All MIBs › HPN-ICF-ARP-RATELIMIT-MIB
Last Updated: 2013-10-14
Category: Domain: Security, Vendor: H3C/HH3C, Vendor: HP/HPE
Description: HP Networking ICF SNMP MIB for ARP packet rate limiting per interface to mitigate ARP flood attacks on HP networking devices.
Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.
What Is HPN-ICF-ARP-RATELIMIT-MIB?
HPN-ICF-ARP-RATELIMIT-MIB is an HPE/H3C Comware ICF private MIB that defines objects for controlling and monitoring the rate of ARP packets delivered to a switch's CPU, a common defense against ARP flood/broadcast-storm conditions. It exposes a per-interface configuration table (hpnicfARPRatelimitConfigTable/Entry with hpnicfARPRatelimitValue) plus trap objects reporting rate-limit violations, including a trap counter (hpnicfARPRatelimitTrapCount) and descriptive message (hpnicfARPRatelimitTrapMsg). The current revision is monitoring-only, so its value is in observing whether ARP traffic on an interface is spiking abnormally, which is a software/traffic-anomaly signal rather than a hardware sensor reading. Sustained rate-limit trap activity is often an early symptom of a compromised host or misbehaving NIC on the segment. It is a vendor extension layered on standard SNMPv2-CONF/TC notification conventions and is deployed on HPE/H3C Comware switches and routers in enterprise and campus networks. Engineers can download the HPN-ICF-ARP-RATELIMIT-MIB file directly to load it into their MIB browser.
IPNetwork Monitor allows you to monitor SNMP objects defined in HPN-ICF-ARP-RATELIMIT-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.
Supported Devices
- HPE/H3C Comware switches
- HPE/H3C Comware routers
Monitoring Examples
An administrator polls hpnicfARPRatelimitConfigTable to see the configured hpnicfARPRatelimitValue per interface, then watches hpnicfARPRatelimitTrapCount and the hpnicfARPRatelimitTrap notification to detect when an interface exceeds its allowed ARP packet rate. A rising trap count alongside the descriptive hpnicfARPRatelimitTrapMsg text would point to a potential ARP flood or spoofing attack on that port. Because the implementation is monitor-only, hpnicfARPRatelimitObjects/Traps exist mainly to surface alerts rather than to let the operator change enforcement via SNMP.
What Can Be Monitored
- ARP packet rate limit value per interface
- ARP rate-limit trap count
- ARP rate-limit trap messages
- ARP rate-limit configuration table entries
Imported Objects
From HPN-ICF-OID-MIB
| hpnicfCommon | OBJECT-IDENTITY |
From IF-MIB
| ifIndex | OBJECT-TYPE |
From SNMPv2-SMI
| MODULE-IDENTITY | |
| NOTIFICATION-TYPE | |
| OBJECT-TYPE | |
| Unsigned32 |
OIDs
RFC description
HP/HPE Integrated Comnet Fabric (ICF) MIB; defines ARP rate-limiting configuration and monitoring objects for HP network devices.
Start monitoring HPE/H3C Comware switch or router (ARP packet rate limiting) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.