HP-ICF-DHCPv6-SNOOP-MIB

All MIBs › HP-ICF-DHCPv6-SNOOP-MIB

Organization: HP Networking

Last Updated: 2017-11-08

Category: Protocol: DHCP, Technology: IPv6, Vendor: HP/HPE

Description: HP ICF SNMP MIB for DHCPv6 snooping to validate DHCPv6 messages and prevent rogue DHCPv6 server attacks on HP ProCurve switches.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is HP-ICF-DHCPv6-SNOOP-MIB?

HP-ICF-DHCPv6-SNOOP-MIB is an HP Networking proprietary MIB implementing DHCPv6 Snooping. Its objects cover global/per-VLAN enable, database file/write-delay/write-timeout, out-of-resources and errant-reply trap controls, database FTP port/SFTP username-password and server-validation settings, an authorized-server table (address type/address, status), and client-to-server (CS) forward/MAC-mismatch/bad-release/untrusted-destination-port counters plus server-to-client (SC) forward/untrusted-port/relay-reply-untrusted-port/unauthorized-server counters and a database-write-attempts counter. As a configuration/security MIB it lets an administrator confirm which DHCPv6 servers are authorized and watch for spoofed/untrusted DHCPv6 traffic on an HP switch. It is deployed on HP Networking switches (DHCPv6 Snooping). Engineers can download the HP-ICF-DHCPv6-SNOOP-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in HP-ICF-DHCPv6-SNOOP-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

HP Networking switches (DHCPv6 Snooping)

Monitoring Examples

An administrator checks hpicfDSnoopV6SCUnauthorizedServers to catch an unauthorized DHCPv6 server responding on an HP switch.

What Can Be Monitored

DHCPv6 snooping authorized-server list and violation counters

Imported Objects

From HP-ICF-OID

hpSwitch

OBJECT-IDENTITY

From HP-ICF-TC

VidList

From HPICF-SAVI-MIB

hpicfSaviObjectsBindingEntry	OBJECT-TYPE
hpicfSaviObjectsPortEntry	OBJECT-TYPE

From IF-MIB

InterfaceIndex

From INET-ADDRESS-MIB

InetAddress
InetAddressType

From Q-BRIDGE-MIB

VlanIndex

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Counter32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DateAndTime
MacAddress
RowStatus
TruthValue

How to Use in IPNetwork Monitor

Example using hpicfDSnoopV6CSForwards OID:

Select an HP Networking switch (DHCPv6 Snooping) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type hpicfDSnoopV6CSForwards into the Find box to locate it in the OID tree, then select it and click OK. It reports the number of snooped DHCPv6 packets that were successfully forwarded from untrusted client ports towards trusted DHCPv6 server ports. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
hpicfDSnoopV6	1.3.6.1.4.1.11.2.14.11.5.1.102			This MIB module contains HP proprietary objects for managing DHCPV6 Snooping.
hpicfDSnoopV6Notifications	1.3.6.1.4.1.11.2.14.11.5.1.102.0
NTF hpicfDSnoopV6SourceBindingOutOfResources	1.3.6.1.4.1.11.2.14.11.5.1.102.0.1			This trap indicates that the number of bindings exceeded the maximum limit of 8192 bindings. This notification trap is controlled by the state of ' hpicfDSnoopV6OutOfResourcesTrapCtrl' object. Implementation of this trap is optional.
hpicfDsnoopV6SourceBindingOutOfResourcesObjects	1.3.6.1.4.1.11.2.14.11.5.1.102.0.2
NUM hpicfDsnoopV6SourceBindingPort	1.3.6.1.4.1.11.2.14.11.5.1.102.0.2.1	InterfaceIndex	accessible-for-notify	The port of failed binding entry. Maximum binding limit is reached.
MAC hpicfDsnoopV6SourceBindingMacAddress	1.3.6.1.4.1.11.2.14.11.5.1.102.0.2.2	MacAddress	accessible-for-notify	The MAC address of failed binding entry. Maximum binding limit is reached.
IPt hpicfDsnoopV6SourceBindingIpAddressType	1.3.6.1.4.1.11.2.14.11.5.1.102.0.2.3	InetAddressType	accessible-for-notify	The IPv6 address type of failed binding entry. Maximum binding limit is reached.
IP hpicfDsnoopV6SourceBindingIpAddress	1.3.6.1.4.1.11.2.14.11.5.1.102.0.2.4	InetAddress	accessible-for-notify	The IPv6 address of failed binding entry. Maximum binding limit is reached.
VLA hpicfDsnoopV6SourceBindingVlan	1.3.6.1.4.1.11.2.14.11.5.1.102.0.2.5	VlanIndex	read-only	The VLAN of failed binding entry. Maximum binding limit is reached.
NTF hpicfDSnoopV6SourceBindingErrantReply	1.3.6.1.4.1.11.2.14.11.5.1.102.0.3			An hpicfDSnoopV6SourceBindingErrantReply notification signifies that the DHCPV6 snooping entity has detected and dropped an errant DHCPv6 reply packet. This notification trap is controlled by the state of 'hpicfDSnoopV6ErrantReplyTrapCtrl' object
hpicfDSnoopV6SourceBindingNotifyObjects	1.3.6.1.4.1.11.2.14.11.5.1.102.0.4
C32 hpicfDSnoopV6SourceBindingNotifyCount	1.3.6.1.4.1.11.2.14.11.5.1.102.0.4.1	Counter32	accessible-for-notify	A count of the DHCPV6 snooping notification sent from the DHCPv6 snooping entity to the SNMP entity. This count may be greater than the count of notifications actually transmitted by the SNMP entity due to rate limiting or configuration.
MAC hpicfDSnoopV6SourceBindingErrantSrcMAC	1.3.6.1.4.1.11.2.14.11.5.1.102.0.4.2	MacAddress	accessible-for-notify	The MAC address received in the errant DHCPv6 reply packet.
IPt hpicfDSnoopV6SourceBindingErrantSrcIPType	1.3.6.1.4.1.11.2.14.11.5.1.102.0.4.3	InetAddressType	accessible-for-notify	The type of address reported in hpicfDhcpSnoopSourceBindingErrantSrcIP.
IP hpicfDSnoopV6SourceBindingErrantSrcIP	1.3.6.1.4.1.11.2.14.11.5.1.102.0.4.4	InetAddress	accessible-for-notify	The IPv6 address received in the errant DHCPv6 reply packet.
hpicfDSnoopV6Objects	1.3.6.1.4.1.11.2.14.11.5.1.102.1
hpicfDSnoopV6Config	1.3.6.1.4.1.11.2.14.11.5.1.102.1.1
hpicfDSnoopV6GlobalCfg	1.3.6.1.4.1.11.2.14.11.5.1.102.1.1.1
T/F hpicfDSnoopV6Enable	1.3.6.1.4.1.11.2.14.11.5.1.102.1.1.1.1	TruthValue	read-write	This object provides the administrative status of the DHCPv6 Snooping feature. This status must be enabled for DHCPv6 snooping to work.
VID hpicfDSnoopV6VlanEnable	1.3.6.1.4.1.11.2.14.11.5.1.102.1.1.1.2	VidList	read-write	This object contains vid map for vlans on which DHCPV6 Snooping is enabled. A bit that is on (equal to 1) indicates that DHCPV6 snooping is enabled on corresponding vlan .
STR hpicfDSnoopV6DatabaseFile	1.3.6.1.4.1.11.2.14.11.5.1.102.1.1.1.3	SnmpAdminString	read-write	A location to store the lease database or to retrieve it after a reboot. The location must be given in the form of a Uniform Resource Locator (URL) as defined in RFC 2396. The permissible character sets and the encoding rules defined in RFC 2396 section 2 apply.
U32 hpicfDSnoopV6DatabaseWriteDelay	1.3.6.1.4.1.11.2.14.11.5.1.102.1.1.1.4	Unsigned32	read-write	The number of seconds to delay writing the DHCPv6 lease database file after a database change. This allows grouping multiple database changes into a single write. The default value is 300 seconds.
U32 hpicfDSnoopV6DatabaseWriteTimeout	1.3.6.1.4.1.11.2.14.11.5.1.102.1.1.1.5	Unsigned32	read-write	The number of seconds to wait for the database file transfer to finish. If file transfer is not over within this period, a file transfer failure message is displayed. To continue trying indefinitely, specify a value of 0. The default value is 300 seconds.
INT hpicfDSnoopV6OutOfResourcesTrapCtrl	1.3.6.1.4.1.11.2.14.11.5.1.102.1.1.1.6	INTEGER	read-write	This object provides the operational status of DSNOOPv6 out of resource control trap. The default value is enabled. This notification trap is sent when the number of bindings exceed the maximum limit of 8192 bindings. Configuration of this object requires SNMPv3 authentication.
INT hpicfDSnoopV6ErrantReplyTrapCtrl	1.3.6.1.4.1.11.2.14.11.5.1.102.1.1.1.7	INTEGER	read-write	This object provides the operational status of DSNOOPv6 errant repy control trap. The default value is enabled. This notification trap is sent when a DHCPv6 reply packet is received on an untrusted port or from an un-authorized server. Configuration of this object requires SNMPv3 authentication.
U32 hpicfDSnoopV6DatabaseFTPort	1.3.6.1.4.1.11.2.14.11.5.1.102.1.1.1.8	Unsigned32	read-write	A location to store the port value of the FT Server. The default port value will be 69 for TFTP and 22 for SFTP.
STR hpicfDSnoopV6DatabaseSFTPUsername	1.3.6.1.4.1.11.2.14.11.5.1.102.1.1.1.9	SnmpAdminString	read-write	A location to store the Username of the SFTP Server. The default value of username is root.
STR hpicfDSnoopV6DatabaseSFTPPassword	1.3.6.1.4.1.11.2.14.11.5.1.102.1.1.1.10	SnmpAdminString	read-write	A location to store the Password of the SFTP Server.
INT hpicfDSnoopV6DatabaseValidateSFTPServer	1.3.6.1.4.1.11.2.14.11.5.1.102.1.1.1.11	INTEGER	read-write	This object sets the validate-sftp-server flag. When enabled, the user must login to the SFTP server to verify and accept the public key of the server. When disabled, the public key is accepted automatically.
hpicfDSnoopV6AuthorizedServerTable	1.3.6.1.4.1.11.2.14.11.5.1.102.1.1.2		not-accessible	Table of authorized DHCP server addresses.
hpicfDSnoopV6AuthorizedServerEntry	1.3.6.1.4.1.11.2.14.11.5.1.102.1.1.2.1		not-accessible	A row in the table, containing the address of a single authorized DHCP server.
IPt hpicfDSnoopV6AuthorizedServerAddrType	1.3.6.1.4.1.11.2.14.11.5.1.102.1.1.2.1.1	InetAddressType	not-accessible	The IP address type of authorized DHCPv6 server.
IP hpicfDSnoopV6AuthorizedServerAddress	1.3.6.1.4.1.11.2.14.11.5.1.102.1.1.2.1.2	InetAddress	not-accessible	The address of a known valid DHCP server. The type of address contained in this object is indicated by hpicfDSnoopV6AuthorizedServerAddrType. To allow a server packet to be forwarded to a client, it must be received on a trusted port from a server address in this table. If this table is empty, all addresses are trusted. Note that this feature compares the source address of the received DHCPv6 server packet against the addresses in this table. Therefore, this table must contain trusted server addresses and trusted DHCPv6 relays that a server packet may be relayed through.
ROW hpicfDSnoopV6AuthorizedServerStatus	1.3.6.1.4.1.11.2.14.11.5.1.102.1.1.2.1.3	RowStatus	read-create	The status of this DHCP server address entry. Only 'active' entries are used when validating DHCP server packets. Row statuses createAndWait(5), notReady(3) and notInService(2) are not supported.
hpicfDSnoopV6PortMaxBindingTable	1.3.6.1.4.1.11.2.14.11.5.1.102.1.1.3		not-accessible	This table contains the maximum binding information of port.
hpicfDSnoopV6PortMaxBindingEntry	1.3.6.1.4.1.11.2.14.11.5.1.102.1.1.3.1		not-accessible	The maximum number of bindings on the Port.
U32 hpicfDSnoopV6PortStaticBinding	1.3.6.1.4.1.11.2.14.11.5.1.102.1.1.3.1.2	Unsigned32	read-only	This object indicates the static bindings configured on this port.
U32 hpicfDSnoopV6PortDynamicBinding	1.3.6.1.4.1.11.2.14.11.5.1.102.1.1.3.1.3	Unsigned32	read-only	This object indicates the number of dynamic bindings on this port.
hpicfDSnoopV6StaticBindingTable	1.3.6.1.4.1.11.2.14.11.5.1.102.1.1.4		not-accessible	This table contains the VLAN ID for binding entry.
hpicfDSnoopV6StaticBindingEntry	1.3.6.1.4.1.11.2.14.11.5.1.102.1.1.4.1		not-accessible	Extension of VLAN ID in hpicfSaviObjectsBindingTable.
VLA hpicfDSnoopV6BindingVlanId	1.3.6.1.4.1.11.2.14.11.5.1.102.1.1.4.1.1	VlanIndex	read-write	The VLAN on which this client is discovered.
IP hpicfDSnoopV6BindingLLAddress	1.3.6.1.4.1.11.2.14.11.5.1.102.1.1.4.1.2	InetAddress	read-write	The VLAN on which this client is discovered.
U32 hpicfDSnoopV6BindingSecVlan	1.3.6.1.4.1.11.2.14.11.5.1.102.1.1.4.1.3	Unsigned32	read-only	The secondary VLAN on which this client is discovered. if binding is learned on primary or normal VLAN, this object will be zero.
hpicfDSnoopV6GlobalStats	1.3.6.1.4.1.11.2.14.11.5.1.102.1.2
C32 hpicfDSnoopV6CSForwardsEx	1.3.6.1.4.1.11.2.14.11.5.1.102.1.2.1	Counter32	read-only	Number of snooped DHCPv6 packets that were successfully forwarded from untrusted client ports towards trusted DHCPv6 server ports.
C32 hpicfDSnoopV6CSMACMismatches	1.3.6.1.4.1.11.2.14.11.5.1.102.1.2.2	Counter32	read-only	Number of snooped DHCPv6 client packets that were discarded due to MAC verification check failure.
C32 hpicfDSnoopV6CSBadReleases	1.3.6.1.4.1.11.2.14.11.5.1.102.1.2.3	Counter32	read-only	Number of snooped DHCPv6 client packets that were discarded because they were RELEASE packets received on a port different from the port that the address was leased to.
C32 hpicfDSnoopV6CSUntrustedDestPorts	1.3.6.1.4.1.11.2.14.11.5.1.102.1.2.4	Counter32	read-only	Number of snooped DHCPv6 client unicast packets that were discarded because they were destined to untrusted ports.
C32 hpicfDSnoopV6SCForwards	1.3.6.1.4.1.11.2.14.11.5.1.102.1.2.5	Counter32	read-only	Number of snooped DHCPv6 packets that were successfully forwarded from trusted DHCPv6 server ports to untrusted client ports.
C32 hpicfDSnoopV6SCUntrustedPorts	1.3.6.1.4.1.11.2.14.11.5.1.102.1.2.6	Counter32	read-only	Number of snooped DHCPv6 server packets that were dropped because they were received on untrusted ports.
C32 hpicfDSnoopV6SCRelayReplyUntrustedPorts	1.3.6.1.4.1.11.2.14.11.5.1.102.1.2.7	Counter32	read-only	Number of relay reply packets that were dropped by the switch because they were received on untrusted ports.
C32 hpicfDSnoopV6SCUnauthorizedServers	1.3.6.1.4.1.11.2.14.11.5.1.102.1.2.8	Counter32	read-only	Number of snooped DHCPv6 server packets that were discarded because they were received from unauthorized DHCPv6 server
C32 hpicfDSnoopV6DBFileWriteAttempts	1.3.6.1.4.1.11.2.14.11.5.1.102.1.2.9	Counter32	read-only	Number of attempts that have been made to write the DHCPv6 lease database to a configured file location.
C32 hpicfDSnoopV6DBFileWriteFailures	1.3.6.1.4.1.11.2.14.11.5.1.102.1.2.10	Counter32	read-only	Number of times that an attempt to write the DHCPv6 lease database to a configured file location has failed.
INT hpicfDSnoopV6DBFileReadStatus	1.3.6.1.4.1.11.2.14.11.5.1.102.1.2.11	INTEGER	read-only	This object indicates whether the DHCPv6 lease database from configured location is loaded successfully after the last reboot.
INT hpicfDSnoopV6DBFileWriteStatus	1.3.6.1.4.1.11.2.14.11.5.1.102.1.2.12	INTEGER	read-only	This object indicates whether the DHCPv6 lease database is currently synchronized with the the configured file server. 'notConfigured' means that the switch is not configured with a server location. 'delaying' means the switch is waiting for the write delay to expire before writing the current database. 'inProgress' means that a lease database transfer is active. 'succeeded' means that all leases in our database have been written to the server. 'failed' means that the last attempt to write our lease database failed.
DAT hpicfDSnoopV6DBFileLastWriteTime	1.3.6.1.4.1.11.2.14.11.5.1.102.1.2.13	DateAndTime	read-only	Time at which the switch last successfully wrote the lease database to the server. This object contains a value of all zeroes if lease database is not written since the last reboot.
C32 hpicfDSnoopV6MaxbindPktsDropped	1.3.6.1.4.1.11.2.14.11.5.1.102.1.2.14	Counter32	read-only	This object provides the total number of DHCPv6 snooping packets dropped by the switch. A switch drops the DHCPv6 snooping packets on a port when the port exceeds maximum binding limit configured on it.
hpicfDSnoopV6ClearStatsOptions	1.3.6.1.4.1.11.2.14.11.5.1.102.1.3
T/F hpicfDSnoopV6ClearStats	1.3.6.1.4.1.11.2.14.11.5.1.102.1.3.1	TruthValue	read-write	This object clears the DSNOOPv6 statistics when set to TRUE. A write operation of FALSE leads to a no operation and a get request for this object always returns FALSE.
hpicfDSnoopV6Conformance	1.3.6.1.4.1.11.2.14.11.5.1.102.2
hpicfDSnoopV6Groups	1.3.6.1.4.1.11.2.14.11.5.1.102.2.1
hpicfDSnoopV6BaseGroup	1.3.6.1.4.1.11.2.14.11.5.1.102.2.1.1			A collection of objects for configuring and monitoring the base DHCPv6 snooping functionality.
hpicfDSnoopV6ServersGroup	1.3.6.1.4.1.11.2.14.11.5.1.102.2.1.2			A collection of objects for configuring and monitoring DHCP snooping trusted servers.
hpicfDSnoopV6DbaseFileGroup	1.3.6.1.4.1.11.2.14.11.5.1.102.2.1.3			A collection of objects for configuring and monitoring DHCP snooping database file management.
hpicfDSnoopV6MaxBindingsGroup	1.3.6.1.4.1.11.2.14.11.5.1.102.2.1.4			A collection of objects for monitoring the binding limits on a port.
hpicfDSnoopV6StaticBindingsGroup	1.3.6.1.4.1.11.2.14.11.5.1.102.2.1.5			A collection of objects used to configure static binding for a VLAN.
hpicfDSnoopV6ClearStatsOptionsGroup	1.3.6.1.4.1.11.2.14.11.5.1.102.2.1.6			A collection of objects used to clear DSNOOPv6 statistics.
hpicfDSnoopV6TrapObjectsGroup	1.3.6.1.4.1.11.2.14.11.5.1.102.2.1.7			A collection of objects used in the DSNOOPv6 notification.
hpicfDSnoopV6TrapsGroup	1.3.6.1.4.1.11.2.14.11.5.1.102.2.1.8			A collection of trap objects that provide DSNOOPv6 notifications.
hpicfDSnoopV6DbaseFileGroup1	1.3.6.1.4.1.11.2.14.11.5.1.102.2.1.9			A collection of objects for configuring and monitoring DHCP snooping database file management.
hpicfDSnoopV6Compliances	1.3.6.1.4.1.11.2.14.11.5.1.102.2.3
hpicfDSnoopV6Compliance2	1.3.6.1.4.1.11.2.14.11.5.1.102.2.3.1			The compliance statement for HP Routing switches that support DHCPv6 Snooping.
hpicfDSnoopV6Compliance	1.3.6.1.4.1.11.2.14.11.5.1.102.2.3.2			The compliance statement for HP Routing switches that support DHCPv6 Snooping.

RFC description

HP vendor-private MIB for DHCPv6 snooping monitoring on HP Intelligent Connectivity Framework switches.

Start monitoring HP Networking switch (DHCPv6 Snooping) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download HP-ICF-DHCPv6-SNOOP-MIB