HUAWEI-ATK-MIB

All MIBs › HUAWEI-ATK-MIB

Organization: Huawei Technologies co.,Ltd.

Last Updated: 2003-04-11

Category: Domain: Security, VPN and Security, Vendor: Huawei

Description: Huawei attack detection and defense MIB for monitoring and configuring protection against DoS/DDoS attacks, scanning, and flooding threats.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is HUAWEI-ATK-MIB?

HUAWEI-ATK-MIB is a Huawei Technologies proprietary MIB managing Attack Defence (ATCKDF), a suite of protections against common network-layer attacks, across Huawei's product line. Its objects are per-attack-type enable switches — IP spoofing, LAND, Smurf, Fraggle, WinNuke, ICMP redirect/unreachable, source-route, route-record, traceroute, TCP-flag, ping-of-death, teardrop, fragment-flag — alongside IP-sweep and port-scan detection with configurable speed/blacklist-time thresholds, large-ICMP detection with a length threshold, and SYN/UDP/ICMP flood protection. As a configuration/security MIB it lets an administrator confirm which specific attack defenses are enabled and their detection thresholds. It is deployed on Huawei routers/switches/firewalls. Engineers can download the HUAWEI-ATK-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in HUAWEI-ATK-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Huawei routers/switches/firewalls

Monitoring Examples

An administrator checks hwAtkSynFloodSw and hwAtkPortScanSpeed to confirm SYN-flood protection and port-scan detection thresholds are enabled as intended on a Huawei device facing the internet.

What Can Be Monitored

per-attack-type defense enable state and detection thresholds

Imported Objects

From HUAWEI-MIB

hwDatacomm

OBJECT-IDENTITY

From MPLS-VPN-MIB

mplsVpnVrfName

OBJECT-TYPE

From SNMPv2-CONF

OBJECT-GROUP

From SNMPv2-SMI

Integer32
IpAddress
MODULE-IDENTITY
OBJECT-TYPE

From SNMPv2-TC

RowStatus
TruthValue

OIDs

OID symbolic	OID numeric	Type	Access	Description
hwATK	1.3.6.1.4.1.2011.5.25.10
hwATKComm	1.3.6.1.4.1.2011.5.25.10.1			V1.00 The HUAWEI-ATK-MIB contains objects to manage the ATCKDF(Attack Defence) configuration for all products.
hwAtkGlobalMibObjects	1.3.6.1.4.1.2011.5.25.10.1.1
T/F hwAtkIpSpoofingSw	1.3.6.1.4.1.2011.5.25.10.1.1.1	TruthValue	read-write	The switch indicates whether inspecting IP spoofing attack.
T/F hwAtkLandSw	1.3.6.1.4.1.2011.5.25.10.1.1.2	TruthValue	read-write	The switch indicates whether inspecting Land attack.
T/F hwAtkSmurfSw	1.3.6.1.4.1.2011.5.25.10.1.1.3	TruthValue	read-write	The switch indicates whether inspecting Smurf attack.
T/F hwAtkFraggleSw	1.3.6.1.4.1.2011.5.25.10.1.1.4	TruthValue	read-write	The switch indicates whether inspecting Fraggle attack.
T/F hwAtkWinNukeSw	1.3.6.1.4.1.2011.5.25.10.1.1.5	TruthValue	read-write	The switch indicates whether inspecting WinNuke attack.
T/F hwAtkIcmpRedirectSw	1.3.6.1.4.1.2011.5.25.10.1.1.6	TruthValue	read-write	The switch indicates whether blocking ICMP re-direction packets.
T/F hwAtkIcmpUnReachSw	1.3.6.1.4.1.2011.5.25.10.1.1.7	TruthValue	read-write	The switch indicates whether blocking ICMP unreachable packets.
T/F hwAtkSourceRouteSw	1.3.6.1.4.1.2011.5.25.10.1.1.8	TruthValue	read-write	The switch indicates whether blocking packets with source route option.
T/F hwAtkRouteRecordSw	1.3.6.1.4.1.2011.5.25.10.1.1.9	TruthValue	read-write	The switch indicates whether blocking packets with route record option.
T/F hwAtkTracertSw	1.3.6.1.4.1.2011.5.25.10.1.1.10	TruthValue	read-write	The switch indicates whether blocking packets of tracert.
T/F hwAtkTcpFlagSw	1.3.6.1.4.1.2011.5.25.10.1.1.11	TruthValue	read-write	The switch indicates whether inspecting the flag of TCP packets.
T/F hwAtkPingOfDeathSw	1.3.6.1.4.1.2011.5.25.10.1.1.12	TruthValue	read-write	The switch indicates whether inspecting ping-of-death attack.
T/F hwAtkTeardropSw	1.3.6.1.4.1.2011.5.25.10.1.1.13	TruthValue	read-write	The switch indicates whether inspecting teardrop attack.
T/F hwAtkFragFlagSw	1.3.6.1.4.1.2011.5.25.10.1.1.14	TruthValue	read-write	The switch indicates whether inspecting the flag for fragment.
T/F hwAtkIPSweepSw	1.3.6.1.4.1.2011.5.25.10.1.1.15	TruthValue	read-write	The switch indicates whether inspecting IP sweep attack.
I32 hwAtkIpSweepSpeed	1.3.6.1.4.1.2011.5.25.10.1.1.16	Integer32	read-write	The maximum speed of IP sweeping.
I32 hwAtkIPSweepBlsTime	1.3.6.1.4.1.2011.5.25.10.1.1.17	Integer32	read-write	The time to add a host to blacklist when find it is sweeping.
T/F hwAtkPortScanSw	1.3.6.1.4.1.2011.5.25.10.1.1.18	TruthValue	read-write	The switch indicates whether inspecting port scan attack.
I32 hwAtkPortScanSpeed	1.3.6.1.4.1.2011.5.25.10.1.1.19	Integer32	read-write	The maximum speed of port scanning.
I32 hwAtkPortScanBlsTime	1.3.6.1.4.1.2011.5.25.10.1.1.20	Integer32	read-write	The time to add a host to blacklist when find it is scanning port.
T/F hwAtkLargeIcmpSw	1.3.6.1.4.1.2011.5.25.10.1.1.21	TruthValue	read-write	The switch indicates whether blocking large icmp packets.
I32 hwAtkIcmpLength	1.3.6.1.4.1.2011.5.25.10.1.1.22	Integer32	read-write	The maximum length of ICMP packets allowed to pass the system.
T/F hwAtkSynFloodSw	1.3.6.1.4.1.2011.5.25.10.1.1.23	TruthValue	read-write	The switch indicates whether inspecting SYN flooding attack.
T/F hwAtkUdpFloodSw	1.3.6.1.4.1.2011.5.25.10.1.1.24	TruthValue	read-write	The switch indicates whether inspecting UDP flooding attack.
T/F hwAtkIcmpFloodSw	1.3.6.1.4.1.2011.5.25.10.1.1.25	TruthValue	read-write	The switch indicates whether inspecting ICMP flooding attack.
hwAtkIPMibObjects	1.3.6.1.4.1.2011.5.25.10.1.2
hwAtkSynFloodIPTable	1.3.6.1.4.1.2011.5.25.10.1.2.1		not-accessible	The table define the parameters of SYN flood defence for hosts.
hwAtkSynFloodIPEntry	1.3.6.1.4.1.2011.5.25.10.1.2.1.1		not-accessible
IP hwAtkSynFloodIP	1.3.6.1.4.1.2011.5.25.10.1.2.1.1.1	IpAddress	not-accessible	The IP address of host to be protected.
I32 hwAtkIPSynFloodSynSpeed	1.3.6.1.4.1.2011.5.25.10.1.2.1.1.2	Integer32	read-create	The maximum speed of SYN packets to the host. when the speed of SYN packets to the host reach the maximum, system will start the TCP proxy.
I32 hwAtkIPSynFloodHalfMax	1.3.6.1.4.1.2011.5.25.10.1.2.1.1.3	Integer32	read-create	The maximum incomplete connection for the host.
I32 hwAtkIPSynFloodHalfAge	1.3.6.1.4.1.2011.5.25.10.1.2.1.1.4	Integer32	read-create	The age of TCP incomplete connections.
INT hwAtkIPSynFloodProxy	1.3.6.1.4.1.2011.5.25.10.1.2.1.1.5	INTEGER	read-create	The switch of TCP proxy, this switch decides the action of proxy. The switch has three status: auto, on, off.
ROW hwAtkIPSynFloodStatus	1.3.6.1.4.1.2011.5.25.10.1.2.1.1.6	RowStatus	read-create	The status of a row, can be CreateAndGo or Destroy currently.
hwAtkUdpFloodIPTable	1.3.6.1.4.1.2011.5.25.10.1.2.2		not-accessible	The table define the parameters of UDP flood defence for hosts.
hwAtkUdpFloodIPEntry	1.3.6.1.4.1.2011.5.25.10.1.2.2.1		not-accessible
IP hwAtkUdpFloodIP	1.3.6.1.4.1.2011.5.25.10.1.2.2.1.1	IpAddress	not-accessible	The IP address of host to be protected.
I32 hwAtkIPUdpFloodSpeed	1.3.6.1.4.1.2011.5.25.10.1.2.2.1.2	Integer32	read-create	The maximum speed of UDP packets to the host. when the speed of UDP packets to the host reach the maximum, system will drop the subsequent UDP packets to this host, until the speed decline to 80 percent of the maximum.
ROW hwAtkIPUdpFloodStatus	1.3.6.1.4.1.2011.5.25.10.1.2.2.1.3	RowStatus	read-create	The status of a row, can be CreateAndGo or Destroy currently.
hwAtkIcmpFloodIPTable	1.3.6.1.4.1.2011.5.25.10.1.2.3		not-accessible	The table define the parameters of ICMP flood defence for hosts.
hwAtkIcmpFloodIPEntry	1.3.6.1.4.1.2011.5.25.10.1.2.3.1		not-accessible
IP hwAtkIcmpFloodIP	1.3.6.1.4.1.2011.5.25.10.1.2.3.1.1	IpAddress	not-accessible	The IP address of host to be protected.
I32 hwAtkIPIcmpFloodSpeed	1.3.6.1.4.1.2011.5.25.10.1.2.3.1.2	Integer32	read-create	The maximum speed of ICMP packets to the host. when the speed of ICMP packets to the host reach the maximum, system will drop the subsequent ICMP packets to this host, until the speed decline to 80 percent of the maximum.
ROW hwAtkIPIcmpFloodStatus	1.3.6.1.4.1.2011.5.25.10.1.2.3.1.3	RowStatus	read-create	The status of a row, can be CreateAndGo or Destroy currently.
hwAtkCommConformance	1.3.6.1.4.1.2011.5.25.10.1.3
hwAtkCommCompliance	1.3.6.1.4.1.2011.5.25.10.1.3.1
hwAtkCommMibGroups	1.3.6.1.4.1.2011.5.25.10.1.3.2
hwAtkGlobalCfgGroup	1.3.6.1.4.1.2011.5.25.10.1.3.2.1			Description.
hwAtkCommSynFloodGroup	1.3.6.1.4.1.2011.5.25.10.1.3.2.2			Description.
hwAtkCommUdpFloodGroup	1.3.6.1.4.1.2011.5.25.10.1.3.2.3			Description.
hwAtkCommIcmpFloodGroup	1.3.6.1.4.1.2011.5.25.10.1.3.2.4			Description.

RFC description

Huawei Attack Defence MIB for configuring and monitoring attack defense mechanisms on firewalls and routers.

Start monitoring Huawei router, switch, or firewall (Attack Defence) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download HUAWEI-ATK-MIB

What Is HUAWEI-ATK-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description