HP-ICF-ARP-THROTTLE

All MIBs › HP-ICF-ARP-THROTTLE

Organization: HP Networking

Last Updated: 2015-05-07

Category: Domain: Security, Vendor: HP/HPE

Description: HP ICF SNMP MIB for ARP rate limiting (throttling) to protect against ARP flood attacks on HP ProCurve switches.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is HP-ICF-ARP-THROTTLE?

HP-ICF-ARP-THROTTLE is an HP Networking proprietary MIB (registered under hpSwitch) that manages ARP rate-limiting on HP ProCurve switches to protect against ARP flood attacks. Its configuration branch, hpicfArpThrottleConfig, exposes hpicfArpThrottleEnable to turn the feature on or off, hpicfArpThrottleRemediationMode to choose between monitor(0) (alert only) and filter(1) (drop offending ARP packets), hpicfArpThrottleThreshold (default 30) capping ARP packets a client may send in a 5-second window, hpicfArpThrottleBlacklistAgingTime controlling how long an offending client stays blacklisted, and an hpicfArpThrottleExcludedMacTable for MAC addresses exempted from throttling. Its statistics branch reports hpicfArpThrottleStatsNumClientsInBlacklist and hpicfArpThrottleStatsNumClientsBeingTracked, and the module fires an hpicfArpThrottleExceedThresholdTrap notification carrying the offending hpicfArpThrottleClientOverThreshold MAC address whenever a client crosses the configured threshold. Because it combines both configuration and live counters, monitoring it reveals not just whether ARP throttling is enabled but whether it is actively catching flood sources in real time. It is deployed on HP ProCurve switches, and the HP-ICF-ARP-THROTTLE MIB is the standard reference for configuring and alerting on this feature via SNMP.

IPNetwork Monitor allows you to monitor SNMP objects defined in HP-ICF-ARP-THROTTLE. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

HP ProCurve switches

Monitoring Examples

An operator polls hpicfArpThrottleStatsNumClientsInBlacklist for a rising trend and watches for hpicfArpThrottleExceedThresholdTrap notifications carrying hpicfArpThrottleClientOverThreshold; a spike in blacklisted clients combined with hpicfArpThrottleRemediationMode set to monitor(0) rather than filter(1) would mean an active ARP flood is being logged but not actually blocked.

What Can Be Monitored

ARP throttle enable/disable state
remediation mode (monitor vs filter)
ARP packet threshold and blacklist aging time
excluded MAC address table
count of blacklisted and tracked clients
ARP-flood-exceeded-threshold trap notifications

Imported Objects

From HP-ICF-OID

hpSwitch

OBJECT-IDENTITY

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Integer32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE

From SNMPv2-TC

MacAddress
RowStatus
TruthValue

How to Use in IPNetwork Monitor

Example using hpicfArpThrottleStatsNumClientsInBlacklist OID:

Select an HP ProCurve switch (ARP rate-limiting/throttle) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type hpicfArpThrottleStatsNumClientsInBlacklist into the Find box to locate it in the OID tree, then select it and click OK. It reports the total number of clients in blacklist. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
hpicfArpThrottle	1.3.6.1.4.1.11.2.14.11.5.1.119			This MIB module contains HP proprietary objects for managing ARP throttling.
hpicfArpThrottleNotifications	1.3.6.1.4.1.11.2.14.11.5.1.119.0
NTF hpicfArpThrottleExceedThresholdTrap	1.3.6.1.4.1.11.2.14.11.5.1.119.0.1			This notification indicates that a client sending large number of ARP packets over the configured threshold is detected. The MAC address of the client is included in the notification.
hpicfArpThrottleObjects	1.3.6.1.4.1.11.2.14.11.5.1.119.1
MAC hpicfArpThrottleClientOverThreshold	1.3.6.1.4.1.11.2.14.11.5.1.119.1.1	MacAddress	accessible-for-notify	MAC address of a client that just went over the ARP throttle Threshold. It is used in hpicfArpThrottle notification.
hpicfArpThrottleConfig	1.3.6.1.4.1.11.2.14.11.5.1.119.1.2
T/F hpicfArpThrottleEnable	1.3.6.1.4.1.11.2.14.11.5.1.119.1.2.1	TruthValue	read-write	The administrative status of the ARP Throttle feature. true(1) - enabled; false(2) - disabled.
INT hpicfArpThrottleRemediationMode	1.3.6.1.4.1.11.2.14.11.5.1.119.1.2.2	INTEGER	read-write	The remediation mode of the ARP Throttle. In monitor mode, the switch only logs alerts when a client exceeds the configured threshold; In filter mode, ARP packets over the threshold will be dropped in addition to alert logging.
I32 hpicfArpThrottleThreshold	1.3.6.1.4.1.11.2.14.11.5.1.119.1.2.3	Integer32	read-write	The maximum number of ARP packets a client can send in 5 seconds. When a client goes over the threshold, it will be put into a blacklist and subject to the configured remediation action.
I32 hpicfArpThrottleBlacklistAgingTime	1.3.6.1.4.1.11.2.14.11.5.1.119.1.2.4	Integer32	read-write	The time a client stays in the blacklist, in seconds.
hpicfArpThrottleExcludedMacTable	1.3.6.1.4.1.11.2.14.11.5.1.119.1.2.5		not-accessible	List of excluded MAC addresses that are not subject to throttling.
hpicfArpThrottleExcludedMacEntry	1.3.6.1.4.1.11.2.14.11.5.1.119.1.2.5.1		not-accessible	Information of an excluded MAC address that is not subject to throttling.
MAC hpicfArpThrottleExcludedMac	1.3.6.1.4.1.11.2.14.11.5.1.119.1.2.5.1.1	MacAddress	not-accessible	A MAC address to be included from ARP throttle.
ROW hpicfArpThrottleExcludedMacStatus	1.3.6.1.4.1.11.2.14.11.5.1.119.1.2.5.1.2	RowStatus	read-create	The row status of this entry instance. createAndGo - will create the entry for the excluded MAC and transition the status to active. active - indicate the entry instance is in effect. destroy - delete the entry instance. All other RowStatus values are NOT supported.
hpicfArpThrottleStats	1.3.6.1.4.1.11.2.14.11.5.1.119.1.3
C32 hpicfArpThrottleStatsNumClientsInBlacklistEx	1.3.6.1.4.1.11.2.14.11.5.1.119.1.3.1	Counter32	read-only	Total number of clients in blacklist.
C32 hpicfArpThrottleStatsNumClientsBeingTracked	1.3.6.1.4.1.11.2.14.11.5.1.119.1.3.2	Counter32	read-only	Total number of clients being tracked for their ARP packets.
hpicfArpThrottleConformance	1.3.6.1.4.1.11.2.14.11.5.1.119.2
hpicfArpThrottleGroups	1.3.6.1.4.1.11.2.14.11.5.1.119.2.1
hpicfArpThrottleBaseGroup	1.3.6.1.4.1.11.2.14.11.5.1.119.2.1.1			A group of objects that provides ARP throttle configuration, Statistics, and traps.
hpicfArpThrottleNotificationGroup	1.3.6.1.4.1.11.2.14.11.5.1.119.2.1.2			A group of notifications for ARP throttle.
hpicfArpThrottleCompliances	1.3.6.1.4.1.11.2.14.11.5.1.119.2.2
hpicfArpThrottleCompliance	1.3.6.1.4.1.11.2.14.11.5.1.119.2.2.1			The compliance statement for HP switches that support ARP Throttle.

RFC description

HP proprietary MIB for managing ARP packet throttling and rate-limiting on network switches.

Start monitoring HP ProCurve switch (ARP rate-limiting/throttle) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download HP-ICF-ARP-THROTTLE