HH3C-LI-MIB

All MIBs › HH3C-LI-MIB

Organization: Hangzhou H3C Tech. Co., Ltd.

Last Updated: 2009-08-25

Category: Domain: Security, Vendor: H3C/HH3C

Description: Manages Lawful Intercept (LI) mediation functions and intercept request provisioning on H3C carrier-grade platforms.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is HH3C-LI-MIB?

HH3C-LI-MIB is an H3C carrier-grade enterprise MIB for provisioning and managing Lawful Intercept (LI) mediation functions on routers and edge devices used by service providers. It exposes configuration data for mediation delivery, including destination address/port, source interface binding, DSCP marking, timeout, and transport protocol used to forward intercepted traffic to a law-enforcement mediation device. Monitoring-wise, the MIB is mainly used to verify the operational status of intercept sessions and mediation delivery paths, such as whether a mediation entry's timeout or destination is reachable and correctly configured, rather than classic hardware health metrics. Because LI mediation rides on top of standard IP transport, it implicitly depends on the device's underlying interface and IP addressing MIBs (e.g. IF-MIB, IP-MIB) for source interface resolution. It is typically deployed on carrier-grade H3C routers and switches subject to regulatory lawful-intercept compliance requirements, and an HH3C-LI-MIB download is typically required to load the module into a MIB browser for configuration review.

IPNetwork Monitor allows you to monitor SNMP objects defined in HH3C-LI-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

H3C carrier-grade router
H3C service-provider edge switch

Monitoring Examples

An administrator can inspect hh3cLIMediationTable/hh3cLIMediationEntry, keyed by hh3cLIMediationIndex, to confirm hh3cLIMediationDestAddr, hh3cLIMediationDestPort, and hh3cLIMediationTransport are correctly pointing at the mediation collector. hh3cLIMediationSrcInterface and hh3cLIMediationDscp let the operator verify which egress interface and QoS marking is used for the intercepted traffic copy. If hh3cLIMediationTimeOut expires without a new binding via hh3cLINewIndex, that would indicate a stale or failed intercept provisioning that needs re-establishment.

What Can Be Monitored

mediation destination address/port
mediation transport protocol
source interface for intercept
DSCP marking of intercepted traffic
mediation session timeout
board information for LI module

Imported Objects

From HH3C-OID-MIB

hh3cCommon

OBJECT-IDENTITY

From IF-MIB

InterfaceIndexOrZero

From INET-ADDRESS-MIB

InetAddress
InetAddressPrefixLength
InetAddressType
InetPortNumber

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-SMI

Counter32
Counter64
Integer32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DateAndTime
MacAddress
RowStatus
TruthValue

OIDs

OID symbolic	OID numeric	Type	Access	Description
hh3cLI	1.3.6.1.4.1.25506.2.111			Lawful Interception MIB
hh3cLICommon	1.3.6.1.4.1.25506.2.111.1
hh3cLITrapBindObjects	1.3.6.1.4.1.25506.2.111.1.1
U32 hh3cLIBoardInformation	1.3.6.1.4.1.25506.2.111.1.1.1	Unsigned32	accessible-for-notify	It is a slot number.
hh3cLINotifications	1.3.6.1.4.1.25506.2.111.1.2
hh3cLINotificationsPrefix	1.3.6.1.4.1.25506.2.111.1.2.0
NTF hh3cLIActive	1.3.6.1.4.1.25506.2.111.1.2.0.1			This Notification is sent when a type of intercepting configuration is changed from inactive to active. The value of the hh3cLIStreamtype which identify the actual intercept stream is included in this notification.
NTF hh3cLITimeOut	1.3.6.1.4.1.25506.2.111.1.2.0.2			When the time specified in hh3cLIMediationTimeout arrives, the device notifies the manager corresponding intercept is removed.
NTF hh3cLIFailureInformation	1.3.6.1.4.1.25506.2.111.1.2.0.3			When interception is configured on distributed device, the configuration perhaps failed on some board. If this happened, this notification will occur.
hh3cLIObjects	1.3.6.1.4.1.25506.2.111.1.3
I32 hh3cLINewIndex	1.3.6.1.4.1.25506.2.111.1.3.1	Integer32	read-only	This object will be used as an index value for a new hh3cLIMediationEntry. Whenever read, the agent will give a non-used value. This is to reduce the probability of conflict during creation of new hh3cLIMediationTable entries.
hh3cLIMediationTable	1.3.6.1.4.1.25506.2.111.1.3.2		not-accessible	This table describes interception gateway information with which interception device communicates.
hh3cLIMediationEntry	1.3.6.1.4.1.25506.2.111.1.3.2.1		not-accessible	An entry of configuring mediation device.
I32 hh3cLIMediationIndex	1.3.6.1.4.1.25506.2.111.1.3.2.1.1	Integer32	not-accessible	hh3cLIMediationIndex is a entry identifier. The Mediation Device should be responsible for making sure these are unique. Before creating a new entry, a value for this variable may be obtained by reading hh3cLINewIndex to reduce the probability of a value collision.
IPt hh3cLIMediationDestAddrType	1.3.6.1.4.1.25506.2.111.1.3.2.1.2	InetAddressType	read-write	The type of hh3cLIMediationDestAddr.
IP hh3cLIMediationDestAddr	1.3.6.1.4.1.25506.2.111.1.3.2.1.3	InetAddress	read-write	The IP Address of the Mediation Device to receive intercepted traffic.
INE hh3cLIMediationDestPort	1.3.6.1.4.1.25506.2.111.1.3.2.1.4	InetPortNumber	read-write	The L4-port number on the Mediation Device to receive intercepted traffic.
NUM hh3cLIMediationSrcInterface	1.3.6.1.4.1.25506.2.111.1.3.2.1.5	InterfaceIndexOrZero	read-write	The interface on the intercepting device from which to transmit intercepted data. If zero, intercepting device will select an outbound interface according to hh3cLIMediationDestAddr.
I32 hh3cLIMediationDscp	1.3.6.1.4.1.25506.2.111.1.3.2.1.6	Integer32	read-write	The Differentiated Services Code Point the intercepting device applies to the IP packets encapsulating the intercepted traffic.
DAT hh3cLIMediationTimeOut	1.3.6.1.4.1.25506.2.111.1.3.2.1.7	DateAndTime	read-write	The time at which this row and all related Stream Table rows should be automatically removed, and the intercept function expire.
INT hh3cLIMediationTransport	1.3.6.1.4.1.25506.2.111.1.3.2.1.8	INTEGER	read-write	The protocol used in transferring intercepted data to the Mediation Device.
T/F hh3cLIMediationNotificationEnable	1.3.6.1.4.1.25506.2.111.1.3.2.1.9	TruthValue	read-write	This variable controls the generation of any notifications or informs by the MIB agent for this table entry.
ROW hh3cLIMediationRowStatus	1.3.6.1.4.1.25506.2.111.1.3.2.1.10	RowStatus	read-create	Operation status of this table entry.
hh3cLIStreamTable	1.3.6.1.4.1.25506.2.111.1.3.3		not-accessible	This table lists the traffic stream's type to be intercepted. The specified filter is defined in hh3cLIIPStreamTable, hh3cLIMACStreamTable or hh3cLIUserStreamTable, according to hh3cLIStreamtype. Also it contains counters for packets to be intercepted and dropped by attached type of filter.
hh3cLIStreamEntry	1.3.6.1.4.1.25506.2.111.1.3.3.1		not-accessible	A single type of data stream to be intercepted.
I32 hh3cLIStreamIndex	1.3.6.1.4.1.25506.2.111.1.3.3.1.1	Integer32	not-accessible	The index of the stream entry.
INT hh3cLIStreamtype	1.3.6.1.4.1.25506.2.111.1.3.3.1.2	INTEGER	read-write	Identifies the type of stream, and according to it uses filter table. It can not be changed after a filter table is attached to it. The following types of streams are supported: ip: IP filter. The exact definition is a row in hh3cLIIPStreamTable. mac: MAC filter. The exact definition is a row in hh3cLIMACStreamTable. userConnecton: User connection filter. The exact definition is a row in hh3cLIUserStreamTable.
T/F hh3cLIStreamEnable	1.3.6.1.4.1.25506.2.111.1.3.3.1.3	TruthValue	read-write	If 'true', the interception is active. And it is set to 'true' only after an additional filter specification has been attached to this stream.
C32 hh3cLIStreamPackets	1.3.6.1.4.1.25506.2.111.1.3.3.1.4	Counter32	read-only	The numbers of packets that have been intercepted.
C32 hh3cLIStreamDrops	1.3.6.1.4.1.25506.2.111.1.3.3.1.5	Counter32	read-only	The numbers of packets were dropped in the lawful intercept process.
C64 hh3cLIStreamHPackets	1.3.6.1.4.1.25506.2.111.1.3.3.1.6	Counter64	read-only	The numbers of packets have been intercepted. This object is a 64-bit version of hh3cLIStreamPackets.
C64 hh3cLIStreamHDrops	1.3.6.1.4.1.25506.2.111.1.3.3.1.7	Counter64	read-only	The numbers of packets were dropped in the lawful intercept process. This object is a 64-bit version of hh3cLIStreamDrops.
ROW hh3cLIStreamRowStatus	1.3.6.1.4.1.25506.2.111.1.3.3.1.8	RowStatus	read-create	Operation status of this table entry.
hh3cLIIPStream	1.3.6.1.4.1.25506.2.111.2
hh3cLIIPStreamObjects	1.3.6.1.4.1.25506.2.111.2.1
hh3cLIIPStreamTable	1.3.6.1.4.1.25506.2.111.2.1.1		not-accessible	This table lists the IPv4 and IPv6 streams to be intercepted. It is associated with hh3cLIMediationTable and hh3cLIStreamTable.
hh3cLIIPStreamEntry	1.3.6.1.4.1.25506.2.111.2.1.1.1		not-accessible	A single stream to be intercepted. The first index indicates the Mediation Device. The second index is that of the stream's counter entry in the hh3cLIStreamTable. The second index permits multiple classifiers to be used together, such as having an IP address as source or destination.
NUM hh3cLIIPStreamInterface	1.3.6.1.4.1.25506.2.111.2.1.1.1.1	InterfaceIndexOrZero	read-write	Traffic received or transmitted over this interface will be intercepted. This value must be set when creating a stream entry, either zero, or a valid interface index. If the value is zero, interception accepts any interface. Then at least one additional parameter must be selected, and not be default value.
IPt hh3cLIIPStreamAddrType	1.3.6.1.4.1.25506.2.111.2.1.1.1.2	InetAddressType	read-write	The type of address, used in packet selection.
IP hh3cLIIPStreamDestAddr	1.3.6.1.4.1.25506.2.111.2.1.1.1.3	InetAddress	read-write	The Destination address used in packet selection. This address will be consistent with the type specified in hh3cLIIPStreamAddrType.
ADR hh3cLIIPStreamDestAddrLength	1.3.6.1.4.1.25506.2.111.2.1.1.1.4	InetAddressPrefixLength	read-write	The length of the Destination Prefix. A value of zero means all addresses to match. This prefix length will be consistent with the type specified in hh3cLIIPStreamAddrType.
IP hh3cLIIPStreamSrcAddr	1.3.6.1.4.1.25506.2.111.2.1.1.1.5	InetAddress	read-write	The Source Address used in packet selection. This address will be consistent with the type specified in hh3cLIIPStreamAddrType.
ADR hh3cLIIPStreamSrcAddrLength	1.3.6.1.4.1.25506.2.111.2.1.1.1.6	InetAddressPrefixLength	read-write	The length of the Source Prefix. A value of zero means all addresses to match. This prefix length will be consistent with the type specified in hh3cLIIPStreamAddrType.
I32 hh3cLIIPStreamTosByte	1.3.6.1.4.1.25506.2.111.2.1.1.1.7	Integer32	read-write	The value of the TOS byte. If hh3cLIIPStreamTosByte&(~hh3cLIIPStreamTosByteMask)!=0, configuration is rejected.
I32 hh3cLIIPStreamTosByteMask	1.3.6.1.4.1.25506.2.111.2.1.1.1.8	Integer32	read-write	This value is ANDed with the value of the TOS byte in a packet and compared with hh3cLIIPStreamTosByte. If the values are equal, the comparison is equal. If both the mask and the TosByte value are zero, the result is to always accept.
I32 hh3cLIIPStreamFlowId	1.3.6.1.4.1.25506.2.111.2.1.1.1.9	Integer32	read-write	The flow identifier in an IPv6 header. -1 indicates that the Flow Id is unused.
I32 hh3cLIIPStreamProtocol	1.3.6.1.4.1.25506.2.111.2.1.1.1.10	Integer32	read-write	The IP protocol to match against the IPv4 protocol number or the IPv6 Next- Header number in the packet.
INE hh3cLIIPStreamDestL4PortMin	1.3.6.1.4.1.25506.2.111.2.1.1.1.11	InetPortNumber	read-write	The minimum value that the layer-4 destination port number in the packet must have in order to match. This value must be equal to or less than the value specified for this entry in hh3cLIIPStreamDestL4PortMax. If both hh3cLIIPStreamDestL4PortMin and hh3cLIIPStreamDestL4PortMax are at their default values, the port number is effectively unused. If hh3cLIIPStreamDestL4PortMin is equal to hh3cLIIPStreamDestL4PortMax, only one port number to be intercepted.
INE hh3cLIIPStreamDestL4PortMax	1.3.6.1.4.1.25506.2.111.2.1.1.1.12	InetPortNumber	read-write	The maximum value that the layer-4 destination port number in the packet must have in order to match this classifier entry. This value must be equal to or greater than the value specified for this entry in hh3cLIIPStreamDestL4PortMin. If both hh3cLIIPStreamDestL4PortMin and hh3cLIIPStreamDestL4PortMax are at their default values, the port number is effectively unused. If hh3cLIIPStreamDestL4PortMin is equal to hh3cLIIPStreamDestL4PortMax, only one port number to be intercepted.
INE hh3cLIIPStreamSrcL4PortMin	1.3.6.1.4.1.25506.2.111.2.1.1.1.13	InetPortNumber	read-write	The minimum value that the layer-4 destination port number in the packet must have in order to match. This value must be equal to or less than the value specified for this entry in hh3cLIIPStreamSrcL4PortMax. If both hh3cLIIPStreamSrcL4PortMin and hh3cLIIPStreamSrcL4PortMax are at their default values, the port number is effectively unused. If hh3cLIIPStreamSrcL4PortMin is equal to hh3cLIIPStreamSrcL4PortMax, only one port number to be intercepted.
INE hh3cLIIPStreamSrcL4PortMax	1.3.6.1.4.1.25506.2.111.2.1.1.1.14	InetPortNumber	read-write	The maximum value that the layer-4 destination port number in the packet must have in order to match this classifier entry. This value must be equal to or greater than the value specified for this entry in hh3cLIIPStreamSrcL4PortMin. If both hh3cLIIPStreamSrcL4PortMin and hh3cLIIPStreamSrcL4PortMax are at their default values, the port number is effectively unused. If hh3cLIIPStreamSrcL4PortMin is equal to hh3cLIIPStreamSrcL4PortMax, only one port number to be intercepted.
STR hh3cLIIPStreamVRF	1.3.6.1.4.1.25506.2.111.2.1.1.1.15	SnmpAdminString	read-write	It is the name of a Virtual Routing and Forwarding (VRF) of a VPN.
ROW hh3cLIIPStreamRowStatus	1.3.6.1.4.1.25506.2.111.2.1.1.1.18	RowStatus	read-create	Operation status of this table entry.
hh3cLIMACStream	1.3.6.1.4.1.25506.2.111.3
hh3cLIMACStreamObjects	1.3.6.1.4.1.25506.2.111.3.1
hh3cLIMACStreamTable	1.3.6.1.4.1.25506.2.111.3.1.1		not-accessible	This table lists the IEEE 802 streams to be intercepted. It is associated with hh3cLIMediationTable and hh3cLIStreamTable.
hh3cLIMACStreamEntry	1.3.6.1.4.1.25506.2.111.3.1.1.1		not-accessible	A single stream to be intercepted. The first index indicates the Mediation Device. The second index is that of the stream's counter entry in the hh3cLIStreamTable. The second index permits multiple classifiers to be used together, such as having an MAC address as source or destination.
BIT hh3cLIMACStreamFields	1.3.6.1.4.1.25506.2.111.3.1.1.1.1	Bits	read-write	This object displays what attributes will be compared to identify traffic. interface: indicates that traffic on the stated interface is to be intercepted dstMacAddress: indicates that traffic destined to a given address should be intercepted srcMacAddress: indicates that traffic sourced from a given address should be intercepted ethernetPid: indicates that traffic with a stated Ethernet Protocol Identifier should be intercepted dSap: indicates that traffic with an certain 802.2 LLC Destination SAP should be intercepted sSap: indicates that traffic with an certain 802.2 LLC Source SAP should be intercepted At least one of the bits has to be set in order to activate an entry. If multiple bits are set, traffic to be intercepted must be satisfied with all set attributes.
NUM hh3cLIMACStreamInterface	1.3.6.1.4.1.25506.2.111.3.1.1.1.2	InterfaceIndexOrZero	read-write	Traffic received or transmitted over this interface will be intercepted. This value must be set when creating a stream entry, either zero, or a valid interface index. If the value is zero, interception accepts any interface. Additional parameter must be selected together.
MAC hh3cLIMACStreamDestAddr	1.3.6.1.4.1.25506.2.111.3.1.1.1.3	MacAddress	read-write	The Destination address used in packet selection.
MAC hh3cLIMACStreamSrcAddr	1.3.6.1.4.1.25506.2.111.3.1.1.1.4	MacAddress	read-write	The Source Address used in packet selection.
U32 hh3cLIMACStreamEthPid	1.3.6.1.4.1.25506.2.111.3.1.1.1.5	Unsigned32	read-write	The value of the Ethernet Protocol Identifier in the Ethernet traffic or IEEE 802.2 SNAP traffic.
U32 hh3cLIMACStreamDSap	1.3.6.1.4.1.25506.2.111.3.1.1.1.6	Unsigned32	read-write	The value of the IEEE 802.2 Destination SAP.
U32 hh3cLIMACStreamSSap	1.3.6.1.4.1.25506.2.111.3.1.1.1.7	Unsigned32	read-write	The value of the IEEE 802.2 Source SAP.
ROW hh3cLIMACStreamRowStatus	1.3.6.1.4.1.25506.2.111.3.1.1.1.8	RowStatus	read-create	Operation status of this table entry.
hh3cLIUserStream	1.3.6.1.4.1.25506.2.111.4
hh3cLIUserStreamObjects	1.3.6.1.4.1.25506.2.111.4.1
hh3cLIUserStreamTable	1.3.6.1.4.1.25506.2.111.4.1.1		not-accessible	This table lists the user connection streams to be intercepted. It is associated with hh3cLIMediationTable and hh3cLIStreamTable.
hh3cLIUserStreamEntry	1.3.6.1.4.1.25506.2.111.4.1.1.1		not-accessible	A single stream to be intercepted. The first index indicates the Mediation Device. The second index is that of the stream's counter entry in the hh3cLIStreamTable. This permits multiple classifiers to be used together.
OCT hh3cLIUserStreamAcctSessID	1.3.6.1.4.1.25506.2.111.4.1.1.1.1	OCTET STRING	read-write	This is the RADIUS attribute 44 acct-session-ID. The string must be set, and the length not be zero.
ROW hh3cLIUserStreamRowStatus	1.3.6.1.4.1.25506.2.111.4.1.1.1.2	RowStatus	read-create	Operation status of this table entry.

RFC description

Lawful Interception MIB for H3C devices supporting packet capture and protocol stream monitoring.

Start monitoring H3C carrier-grade routers and switches with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download HH3C-LI-MIB

What Is HH3C-LI-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description