HP-ICF-ARP-PROTECT :: hpicfArpProtectValidation

MIB Reference — IPNetwork Monitor · Updated October 05, 2026

All MIBs › HP-ICF-ARP-PROTECT › hpicfArpProtectValidation

hpicfArpProtectValidation

Module: HP-ICF-ARP-PROTECT

OID (symbolic): HP-ICF-ARP-PROTECT::hpicfArpProtectValidation

OID (numeric): 1.3.6.1.4.1.11.2.14.11.5.1.37.1.1.1.3

Node type: OBJECT-TYPE

Type: Bits

Access: read-write

Description: Additional validation checks to perform on ARP packets during Dynamic ARP Protection. srcMac - Drop any ARP request or response packet where the source MAC address in the Ethernet header does not match the sender MAC address in the body of the ARP packet. dstMac - Drop any unicast ARP response packet where the destination MAC address in the Ethernet header does not match the target MAC address in the body of the ARP packet. ip - Drop any ARP packet where the sender IP address is invalid. Drop any ARP response packet where the target IP address is invalid. Invalid addresses include 0.0.0.0, 255.255.255.255, all IP multicast addresses, and all class E IP addresses. These checks are only performed for ARP packets received on untrusted ports in VLANs that are enabled for Dynamic ARP Protection. ARP packets received on trusted ports, and ARP packets in VLANs for which Dynamic ARP Protection is disabled, are forwarded without validation.

What is hpicfArpProtectValidation?

This read-write BITS value selects which additional validation checks Dynamic ARP Protection performs on untrusted-port ARP traffic in protected VLANs: srcMac drops packets where the Ethernet source MAC doesn't match the ARP sender MAC, dstMac drops unicast ARP responses where the Ethernet destination MAC doesn't match the ARP target MAC, and ip drops packets with invalid sender or target IP addresses (like 0.0.0.0, broadcast, multicast, or class E addresses). Admins enable these bits to catch ARP spoofing techniques that pass basic IP-to-MAC binding checks but still contain mismatched or invalid header fields. For example, enabling just the ip(2) bit would block ARP packets claiming an invalid sender IP like 0.0.0.0 without also enforcing the stricter MAC-matching checks.

Examples

Walk all instances (SNMPv2c):

snmpwalk -v2c -c public <target> 1.3.6.1.4.1.11.2.14.11.5.1.37.1.1.1.3
snmpwalk -v2c -c public <target> HP-ICF-ARP-PROTECT::hpicfArpProtectValidation

Get a specific instance (index 1):

snmpget -v2c -c public <target> 1.3.6.1.4.1.11.2.14.11.5.1.37.1.1.1.3.1
snmpget -v2c -c public <target> HP-ICF-ARP-PROTECT::hpicfArpProtectValidation.1

Set instance 1 (SNMPv2c):

snmpset -v2c -c private <target> 1.3.6.1.4.1.11.2.14.11.5.1.37.1.1.1.3.1 s <value>

SNMPv3 example:

snmpget -v3 -l authPriv -u snmpv3-user -a SHA -A "AuthPassword1" -x AES -X "PrivPassword1" <target> hpicfArpProtectValidation.1

Start monitoring HP Networking managed switch (Dynamic ARP Protection) with a free 30-day trial of IPNetwork Monitor. Create custom SNMP monitor using the HP-ICF-ARP-PROTECT::hpicfArpProtectValidation OID value, configure state conditions and alerts, and monitor any HP Networking managed switch (Dynamic ARP Protection) from a single console.

OID Breakdown

Upper-level ancestors (12 from the standard OID tree / other modules)
Numeric OIDNameModule
1isoLANART-AGENT
1.3orgAirPair-MIB
1.3.6dodAirPair-MIB
1.3.6.1internetAirPair-MIB
1.3.6.1.4privateAirPair-MIB
1.3.6.1.4.1enterprisesAirPair-MIB
1.3.6.1.4.1.11hpCLJ8500-MIB
1.3.6.1.4.1.11.2nmCLJ8500-MIB
1.3.6.1.4.1.11.2.14icfCONFIG-MIB
1.3.6.1.4.1.11.2.14.11hpicfObjectsCONFIG-MIB
1.3.6.1.4.1.11.2.14.11.5hpicfSwitchCONFIG-MIB
1.3.6.1.4.1.11.2.14.11.5.1hpSwitchCONFIG-MIB
Numeric OIDNameModule
1.3.6.1.4.1.11.2.14.11.5.1.37hpicfArpProtectHP-ICF-ARP-PROTECT
1.3.6.1.4.1.11.2.14.11.5.1.37.1hpicfArpProtectObjectsHP-ICF-ARP-PROTECT
1.3.6.1.4.1.11.2.14.11.5.1.37.1.1hpicfArpProtectConfigHP-ICF-ARP-PROTECT
1.3.6.1.4.1.11.2.14.11.5.1.37.1.1.1hpicfArpProtectGlobalCfgHP-ICF-ARP-PROTECT
1.3.6.1.4.1.11.2.14.11.5.1.37.1.1.1.3hpicfArpProtectValidationHP-ICF-ARP-PROTECT

Module

This MIB depends on