All MIBs › HP-ICF-CONNECTION-RATE-FILTER
Organization: HP Networking
Last Updated: 2009-05-12
Category: Domain: Security, Vendor: HP/HPE
Description: HP ICF SNMP MIB for connection rate filtering to limit the rate of new TCP/UDP connections and mitigate DoS attacks on HP ProCurve switches.
Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.
What Is HP-ICF-CONNECTION-RATE-FILTER?
HP-ICF-CONNECTION-RATE-FILTER is a vendor-specific MIB in HP's ICF family covering the Connection Rate Filter security feature on HP ProCurve switches, which throttles new TCP/UDP connections from a host to mitigate worm propagation and DoS-style attacks. It exposes configuration and status objects for enabling the feature and defining rate thresholds, along with objects reflecting which hosts/ports have triggered rate-limiting. Its monitoring value is primarily security/fault-oriented: confirming the feature is active and identifying hosts or ports throttled due to abnormal connection-rate behavior, a strong indicator of infected or misbehaving endpoints. It is a self-contained HP-proprietary security feature MIB with no strong dependency on other MIBs beyond standard HP ICF conventions. It is deployed on HP ProCurve managed switches in enterprise LANs wanting automated containment of fast-spreading worms or connection-flood attacks. Engineers can download the HP-ICF-CONNECTION-RATE-FILTER file directly to load it into their MIB browser.
IPNetwork Monitor allows you to monitor SNMP objects defined in HP-ICF-CONNECTION-RATE-FILTER. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.
Supported Devices
- HP ProCurve managed switch
Monitoring Examples
No specific objects were provided for this MIB, so specific OID names cannot be cited; based on its documented purpose, an administrator would poll feature-enable and per-port/host throttle-status objects to see whether the Connection Rate Filter has fired on a given port. A port suddenly reporting an active rate-limit/block condition would indicate a host generating an abnormal burst of new connections, consistent with a worm outbreak or scan.
What Can Be Monitored
- connection rate filter enable/disable state
- per-port/host connection rate threshold
- rate-limit/block trigger status
Imported Objects
From HP-ICF-OID
| hpSwitch | OBJECT-IDENTITY |
From IF-MIB
| ifIndex | OBJECT-TYPE |
From INET-ADDRESS-MIB
| InetAddress | |
| InetAddressType |
From SNMPv2-CONF
| MODULE-COMPLIANCE | |
| NOTIFICATION-GROUP | |
| OBJECT-GROUP |
From SNMPv2-SMI
| Integer32 | |
| MODULE-IDENTITY | |
| NOTIFICATION-TYPE | |
| OBJECT-TYPE |
From SNMPv2-TC
| TruthValue |
OIDs
RFC description
HP-proprietary MIB module for managing connection rate filtering on HP ICF (Intelligent Connectivity Framework) network devices.
Start monitoring HP ProCurve managed switch (Connection Rate Filter, worm/DoS mitigation) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.