HPN-ICF-IDS-MIB

All MIBs › HPN-ICF-IDS-MIB

Last Updated: 2005-07-14

Category: Domain: Security, Vendor: H3C/HH3C, Vendor: HP/HPE

Description: Manages intrusion detection system (IDS) signature rules and alert statistics on HP/Comware security appliances.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is HPN-ICF-IDS-MIB?

HPN-ICF-IDS-MIB is an HPE/H3C Comware ICF private MIB that exposes intrusion detection system (IDS) information on the device, covering signature-based detection of intruder/attack activity. No populated object list is available for this snapshot, but an IDS MIB of this kind typically models detected-signature counters, alert/event tables, and enable/configuration scalars for the detection engine. Its monitoring purpose is fundamentally a software/security-status one: revealing whether the IDS engine is active and how many suspicious events it has flagged, rather than reporting physical hardware sensors. Because IDS processing can be CPU-intensive, sustained high alert rates are also often correlated with elevated device CPU load. It depends on general HPE/H3C Comware security MIB conventions and is deployed on HPE/H3C Comware security appliances and switches/routers with IDS enabled. Engineers can download the HPN-ICF-IDS-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in HPN-ICF-IDS-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

HPE/H3C Comware security appliances
HPE/H3C Comware switches/routers with IDS enabled

Monitoring Examples

No sample object names are available for this module in this snapshot, so a specific polling walkthrough cannot be given with confidence. In practice an admin would be expected to poll IDS enable/status scalars and an alert or signature-hit table to see how many intrusion signatures matched recent traffic, with a sudden rise typically indicating an active attack or scan against the protected device or segment.

What Can Be Monitored

IDS detection enable/status
intrusion signature/alert counts

Imported Objects

From HPN-ICF-OID-MIB

hpnicfCommon

OBJECT-IDENTITY

From INET-ADDRESS-MIB

InetAddress
InetAddressType

From SNMPv2-SMI

Integer32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

OIDs

OID symbolic	OID numeric	Type	Access	Description
hpnicfIds	1.3.6.1.4.1.11.2.14.11.15.2.47
hpnicfIDSMib	1.3.6.1.4.1.11.2.14.11.15.2.47.1			This MIB describes IDS private information. IDS(Instruction Detecting System) is used to detect intruder activity.
hpnicfIDSTrapGroup	1.3.6.1.4.1.11.2.14.11.15.2.47.1.1
hpnicfIDSTrapInfo	1.3.6.1.4.1.11.2.14.11.15.2.47.1.1.1
U32 hpnicfIDSTrapIPFragmentQueueLen	1.3.6.1.4.1.11.2.14.11.15.2.47.1.1.1.1	Unsigned32	accessible-for-notify	The length of IP fragment queue.
U32 hpnicfIDSTrapStatSessionTabLen	1.3.6.1.4.1.11.2.14.11.15.2.47.1.1.1.2	Unsigned32	accessible-for-notify	The length of status session table.
IPt hpnicfIDSTrapIPAddressType	1.3.6.1.4.1.11.2.14.11.15.2.47.1.1.1.3	InetAddressType	accessible-for-notify	The type of IP Address.
IP hpnicfIDSTrapIPAddress	1.3.6.1.4.1.11.2.14.11.15.2.47.1.1.1.4	InetAddress	accessible-for-notify	IP Address.
OCT hpnicfIDSTrapUserName	1.3.6.1.4.1.11.2.14.11.15.2.47.1.1.1.5	OCTET STRING	accessible-for-notify	User name.
INT hpnicfIDSTrapLoginType	1.3.6.1.4.1.11.2.14.11.15.2.47.1.1.1.6	INTEGER	accessible-for-notify	Login type, including telnet, ssh and web.
INT hpnicfIDSTrapUpgradeType	1.3.6.1.4.1.11.2.14.11.15.2.47.1.1.1.7	INTEGER	accessible-for-notify	Upgrade type, including programme(system image), crb(custom rule base, one kind of configuration file), vrb(vendor rule base, one kind of configuration file).
OCT hpnicfIDSTrapCRLName	1.3.6.1.4.1.11.2.14.11.15.2.47.1.1.1.8	OCTET STRING	accessible-for-notify	CRL(Certificate Revoke List) name.
OCT hpnicfIDSTrapCertName	1.3.6.1.4.1.11.2.14.11.15.2.47.1.1.1.9	OCTET STRING	accessible-for-notify	Certificate name.
U32 hpnicfIDSTrapDetectRuleID	1.3.6.1.4.1.11.2.14.11.15.2.47.1.1.1.10	Unsigned32	accessible-for-notify	The rule ID which is a unique identifier for a specified detect rule.
I32 hpnicfIDSTrapEngineID	1.3.6.1.4.1.11.2.14.11.15.2.47.1.1.1.11	Integer32	accessible-for-notify	A unique number used to identify an interface.
OCT hpnicfIDSTrapFileName	1.3.6.1.4.1.11.2.14.11.15.2.47.1.1.1.12	OCTET STRING	accessible-for-notify	The file name.
U32 hpnicfIDSTrapCfgLineInFile	1.3.6.1.4.1.11.2.14.11.15.2.47.1.1.1.13	Unsigned32	accessible-for-notify	The line number in the configuration file.
OCT hpnicfIDSTrapReasonForError	1.3.6.1.4.1.11.2.14.11.15.2.47.1.1.1.14	OCTET STRING	accessible-for-notify	The information of the notification. Although the format and content of this object are device specific, they should be defined uniformly in the device.
hpnicfIDSTrap	1.3.6.1.4.1.11.2.14.11.15.2.47.1.1.2
hpnicfIDSTrapPrefix	1.3.6.1.4.1.11.2.14.11.15.2.47.1.1.2.0
NTF hpnicfIDSTrapIPFragQueueFull	1.3.6.1.4.1.11.2.14.11.15.2.47.1.1.2.0.1			This notification will be generated when the IP fragment queue is full. The hpnicfIDSTrapIPFragmentQueueLen describes the length of current fragment queue. The hpnicfIDSTrapReasonForError describes reason for error.
NTF hpnicfIDSTrapStatSessTabFull	1.3.6.1.4.1.11.2.14.11.15.2.47.1.1.2.0.2			This notification will be generated when the status session table is full. The hpnicfIDSTrapStatSessionTabLen describes the length of current status session table. The hpnicfIDSTrapReasonForError describes reason for error.
NTF hpnicfIDSTrapDetectRuleParseFail	1.3.6.1.4.1.11.2.14.11.15.2.47.1.1.2.0.3			This notification will be generated when failing to parse the rules for detecting. The hpnicfIDSTrapDetectRuleID object describes rule ID. The hpnicfIDSTrapEngineID object identifies an interface the rule applies to. The hpnicfIDSTrapReasonForError object describes reason for error.
NTF hpnicfIDSTrapDBConnLost	1.3.6.1.4.1.11.2.14.11.15.2.47.1.1.2.0.4			This notification will be generated when connecting with database server fails. The hpnicfIDSTrapIPAddressType object describes the IP address type of database server. The hpnicfIDSTrapIPAddress object describes the IP address of database server. The hpnicfIDSTrapReasonForError describes reason of connecting failure.
NTF hpnicfIDSTrapCRLNeedUpdate	1.3.6.1.4.1.11.2.14.11.15.2.47.1.1.2.0.5			This notification will be generated when IDS device detects that CRL is out of date. The hpnicfIDSTrapCRLName object describes the CRL(Certificate Revoke List) name. The hpnicfIDSTrapReasonForError object describes reason for error.
NTF hpnicfIDSTrapCertOverdue	1.3.6.1.4.1.11.2.14.11.15.2.47.1.1.2.0.6			This notification will be generated when IDS device detects that certificate is overdue. The hpnicfIDSTrapCertName object describes the certificate name. The hpnicfIDSTrapReasonForError object describes reason for error.
NTF hpnicfIDSTrapTooManyLoginFail	1.3.6.1.4.1.11.2.14.11.15.2.47.1.1.2.0.7			This notification will be generated when the login failure times of a user over a certain number. The hpnicfIDSTrapUserName object describes the user name when logging in. The hpnicfIDSTrapIPAddressType object describes the IP address type of client. The hpnicfIDSTrapIPAddress object describes the IP address of client. The hpnicfIDSTrapLoginType object describes login type, including: telnet, ssh, web. The hpnicfIDSTrapReasonForError object describes reason for error.
NTF hpnicfIDSTrapUpgradeError	1.3.6.1.4.1.11.2.14.11.15.2.47.1.1.2.0.8			This notification will be generated when upgrading fails. The hpnicfIDSTrapUpgradeType object describes upgrade type, including: programme, vrb. The hpnicfIDSTrapReasonForError object describes reason for error.
NTF hpnicfIDSTrapFileAccessError	1.3.6.1.4.1.11.2.14.11.15.2.47.1.1.2.0.9			This notification will be generated when accessing file fails. The hpnicfIDSTrapFileName object describes the name of file accessed. The hpnicfIDSTrapReasonForError object describes reason for error.
NTF hpnicfIDSTrapConsArithMemLow	1.3.6.1.4.1.11.2.14.11.15.2.47.1.1.2.0.10			This notification will be generated when memory used by constructing the arithmetic to seek content is lacking. The hpnicfIDSTrapReasonForError object describes reason for error.
NTF hpnicfIDSTrapSSRAMOperFail	1.3.6.1.4.1.11.2.14.11.15.2.47.1.1.2.0.11			This notification will be generated when reading or writing SSRAM of CIE card fails. The hpnicfIDSTrapReasonForError object describes reason for error.
NTF hpnicfIDSTrapPacketProcessDisorder	1.3.6.1.4.1.11.2.14.11.15.2.47.1.1.2.0.12			This notification will be generated when packets processed is in disorder. The hpnicfIDSTrapReasonForError object describes reason for error.
NTF hpnicfIDSTrapCfgFileFormatError	1.3.6.1.4.1.11.2.14.11.15.2.47.1.1.2.0.13			When devices startup and load the configuration file, if format error is found, this notification will be generated. The hpnicfIDSTrapFileName object describes the name of configuration file. The hpnicfIDSTrapCfgLineInFile object describes the line number in the file.

RFC description

HP intrusion detection system monitoring with trap reporting for fragment queues and attack detection.

Start monitoring HPE/H3C Comware switch/router or security appliance (intrusion detection) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download HPN-ICF-IDS-MIB

What Is HPN-ICF-IDS-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description