HUAWEI-NDEC-MIB

All MIBs › HUAWEI-NDEC-MIB

Organization: HUAWEI Technologies Co., Ltd.

Last Updated: 2004-09-15

Category: IP and Core Protocols, Technology: IPv6, Vendor: Huawei

Description: Huawei NDEC (Neighbor Discovery Exception Control) MIB for managing ND attack defense and exception packet processing.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is HUAWEI-NDEC-MIB?

HUAWEI-NDEC-MIB (Neighbor Discovery Exception Control) is a Huawei security MIB that manages defense against IPv6 Neighbor Discovery-based attacks and exception-packet handling on Huawei routers and switches. It exposes a table of defense/security-association-style entries covering peer IP address, protocol, SPI, encryption and authentication algorithm, and association lifetime, scoped per interface card, plus a notification group for ND exceptions. Its monitoring value is primarily security/software status: tracking how much lifetime (in bytes or seconds) remains on an active defense association and watching for exception traps reveals an ongoing or attempted ND-based attack, and per-card association counts show how the defense load is distributed across hardware. It reuses IPsec-style security-association concepts (SPI, encryption/auth algorithm, lifetime) applied here to ND exception control rather than to a true IPsec tunnel. It is typically deployed on Huawei routers and switches at network edges exposed to IPv6 hosts, where ND spoofing or flooding attacks are a concern. Network engineers evaluating or troubleshooting this functionality can download the HUAWEI-NDEC-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in HUAWEI-NDEC-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Huawei routers and switches with IPv6 Neighbor Discovery attack-defense capability

Monitoring Examples

An operator would poll hipsNDECSAListTable/hipsNDECSAListEntry, checking hipsPeerIpAddr, hipsEncAlgorithm, and hipsAuthAlgorithm for a given defense entry, then read hipsSaLifeKBytes and hipsSaLifeSecond to see how much of that entry's lifetime remains before it must be renegotiated. Watching hipsByCard shows whether defense associations are concentrated unevenly on one interface card, which could indicate that card is the target of an attack. A trap raised via hipsNDECLeaf/hipsTraps signals that an ND exception packet was detected and handled, which the operator would correlate with the affected peer's entry.

What Can Be Monitored

ND defense association list
peer IP address per association
encryption/authentication algorithm in use
association lifetime remaining (bytes/seconds)
per-card association distribution
ND exception trap events

Imported Objects

From HUAWEI-3COM-OID-MIB

mlsr	OBJECT-IDENTITY

From SNMPv2-SMI

Counter32
Gauge32
Integer32
IpAddress
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DisplayString
TruthValue

How to Use in IPNetwork Monitor

Example using hipsInPac OID:

Select a Huawei router or switch with IPv6 ND attack-defense capability as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type hipsInPac into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. It reports the total packets of the NDEC recieved. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
huaweiNDEC	1.3.6.1.4.1.2011.2.33.2			This MIB contains objects to manage the NDEC device.
hipsNDECSAListTable	1.3.6.1.4.1.2011.2.33.2.1		not-accessible	The table containing the list of all SA entries configured on NDEC by the operator.
hipsNDECSAListEntry	1.3.6.1.4.1.2011.2.33.2.1.1		not-accessible	Each entry contains the attributes associated with a single NDEC'S SA entry.
IP hipsPeerIpAddr	1.3.6.1.4.1.2011.2.33.2.1.1.1	IpAddress	read-only	The peer IP address of this SA entry.
INT hipsProtocol	1.3.6.1.4.1.2011.2.33.2.1.1.2	INTEGER	read-only	The Protocol of this SA entry.
G32 hipsSPI	1.3.6.1.4.1.2011.2.33.2.1.1.3	Gauge32	read-only	The SPI of this SA entry.
INT hipsEncAlgorithm	1.3.6.1.4.1.2011.2.33.2.1.1.4	INTEGER	read-only	The encrypt algorithm of this SA entry.
INT hipsAuthAlgorithm	1.3.6.1.4.1.2011.2.33.2.1.1.5	INTEGER	read-only	The authentication algorithm of this SA entry.
IP hipsLocalIpAddr	1.3.6.1.4.1.2011.2.33.2.1.1.6	IpAddress	read-only	The local IP address of this SA entry.
G32 hipsSaLifeKBytes	1.3.6.1.4.1.2011.2.33.2.1.1.7	Gauge32	read-only	The lifetime of this SA entry in bytes.
G32 hipsSaLifeSecond	1.3.6.1.4.1.2011.2.33.2.1.1.8	Gauge32	read-only	The lifetime of this SA entry in seconds.
T/F hipsByCard	1.3.6.1.4.1.2011.2.33.2.1.1.9	TruthValue	read-only	The flag of this SA on NDEC or not.
INT hipsNegotiateSaMode	1.3.6.1.4.1.2011.2.33.2.1.1.10	INTEGER	read-only	The type of key used by the IPSec Phase-2 Tunnel.
G32 hipsExpBytes	1.3.6.1.4.1.2011.2.33.2.1.1.11	Gauge32	read-only	This object specifies the lifetime in bytes of the tunnels generated using this policy specification.
G32 hipsSoftBytes	1.3.6.1.4.1.2011.2.33.2.1.1.12	Gauge32	read-only	This object specifies the lifetime in bytes of the tunnels generated using this policy specification.
G32 hipsExpTimeout	1.3.6.1.4.1.2011.2.33.2.1.1.13	Gauge32	read-only	This object specifies the lifetime in seconds of the tunnels generated using this policy specification.
G32 hipsSoftTimeout	1.3.6.1.4.1.2011.2.33.2.1.1.14	Gauge32	read-only	This object specifies the lifetime in seconds of the tunnels generated using this policy specification.
hikeSATable	1.3.6.1.4.1.2011.2.33.2.2		not-accessible	The table containing IKE SA entities configured on NDEC by the operator.
hikeSAEntry	1.3.6.1.4.1.2011.2.33.2.2.1		not-accessible	Each entry contains the attributes associated with a single IKE SA entity.
I32 hikeConnId	1.3.6.1.4.1.2011.2.33.2.2.1.1	Integer32	read-only	The identifier of IKE SA connection.
IP hikePeerIpAddr	1.3.6.1.4.1.2011.2.33.2.2.1.2	IpAddress	read-only	The peer IP address of this IKE SA.
STR hikeFlag	1.3.6.1.4.1.2011.2.33.2.2.1.3	DisplayString	read-only	The status of this IKE SA.
INT hikePhase	1.3.6.1.4.1.2011.2.33.2.2.1.4	INTEGER	read-only	The phase of this IKE SA.
INT hikeDoi	1.3.6.1.4.1.2011.2.33.2.2.1.5	INTEGER	read-only	The domain of this IKE SA
T/F hikeClearSA	1.3.6.1.4.1.2011.2.33.2.2.1.6	TruthValue	read-write	Clear this IKE SA or not.
hipsIKEPolicyTable	1.3.6.1.4.1.2011.2.33.2.3		not-accessible	List of all ISAKMP policy entries.
hipsIKEPolicyEntry	1.3.6.1.4.1.2011.2.33.2.3.1		not-accessible	Each entry includes the properties of a ISAKMP Policy entry.
I32 hipsIsakmpPolPriority	1.3.6.1.4.1.2011.2.33.2.3.1.1	Integer32	read-only	ISAKMP Policy entry's priority.
INT hipsIsakmpPolEncr	1.3.6.1.4.1.2011.2.33.2.3.1.2	INTEGER	read-only	The specified encryption transform. It is used by Internet Key Exchange(IKE) tunnels to protect the ISAKMP PDUs.
INT hipsIsakmpPolHash	1.3.6.1.4.1.2011.2.33.2.3.1.3	INTEGER	read-only	The specified hash transform. It is used by Internet Key Exchange(IKE) tunnels to protect the ISAKMP PDUs.
INT hipsIsakmpPolAuth	1.3.6.1.4.1.2011.2.33.2.3.1.4	INTEGER	read-only	The specified peer authentication method. The local entity would authenticate the peer using the method specified by this object when this policy entity is selected to negotiate with a peer.
INT hipsIsakmpPolGroup	1.3.6.1.4.1.2011.2.33.2.3.1.5	INTEGER	read-only	This object is used to specify the Oakley group which is used for Diffie Hellman exchange in the Main Mode. The local entity selects the group specified by this object to perform Diffie Hellman exchange with the peer when this policy item is chosen to negotiate the Main Mode with an IKE peer.
G32 hipsIsakmpPolLifetime	1.3.6.1.4.1.2011.2.33.2.3.1.6	Gauge32	read-only	This object indicates the lifetime of the IKE tunnels in seconds.
hipsStaticCryptomapTable	1.3.6.1.4.1.2011.2.33.2.4		not-accessible	The table includes the list of the member cryptomaps of the cryptomap sets which are set on the specific entity.
hipsStaticCryptomapEntry	1.3.6.1.4.1.2011.2.33.2.4.1		not-accessible	Each entry contains properites of a single static cryptomap entry. The members of dynamic cryptomap sets, which may be linked with the parent static cryptomap set, are not included in this table.
STR hipsStaticCryptomapName	1.3.6.1.4.1.2011.2.33.2.4.1.1	DisplayString	read-only	The name of the cryptomap entry in the cryptomap set. This is the first index component of this table.
I32 hipsStaticCryptomapSN	1.3.6.1.4.1.2011.2.33.2.4.1.2	Integer32	read-only	The sequence number of the cryptomap entry in the cryptomap set. This is the second index component of this table.
INT hipsStaticCryptomapNegMode	1.3.6.1.4.1.2011.2.33.2.4.1.3	INTEGER	read-only	Type of the cryptomap entry. This object may be an ISAKMP cryptomap or manual.
INT hipsStaticCryptomapMatchAddr	1.3.6.1.4.1.2011.2.33.2.4.1.4	INTEGER	read-only	The access list number entered by the operatoir while creating this cryptomap.
IP hipsStaticCryptomapPeerIpAddr	1.3.6.1.4.1.2011.2.33.2.4.1.5	IpAddress	read-only	The IP address of the current peer. Traffic protected by this cryptomap is protected by a tunnel terminating at the device whose IP address is the value of this object.
STR hipsStaticCryptomapTransforName	1.3.6.1.4.1.2011.2.33.2.4.1.6	DisplayString	read-only	The transform associated with this cryptomap entry.
G32 hipsStaticCryptomapLifetime	1.3.6.1.4.1.2011.2.33.2.4.1.7	Gauge32	read-only	This object indicates the lifetime of the IPSec SA which is created using this IPSec policy entry.
G32 hipsStaticCryptomapLifesize	1.3.6.1.4.1.2011.2.33.2.4.1.8	Gauge32	read-only	This object identifies the lifesize of the IPSec SAs generated using this IPSec policy entry. Lifesize means maximum traffic in bytes that may be carried.
IP hipsStaticCryptomapLocalIpAddr	1.3.6.1.4.1.2011.2.33.2.4.1.9	IpAddress	read-only	The value of this object is the local IP address of the IPSec SAs generated using this IPSec policy entry.
STR hipsIfNameUsed	1.3.6.1.4.1.2011.2.33.2.4.1.10	DisplayString	read-only	This object indicates the name of the interface which uses this IPSec policy entry.
G32 hipsInAHSPI	1.3.6.1.4.1.2011.2.33.2.4.1.11	Gauge32	read-only	This object indicates the inbound AH SPI IPSec SAs generated using this IPSec policy entry.
G32 hipsInESPSPI	1.3.6.1.4.1.2011.2.33.2.4.1.12	Gauge32	read-only	This object indicates the inbound ESP SPI IPSec SAs generated using this IPSec policy entry.
G32 hipsOutAHSPI	1.3.6.1.4.1.2011.2.33.2.4.1.13	Gauge32	read-only	This object indicates the outbound AH SPI IPSec SAs generated using this IPSec policy entry.
G32 hipsOutESPSPI	1.3.6.1.4.1.2011.2.33.2.4.1.14	Gauge32	read-only	This object indicates the outbound ESP SPI IPSec SAs generated using this IPSec policy entry.
STR hipsInAhHexKeyString	1.3.6.1.4.1.2011.2.33.2.4.1.15	DisplayString	read-only	This object indicates the inbound AH authentication key IPSec SAs generated using this IPSec policy entry. The AH authentication key is in hex.
STR hipsInEspCipherHexKeyString	1.3.6.1.4.1.2011.2.33.2.4.1.16	DisplayString	read-only	This object indicates the inbound ESP authentication key IPSec SAs generated using this IPSec policy entry. The ESP authentication key is hex.
STR hipsInEspAuthenHexKeyString	1.3.6.1.4.1.2011.2.33.2.4.1.17	DisplayString	read-only	This object indicates the inbound ESP authentication key IPSec SAs generated using this IPSec policy entry. The ESP authentication key is hex.
STR hipsInAhStringKeyString	1.3.6.1.4.1.2011.2.33.2.4.1.18	DisplayString	read-only	This object indicates the inbound ESP authentication key IPSec SAs generated using this IPSec policy entry. The key is in string.
STR hipsInEspStringKeyString	1.3.6.1.4.1.2011.2.33.2.4.1.19	DisplayString	read-only	This object indicates the inbound ESP authentication key IPSec SAs generated using this IPSec policy entry. The key is in string.
STR hipsOutAhHexKeyString	1.3.6.1.4.1.2011.2.33.2.4.1.20	DisplayString	read-only	This object indicates the outbound AH authentication key IPSec SAs generated using this IPSec policy entry. The key is in hex.
STR hipsOutEspCipherHexKeyString	1.3.6.1.4.1.2011.2.33.2.4.1.21	DisplayString	read-only	This object indicates the outbound ESP authentication key IPSec SAs generated using this IPSec policy entry. The key is in hex.
STR hipsOutEspAuthenHexKeyString	1.3.6.1.4.1.2011.2.33.2.4.1.22	DisplayString	read-only	This object indicates the outbound ESP authentication key IPSec SAs generated using this IPSec policy entry. The key is in hex.
STR hipsOutAhStringKeyString	1.3.6.1.4.1.2011.2.33.2.4.1.23	DisplayString	read-only	This object indicates the outbound AH authentication key IPSec SAs generated using this IPSec policy entry. The key is in string.
STR hipsOutEspStringKeyString	1.3.6.1.4.1.2011.2.33.2.4.1.24	DisplayString	read-only	This object indicates the outbound ESP authentication key IPSec SAs generated using this IPSec policy entry. The key is in string.
hipsTransformNameSetTable	1.3.6.1.4.1.2011.2.33.2.5		not-accessible	Transform set table.
hipsTransformNameSetEntry	1.3.6.1.4.1.2011.2.33.2.5.1		not-accessible	Each entry refers to properties of a transform.
STR hipsTransformName	1.3.6.1.4.1.2011.2.33.2.5.1.1	DisplayString	read-only	Name of the transform entry.
INT hipsTransformMode	1.3.6.1.4.1.2011.2.33.2.5.1.2	INTEGER	read-only	Mode of the transform entry.
INT hipsTransformProtocol	1.3.6.1.4.1.2011.2.33.2.5.1.3	INTEGER	read-only	Transform protocol.
INT hipsAH	1.3.6.1.4.1.2011.2.33.2.5.1.4	INTEGER	read-only	Algorithm of AH protocol.
INT hipsEespEn	1.3.6.1.4.1.2011.2.33.2.5.1.5	INTEGER	read-only	Encryption algorithm of ESP protocol.
INT hipsEspAu	1.3.6.1.4.1.2011.2.33.2.5.1.6	INTEGER	read-only	Authentication algorithm of ESP protocol.
T/F hipsIsCardTransform	1.3.6.1.4.1.2011.2.33.2.5.1.7	TruthValue	read-only	This object indicates the flag of the NDEC is used for IPSec SAs generated using this IPSec policy entry.
hipsNDECInfoTable	1.3.6.1.4.1.2011.2.33.2.6		not-accessible	Table of NDEC set.
hipsNDECInfoEntry	1.3.6.1.4.1.2011.2.33.2.6.1		not-accessible	Properties of each NDEC.
INT hipsCardSlot	1.3.6.1.4.1.2011.2.33.2.6.1.1	INTEGER	read-only	Slot number of NDEC .
C32 hipsInPacEx	1.3.6.1.4.1.2011.2.33.2.6.1.2	Counter32	read-only	Total packets of the NDEC recieved.
C32 hipsOutPac	1.3.6.1.4.1.2011.2.33.2.6.1.3	Counter32	read-only	Total packets of the NDEC sent.
C32 hipsInByte	1.3.6.1.4.1.2011.2.33.2.6.1.4	Counter32	read-only	Total bytes of the NDEC sent.
C32 hipsOutByte	1.3.6.1.4.1.2011.2.33.2.6.1.5	Counter32	read-only	Total bytes of the NDEC sent.
C32 hipsDropPac	1.3.6.1.4.1.2011.2.33.2.6.1.6	Counter32	read-only	Total packets of the NDEC dropped .
INT hipsCardStatus	1.3.6.1.4.1.2011.2.33.2.6.1.7	INTEGER	read-only	State of the NDEC.
STR hipsCardHardVer	1.3.6.1.4.1.2011.2.33.2.6.1.8	DisplayString	read-only	Hardware version of the NDEC.
STR hipsCardSoftVer	1.3.6.1.4.1.2011.2.33.2.6.1.9	DisplayString	read-only	Software version of the NDEC.
STR hipsCardCPLDVer	1.3.6.1.4.1.2011.2.33.2.6.1.10	DisplayString	read-only	CPLD version of the NDEC.
INT hipsCardOperate	1.3.6.1.4.1.2011.2.33.2.6.1.11	INTEGER	read-write	The version of the NDEC's CPLD. cardClearStatic(1): clear the statistics of the card cardReset(2): rest the card cardSynTime(3): synchoronize the clock of the card cardSysLogOn(4):turn on the log of the card cardSysLogOff(5):turn off the log of the card cardSysLogClear(6):clear the log of the card
G32 hipsDropPacInUnitTime	1.3.6.1.4.1.2011.2.33.2.6.1.12	Gauge32	read-only	Dropped packets in unit interval.
hipsNDECLeaf	1.3.6.1.4.1.2011.2.33.2.7
INT hipsNDECConnections	1.3.6.1.4.1.2011.2.33.2.7.1	INTEGER	read-only	Total connections of the system at this time.
INT hipsNDECBackup	1.3.6.1.4.1.2011.2.33.2.7.2	INTEGER	read-write	The flag that NDEC using backup. The value 1 represents using backup The value 0 represents not using backup
hipsTraps	1.3.6.1.4.1.2011.2.33.2.8
NTF hipsNDECNormalResetTrap	1.3.6.1.4.1.2011.2.33.2.8.1			This trap is generated when the NDEC card is reset.
NTF hipsNDECStateChangeTrap	1.3.6.1.4.1.2011.2.33.2.8.2			This trap is generated when the NDEC card's state changes.
NTF hipsNDECFlowTrap	1.3.6.1.4.1.2011.2.33.2.8.3			This trap is generated when a NDEC card is overloaded.

RFC description

NDEC security appliance management for IPsec configuration, encryption algorithms, and cryptomap settings.

Start monitoring Huawei router or switch with IPv6 ND attack-defense capability with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download HUAWEI-NDEC-MIB