HP-ICF-MACNOTIFY-MIB

All MIBs › HP-ICF-MACNOTIFY-MIB

Organization: HP Networking

Last Updated: 2013-07-18

Category: Technology: Network Monitoring, Technology: Switching/L2, Vendor: HP/HPE

Description: HP ICF SNMP MIB for MAC address change notifications generating traps when MAC table entries change on HP ProCurve switches.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is HP-ICF-MACNOTIFY-MIB?

HP-ICF-MACNOTIFY-MIB is an HP proprietary SNMP module in the HP ICF family for ProCurve/Aruba switches that manages MAC address change notifications, generating SNMP traps whenever entries in the switch's MAC address table are learned, moved, or removed. Its data is centered on trap/notification configuration rather than continuous counters, covering which VLANs or ports have notification enabled and the trap-generation interval. For monitoring purposes it supports fault and event detection on the switch, helping an operator track unexpected end-station moves, MAC flapping, or unauthorized device attachment, which is effectively a software-driven event-monitoring capability layered on switch hardware state. It depends conceptually on the standard Bridge-MIB's MAC address table (dot1dTpFdbTable) as the underlying data source it reports changes against. It is typically deployed in secure or regulated network environments where administrators need near-real-time alerts on MAC table churn, such as data centers or campus access layers, where HP-ICF-MACNOTIFY-MIB SNMP monitoring supports near-real-time alerting on MAC table churn.

IPNetwork Monitor allows you to monitor SNMP objects defined in HP-ICF-MACNOTIFY-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

HP ProCurve switch
HP/Aruba networking switch

Monitoring Examples

The module's core function is to configure MAC-notification traps and their triggering interval; when enabled, the switch emits a trap identifying the VLAN, port, and MAC address involved in an add or delete event on the bridge forwarding table. An administrator would enable this feature on sensitive access ports and watch for unexpected traps indicating a new, unrecognized MAC address appearing, which could reveal a rogue device or a MAC-spoofing attempt. No sample objects were available in the source excerpt, so exact object names cannot be confirmed, but the functional scope is limited to notification configuration rather than broad performance metrics.

What Can Be Monitored

MAC address change notification enable state
notification interval
affected VLAN/port on MAC table change
MAC table add/delete events

Imported Objects

From HP-ICF-OID

hpSwitch

OBJECT-IDENTITY

From IF-MIB

InterfaceIndex

From Q-BRIDGE-MIB

PortList
VlanId

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Integer32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

MacAddress

How to Use in IPNetwork Monitor

Example using hpicfMacNotifyLearnedCount OID:

Select an HP ProCurve/Aruba switch (MAC address change notification traps) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type hpicfMacNotifyLearnedCount into the Find box to locate it in the OID tree, then select it and click OK. It reports a count of MAC addresses learned by the MAC Address Table. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
hpicfMacNotifyMIB	1.3.6.1.4.1.11.2.14.11.5.1.66			The MIB module for managing MAC address notifications.
hpicfMacNotifyNotificationObjects	1.3.6.1.4.1.11.2.14.11.5.1.66.0
NTF hpicfMacNotifyMacAddressTableChange	1.3.6.1.4.1.11.2.14.11.5.1.66.0.1			The hpicfMacNotifyMacAddressTableChange notification signifies that hpicfMacNotifyEnable is enabled and either a MAC address table change learn / remove / age occurred on a configured hpicfMacNotifyTrapConfig interface or hpicfMacNotifyMoveEnable is enabled and a MAC address has been moved. Notifications will buffered on the system to be sent on hpicfMacNotifyTrapInterval. During high system activity, notification may be sent before the interval and in some cases, notifications will be dropped. The system will log dropped notification events
NTF hpicfMacNotifyPortMacAddressCount	1.3.6.1.4.1.11.2.14.11.5.1.66.0.2			The hpicfMacNotifyPortMacAddressCount notification signifies that hpicfMacNotifyPortLearnedCountEnable is enabled and the number of MAC address learn has reached the configured MAC count on switch port. The hpicfMacNotifyMacAddress specifies the exceeded MAC learn address.
hpicfMacNotifyConfigObjects	1.3.6.1.4.1.11.2.14.11.5.1.66.1
INT hpicfMacNotifyEnable	1.3.6.1.4.1.11.2.14.11.5.1.66.1.1	INTEGER	read-write	Indicates whether the SNMP entity is permitted to generate learned, moved or removed hpicfMacNotifyMacAddressTableChange trap notifications. Default is disabled.
U32 hpicfMacNotifyTrapInterval	1.3.6.1.4.1.11.2.14.11.5.1.66.1.2	Unsigned32	read-write	Defines the interval in seconds between sending hpicfMacNotifyMacAddressTableChange notifications. The notifications will be buffered on the system until the interval. If the buffer becomes full before the interval, the full buffer will be sent. A value of 0 (zero) indicates MAC address changes will be sent when the event occurs. Default value is 30 seconds.
INT hpicfMacNotifyMoveEnable	1.3.6.1.4.1.11.2.14.11.5.1.66.1.3	INTEGER	read-write	Indicates whether the SNMP entity is permitted to generate hpicfMacNotifyMacAddressTableChange for MAC address moves on the system. Notifications are generated when a MAC address is moved from one port to another port on the system. hpicfMacNotifyEnable must be enabled. Default is disable.
POR hpicfMacNotifyLearnedPortConfig	1.3.6.1.4.1.11.2.14.11.5.1.66.1.4	PortList	read-write	Used to configure the MAC address learned notification traps on specific ports. Each octet within this value specifies a set of eight ports, with the first octet specifying ports 1 through 8, the second octet specifying ports 9 through 16, etc. Within each octet, the most significant bit represents the lowest numbered port, and the least significant bit represents the highest numbered port. Thus, each port is represented by a single bit within the value of this object. If that bit has a value of '1' then that port is enabled to send traps for learned MAC addresses; the port is not enabled if its bit has a value of '0'. Enabling hpicfMacNotifyLearnedPortConfig on a trunk port is permitted but not recommended. hpicfMacNotifyEnable must be enabled for traps to be sent.
POR hpicfMacNotifyRemovedPortConfig	1.3.6.1.4.1.11.2.14.11.5.1.66.1.5	PortList	read-write	Used to configure the MAC address removed notification traps on specific ports. Each octet within this value specifies a set of eight ports, with the first octet specifying ports 1 through 8, the second octet specifying ports 9 through 16, etc. Within each octet, the most significant bit represents the lowest numbered port, and the least significant bit represents the highest numbered port. Thus, each port is represented by a single bit within the value of this object. If that bit has a value of '1' then that port is enabled to send traps for removed MAC addresses; the port is not enabled if its bit has a value of '0'. Enabling hpicfMacNotifyRemovedPortConfig on a trunk port is permitted but not recommended. hpicfMacNotifyEnable must be enabled for traps to be sent.
INT hpicfMacNotifyAction	1.3.6.1.4.1.11.2.14.11.5.1.66.1.6	INTEGER	accessible-for-notify	Indicate the MAC address table change action for hpicfMacNotifyMacAddress: learned, moved, removed or aged.
MAC hpicfMacNotifyMacAddress	1.3.6.1.4.1.11.2.14.11.5.1.66.1.7	MacAddress	accessible-for-notify	The MAC address that has been learned, moved, removed or aged in the MAC address table.
I32 hpicfMacNotifyFromPortId	1.3.6.1.4.1.11.2.14.11.5.1.66.1.8	Integer32	accessible-for-notify	The related from port index of the MAC address hpicfMacNotifyMacAddress. Port index will be determined by the action in hpicfMacNotifyAction. Action: Learned: The value will be zero Moved: The port from which the MAC was moved Removed: The port from which MAC was removed Aged: The port on which the MAC has aged
I32 hpicfMacNotifyToPortId	1.3.6.1.4.1.11.2.14.11.5.1.66.1.9	Integer32	accessible-for-notify	The related port index of the MAC address hpicfMacNotifyMacAddress. Port index will be determined by the action in hpicfMacNotifyAction. Action: Learned: The actual port the MAC was learned Moved: The port to which the MAC was moved Removed: The value will be zero Aged: The value will be zero
I32 hpicfMacNotifyVlanId	1.3.6.1.4.1.11.2.14.11.5.1.66.1.10	Integer32	accessible-for-notify	The related Vlan ID of the MAC address hpicfMacNotifyMacAddress. Vlan ID will be determined by the action in hpicfMacNotifyAction. Action: Learned: VLAN that the hpicfMacNotifyToPortId belongs to Moved: VLAN that the hpicfMacNotifyToPortId belongs to Removed: VLAN that hpicfMacNotifyFromPortId belongs to Aged: VLAN that hpicfMacNotifyFromPortId belongs to
POR hpicfMacNotifyAgedPortConfig	1.3.6.1.4.1.11.2.14.11.5.1.66.1.11	PortList	read-write	This object is used to configure the ports for sending traps when MAC addresses age out. Each octet within this value specifies a set of eight ports.The first octet specifying ports 1 through 8, the second octet specifying ports 9 through 16 and so on . Within each octet, the most significant bit represents the lowest numbered port, and the least significant bit represents the highest numbered port. A bitvalue of (1) indicates that the corresponding port is enabled to send traps for aged MAC addresses. A bitvalue of (0) indicates that the corresponding port is not enabled to send traps for aged MAC addresses. Enabling hpicfMacNotifyAgedPortConfig on a trunk port is permitted but not recommended. hpicfMacNotifyEnable must be enabled for traps to be sent.
hpicfMacNotifyStats	1.3.6.1.4.1.11.2.14.11.5.1.66.2
C32 hpicfMacNotifyLearnedCountEx	1.3.6.1.4.1.11.2.14.11.5.1.66.2.1	Counter32	read-only	A count of MAC addresses learned by the MAC Address Table.
C32 hpicfMacNotifyRemovedCount	1.3.6.1.4.1.11.2.14.11.5.1.66.2.2	Counter32	read-only	A count of MAC addresses removed from the MAC Address Table.
C32 hpicfMacNotifyMoveCount	1.3.6.1.4.1.11.2.14.11.5.1.66.2.3	Counter32	read-only	A count of MAC addresses moved in the MAC Address Table.
C32 hpicfMacNotifyCount	1.3.6.1.4.1.11.2.14.11.5.1.66.2.4	Counter32	read-only	A count of Mac Address notifications sent. hpicfMacNotifyEnable must be enabled for the counter to be activated. This number is incremented each time a Mac Address Table Change learn/move/remove occurs on a hpicfMacNotifyTrapConfig enabled interface or when hpicfMacNotifyMoveEnable is enabled. This count will include notifications that are dropped due to buffering overflow during high activity. hpicfMacNotifyCount is initialized to zero at boot.
C32 hpicfMacNotifyAgedCount	1.3.6.1.4.1.11.2.14.11.5.1.66.2.5	Counter32	read-only	A count of MAC addresses agedout from the MAC Address Table.
hpicfMacNotifyConformance	1.3.6.1.4.1.11.2.14.11.5.1.66.3
hpicfMacNotifyCompliances	1.3.6.1.4.1.11.2.14.11.5.1.66.3.1
hpicfMacNotifyCompliance	1.3.6.1.4.1.11.2.14.11.5.1.66.3.1.1			The compliance statement for SNMP entities which implement the MAC Notify MIB.
hpicfMacCountNotifyCompliance	1.3.6.1.4.1.11.2.14.11.5.1.66.3.1.2			The compliance steatement for SNMP entities which implement the mac count notify mib objects.
hpicfMacNotifyCompliance2	1.3.6.1.4.1.11.2.14.11.5.1.66.3.1.3			The compliance statement for SNMP entities which implement the MAC Notify MIB.
hpicfMacNotifyGroups	1.3.6.1.4.1.11.2.14.11.5.1.66.3.2
hpicfMacNotifyGlobalConfigGroup	1.3.6.1.4.1.11.2.14.11.5.1.66.3.2.1			A collection of objects used to globally configure the SNMP traps used to monitor the MAC address table using the MAC-notify feature
hpicfMacNotifyConfigGroup	1.3.6.1.4.1.11.2.14.11.5.1.66.3.2.2			A collection of objects used to configure and to monitor, through SNMP traps, for the MAC address table changes (learns/removes).
hpicfMacNotifyStatsGroup	1.3.6.1.4.1.11.2.14.11.5.1.66.3.2.3			A group of counters used to maintain statistics on the number of MAC address table changes and the number of notification packets sent for changes in the MAC address table.
hpicfMacNotifyNotifications	1.3.6.1.4.1.11.2.14.11.5.1.66.3.2.4			A group of notifications used to signal changes (learns/moves/removes) in the MAC address table.
hpicfMacNotifyClearGroup	1.3.6.1.4.1.11.2.14.11.5.1.66.3.2.5			A collection of objects used to clear the MAC address tables
hpicfMacCountNotifyConfigGroup	1.3.6.1.4.1.11.2.14.11.5.1.66.3.2.6			A collection of objects used to configure and to montior, through SNMP traps, for the MAC address learn count on the ports.
hpicfMacCountNotifyNotifications	1.3.6.1.4.1.11.2.14.11.5.1.66.3.2.7			A group of notifications used to signal MAC address learn count on a port.
hpicfMacNotifyStatsGroup2	1.3.6.1.4.1.11.2.14.11.5.1.66.3.2.8			A collection of counters used to maintain the statistics of MAC address table changes and the notifications sent for each instance of MAC address table change.
hpicfMacNotifyConfigGroup2	1.3.6.1.4.1.11.2.14.11.5.1.66.3.2.9			A collection of objects used to configure and monitor the SNMP traps for the MAC address table changes .
hpicfMacNotifyClearObjects	1.3.6.1.4.1.11.2.14.11.5.1.66.4
POR hpicfMacNotifyClearMacTableOnPorts	1.3.6.1.4.1.11.2.14.11.5.1.66.4.1	PortList	read-write	Used to clear the MAC address table on a specific port. Each octet within this value specifies a set of eight ports, with the first octet specifying ports 1 through 8, the second octet specifying ports 9 through 16, etc. Within each octet, the most significant bit represents the lowest numbered port, and the least significant bit represents the highest numbered port. Thus, each port is represented by a single bit within the value of this object. If that bit has a value of '1 then that port is included in the set of ports; the port is not included if its bit has a value of '0'.
VLA hpicfMacNotifyClearMacTableOnVlan	1.3.6.1.4.1.11.2.14.11.5.1.66.4.2	VlanId	read-write	Used to clear the MAC address table on a specific VLAN. VLAN ID identifies the VLAN that will be cleared.
hpicfMacCountNotifyConfigObjects	1.3.6.1.4.1.11.2.14.11.5.1.66.5
INT hpicfMacNotifyPortLearnedCountEnable	1.3.6.1.4.1.11.2.14.11.5.1.66.5.1	INTEGER	read-write	Indicates whether or not to generate hpicfMacNotifyPortMacAddressCount trap. Notifications are generated when the MAC address count on a switch port equals the defined MAC count as in hpicfMacNotifyPortLearnedCount object. Default is disabled.
POR hpicfMacNotifyPortLearnedCountConfig	1.3.6.1.4.1.11.2.14.11.5.1.66.5.2	PortList	read-write	Used to config the MAC address learned notification traps on specific ports. Each octet within this value specifies a set of eight ports, with the first octet specifying ports 1 through 8, the second octet specifying ports 9 through 16, etc. Within each octet, the most significant bit represents the lowest numbered port, and the least significant bit represents the highest numbered port. Thus, each port is represented by a single bit within the value of this object. If that bit has a value of '1' then that port is enabled to send traps for learned MAC addresses;the port is not enabled if its bit has a value of '0'. Enabling picfMacNotifyPortLearnedCountConfig on a trunk port is permitted but not recommended. hpicfMacNotifyPortLearnedCountEnable must be enabled for traps to be sent.
hpicfMacNotifyPortLearnedCountConfigTable	1.3.6.1.4.1.11.2.14.11.5.1.66.5.3		not-accessible	Table containing the configured MAC count for sending mac-count-notify traps on a port.
hpicfMacNotifyPortLearnedCountConfigEntry	1.3.6.1.4.1.11.2.14.11.5.1.66.5.3.1		not-accessible	An entry in hpicfMacNotifyPortLearnedCountConfigTable containing MAC count for sending mac-count-notify traps for a port.
NUM hpicfMacNotifyPortIndex	1.3.6.1.4.1.11.2.14.11.5.1.66.5.3.1.1	InterfaceIndex	not-accessible	Indicates the ifIndex of the port
U32 hpicfMacNotifyPortLearnedCount	1.3.6.1.4.1.11.2.14.11.5.1.66.5.3.1.2	Unsigned32	read-write	Indicates the count of MAC learns when reached to send the mac-notify traps

RFC description

HP proprietary MIB for MAC address change notifications on network switches, sending SNMP traps when dynamic MAC table events occur (learn, move, age, remove).

Start monitoring HP ProCurve/Aruba switch (MAC address change notification traps) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download HP-ICF-MACNOTIFY-MIB