HUAWEI-SECSTAT-MIB

All MIBs › HUAWEI-SECSTAT-MIB

Organization: Huawei Technologies co.,Ltd.

Last Updated: 2003-04-10

Category: Domain: Security, Vendor: Huawei

Description: Huawei security statistics MIB providing firewall session counts, attack detection counters, and traffic filtering statistics.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is HUAWEI-SECSTAT-MIB?

HUAWEI-SECSTAT-MIB is a Huawei enterprise MIB in the security domain, covering routers and firewalls that run Huawei's VRP (Versatile Routing Platform) software. It exposes security-related statistics such as firewall session counts, attack/intrusion detection counters, and traffic-filtering hit counts rather than device hardware inventory. Its primary monitoring value is software-level: it lets an operator watch the health of the security processing pipeline, seeing whether session tables are filling up, whether attack counters are incrementing abnormally, and whether filtering rules are being triggered at expected rates. It is a Huawei private-enterprise module and is typically used alongside HUAWEI-SECURITY-MIB, which defines the policies these statistics report against. Deployment context is enterprise or carrier edge routers/firewalls where security operations teams need real-time visibility into attack traffic and session-table pressure. Engineers can download the HUAWEI-SECSTAT-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in HUAWEI-SECSTAT-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Huawei router
Huawei firewall

Monitoring Examples

Since no concrete object list is available for this module, a realistic scenario is inferred from its stated purpose: an admin would poll session-count and attack-detection counters exposed under the security-statistics subtree to detect a spike in dropped or attacked sessions, which would indicate an ongoing DoS attempt or a misconfigured filtering policy. A sudden plateau in session counts near a configured maximum would reveal the firewall's session table approaching capacity.

What Can Be Monitored

firewall session count
attack detection counters
traffic filtering statistics
session table utilization

Imported Objects

From HUAWEI-MIB

hwDatacomm

OBJECT-IDENTITY

From SNMPv2-CONF

OBJECT-GROUP

From SNMPv2-SMI

Counter64
Integer32
MODULE-IDENTITY
OBJECT-TYPE

From SNMPv2-TC

TruthValue

How to Use in IPNetwork Monitor

Example using hwSecStatMonPeakSessSpeed OID:

Select a Huawei router or firewall running VRP (security statistics) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type hwSecStatMonPeakSessSpeed into the Find box to locate it in the OID tree, then select it and click OK. The maximun speed of session establishing since device startup. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter64-type OID, Value bounds is the most useful condition here — trigger an alert if the value climbs close to a level you consider a practical ceiling for this device, since a rising peak often signals sustained load growth worth planning capacity around. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
hwSECSTAT	1.3.6.1.4.1.2011.5.25.11
hwSECSTATCommon	1.3.6.1.4.1.2011.5.25.11.1			V1.00 The HUAWEI-SECSTAT-MIB contains objects to manage the security statistics for router and firewall product.
hwSecStatCfgObjects	1.3.6.1.4.1.2011.5.25.11.1.1
T/F hwSecStatGlobalStatEnable	1.3.6.1.4.1.2011.5.25.11.1.1.1	TruthValue	read-write	The status indicate whether enable the global statistics.
hwSecStatGlobalPktScale	1.3.6.1.4.1.2011.5.25.11.1.1.2
I32 hwSecStatTcpPktScale	1.3.6.1.4.1.2011.5.25.11.1.1.2.1	Integer32	read-write	The percent of TCP packets. The hwSecStatTcpPktScale + hwSecStatUdpPktScale + hwSecStatIcmpPktScale must less than 100
I32 hwSecStatUdpPktScale	1.3.6.1.4.1.2011.5.25.11.1.1.2.2	Integer32	read-write	The percent of UDP packets. The hwSecStatTcpPktScale + hwSecStatUdpPktScale + hwSecStatIcmpPktScale must less than 100
I32 hwSecStatIcmpPktScale	1.3.6.1.4.1.2011.5.25.11.1.1.2.3	Integer32	read-write	The percent of ICMP packets. The hwSecStatTcpPktScale + hwSecStatUdpPktScale + hwSecStatIcmpPktScale must less than 100
I32 hwSecStatAlteration	1.3.6.1.4.1.2011.5.25.11.1.1.2.4	Integer32	read-write	The proportion of change in the packets scale.
I32 hwSecStatCalcTime	1.3.6.1.4.1.2011.5.25.11.1.1.2.5	Integer32	read-write	The period of packet scale statistics, the unit is minute.
I32 hwSecStatPktScaleSetDefault	1.3.6.1.4.1.2011.5.25.11.1.1.2.6	Integer32	read-write	This OID is used for setting the packet scale configuration to default. When you want to set the value to default, set this OID to 1.
hwSecStatGlobalSessNum	1.3.6.1.4.1.2011.5.25.11.1.1.3
I32 hwSecStatTcpSessNumMax	1.3.6.1.4.1.2011.5.25.11.1.1.3.1	Integer32	read-write	The maximun number of TCP session allowed.
I32 hwSecStatTcpSessNumMin	1.3.6.1.4.1.2011.5.25.11.1.1.3.2	Integer32	read-write	The minimum of TCP session. when the number of TCP session in one system arrive the maximum allowed, system would decrease the TCP session by some method, once the number of tcp session in one system arrive the minumim, system would stop decreasing the TCP session.
I32 hwSecStatUdpSessNumMax	1.3.6.1.4.1.2011.5.25.11.1.1.3.3	Integer32	read-write	The maximun number of UDP session allowed.
I32 hwSecStatUdpSessNumMin	1.3.6.1.4.1.2011.5.25.11.1.1.3.4	Integer32	read-write	The minimum of UDP session. when the number of UDP session in one system arrive the maximum allowed, system would decrease the UDP session by some method, once the number of tcp session in one system arrive the minumim, system would stop decreasing the UDP session.
I32 hwSecStatGlobalSessSetDefault	1.3.6.1.4.1.2011.5.25.11.1.1.3.5	Integer32	read-write	This OID is used for setting the global session number configuration to default. When you want to set the value to default, set this OID to 1.
I32 hwSecStatIcmpSessNumMax	1.3.6.1.4.1.2011.5.25.11.1.1.3.6	Integer32	read-write	The maximun number of ICMP session allowed.
I32 hwSecStatIcmpSessNumMin	1.3.6.1.4.1.2011.5.25.11.1.1.3.7	Integer32	read-write	The minimum of ICMP session. when the number of ICMP session in one system arrive the maximum allowed, system would decrease the ICMP session by some method, once the number of ICMP session in one system arrive the minumim, system would stop decreasing the ICMP session.
I32 hwSecStatTcpProxySessNumMax	1.3.6.1.4.1.2011.5.25.11.1.1.3.8	Integer32	read-write	The maximun number of TcpProxy session allowed.
I32 hwSecStatTcpProxySessNumMin	1.3.6.1.4.1.2011.5.25.11.1.1.3.9	Integer32	read-write	The minimum of TcpProxy session. when the number of TcpProxy session in one system arrive the maximum allowed, system would decrease the TcpProxy session by some method, once the number of TcpProxy session in one system arrive the minumim, system would stop decreasing the TcpProxy session.
hwSecStatMonitorObjects	1.3.6.1.4.1.2011.5.25.11.1.2
hwSecStatMonitorGlobalSessFlow	1.3.6.1.4.1.2011.5.25.11.1.2.1
C64 hwSecStatMonTotalBootConnNum	1.3.6.1.4.1.2011.5.25.11.1.2.1.1	Counter64	read-only	The total number of connection since device startup. This number is increased only.
C64 hwSecStatMonPeakSessSpeedEx	1.3.6.1.4.1.2011.5.25.11.1.2.1.2	Counter64	read-only	The maximun speed of session establishing since device startup.
C64 hwSecStatMonCurSessSpeed	1.3.6.1.4.1.2011.5.25.11.1.2.1.3	Counter64	read-only	The current speed of session establishing.
C64 hwSecStatMonTotalSess	1.3.6.1.4.1.2011.5.25.11.1.2.1.4	Counter64	read-only	The total session in the system currently.
C64 hwSecStatMonHalfConn	1.3.6.1.4.1.2011.5.25.11.1.2.1.5	Counter64	read-only	The number of incomplete session in system currently.
C64 hwSecStatMonTcpSess	1.3.6.1.4.1.2011.5.25.11.1.2.1.6	Counter64	read-only	The current number of TCP sessions.
C64 hwSecStatMonUdpSess	1.3.6.1.4.1.2011.5.25.11.1.2.1.7	Counter64	read-only	The current number of UDP sessions.
C64 hwSecStatMonIcmpSess	1.3.6.1.4.1.2011.5.25.11.1.2.1.8	Counter64	read-only	The current number of ICMP sessions.
C64 hwSecStatMonSvrMapTblNum	1.3.6.1.4.1.2011.5.25.11.1.2.1.9	Counter64	read-only	The total number of server map.
C64 hwSecStatFragTblNum	1.3.6.1.4.1.2011.5.25.11.1.2.1.10	Counter64	read-only	The number of entry in fragment table.
C64 hwSecStatMonRcvIcmpPkts	1.3.6.1.4.1.2011.5.25.11.1.2.1.11	Counter64	read-only	The total number of ICMP packets received by system.
C64 hwSecStatMonRcvIcmpOcts	1.3.6.1.4.1.2011.5.25.11.1.2.1.12	Counter64	read-only	The total bytes of ICMP packets received by system.
C64 hwSecStatMonRcvTcpPkts	1.3.6.1.4.1.2011.5.25.11.1.2.1.13	Counter64	read-only	The total number of TCP packets received by system.
C64 hwSecStatMonRcvTcpOcts	1.3.6.1.4.1.2011.5.25.11.1.2.1.14	Counter64	read-only	The total bytes of TCP packets received by system.
C64 hwSecStatMonRcvUdpPkts	1.3.6.1.4.1.2011.5.25.11.1.2.1.15	Counter64	read-only	The total number of UDP packets received by system.
C64 hwSecStatMonRcvUdpOcts	1.3.6.1.4.1.2011.5.25.11.1.2.1.16	Counter64	read-only	The total bytes of UDP packets received by system.
C64 hwSecStatMonRcvEtcPkts	1.3.6.1.4.1.2011.5.25.11.1.2.1.17	Counter64	read-only	The total number of other type packets received by system.
C64 hwSecStatMonRcvEtcOcts	1.3.6.1.4.1.2011.5.25.11.1.2.1.18	Counter64	read-only	The total bytes of other type packets received by system.
C64 hwSecStatMonPassIcmpPkts	1.3.6.1.4.1.2011.5.25.11.1.2.1.19	Counter64	read-only	The total number of ICMP packets pass the system.
C64 hwSecStatMonPassIcmpOcts	1.3.6.1.4.1.2011.5.25.11.1.2.1.20	Counter64	read-only	The total bytes of ICMP packets pass the system.
C64 hwSecStatMonPassTcpPkts	1.3.6.1.4.1.2011.5.25.11.1.2.1.21	Counter64	read-only	The total number of TCP packets pass the system.
C64 hwSecStatMonPassTcpOcts	1.3.6.1.4.1.2011.5.25.11.1.2.1.22	Counter64	read-only	The total bytes of TCP packets pass the system.
C64 hwSecStatMonPassUdpPkts	1.3.6.1.4.1.2011.5.25.11.1.2.1.23	Counter64	read-only	The total number of UDP packets pass the system.
C64 hwSecStatMonPassUdpOcts	1.3.6.1.4.1.2011.5.25.11.1.2.1.24	Counter64	read-only	The total bytes of UDP packets pass the system.
C64 hwSecStatMonPassEtcPkts	1.3.6.1.4.1.2011.5.25.11.1.2.1.25	Counter64	read-only	The total number of other type packets pass the system.
C64 hwSecStatMonPassEtcOcts	1.3.6.1.4.1.2011.5.25.11.1.2.1.26	Counter64	read-only	The total bytes of other type packets pass the system.
C64 hwSecStatMonSynPkts	1.3.6.1.4.1.2011.5.25.11.1.2.1.27	Counter64	read-only	The total number of SYN packets arriving the system.
C64 hwSecStatMonFinPkts	1.3.6.1.4.1.2011.5.25.11.1.2.1.28	Counter64	read-only	The total number of FIN packets arriving the system.
C64 hwSecStatMonSynAckPkts	1.3.6.1.4.1.2011.5.25.11.1.2.1.29	Counter64	read-only	The total number of SYN-ACK packets arriving the system.
C64 hwSecStatMonRstPkts	1.3.6.1.4.1.2011.5.25.11.1.2.1.30	Counter64	read-only	The total number of RESET packets arriving the system.
C64 hwSecStatMonRcvFragPkts	1.3.6.1.4.1.2011.5.25.11.1.2.1.31	Counter64	read-only	The total number of fragment packets arriving the system.
C64 hwSecStatMonRcvFragOcts	1.3.6.1.4.1.2011.5.25.11.1.2.1.32	Counter64	read-only	The total bytes of fragment packets arriving the system.
C64 hwSecStatMonAllPkts	1.3.6.1.4.1.2011.5.25.11.1.2.1.33	Counter64	read-only	The number of received packets by the device.
C64 hwSecStatMonAllOcts	1.3.6.1.4.1.2011.5.25.11.1.2.1.34	Counter64	read-only	The number of received bytes by the device.
I32 hwSecStatClearGlobalSessFlowInfo	1.3.6.1.4.1.2011.5.25.11.1.2.1.35	Integer32	read-write	Use this OID to clear the global session flow statistics information. When you want to clear the information, set this OID to 1.
hwSecStatMonitorGlobalAppInfo	1.3.6.1.4.1.2011.5.25.11.1.2.2
C64 hwSecStatMonFtpSessions	1.3.6.1.4.1.2011.5.25.11.1.2.2.1	Counter64	read-only	The total number of FTP sessions in the system currently.
C64 hwSecStatMonRcvFtpPkts	1.3.6.1.4.1.2011.5.25.11.1.2.2.2	Counter64	read-only	The total number of FTP packets received by system.
C64 hwSecStatMonRcvFtpOcts	1.3.6.1.4.1.2011.5.25.11.1.2.2.3	Counter64	read-only	The total bytes of FTP packets received by system.
C64 hwSecStatMonSmtpSessions	1.3.6.1.4.1.2011.5.25.11.1.2.2.4	Counter64	read-only	The total number of SMTP sessions in the system currently.
C64 hwSecStatMonRcvSmtpPkts	1.3.6.1.4.1.2011.5.25.11.1.2.2.5	Counter64	read-only	The total number of SMTP packets received by system.
C64 hwSecStatMonRcvSmtpOcts	1.3.6.1.4.1.2011.5.25.11.1.2.2.6	Counter64	read-only	The total bytes of SMTP packets received by system.
C64 hwSecStatMonHttpSessions	1.3.6.1.4.1.2011.5.25.11.1.2.2.7	Counter64	read-only	The total number of HTTP sessions in the system currently.
C64 hwSecStatMonRcvHttpPkts	1.3.6.1.4.1.2011.5.25.11.1.2.2.8	Counter64	read-only	The total number of HTTP packets received by system.
C64 hwSecStatMonRcvHttpOcts	1.3.6.1.4.1.2011.5.25.11.1.2.2.9	Counter64	read-only	The total bytes of HTTP packets received by system.
C64 hwSecStatMonH323Sessions	1.3.6.1.4.1.2011.5.25.11.1.2.2.10	Counter64	read-only	The total number of H323 sessions in the system currently.
C64 hwSecStatMonRcvH323Pkts	1.3.6.1.4.1.2011.5.25.11.1.2.2.11	Counter64	read-only	The total number of H323 packets received by system.
C64 hwSecStatMonRcvH323Octs	1.3.6.1.4.1.2011.5.25.11.1.2.2.12	Counter64	read-only	The total bytes of H323 packets received by system.
C64 hwSecStatMonRtspSessions	1.3.6.1.4.1.2011.5.25.11.1.2.2.13	Counter64	read-only	The total number of RTSP sessions in the system currently.
C64 hwSecStatMonRcvRtspPkts	1.3.6.1.4.1.2011.5.25.11.1.2.2.14	Counter64	read-only	The total number of RTSP packets received by system.
C64 hwSecStatMonRcvRtspOcts	1.3.6.1.4.1.2011.5.25.11.1.2.2.15	Counter64	read-only	The total bytes of RTSP packets received by system.
C64 hwSecStatMonJavaAtckNum	1.3.6.1.4.1.2011.5.25.11.1.2.2.16	Counter64	read-only	The number of JAVA attack detected by system.
I32 hwSecStatClearGlobalAppInfo	1.3.6.1.4.1.2011.5.25.11.1.2.2.17	Integer32	read-write	Use this OID to clear the global application statistics information. When you want to clear the information, set this OID to 1.
hwSecStatMonitorGlobalDrop	1.3.6.1.4.1.2011.5.25.11.1.2.3
C64 hwSecStatNoSessTblPkts	1.3.6.1.4.1.2011.5.25.11.1.2.3.1	Counter64	read-only	The total number of packets dropped for no session.
C64 hwSecStatNoSessTblOcts	1.3.6.1.4.1.2011.5.25.11.1.2.3.2	Counter64	read-only	The total bytes of packets dropped for no session.
C64 hwSecStatSeqErrPkts	1.3.6.1.4.1.2011.5.25.11.1.2.3.3	Counter64	read-only	The total number of packets dropped for sequence number error.
C64 hwSecStatSeqErrOcts	1.3.6.1.4.1.2011.5.25.11.1.2.3.4	Counter64	read-only	The total bytes of packets dropped for sequence number error.
C64 hwSecStatAclDenyNonIcmpPkts	1.3.6.1.4.1.2011.5.25.11.1.2.3.5	Counter64	read-only	The total number of non ICMP packets denied for acl rule.
C64 hwSecStatAclDenyNonIcmpOcts	1.3.6.1.4.1.2011.5.25.11.1.2.3.6	Counter64	read-only	The total bytes of non ICMP packets denied for acl rule.
C64 hwSecStatAclDenyIcmpPkts	1.3.6.1.4.1.2011.5.25.11.1.2.3.7	Counter64	read-only	The total number of ICMP packets denied by acl rule.
C64 hwSecStatAclDenyIcmpOcts	1.3.6.1.4.1.2011.5.25.11.1.2.3.8	Counter64	read-only	The total bytes of ICMP packets denied by acl rule.
C64 hwSecStatBlsDenyPkts	1.3.6.1.4.1.2011.5.25.11.1.2.3.9	Counter64	read-only	The total number of packets denied by blacklist.
C64 hwSecStatBlsDenyOcts	1.3.6.1.4.1.2011.5.25.11.1.2.3.10	Counter64	read-only	The total bytes of packets denied by blacklist.
C64 hwSecStatIcmpFloodDropPkts	1.3.6.1.4.1.2011.5.25.11.1.2.3.11	Counter64	read-only	The total number of packets dropped due to ICMP Flood attack.
C64 hwSecStatIcmpFloodDropOcts	1.3.6.1.4.1.2011.5.25.11.1.2.3.12	Counter64	read-only	The total bytes of packets dropped due to ICMP Flood attack.
C64 hwSecStatUdpFloodDropPkts	1.3.6.1.4.1.2011.5.25.11.1.2.3.13	Counter64	read-only	The total number of packets dropped due to UDP Flood attack.
C64 hwSecStatUdpFloodDropOcts	1.3.6.1.4.1.2011.5.25.11.1.2.3.14	Counter64	read-only	The total bytes of packets dropped due to UDP Flood attack.
C64 hwSecStatAlgDropPkts	1.3.6.1.4.1.2011.5.25.11.1.2.3.15	Counter64	read-only	The total number of packets dropped by application layer gateway.
C64 hwSecStatAlgDropOcts	1.3.6.1.4.1.2011.5.25.11.1.2.3.16	Counter64	read-only	The total bytes of packets dropped by application layer gateway.
C64 hwSecStatIPVerErrDropPkts	1.3.6.1.4.1.2011.5.25.11.1.2.3.17	Counter64	read-only	The total number of packets dropped for IP version error.
C64 hwSecStatIpCrcDropPkts	1.3.6.1.4.1.2011.5.25.11.1.2.3.18	Counter64	read-only	The total number of packets dropped for CRC error.
C64 hwSecStatIpTTLDropPkts	1.3.6.1.4.1.2011.5.25.11.1.2.3.19	Counter64	read-only	The total number of packets dropped for TTL error.
C64 hwSecStatProtoErrDropPkts	1.3.6.1.4.1.2011.5.25.11.1.2.3.20	Counter64	read-only	The total number of packets dropped for protocol error.
I32 hwSecStatClearGlobalDropInfo	1.3.6.1.4.1.2011.5.25.11.1.2.3.21	Integer32	read-write	Use this OID to clear the global dropped packets statistics information. When you want to clear the information, set this OID to 1.
hwSecStatConformance	1.3.6.1.4.1.2011.5.25.11.1.3
hwSecStatCompliance	1.3.6.1.4.1.2011.5.25.11.1.3.1
hwSecStatMibGroups	1.3.6.1.4.1.2011.5.25.11.1.3.2
hwSecStatGlobalCfgGroup	1.3.6.1.4.1.2011.5.25.11.1.3.2.1			Description.
hwSecStatGlobalMonitorGroup	1.3.6.1.4.1.2011.5.25.11.1.3.2.2			Description.

RFC description

Collects security statistics including TCP/UDP/ICMP session counts and packet rates for Huawei routers and firewalls.

Start monitoring Huawei router or firewall running VRP (security statistics) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download HUAWEI-SECSTAT-MIB