HPN-ICF-DHCPSNOOP-MIB

All MIBs › HPN-ICF-DHCPSNOOP-MIB

Last Updated: 2005-01-14

Category: Protocol: DHCP, Vendor: H3C/HH3C, Vendor: HP/HPE

Description: HP Networking ICF SNMP MIB for DHCP snooping binding table and trust interface management on HP networking devices.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is HPN-ICF-DHCPSNOOP-MIB?

HPN-ICF-DHCPSNOOP-MIB is HP Networking's proprietary MIB (part of the Comware/ICF private MIB family, shared with H3C) for managing the DHCP snooping security feature, covering the snooping binding table and trusted-interface designation. It exposes configuration for enabling the feature and the live binding-table data it maintains as clients obtain DHCP leases. Its status-monitoring role is software/security-feature oriented: whether DHCP snooping is enabled per VLAN and which interfaces are trusted, along with the current binding-table population, indicate whether the switch is actively protecting against rogue DHCP servers rather than reporting on physical component health. It complements the standard IF-MIB for interface indexing and BRIDGE-MIB for VLAN/port context when associating snooping data with a physical port. It is deployed on HP/H3C Comware-based enterprise access switches that use DHCP snooping to prevent rogue DHCP servers and IP spoofing on the LAN. Engineers can download the HPN-ICF-DHCPSNOOP-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in HPN-ICF-DHCPSNOOP-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

HP Networking (Comware/H3C ICF) switch

Monitoring Examples

No sample objects were provided for this module, so a concrete polling scenario with real object names cannot be constructed; consistent with its stated purpose, monitoring would involve checking the DHCP snooping enable state per VLAN and reviewing the snooping binding table for unexpected or missing lease entries, which could indicate a rogue DHCP server or a misconfigured trusted port.

What Can Be Monitored

DHCP snooping enable/disable status
DHCP snooping binding table entries
trusted interface configuration
DHCP snooping VLAN status

Imported Objects

From HPN-ICF-LswVLAN-MIB

hpnicfdot1qVlanIndex

OBJECT-TYPE

From HPN-ICF-OID-MIB

hpnicfCommon

OBJECT-IDENTITY

From IF-MIB

ifIndex

OBJECT-TYPE

From INET-ADDRESS-MIB

InetAddress
InetAddressType

From SNMPv2-SMI

Integer32
IpAddress
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE

From SNMPv2-TC

MacAddress
TruthValue

OIDs

OID symbolic	OID numeric	Type	Access	Description
hpnicfDhcpSnoop	1.3.6.1.4.1.11.2.14.11.15.2.36			The private MIB file includes the DHCP Snooping profile.
hpnicfDhcpSnoopMibObject	1.3.6.1.4.1.11.2.14.11.15.2.36.1
INT hpnicfDhcpSnoopEnable	1.3.6.1.4.1.11.2.14.11.15.2.36.1.1	INTEGER	read-write	DHCP Snooping status (enable or disable).
hpnicfDhcpSnoopTable	1.3.6.1.4.1.11.2.14.11.15.2.36.1.2		not-accessible	The table containing information of DHCP clients listened by DHCP snooping and it's enabled or disabled by setting hpnicfDhcpSnoopEnable node.
hpnicfDhcpSnoopEntry	1.3.6.1.4.1.11.2.14.11.15.2.36.1.2.1		not-accessible	An entry containing information of DHCP clients.
IPt hpnicfDhcpSnoopClientIpAddressType	1.3.6.1.4.1.11.2.14.11.15.2.36.1.2.1.1	InetAddressType	not-accessible	DHCP clients' IP addresses type (IPv4 or IPv6).
IP hpnicfDhcpSnoopClientIpAddress	1.3.6.1.4.1.11.2.14.11.15.2.36.1.2.1.2	InetAddress	not-accessible	DHCP clients' IP addresses collected by DHCP snooping.
MAC hpnicfDhcpSnoopClientMacAddress	1.3.6.1.4.1.11.2.14.11.15.2.36.1.2.1.3	MacAddress	read-only	DHCP clients' MAC addresses collected by DHCP snooping.
INT hpnicfDhcpSnoopClientProperty	1.3.6.1.4.1.11.2.14.11.15.2.36.1.2.1.4	INTEGER	read-only	Method of getting IP addresses collected by DHCP snooping.
I32 hpnicfDhcpSnoopClientUnitNum	1.3.6.1.4.1.11.2.14.11.15.2.36.1.2.1.5	Integer32	read-only	IRF (Intelligent Resilient Fabric) unit number via whom the clients get their IP addresses. The value 0 means this device does not support IRF.
hpnicfDhcpSnoopTrustTable	1.3.6.1.4.1.11.2.14.11.15.2.36.1.3		not-accessible	A table is used to configure and monitor port trusted status.
hpnicfDhcpSnoopTrustEntry	1.3.6.1.4.1.11.2.14.11.15.2.36.1.3.1		not-accessible	An entry containing information about trusted status of ports.
INT hpnicfDhcpSnoopTrustStatus	1.3.6.1.4.1.11.2.14.11.15.2.36.1.3.1.1	INTEGER	read-write	Trusted status of current port which supports both get and set operation.
hpnicfDhcpSnoopVlanTable	1.3.6.1.4.1.11.2.14.11.15.2.36.1.4		not-accessible	A table is used to configure and monitor DHCP Snooping status of VLANs.
hpnicfDhcpSnoopVlanEntry	1.3.6.1.4.1.11.2.14.11.15.2.36.1.4.1		not-accessible	The entry information about hpnicfDhcpSnoopVlanTable.
I32 hpnicfDhcpSnoopVlanIndex	1.3.6.1.4.1.11.2.14.11.15.2.36.1.4.1.1	Integer32	not-accessible	Current VLAN index.
T/F hpnicfDhcpSnoopVlanEnable	1.3.6.1.4.1.11.2.14.11.15.2.36.1.4.1.2	TruthValue	read-write	DHCP Snooping status of current VLAN.
hpnicfDhcpSnoopTraps	1.3.6.1.4.1.11.2.14.11.15.2.36.2
hpnicfDhcpSnoopTrapsPrefix	1.3.6.1.4.1.11.2.14.11.15.2.36.2.0
NTF hpnicfDhcpSnoopSpoofServerDetected	1.3.6.1.4.1.11.2.14.11.15.2.36.2.0.1			To detect unauthorized DHCP servers on a network, the DHCP snooping device sends DHCP-DISCOVER messages through its downstream port (which is connected to the DHCP clients). If any response (DHCP-OFFER message) is received from the downstream port, an unauthorized DHCP server is considered present, and then the device sends a trap. With unauthorized DHCP server detection enabled, the interface sends a DHCP-DISCOVER message to detect unauthorized DHCP servers on the network. If this interface receives a DHCP-OFFER message, the DHCP server which sent it is considered unauthorized.
NTF hpnicfDhcpSnoopNewBinding	1.3.6.1.4.1.11.2.14.11.15.2.36.2.0.2			The device sends a trap when adding a new binding.
hpnicfDhcpSnoopTrapsObject	1.3.6.1.4.1.11.2.14.11.15.2.36.2.1
MAC hpnicfDhcpSnoopSpoofServerMac	1.3.6.1.4.1.11.2.14.11.15.2.36.2.1.1	MacAddress	accessible-for-notify	MAC address of the spoofing server and it is derived from link-layer header of offer packet. If the offer packet is relayed by dhcp relay entity, it may be the MAC address of relay entity.
IP hpnicfDhcpSnoopSpoofServerIP	1.3.6.1.4.1.11.2.14.11.15.2.36.2.1.2	IpAddress	accessible-for-notify	IP address of the spoofing server and it is derived from IP header of offer packet. A tricksy host may send offer packet use other host's address, so this address can not always be trust.
IP hpnicfDhcpSnoopBindingIP	1.3.6.1.4.1.11.2.14.11.15.2.36.2.1.3	IpAddress	accessible-for-notify	IP address of a new binding.
MAC hpnicfDhcpSnoopBindingMac	1.3.6.1.4.1.11.2.14.11.15.2.36.2.1.4	MacAddress	accessible-for-notify	MAC address of a new binding.

RFC description

Monitors DHCP snooping activity on switches, tracking DHCP client bindings and detecting spoofed servers.

Start monitoring HP Networking (Comware/H3C ICF) switch (DHCP snooping) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download HPN-ICF-DHCPSNOOP-MIB

What Is HPN-ICF-DHCPSNOOP-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description