HM2-DOS-MITIGATION-MIB

All MIBs › HM2-DOS-MITIGATION-MIB

Organization: Hirschmann Automation and Control GmbH

Last Updated: 2012-09-18

Category: Domain: Security, VPN and Security, Vendor: Belden

Description: Hirschmann HiOS (HM2) denial-of-service mitigation MIB for configuring DoS attack protection mechanisms.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is HM2-DOS-MITIGATION-MIB?

HM2-DOS-MITIGATION-MIB is part of Hirschmann's HiOS (HM2) MIB family for industrial switches, providing configuration and status for denial-of-service attack mitigation features. It exposes enable/disable settings for detecting specific attack patterns (TCP null/Xmas/SYN-FIN scans, land attacks, minimal TCP header size, offset-one attacks, privileged source ports, matching source/destination ports, oversized/fragmented ICMP packets) along with a notifications group for alerting when mitigation triggers. Its monitoring role is security/software-status oriented: an operator polls these objects to confirm DoS mitigation features are enabled as intended and watches the notifications group to detect when an actual attack pattern has been observed and mitigated on the switch. It is a Hirschmann HM2/HiOS platform-specific security MIB, likely deployed alongside other HM2 MIBs (e.g. L2 forwarding) sharing the same conformance framework. Typical deployment is on Hirschmann industrial Ethernet switches protecting automation networks from malformed or malicious traffic. Engineers can download the HM2-DOS-MITIGATION-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in HM2-DOS-MITIGATION-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Hirschmann HiOS (HM2) industrial Ethernet switch

Monitoring Examples

A security administrator polls hm2DosMitigationTcpNullScan, hm2DosMitigationTcpXmasScan, and hm2DosMitigationTcpSynFinScan to confirm scan-detection mitigations remain enabled after a configuration change or firmware upgrade. hm2DosMitigationIcmpFrags and hm2DosMitigationIcmpPacketSize settings reveal whether oversized or fragmented ICMP packets are being filtered, relevant to blocking ping-of-death style attacks on the plant network. If hm2DosMitigationNotifications fires repeatedly, it indicates the switch is actively observing and mitigating an ongoing attack pattern such as a land attack (hm2DosMitigationLandAttack) that warrants investigation.

What Can Be Monitored

TCP scan-pattern mitigation status
land attack mitigation status
ICMP fragment/packet-size mitigation
minimal TCP header mitigation
DoS mitigation trigger notifications

Imported Objects

From HM2-TC-MIB

HmEnabledStatus
hm2ConfigurationMibs	OBJECT-IDENTITY

From IF-MIB

InterfaceIndex

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

MODULE-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

RowStatus
TEXTUAL-CONVENTION

OIDs

OID symbolic	OID numeric	Type	Access	Description
hm2DosMitigationMib	1.3.6.1.4.1.248.11.82			Hirschmann Denial of Service MIB Copyright (C) 2012. All Rights Reserved.
hm2DosMitigationNotifications	1.3.6.1.4.1.248.11.82.0
hm2DosMitigationObjects	1.3.6.1.4.1.248.11.82.1
hm2DosMitigationGeneralSettings	1.3.6.1.4.1.248.11.82.1.1
hm2DosMitigationCapabilities	1.3.6.1.4.1.248.11.82.1.1.0
DOS hm2DosMitigationTcpHdrChecksSup	1.3.6.1.4.1.248.11.82.1.1.0.1	DosFeatureValue	read-only	The type of support for TCP header checks.
DOS hm2DosMitigationIcmpChecksSup	1.3.6.1.4.1.248.11.82.1.1.0.2	DosFeatureValue	read-only	The type of support for ICMP checks.
DOS hm2DosMitigationTcpSynLimitSup	1.3.6.1.4.1.248.11.82.1.1.0.3	DosFeatureValue	read-only	The type of support for TCP SYN limiter.
DOS hm2DosMitigationArpLimitSup	1.3.6.1.4.1.248.11.82.1.1.0.4	DosFeatureValue	read-only	The type of support for ARP limiter.
DOS hm2DosMitigationTcpNullScanSup	1.3.6.1.4.1.248.11.82.1.1.0.5	DosFeatureValue	read-only	The type of support for TCP Null Scan.
DOS hm2DosMitigationTcpXmasSup	1.3.6.1.4.1.248.11.82.1.1.0.6	DosFeatureValue	read-only	The type of support for TCP Xmas Scan.
DOS hm2DosMitigationTcpLandSup	1.3.6.1.4.1.248.11.82.1.1.0.7	DosFeatureValue	read-only	The type of support for land attack detection.
hm2DosMitigationTcpHdrChecks	1.3.6.1.4.1.248.11.82.1.1.1
HME hm2DosMitigationTcpNullScan	1.3.6.1.4.1.248.11.82.1.1.1.1	HmEnabledStatus	read-write	When enabled, TCP Null scans (TCP flags and sequence number set to 0) are filtered by the device.
HME hm2DosMitigationTcpXmasScan	1.3.6.1.4.1.248.11.82.1.1.1.4	HmEnabledStatus	read-write	When enabled TCP Xmas scans (TCP flags FIN, URG and PSH all set to 1 and a TCP sequence number = 0) are filtered by the device.
HME hm2DosMitigationTcpSynFinScan	1.3.6.1.4.1.248.11.82.1.1.1.7	HmEnabledStatus	read-write	When enabled TCP packets with SYN and FIN flags set are filtered by the device.
HME hm2DosMitigationTcpMinimalHeader	1.3.6.1.4.1.248.11.82.1.1.1.10	HmEnabledStatus	read-write	When enabled all TCP frames are checked for a minimal valid header size. Packets that contain an invalid header size are discarded.
U32 hm2DosMitigationTcpMinimalHeaderSize	1.3.6.1.4.1.248.11.82.1.1.1.11	Unsigned32	read-write	Specifies the minimum size of a valid TCP frame header size.
HME hm2DosMitigationLandAttack	1.3.6.1.4.1.248.11.82.1.1.1.13	HmEnabledStatus	read-write	When enabled all IP frames are checked for equality of src and dst IP address (known as land attack). Packets that contain such a combination are silently discarded when enabled.
HME hm2DosMitigationTcpOffsetEqu1	1.3.6.1.4.1.248.11.82.1.1.1.14	HmEnabledStatus	read-write	Enable/Disable TCP offset DoS protection. All packets ingress having a TCP header offset equal to 1 are dropped.
HME hm2DosMitigationTcpPrivilegedSrcPort	1.3.6.1.4.1.248.11.82.1.1.1.15	HmEnabledStatus	read-write	Enable/Disable TCP SYN and L4 source port smaller than 1024 DoS protection. All packets ingress having the TCP SYN flag set and a L4 source port from 0 to 1023 are dropped.
HME hm2DosMitigationTcpSrcDstPortEqu	1.3.6.1.4.1.248.11.82.1.1.1.16	HmEnabledStatus	read-write	Enable/Disable L4 source port equals L4 destination port DoS protection. All TCP or UDP packets ingress having the L4 source port equal to L4 destination port are dropped.
hm2DosMitigationIcmpChecks	1.3.6.1.4.1.248.11.82.1.1.2
HME hm2DosMitigationIcmpFrags	1.3.6.1.4.1.248.11.82.1.1.2.1	HmEnabledStatus	read-write	When enabled, all fragmented ICMP packets are filtered by the device.
U32 hm2DosMitigationIcmpPacketSize	1.3.6.1.4.1.248.11.82.1.1.2.4	Unsigned32	read-write	Specifies the max. allowed payload size of ICMP packets. Packets having bigger payload are filtered by the device if the hm2DosMitigationIcmpPacketSizeMode is enabled.
HME hm2DosMitigationIcmpPacketSizeMode	1.3.6.1.4.1.248.11.82.1.1.2.5	HmEnabledStatus	read-write	When enabled all ICMP ingress packets having the payload bigger than hm2DosMitigationIcmpPacketSize are filtered by device.
HME hm2DosMitigationIcmpSmurfAttack	1.3.6.1.4.1.248.11.82.1.1.2.6	HmEnabledStatus	read-write	When enabled, all ingress ICMP packets having the type set to ECHO_REQ (ping) and a broadcast destination IP are dropped.
hm2DosMitigationL2Checks	1.3.6.1.4.1.248.11.82.1.1.3
HME hm2DosMitigationSMacDMac	1.3.6.1.4.1.248.11.82.1.1.3.7	HmEnabledStatus	read-write	Enable/Disable source MAC address equals destination MAC address DoS protection. All packets ingress having SMAC equals DMAC are dropped.
hm2DosMitigationLimiter	1.3.6.1.4.1.248.11.82.1.2
hm2DosMitigationLimiterObjects	1.3.6.1.4.1.248.11.82.1.2.1
hm2DosMitigationLimiterRules	1.3.6.1.4.1.248.11.82.1.2.2
hm2DosMitigationLimiterRuleTable	1.3.6.1.4.1.248.11.82.1.2.2.1		not-accessible	TCP Syn Limiter Interface Table
hm2DosMitigationLimiterRuleEntry	1.3.6.1.4.1.248.11.82.1.2.2.1.1		not-accessible	TCP Syn Interface entry.
NUM hm2DosMitigationLimiterInterface	1.3.6.1.4.1.248.11.82.1.2.2.1.1.1	InterfaceIndex	accessible-for-notify	The interface the limiter is assigned to.
U32 hm2DosMitigationLimiterTcpSynLimit	1.3.6.1.4.1.248.11.82.1.2.2.1.1.2	Unsigned32	read-create	The number of allowed outgoing TCP syn packets per second per interface. A value of 0 disables the limiter for this interface.
U32 hm2DosMitigationLimiterArpLimit	1.3.6.1.4.1.248.11.82.1.2.2.1.1.3	Unsigned32	read-create	The number of allowed outgoing ARP packets per second per interface. A value of 0 disables the limiter for this interface.
ROW hm2DosMitigationLimiterRowStatus	1.3.6.1.4.1.248.11.82.1.2.2.1.1.4	RowStatus	read-create	Row status.
hm2DosMitigationConformance	1.3.6.1.4.1.248.11.82.2
hm2DosMitigationCompliances	1.3.6.1.4.1.248.11.82.2.1
hm2DosMitigationCompliance	1.3.6.1.4.1.248.11.82.2.1.1			The compliance statement for an SNMP entity which implements the Hirschmann DOS Mitigation MIB.
hm2DosMitigationGroups	1.3.6.1.4.1.248.11.82.2.2
hm2DosMitigationGeneralGroup	1.3.6.1.4.1.248.11.82.2.2.1			A collection of all Hirschmann objects provided by the DoS Mitigation module.

RFC description

Hirschmann denial of service mitigation controls for TCP fragmentation, null scans, and protocol anomalies.

Start monitoring Hirschmann industrial Ethernet switches with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download HM2-DOS-MITIGATION-MIB

What Is HM2-DOS-MITIGATION-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description