HH3C-MAC-INFORMATION-MIB

All MIBs › HH3C-MAC-INFORMATION-MIB

Organization: Hangzhou H3C Technologies Co., Ltd.

Last Updated: 2007-12-28

Category: Technology: Switching/L2, Vendor: H3C/HH3C

Description: Manages MAC address change and move notification functions on H3C switches for network security monitoring.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is HH3C-MAC-INFORMATION-MIB?

HH3C-MAC-INFORMATION-MIB manages the "MAC Information" feature on H3C switches, which reports MAC address learning and removal events to a remote monitoring device — useful for tracking host churn and detecting unauthorized devices. It exposes global enable/interval/cache-length configuration, counters for learned and removed MAC addresses, counts of traps and syslog messages sent, and a per-interface table for interface-level MAC-change settings. Its monitoring value is software/network-status oriented: tracking how many MAC addresses have been learned or removed and how many notifications have been generated, revealing abnormal churn (e.g., a MAC-flapping attack or rogue device) rather than physical hardware faults. It is a proprietary H3C feature that works alongside the standard bridge MIB's forwarding-database concept, adding change-notification on top of it. It is deployed on H3C access-layer switches in enterprise networks for security/audit purposes, tracking client device churn. Engineers can download the HH3C-MAC-INFORMATION-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in HH3C-MAC-INFORMATION-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

H3C access-layer switches

Monitoring Examples

hh3cMACInformationLearntMACNum and hh3cMACInformationRemovedMACNum give running counts of MAC learn/remove events, while hh3cMACInformationTrapSendNum and hh3cMACInformationSyslogSendNum show how many notifications have fired — a sudden spike in these would indicate MAC flapping or a port under attack. hh3cMACInfomationIfTable/hh3cMACInfomationIfEntry let an admin enable hh3cMACLearntEnable/hh3cMACRemovedEnable per interface to scope monitoring to specific access ports.

What Can Be Monitored

learned MAC address count
removed MAC address count
MAC-change trap/syslog send counts
per-interface MAC learning enable status

Imported Objects

From HH3C-OID-MIB

hh3cCommon

OBJECT-IDENTITY

From IF-MIB

ifIndex

OBJECT-TYPE

From SNMPv2-SMI

Counter32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

TEXTUAL-CONVENTION

OIDs

OID symbolic	OID numeric	Type	Access	Description
hh3cMACInformation	1.3.6.1.4.1.25506.2.87			This MIB file is to provide the definition of the MAC Information general configuration. MAC Information feature is used to make that the changed MAC information in the monitored device is knowable in remote monitoring device.
hh3cMACInformationObjects	1.3.6.1.4.1.25506.2.87.1
hh3cMACInformationMibGlobal	1.3.6.1.4.1.25506.2.87.1.1
INT hh3cMACInformationEnabled	1.3.6.1.4.1.25506.2.87.1.1.1	INTEGER	read-write	The value is a global setting. The feature will not work until the value is set to enabled(1). If the value is set to disabled(2), the feature will stop working even there are interfaces that have been enabled the feature.
U32 hh3cMACInformationcSendInterval	1.3.6.1.4.1.25506.2.87.1.1.2	Unsigned32	read-write	The maximum interval that the device generate syslogs or traps. The unit is second.
C32 hh3cMACInformationLearntMACNum	1.3.6.1.4.1.25506.2.87.1.1.3	Counter32	read-only	The number of MAC addresses that learnt by the device since the hh3cMACInformationEnabled is set to enabled(1) and hh3cMACLearntEnable is set to enabled(1) at least on one interface. If the hh3cMACInformationEnabled is set to disabled(2), the object will always return 0.
C32 hh3cMACInformationRemovedMACNum	1.3.6.1.4.1.25506.2.87.1.1.4	Counter32	read-only	The number of MAC addresses that removed by the device since the hh3cMACInformationEnabled is set to enabled(1) and hh3cMACRemovedEnable is set to enabled(1) at least on one interface. If the hh3cMACInformationEnabled is set to disabled(2), the object will always return 0.
C32 hh3cMACInformationTrapSendNum	1.3.6.1.4.1.25506.2.87.1.1.5	Counter32	read-only	The number of traps that have been generated. This object is valid only when the hh3cMACInfomationWorkMode is set to trap(1). If the hh3cMACInfomationWorkMode is set to syslog(2), the object will always return 0.
C32 hh3cMACInformationSyslogSendNum	1.3.6.1.4.1.25506.2.87.1.1.6	Counter32	read-only	The number of syslogs that have been generated. This object is valid only when the hh3cMACInfomationWorkMode is set to syslog(2). If the hh3cMACInfomationWorkMode is set to trap(1), the object will always return 0.
U32 hh3cMACInformationCacheLen	1.3.6.1.4.1.25506.2.87.1.1.7	Unsigned32	read-write	The maximum queue lenth used to cache the changed MAC addresses information in the monitored device. If the value is set to 0, syslog or trap will generate as soon as there is a MAC address learnt or removed.
HH3 hh3cMACInfomationWorkMode	1.3.6.1.4.1.25506.2.87.1.1.8	Hh3cMACInfoWorkMode	read-write	The working mode of MAC Information feature. If the object is set to trap(1), the device will use trap mode to notify the MAC address information and all properties of trap interrelated is valid. If the object is set to syslog(2), the device will use syslog mode to notify the MAC address information and all properties of trap interrelated is invalid.
hh3cMACInformationMIBTableTroop	1.3.6.1.4.1.25506.2.87.1.2
hh3cMACInfomationIfTable	1.3.6.1.4.1.25506.2.87.1.2.1		not-accessible	The table is used to enable or disable the MAC Information feature on interfaces.
hh3cMACInfomationIfEntry	1.3.6.1.4.1.25506.2.87.1.2.1.1		not-accessible	The entry of hh3cMACInfomationIfTable.
INT hh3cMACLearntEnable	1.3.6.1.4.1.25506.2.87.1.2.1.1.1	INTEGER	read-write	If the object is set to enabled(1) on interface, the device will cache the MAC address information that learnt on the interface.
INT hh3cMACRemovedEnable	1.3.6.1.4.1.25506.2.87.1.2.1.1.2	INTEGER	read-write	If the object is set to enable(1) on interface, the device will cache the MAC address information that removed on the interface.
hh3cMACInformationMibTrap	1.3.6.1.4.1.25506.2.87.1.3
hh3cMACInformationTraps	1.3.6.1.4.1.25506.2.87.1.3.0
NTF hh3cMACInformationChangedTrap	1.3.6.1.4.1.25506.2.87.1.3.0.1			When the cached number of MAC address information is reached the value specified by hh3cMACInformationCacheLen, trap is generated and is sent to the remote monitoring device. The trap is also generated when the amount of time elapsed since the previous notification is greater than the interval value specified by hh3cMACInformationcSendInterval and there is at least one cached MAC address information learnt or removed. The object is valid only when hh3cMACInfomationWorkMode is set to trap(1). When the hh3cMACInfomationWorkMode is set to syslog(2), No trap will be generated even hh3cMACInformationEnabled is set to enabled(1) and the feature is enabled on interface.
hh3cMACInformationTrapObjects	1.3.6.1.4.1.25506.2.87.1.3.2
U32 hh3cMACInfoTrapIndex	1.3.6.1.4.1.25506.2.87.1.3.2.1	Unsigned32	accessible-for-notify	The sequence number of trap information. When it reaches the maximum value, it should be set to 1.
U32 hh3cMACInfoTrapCount	1.3.6.1.4.1.25506.2.87.1.3.2.2	Unsigned32	accessible-for-notify	The cell number of the current trap information. The trap message may consists of more than one MAC address information. Each of the one MAC address information in one trap is called cell.
OCT hh3cMACInfoTrapMsg	1.3.6.1.4.1.25506.2.87.1.3.2.3	OCTET STRING	accessible-for-notify	This object is the MAC information that learnt or removed in the monitored device. It can consists of more than one MAC information in the object. This object is in the format of '...'. Each cell consists of 12 octets in the format of ''. is the reason type of MAC address changed and have size of 1 octet. It only supports the following values. 1 - MAC learnt. 2 - MAC removed. is the vlan number that correspond to the MAC address in MAC address table and has size of 2 octet. is the MAC address and has size of 6 octets. is the MAC address type and has size of 1 octet. It only supports the following values. 0 - Unknown 1 - Learnt 2 - Config dynamic 3 - Config static 4 - Blackhole 5 - Security 6 - 802.1x 7 - MAC authentication 8 - Voice VLAN 9 - WAPI is the index of the interface where the MAC address is learnt or removed and has size of 2 octets.
hh3cMACInformationMibTrapExt	1.3.6.1.4.1.25506.2.87.1.4
hh3cMACInformationTrapsExt	1.3.6.1.4.1.25506.2.87.1.4.0
NTF hh3cMACInformationChangedTrapExt	1.3.6.1.4.1.25506.2.87.1.4.0.1			When the cached number of MAC address information is reached the value specified by hh3cMACInformationCacheLen, trap is generated and is sent to the remote monitoring device. The trap is also generated when the amount of time elapsed since the previous notification is greater than the interval value specified by hh3cMACInformationcSendInterval and there is at least one cached MAC address information learnt or removed. The object is valid only when hh3cMACInfomationWorkMode is set to trap(1). When the hh3cMACInfomationWorkMode is set to syslog(2), No trap will be generated even hh3cMACInformationEnabled is set to enabled(1) and the feature is enabled on interface.
hh3cMACInformationTrapObjectsExt	1.3.6.1.4.1.25506.2.87.1.4.2
U32 hh3cMACInfoTrapVerExt	1.3.6.1.4.1.25506.2.87.1.4.2.1	Unsigned32	accessible-for-notify	The version of trap information.
U32 hh3cMACInfoTrapIndexExt	1.3.6.1.4.1.25506.2.87.1.4.2.2	Unsigned32	accessible-for-notify	The sequence number of trap information. When it reaches the maximum value, it should be set to 1.
U32 hh3cMACInfoTrapCountExt	1.3.6.1.4.1.25506.2.87.1.4.2.3	Unsigned32	accessible-for-notify	The cell number of the current trap information. The trap message may consists of more than one MAC address information. Each of the one MAC address information in one trap is called cell.
OCT hh3cMACInfoTrapMsgExt	1.3.6.1.4.1.25506.2.87.1.4.2.4	OCTET STRING	accessible-for-notify	This object is the MAC information that learnt or removed in the monitored device. It can consists of more than one MAC information in the object. This object is in the format of '...'. Each cell consists of 14 octets in the format of ''. is the reason type of MAC address changed and have size of 1 octet. It only supports the following values. 1 - MAC learnt. 2 - MAC removed. is the vlan number that correspond to the MAC address in MAC address table and has size of 2 octet. is the MAC address and has size of 6 octets. is the MAC address type and has size of 1 octet. It only supports the following values. 0 - Unknown 1 - Learnt 2 - Config dynamic 3 - Config static 4 - Blackhole 5 - Security 6 - 802.1x 7 - MAC authentication 8 - Voice VLAN 9 - WAPI is the index of the interface where the MAC address is learnt or removed and has size of 4 octets.

RFC description

H3C vendor-private MIB for MAC Information feature monitoring of changed MAC addresses in network devices.

Start monitoring H3C access-layer switch (MAC learn/remove notifications) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download HH3C-MAC-INFORMATION-MIB

What Is HH3C-MAC-INFORMATION-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description