HH3C-SAVA-MIB

All MIBs › HH3C-SAVA-MIB

Organization: New H3C Tech. Co., Ltd.

Last Updated: 2020-06-30

Category: Domain: Security, Vendor: H3C/HH3C

Description: HH3C MIB for Source Address Validation Architecture (SAVA) providing IP source address anti-spoofing.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is HH3C-SAVA-MIB?

HH3C-SAVA-MIB is an H3C MIB for Source Address Validation Architecture (SAVA), a mechanism to prevent IP source-address spoofing by validating that packets originate from their claimed source address, for both IPv4 and IPv6. It exposes system-wide and per-interface SAVA configuration, including whether validation is enabled on an interface and notification-interval/count settings for reporting violations, along with remote route-tag information used in the validation logic. Its monitoring focus is security/configuration status, confirming SAVA is enabled on the interfaces where it's required and that violation notifications are being generated as expected, which helps detect spoofing attempts or misconfigured validation scope rather than hardware health. It complements general IP-layer standards (IPv4/IPv6 addressing) since SAVA validation logic operates on top of standard IP forwarding, though it isn't a direct extension of a specific IETF MIB. It is typically deployed on H3C edge/access routers and switches enforcing anti-spoofing policy at the network boundary. Engineers can download the HH3C-SAVA-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in HH3C-SAVA-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

H3C edge router
H3C access switch

Monitoring Examples

An admin would poll hh3cSavaIfTable, keyed by hh3cSavaIfIndex, to confirm hh3cSavaIfEnable is set for a given hh3cSavaIfIPVersion on interfaces that should be enforcing source-address validation, and check hh3cSavaIfRemoteRoutetag for correct route-tag association. At the system level, hh3cSavaSystemNotifyInterval and hh3cSavaSystemNotifyNumber control how often hh3cSavaSystemNotify fires; a spike in these notifications would reveal an active source-spoofing attempt being blocked. An interface expected to have SAVA enabled but showing hh3cSavaIfEnable as false would indicate a security policy gap at that network edge.

What Can Be Monitored

SAVA enable status per interface
SAVA notification interval/count
spoofing violation notifications
remote route-tag association
IP version validated (v4/v6)

Imported Objects

From HH3C-OID-MIB

hh3cCommon

OBJECT-IDENTITY

From IF-MIB

InterfaceIndex

From INET-ADDRESS-MIB

InetAddressType
InetVersion

From IPV6-TC

Ipv6AddressPrefix

From SNMPv2-SMI

Counter64
MODULE-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

TEXTUAL-CONVENTION
TruthValue

How to Use in IPNetwork Monitor

Example using hh3cSavaCountFilterPkt OID:

Select an H3C edge router/access switch (Source Address Validation Architecture) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type hh3cSavaCountFilterPkt into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. The count of packets dropped. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter64-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases between polls, since a rising count of errors, failures, or discards often points to a real underlying problem. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
hh3cSava	1.3.6.1.4.1.25506.2.191			The MIB module for support configuration and monitoring of SAVA Module.
hh3cSavaObjects	1.3.6.1.4.1.25506.2.191.1
hh3cSavaSystemTable	1.3.6.1.4.1.25506.2.191.1.1		not-accessible	The table containing SAVA system-wide parameters.
hh3cSavaSystemEntry	1.3.6.1.4.1.25506.2.191.1.1.1		not-accessible	An entry containing SAVA system-wide parameters for a particular IP version.
INE hh3cSavaSystemIPVersion	1.3.6.1.4.1.25506.2.191.1.1.1.1	InetVersion	not-accessible	The IP version.
T/F hh3cSavaSystemNotify	1.3.6.1.4.1.25506.2.191.1.1.1.2	TruthValue	read-write	An log switch for spoofing Notify. true, the attribute is set. false, the attribute is not set.
U32 hh3cSavaSystemNotifyInterval	1.3.6.1.4.1.25506.2.191.1.1.1.3	Unsigned32	read-write	Interval for log.0, 5 to 3600s.
U32 hh3cSavaSystemNotifyNumber	1.3.6.1.4.1.25506.2.191.1.1.1.4	Unsigned32	read-write	Number of spoofing notify: 1~128.
hh3cSavaIfTable	1.3.6.1.4.1.25506.2.191.1.2		not-accessible	The table containing SAVA parameters of each interface.
hh3cSavaIfEntry	1.3.6.1.4.1.25506.2.191.1.2.1		not-accessible	An entry containing SAVA running parameters of an interface.
INE hh3cSavaIfIPVersion	1.3.6.1.4.1.25506.2.191.1.2.1.1	InetVersion	not-accessible	The IP version.
NUM hh3cSavaIfIndex	1.3.6.1.4.1.25506.2.191.1.2.1.2	InterfaceIndex	not-accessible	The index value that uniquely identifies the interface to which this entry is applicable. The interface identified by a particular value of this index is the same interface as identified by the same value of the IF-MIB's ifIndex.
T/F hh3cSavaIfEnable	1.3.6.1.4.1.25506.2.191.1.2.1.3	TruthValue	read-write	An attribute defined in SAVA protocol. true, the attribute is set. false, the attribute is not set.
U32 hh3cSavaIfRemoteRoutetag	1.3.6.1.4.1.25506.2.191.1.2.1.4	Unsigned32	read-write	The number of route tag.
STR hh3cSavaIfAccessSubnet	1.3.6.1.4.1.25506.2.191.1.2.1.5	Hh3cSavaOwnerString	read-write	An access-net which the interface connect to.
hh3cSavaPrefixTable	1.3.6.1.4.1.25506.2.191.1.3		not-accessible	The table containing the prefix for SAVA.
hh3cSavaPrefixEntry	1.3.6.1.4.1.25506.2.191.1.3.1		not-accessible	An entry containing the prefix for SAVA. Entries are keyed on the source IP address type, binding type, anchor, and source IP address.
IPt hh3cSavaPrefixAddressType	1.3.6.1.4.1.25506.2.191.1.3.1.1	InetAddressType	not-accessible	IP address type of the prefix .
NUM hh3cSavaPrefixIfIndex	1.3.6.1.4.1.25506.2.191.1.3.1.2	InterfaceIndex	not-accessible	The index value that uniquely identifies the interface to which this entry is applicable. The interface identified by a particular value of this index is the same interface as identified by the same value of the IF-MIB's ifIndex.
ADR hh3cSavaPrefixAddress	1.3.6.1.4.1.25506.2.191.1.3.1.3	Ipv6AddressPrefix	not-accessible	The prefix's IP address
U32 hh3cSavaPrefixLength	1.3.6.1.4.1.25506.2.191.1.3.1.4	Unsigned32	not-accessible	mask length of prefix.
INT hh3cSavaPrefixSource	1.3.6.1.4.1.25506.2.191.1.3.1.5	INTEGER	read-only	The origin of the prefix.
hh3cSavaCountTable	1.3.6.1.4.1.25506.2.191.1.4		not-accessible	The table containing count of packets dropped because of validation failure.
hh3cSavaCountEntry	1.3.6.1.4.1.25506.2.191.1.4.1		not-accessible	An entry containing count of packets dropped because of validation failure for each interface.
INE hh3cSavaCountIPVersion	1.3.6.1.4.1.25506.2.191.1.4.1.1	InetVersion	not-accessible	The IP version.
NUM hh3cSavaCountIfIndex	1.3.6.1.4.1.25506.2.191.1.4.1.2	InterfaceIndex	not-accessible	The Interface.
C64 hh3cSavaCountFilterPktEx	1.3.6.1.4.1.25506.2.191.1.4.1.3	Counter64	read-only	The count of packets dropped.
C64 hh3cSavaCountFilterOctets	1.3.6.1.4.1.25506.2.191.1.4.1.4	Counter64	read-only	The octets of packets dropped.

RFC description

New H3C vendor-private MIB for configuring and monitoring Source Address Validation Architecture (SAVA) protection for IPv4 and IPv6.

Start monitoring H3C edge router/access switch (Source Address Validation Architecture) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download HH3C-SAVA-MIB