HUAWEI-TAD-MIB

All MIBs › HUAWEI-TAD-MIB

Organization: Huawei Technologies co.,Ltd.

Last Updated: 2006-06-28

Category: Domain: Security, Vendor: Huawei

Description: Huawei TAD (Traffic Anomaly Detection) MIB for managing anomaly detection thresholds and DDoS mitigation policies.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is HUAWEI-TAD-MIB?

HUAWEI-TAD-MIB is a Huawei enterprise MIB exposing objects under the hwTADObjects subtree for a custom damping feature configurable at the system or interface level, based on its module description; its acronym (TAD) points to traffic/track anomaly damping functionality. With only the top-level object group visible in this batch, the specific runtime data points are not enumerated here, but the described purpose points to configuration objects governing damping thresholds and behavior applied to interfaces or system-wide events. Where implemented, such damping features are used to smooth or suppress rapid state flapping (e.g. interface up/down flapping), so by extension this MIB would support monitoring the stability of interface or system state and whether damping suppression is currently active, an indirect but relevant piece of software/operational health status. It likely depends on Huawei's core interface/system MIB conventions for referencing the interfaces or system entities to which damping is applied. It would be deployed on Huawei routers/switches that support configurable event damping to reduce control-plane churn from flapping links, and engineers typically start with a HUAWEI-TAD-MIB download to inspect the object definitions in a MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in HUAWEI-TAD-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Huawei routers/switches (VRP platform)

Monitoring Examples

Available sample data is limited to the root hwTADObjects node, so no specific table/scalar objects can be cited with confidence; a fuller MIB dump would be needed to identify concrete damping-threshold or anomaly-count objects to poll. Based on the module description, an admin would generally expect to find per-interface or system-level damping configuration and status objects nested under hwTADObjects, useful for detecting excessive event flapping.

What Can Be Monitored

interface/system damping configuration state
anomaly/flap damping status

Imported Objects

From HUAWEI-MIB

hwDatacomm

OBJECT-IDENTITY

From IF-MIB

InterfaceIndex
ifIndex	OBJECT-TYPE

From SNMPv2-SMI

Counter32
Integer32
MODULE-IDENTITY
OBJECT-IDENTITY
OBJECT-TYPE

From SNMPv2-TC

DateAndTime
DisplayString
TEXTUAL-CONVENTION

How to Use in IPNetwork Monitor

Example using hwTADAlarmFlappingCount OID:

Select a Huawei routers/switch as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type hwTADAlarmFlappingCount into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. It reports the how many times alarm's status changed. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
hwTAD	1.3.6.1.4.1.2011.5.25.128			The Custom damping MIB module is defined to manage the configuration under system or interface view.
hwTADObjects	1.3.6.1.4.1.2011.5.25.128.1
hwTADInterfaceTable	1.3.6.1.4.1.2011.5.25.128.1.1		not-accessible	Transmission alarm damping interface configuration table.
hwTADInterfaceEntry	1.3.6.1.4.1.2011.5.25.128.1.1.1		not-accessible	The entry of a SDH or SONET interface with damping function enabled.
NUM hwTADInterfaceIndex	1.3.6.1.4.1.2011.5.25.128.1.1.1.1	InterfaceIndex	not-accessible	Index number of the interface.
HWE hwTADFilterEnable	1.3.6.1.4.1.2011.5.25.128.1.1.1.2	HWEnableValue	read-write	Whether filter function is enabled.
I32 hwTADFilterExpireTime	1.3.6.1.4.1.2011.5.25.128.1.1.1.3	Integer32	read-write	How long the alarm will be postponed to process. Unit: millisecond.
HWE hwTADDampingEnable	1.3.6.1.4.1.2011.5.25.128.1.1.1.4	HWEnableValue	read-write	Whether damping function is enabled.
I32 hwTADSuppress	1.3.6.1.4.1.2011.5.25.128.1.1.1.5	Integer32	read-write	The suppressing value. When figure-of-merit of alarm exceeds this value, this alarm will be damped.
I32 hwTADCeiling	1.3.6.1.4.1.2011.5.25.128.1.1.1.6	Integer32	read-write	The ceiling value. Figure-of-merit can't exceed this value. The ceiling value must be larger than suppressing value.
I32 hwTADReuse	1.3.6.1.4.1.2011.5.25.128.1.1.1.7	Integer32	read-write	The reusing value. When figure-of-merit becomes lower than this value. The alarm will be reused (exit from suppressing status). The reusing value must be less than suppressing value.
I32 hwTADDecayOk	1.3.6.1.4.1.2011.5.25.128.1.1.1.8	Integer32	read-write	The half decay time when alarm status is down. Unit: millisecond.
I32 hwTADDecayNg	1.3.6.1.4.1.2011.5.25.128.1.1.1.9	Integer32	read-write	The half decay time when alarm status is up. Unit: millisecond.
INT hwTADResetStatistics	1.3.6.1.4.1.2011.5.25.128.1.1.1.10	INTEGER	read-write	Whether to reset alarm statistics. 1 means resetting statistics once.
DAT hwTADResetTime	1.3.6.1.4.1.2011.5.25.128.1.1.1.11	DateAndTime	read-only	Last reset time.
I32 hwTADB3tcaThreshold	1.3.6.1.4.1.2011.5.25.128.1.1.1.12	Integer32	read-write	B3tca threshold in form of 10e-n.
I32 hwTADSdbereThreshold	1.3.6.1.4.1.2011.5.25.128.1.1.1.13	Integer32	read-write	Sdbere threshold in form of 10e-n.
I32 hwTADSfbereThreshold	1.3.6.1.4.1.2011.5.25.128.1.1.1.14	Integer32	read-write	Sfbere threshold in form of 10e-n.
hwTADAlarmTable	1.3.6.1.4.1.2011.5.25.128.1.2		not-accessible	Transmission alarm damping alarm configuration table.
hwTADAlarmEntry	1.3.6.1.4.1.2011.5.25.128.1.2.1		not-accessible	The entry of an alarm.
NUM hwTADAlarmIfIndex	1.3.6.1.4.1.2011.5.25.128.1.2.1.1	InterfaceIndex	not-accessible	Index number of the interface.
INT hwTADAlarmType	1.3.6.1.4.1.2011.5.25.128.1.2.1.2	INTEGER	not-accessible	Index number of the alarm. The range is from 1 to 22, corresponding to: auais, batca, lais, lof, lom, lop, los, lrdi, lrei, oof, pais, prdi, prei, pplm, rdool, rrool, sdbere, sfbere, trool, puneq, lcd, wlnk.
HWE hwTADAlarmIfDown	1.3.6.1.4.1.2011.5.25.128.1.2.1.3	HWEnableValue	read-write	Whether this alarm leads to interface down. In default lais, lof and los are enabled to lead interface down.
HWE hwTADAlarmLog	1.3.6.1.4.1.2011.5.25.128.1.2.1.4	HWEnableValue	read-write	Whether this alarm will be logged. In default all alarm types won't be logged.
INT hwTADAlarmStatus	1.3.6.1.4.1.2011.5.25.128.1.2.1.5	INTEGER	read-only	The status of the alarm. 1 means alarm is up, 2 means alarm is down.
INT hwTADAlarmInFilter	1.3.6.1.4.1.2011.5.25.128.1.2.1.6	INTEGER	read-only	Whether this alarm is in filtering status. 1 means alarm is in filtering status, 2 means alarm isn't in filtering status.
STR hwTADAlarmFigure	1.3.6.1.4.1.2011.5.25.128.1.2.1.7	DisplayString	read-only	This figure is used to evaluate the stability of the alarm. Large value means un-stability.
INT hwTADAlarmInSuppress	1.3.6.1.4.1.2011.5.25.128.1.2.1.8	INTEGER	read-only	Whether this alarm is in suppressing status. 1 means alarm is in suppressing status, 2 means alarm isn't in suppressing status.
C32 hwTADAlarmFlappingCountEx	1.3.6.1.4.1.2011.5.25.128.1.2.1.9	Counter32	read-only	How many times alarm's status changed.
C32 hwTADAlarmSuppressCount	1.3.6.1.4.1.2011.5.25.128.1.2.1.10	Counter32	read-only	How many times alarm is suppressed.
hwTADConformance	1.3.6.1.4.1.2011.5.25.128.2
hwTADGroups	1.3.6.1.4.1.2011.5.25.128.2.1
hwTADInterfaceGroup	1.3.6.1.4.1.2011.5.25.128.2.1.1			A collection of objects providing device level control and status information for the interface.
hwTADAlarmGroup	1.3.6.1.4.1.2011.5.25.128.2.1.2			A collection of objects providing device level control and status information for the alarm.

RFC description

Huawei TAD (Telemetry, Analytics, or similar service) MIB providing SNMP management objects for monitoring Huawei network device functions and operational status.

Start monitoring Huawei routers/switches with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download HUAWEI-TAD-MIB