType object describes login type, including: telnet, ssh, web. The hh3cIDSTrapReasonForError object describes reason for error.
NTF hh3cIDSTrapUpgradeError	1.3.6.1.4.1.25506.2.47.1.1.2.0.8			This notification will be generated when upgrading fails. The hh3cIDSTrapUpgradeType object describes upgrade type, including: programme, vrb. The hh3cIDSTrapReasonForError object describes reason for error.
NTF hh3cIDSTrapFileAccessError	1.3.6.1.4.1.25506.2.47.1.1.2.0.9			This notification will be generated when accessing file fails. The hh3cIDSTrapFileName object describes the name of file accessed. The hh3cIDSTrapReasonForError object describes reason for error.
NTF hh3cIDSTrapConsArithMemLow	1.3.6.1.4.1.25506.2.47.1.1.2.0.10			This notification will be generated when memory used by constructing the arithmetic to seek content is lacking. The hh3cIDSTrapReasonForError object describes reason for error.
NTF hh3cIDSTrapSSRAMOperFail	1.3.6.1.4.1.25506.2.47.1.1.2.0.11			This notification will be generated when reading or writing SSRAM of CIE card fails. The hh3cIDSTrapReasonForError object describes reason for error.
NTF hh3cIDSTrapPacketProcessDisorder	1.3.6.1.4.1.25506.2.47.1.1.2.0.12			This notification will be generated when packets processed is in disorder. The hh3cIDSTrapReasonForError object describes reason for error.
NTF hh3cIDSTrapCfgFileFormatError	1.3.6.1.4.1.25506.2.47.1.1.2.0.13			When devices startup and load the configuration file, if format error is found, this notification will be generated. The hh3cIDSTrapFileName object describes the name of configuration file. The hh3cIDSTrapCfgLineInFile object describes the line number in the file.

RFC description

HH3C IDS (Intrusion Detection System) MIB provides management and monitoring objects for intrusion detection capabilities on HH3C network devices.

Start monitoring H3C security-capable switch/router (Intrusion Detection System) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download HH3C-IDS-MIB

What Is HH3C-IDS-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description