HPN-ICF-LI-MIB

All MIBs › HPN-ICF-LI-MIB

Last Updated: 2009-08-25

Category: Domain: Security, Domain: Telco/Transport, Vendor: H3C/HH3C, Vendor: HP/HPE

Description: Manages lawful interception (LI) mediation configuration and session control on HP/Comware carrier routers.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is HPN-ICF-LI-MIB?

HPN-ICF-LI-MIB is an HP/H3C Comware (ICF) carrier-grade router MIB that manages Lawful Interception (LI) mediation configuration, controlling how intercepted traffic sessions are forwarded to law-enforcement mediation devices. It exposes configuration data describing mediation destinations (address, port, protocol/transport, DSCP marking, source interface) and session timeout settings, along with related traps. Its monitoring value is primarily around configuration/status verification and fault notification for the LI subsystem -- e.g., confirming mediation sessions are correctly configured and alerting via traps if an LI mediation path fails -- rather than general hardware health metrics like temperature or CPU. It depends on the underlying HP/H3C Comware ICF (Integrated Component Framework) MIB conventions and SNMP notification infrastructure for its trap delivery. It is typically deployed on carrier/service-provider HP Comware routers where regulatory lawful-intercept mediation must be configured and its operational status tracked, typically by loading the HPN-ICF-LI-MIB MIB Browser to inspect the mediation table's configured objects.

IPNetwork Monitor allows you to monitor SNMP objects defined in HPN-ICF-LI-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

HP/H3C Comware carrier-grade routers

Monitoring Examples

An administrator (typically restricted to authorized LI personnel) would examine hpnicfLIMediationTable, indexed by hpnicfLIMediationIndex, to verify hpnicfLIMediationDestAddr, hpnicfLIMediationDestPort, and hpnicfLIMediationTransport are correctly configured for a mediation device, and check hpnicfLIMediationTimeOut and hpnicfLIMediationSrcInterface for session behavior. hpnicfLINotifications would alert if a configured mediation session cannot be established or is disrupted, indicating a lawful-intercept delivery failure that needs urgent attention.

What Can Be Monitored

LI mediation destination address/port
mediation transport protocol
mediation session timeout
mediation source interface
LI mediation DSCP marking
LI mediation fault notifications

Imported Objects

From HPN-ICF-OID-MIB

hpnicfCommon

OBJECT-IDENTITY

From IF-MIB

InterfaceIndexOrZero

From INET-ADDRESS-MIB

InetAddress
InetAddressPrefixLength
InetAddressType
InetPortNumber

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-SMI

Counter32
Counter64
Integer32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DateAndTime
MacAddress
RowStatus
TruthValue

How to Use in IPNetwork Monitor

Example using hpnicfLIStreamPackets OID:

Select an HP/H3C Comware carrier-grade router (Lawful Interception mediation) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type hpnicfLIStreamPackets into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. The numbers of packets that have been intercepted. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
hpnicfLI	1.3.6.1.4.1.11.2.14.11.15.2.111			Lawful Interception MIB
hpnicfLICommon	1.3.6.1.4.1.11.2.14.11.15.2.111.1
hpnicfLITrapBindObjects	1.3.6.1.4.1.11.2.14.11.15.2.111.1.1
U32 hpnicfLIBoardInformation	1.3.6.1.4.1.11.2.14.11.15.2.111.1.1.1	Unsigned32	accessible-for-notify	It is a slot number.
hpnicfLINotifications	1.3.6.1.4.1.11.2.14.11.15.2.111.1.2
hpnicfLINotificationsPrefix	1.3.6.1.4.1.11.2.14.11.15.2.111.1.2.0
NTF hpnicfLIActive	1.3.6.1.4.1.11.2.14.11.15.2.111.1.2.0.1			This Notification is sent when a type of intercepting configuration is changed from inactive to active. The value of the hpnicfLIStreamtype which identify the actual intercept stream is included in this notification.
NTF hpnicfLITimeOut	1.3.6.1.4.1.11.2.14.11.15.2.111.1.2.0.2			When the time specified in hpnicfLIMediationTimeout arrives, the device notifies the manager corresponding intercept is removed.
NTF hpnicfLIFailureInformation	1.3.6.1.4.1.11.2.14.11.15.2.111.1.2.0.3			When interception is configured on distributed device, the configuration perhaps failed on some board. If this happened, this notification will occur.
hpnicfLIObjects	1.3.6.1.4.1.11.2.14.11.15.2.111.1.3
I32 hpnicfLINewIndex	1.3.6.1.4.1.11.2.14.11.15.2.111.1.3.1	Integer32	read-only	This object will be used as an index value for a new hpnicfLIMediationEntry. Whenever read, the agent will give a non-used value. This is to reduce the probability of conflict during creation of new hpnicfLIMediationTable entries.
hpnicfLIMediationTable	1.3.6.1.4.1.11.2.14.11.15.2.111.1.3.2		not-accessible	This table describes interception gateway information with which interception device communicates.
hpnicfLIMediationEntry	1.3.6.1.4.1.11.2.14.11.15.2.111.1.3.2.1		not-accessible	An entry of configuring mediation device.
I32 hpnicfLIMediationIndex	1.3.6.1.4.1.11.2.14.11.15.2.111.1.3.2.1.1	Integer32	not-accessible	hpnicfLIMediationIndex is a entry identifier. The Mediation Device should be responsible for making sure these are unique. Before creating a new entry, a value for this variable may be obtained by reading hpnicfLINewIndex to reduce the probability of a value collision.
IPt hpnicfLIMediationDestAddrType	1.3.6.1.4.1.11.2.14.11.15.2.111.1.3.2.1.2	InetAddressType	read-write	The type of hpnicfLIMediationDestAddr.
IP hpnicfLIMediationDestAddr	1.3.6.1.4.1.11.2.14.11.15.2.111.1.3.2.1.3	InetAddress	read-write	The IP Address of the Mediation Device to receive intercepted traffic.
INE hpnicfLIMediationDestPort	1.3.6.1.4.1.11.2.14.11.15.2.111.1.3.2.1.4	InetPortNumber	read-write	The L4-port number on the Mediation Device to receive intercepted traffic.
NUM hpnicfLIMediationSrcInterface	1.3.6.1.4.1.11.2.14.11.15.2.111.1.3.2.1.5	InterfaceIndexOrZero	read-write	The interface on the intercepting device from which to transmit intercepted data. If zero, intercepting device will select an outbound interface according to hpnicfLIMediationDestAddr.
I32 hpnicfLIMediationDscp	1.3.6.1.4.1.11.2.14.11.15.2.111.1.3.2.1.6	Integer32	read-write	The Differentiated Services Code Point the intercepting device applies to the IP packets encapsulating the intercepted traffic.
DAT hpnicfLIMediationTimeOut	1.3.6.1.4.1.11.2.14.11.15.2.111.1.3.2.1.7	DateAndTime	read-write	The time at which this row and all related Stream Table rows should be automatically removed, and the intercept function expire.
INT hpnicfLIMediationTransport	1.3.6.1.4.1.11.2.14.11.15.2.111.1.3.2.1.8	INTEGER	read-write	The protocol used in transferring intercepted data to the Mediation Device.
T/F hpnicfLIMediationNotificationEnable	1.3.6.1.4.1.11.2.14.11.15.2.111.1.3.2.1.9	TruthValue	read-write	This variable controls the generation of any notifications or informs by the MIB agent for this table entry.
ROW hpnicfLIMediationRowStatus	1.3.6.1.4.1.11.2.14.11.15.2.111.1.3.2.1.10	RowStatus	read-create	Operation status of this table entry.
hpnicfLIStreamTable	1.3.6.1.4.1.11.2.14.11.15.2.111.1.3.3		not-accessible	This table lists the traffic stream's type to be intercepted. The specified filter is defined in hpnicfLIIPStreamTable, hpnicfLIMACStreamTable or hpnicfLIUserStreamTable, according to hpnicfLIStreamtype. Also it contains counters for packets to be intercepted and dropped by attached type of filter.
hpnicfLIStreamEntry	1.3.6.1.4.1.11.2.14.11.15.2.111.1.3.3.1		not-accessible	A single type of data stream to be intercepted.
I32 hpnicfLIStreamIndex	1.3.6.1.4.1.11.2.14.11.15.2.111.1.3.3.1.1	Integer32	not-accessible	The index of the stream entry.
INT hpnicfLIStreamtype	1.3.6.1.4.1.11.2.14.11.15.2.111.1.3.3.1.2	INTEGER	read-write	Identifies the type of stream, and according to it uses filter table. It can not be changed after a filter table is attached to it. The following types of streams are supported: ip: IP filter. The exact definition is a row in hpnicfLIIPStreamTable. mac: MAC filter. The exact definition is a row in hpnicfLIMACStreamTable. userConnecton: User connection filter. The exact definition is a row in hpnicfLIUserStreamTable.
T/F hpnicfLIStreamEnable	1.3.6.1.4.1.11.2.14.11.15.2.111.1.3.3.1.3	TruthValue	read-write	If 'true', the interception is active. And it is set to 'true' only after an additional filter specification has been attached to this stream.
C32 hpnicfLIStreamPacketsEx	1.3.6.1.4.1.11.2.14.11.15.2.111.1.3.3.1.4	Counter32	read-only	The numbers of packets that have been intercepted.
C32 hpnicfLIStreamDrops	1.3.6.1.4.1.11.2.14.11.15.2.111.1.3.3.1.5	Counter32	read-only	The numbers of packets were dropped in the lawful intercept process.
C64 hpnicfLIStreamHPackets	1.3.6.1.4.1.11.2.14.11.15.2.111.1.3.3.1.6	Counter64	read-only	The numbers of packets have been intercepted. This object is a 64-bit version of hpnicfLIStreamPackets.
C64 hpnicfLIStreamHDrops	1.3.6.1.4.1.11.2.14.11.15.2.111.1.3.3.1.7	Counter64	read-only	The numbers of packets were dropped in the lawful intercept process. This object is a 64-bit version of hpnicfLIStreamDrops.
ROW hpnicfLIStreamRowStatus	1.3.6.1.4.1.11.2.14.11.15.2.111.1.3.3.1.8	RowStatus	read-create	Operation status of this table entry.
hpnicfLIIPStream	1.3.6.1.4.1.11.2.14.11.15.2.111.2
hpnicfLIIPStreamObjects	1.3.6.1.4.1.11.2.14.11.15.2.111.2.1
hpnicfLIIPStreamTable	1.3.6.1.4.1.11.2.14.11.15.2.111.2.1.1		not-accessible	This table lists the IPv4 and IPv6 streams to be intercepted. It is associated with hpnicfLIMediationTable and hpnicfLIStreamTable.
hpnicfLIIPStreamEntry	1.3.6.1.4.1.11.2.14.11.15.2.111.2.1.1.1		not-accessible	A single stream to be intercepted. The first index indicates the Mediation Device. The second index is that of the stream's counter entry in the hpnicfLIStreamTable. The second index permits multiple classifiers to be used together, such as having an IP address as source or destination.
NUM hpnicfLIIPStreamInterface	1.3.6.1.4.1.11.2.14.11.15.2.111.2.1.1.1.1	InterfaceIndexOrZero	read-write	Traffic received or transmitted over this interface will be intercepted. This value must be set when creating a stream entry, either zero, or a valid interface index. If the value is zero, interception accepts any interface. Then at least one additional parameter must be selected, and not be default value.
IPt hpnicfLIIPStreamAddrType	1.3.6.1.4.1.11.2.14.11.15.2.111.2.1.1.1.2	InetAddressType	read-write	The type of address, used in packet selection.
IP hpnicfLIIPStreamDestAddr	1.3.6.1.4.1.11.2.14.11.15.2.111.2.1.1.1.3	InetAddress	read-write	The Destination address used in packet selection. This address will be consistent with the type specified in hpnicfLIIPStreamAddrType.
ADR hpnicfLIIPStreamDestAddrLength	1.3.6.1.4.1.11.2.14.11.15.2.111.2.1.1.1.4	InetAddressPrefixLength	read-write	The length of the Destination Prefix. A value of zero means all addresses to match. This prefix length will be consistent with the type specified in hpnicfLIIPStreamAddrType.
IP hpnicfLIIPStreamSrcAddr	1.3.6.1.4.1.11.2.14.11.15.2.111.2.1.1.1.5	InetAddress	read-write	The Source Address used in packet selection. This address will be consistent with the type specified in hpnicfLIIPStreamAddrType.
ADR hpnicfLIIPStreamSrcAddrLength	1.3.6.1.4.1.11.2.14.11.15.2.111.2.1.1.1.6	InetAddressPrefixLength	read-write	The length of the Source Prefix. A value of zero means all addresses to match. This prefix length will be consistent with the type specified in hpnicfLIIPStreamAddrType.
I32 hpnicfLIIPStreamTosByte	1.3.6.1.4.1.11.2.14.11.15.2.111.2.1.1.1.7	Integer32	read-write	The value of the TOS byte. If hpnicfLIIPStreamTosByte&(~hpnicfLIIPStreamTosByteMask)!=0, configuration is rejected.
I32 hpnicfLIIPStreamTosByteMask	1.3.6.1.4.1.11.2.14.11.15.2.111.2.1.1.1.8	Integer32	read-write	This value is ANDed with the value of the TOS byte in a packet and compared with hpnicfLIIPStreamTosByte. If the values are equal, the comparison is equal. If both the mask and the TosByte value are zero, the result is to always accept.
I32 hpnicfLIIPStreamFlowId	1.3.6.1.4.1.11.2.14.11.15.2.111.2.1.1.1.9	Integer32	read-write	The flow identifier in an IPv6 header. -1 indicates that the Flow Id is unused.
I32 hpnicfLIIPStreamProtocol	1.3.6.1.4.1.11.2.14.11.15.2.111.2.1.1.1.10	Integer32	read-write	The IP protocol to match against the IPv4 protocol number or the IPv6 Next- Header number in the packet.
INE hpnicfLIIPStreamDestL4PortMin	1.3.6.1.4.1.11.2.14.11.15.2.111.2.1.1.1.11	InetPortNumber	read-write	The minimum value that the layer-4 destination port number in the packet must have in order to match. This value must be equal to or less than the value specified for this entry in hpnicfLIIPStreamDestL4PortMax. If both hpnicfLIIPStreamDestL4PortMin and hpnicfLIIPStreamDestL4PortMax are at their default values, the port number is effectively unused. If hpnicfLIIPStreamDestL4PortMin is equal to hpnicfLIIPStreamDestL4PortMax, only one port number to be intercepted.
INE hpnicfLIIPStreamDestL4PortMax	1.3.6.1.4.1.11.2.14.11.15.2.111.2.1.1.1.12	InetPortNumber	read-write	The maximum value that the layer-4 destination port number in the packet must have in order to match this classifier entry. This value must be equal to or greater than the value specified for this entry in hpnicfLIIPStreamDestL4PortMin. If both hpnicfLIIPStreamDestL4PortMin and hpnicfLIIPStreamDestL4PortMax are at their default values, the port number is effectively unused. If hpnicfLIIPStreamDestL4PortMin is equal to hpnicfLIIPStreamDestL4PortMax, only one port number to be intercepted.
INE hpnicfLIIPStreamSrcL4PortMin	1.3.6.1.4.1.11.2.14.11.15.2.111.2.1.1.1.13	InetPortNumber	read-write	The minimum value that the layer-4 destination port number in the packet must have in order to match. This value must be equal to or less than the value specified for this entry in hpnicfLIIPStreamSrcL4PortMax. If both hpnicfLIIPStreamSrcL4PortMin and hpnicfLIIPStreamSrcL4PortMax are at their default values, the port number is effectively unused. If hpnicfLIIPStreamSrcL4PortMin is equal to hpnicfLIIPStreamSrcL4PortMax, only one port number to be intercepted.
INE hpnicfLIIPStreamSrcL4PortMax	1.3.6.1.4.1.11.2.14.11.15.2.111.2.1.1.1.14	InetPortNumber	read-write	The maximum value that the layer-4 destination port number in the packet must have in order to match this classifier entry. This value must be equal to or greater than the value specified for this entry in hpnicfLIIPStreamSrcL4PortMin. If both hpnicfLIIPStreamSrcL4PortMin and hpnicfLIIPStreamSrcL4PortMax are at their default values, the port number is effectively unused. If hpnicfLIIPStreamSrcL4PortMin is equal to hpnicfLIIPStreamSrcL4PortMax, only one port number to be intercepted.
STR hpnicfLIIPStreamVRF	1.3.6.1.4.1.11.2.14.11.15.2.111.2.1.1.1.15	SnmpAdminString	read-write	It is the name of a Virtual Routing and Forwarding (VRF) of a VPN.
ROW hpnicfLIIPStreamRowStatus	1.3.6.1.4.1.11.2.14.11.15.2.111.2.1.1.1.18	RowStatus	read-create	Operation status of this table entry.
hpnicfLIMACStream	1.3.6.1.4.1.11.2.14.11.15.2.111.3
hpnicfLIMACStreamObjects	1.3.6.1.4.1.11.2.14.11.15.2.111.3.1
hpnicfLIMACStreamTable	1.3.6.1.4.1.11.2.14.11.15.2.111.3.1.1		not-accessible	This table lists the IEEE 802 streams to be intercepted. It is associated with hpnicfLIMediationTable and hpnicfLIStreamTable.
hpnicfLIMACStreamEntry	1.3.6.1.4.1.11.2.14.11.15.2.111.3.1.1.1		not-accessible	A single stream to be intercepted. The first index indicates the Mediation Device. The second index is that of the stream's counter entry in the hpnicfLIStreamTable. The second index permits multiple classifiers to be used together, such as having an MAC address as source or destination.
BIT hpnicfLIMACStreamFields	1.3.6.1.4.1.11.2.14.11.15.2.111.3.1.1.1.1	Bits	read-write	This object displays what attributes will be compared to identify traffic. interface: indicates that traffic on the stated interface is to be intercepted dstMacAddress: indicates that traffic destined to a given address should be intercepted srcMacAddress: indicates that traffic sourced from a given address should be intercepted ethernetPid: indicates that traffic with a stated Ethernet Protocol Identifier should be intercepted dSap: indicates that traffic with an certain 802.2 LLC Destination SAP should be intercepted sSap: indicates that traffic with an certain 802.2 LLC Source SAP should be intercepted At least one of the bits has to be set in order to activate an entry. If multiple bits are set, traffic to be intercepted must be satisfied with all set attributes.
NUM hpnicfLIMACStreamInterface	1.3.6.1.4.1.11.2.14.11.15.2.111.3.1.1.1.2	InterfaceIndexOrZero	read-write	Traffic received or transmitted over this interface will be intercepted. This value must be set when creating a stream entry, either zero, or a valid interface index. If the value is zero, interception accepts any interface. Additional parameter must be selected together.
MAC hpnicfLIMACStreamDestAddr	1.3.6.1.4.1.11.2.14.11.15.2.111.3.1.1.1.3	MacAddress	read-write	The Destination address used in packet selection.
MAC hpnicfLIMACStreamSrcAddr	1.3.6.1.4.1.11.2.14.11.15.2.111.3.1.1.1.4	MacAddress	read-write	The Source Address used in packet selection.
U32 hpnicfLIMACStreamEthPid	1.3.6.1.4.1.11.2.14.11.15.2.111.3.1.1.1.5	Unsigned32	read-write	The value of the Ethernet Protocol Identifier in the Ethernet traffic or IEEE 802.2 SNAP traffic.
U32 hpnicfLIMACStreamDSap	1.3.6.1.4.1.11.2.14.11.15.2.111.3.1.1.1.6	Unsigned32	read-write	The value of the IEEE 802.2 Destination SAP.
U32 hpnicfLIMACStreamSSap	1.3.6.1.4.1.11.2.14.11.15.2.111.3.1.1.1.7	Unsigned32	read-write	The value of the IEEE 802.2 Source SAP.
ROW hpnicfLIMACStreamRowStatus	1.3.6.1.4.1.11.2.14.11.15.2.111.3.1.1.1.8	RowStatus	read-create	Operation status of this table entry.
hpnicfLIUserStream	1.3.6.1.4.1.11.2.14.11.15.2.111.4
hpnicfLIUserStreamObjects	1.3.6.1.4.1.11.2.14.11.15.2.111.4.1
hpnicfLIUserStreamTable	1.3.6.1.4.1.11.2.14.11.15.2.111.4.1.1		not-accessible	This table lists the user connection streams to be intercepted. It is associated with hpnicfLIMediationTable and hpnicfLIStreamTable.
hpnicfLIUserStreamEntry	1.3.6.1.4.1.11.2.14.11.15.2.111.4.1.1.1		not-accessible	A single stream to be intercepted. The first index indicates the Mediation Device. The second index is that of the stream's counter entry in the hpnicfLIStreamTable. This permits multiple classifiers to be used together.
OCT hpnicfLIUserStreamAcctSessID	1.3.6.1.4.1.11.2.14.11.15.2.111.4.1.1.1.1	OCTET STRING	read-write	This is the RADIUS attribute 44 acct-session-ID. The string must be set, and the length not be zero.
ROW hpnicfLIUserStreamRowStatus	1.3.6.1.4.1.11.2.14.11.15.2.111.4.1.1.1.2	RowStatus	read-create	Operation status of this table entry.

RFC description

HP/HPE Intelligent Managed Networking (ICF) MIB defining lawful interception (LI) capabilities for network devices.

Start monitoring HP/H3C Comware carrier-grade router (Lawful Interception mediation) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download HPN-ICF-LI-MIB