IDS-MIB

All MIBs › IDS-MIB

Category: Domain: Security

Description: MIB for Intrusion Detection System (IDS) management providing attack event notifications, signature updates, and detection statistics.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is IDS-MIB?

IDS-MIB is a vendor security MIB for Intrusion Detection System functionality, providing management of attack-detection tracking, filtering, and statistics, likely from Nortel/Bay Networks given the rs- object prefix. It exposes tracking entries with filter group names/types, threshold and aging-time configuration for TCP and NCP (connection) tracking, plus overall detection mechanism status. Rather than classic hardware sensors, this MIB's monitoring value is in software/service status: confirming the IDS detection mechanism is enabled (rsIDSMechanismStatus) and healthy, and reviewing tracking/threshold statistics that indicate active or recent attack detection activity. No dependency on other MIBs is evident from the available material. It is deployed on routers or firewalls with embedded intrusion-detection features, in enterprise perimeter or core network security roles. Engineers can download the IDS-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in IDS-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

router/firewall with embedded IDS (Nortel/Bay Networks-style)

Monitoring Examples

An administrator would check rsIDSMechanismStatus to confirm the IDS detection engine is running, then review rsIDStrackingEntry fields such as rsIDSTrackingType, rsIDSTrackingTime, and rsIDSThreshold against rsIDSFilterGroupName/rsIDSFilterGroupType to see which filter groups are actively tracking suspicious traffic patterns. Rising counts against rsIDSTCPAgingTimeFreq or rsIDSNCPsAgingTimeFreq aging parameters, alongside rsIDSStatsAgingTimeFreq, would help tune how long stale attack-tracking state is retained versus how quickly new attacks are flagged.

What Can Be Monitored

IDS detection mechanism status
attack tracking entries by filter group
tracking thresholds
TCP/NCP aging time configuration
detection statistics aging

Imported Objects

From RADWARE-MIB

rsIDS

OBJECT-IDENTITY

From RFC-1212

OBJECT-TYPE

From RFC-1215

TRAP-TYPE

From RFC1155-SMI

Counter
Gauge
IpAddress
NetworkAddress
enterprises

From RFC1213-MIB

DisplayString
PhysAddress
ipAddrEntry

OIDs

OID symbolic	OID numeric	Type	Access	Description
rsIDSTrackingTable	1.3.6.1.4.1.89.35.1.65.1		not-accessible	Table containing the parameters that are needed to detect intrusions
rsIDStrackingEntry	1.3.6.1.4.1.89.35.1.65.1.1		not-accessible	The row definition for this table.
STR rsIDSFilterGroupName	1.3.6.1.4.1.89.35.1.65.1.1.1	DisplayString	read-only	The Name for the filter/group must be unique. that name should be the same as the name of the appropriate filter/group
INT rsIDSTrackingTime	1.3.6.1.4.1.89.35.1.65.1.1.2	INTEGER	read-write	This variable indicates the time interval, in miliseconds, to track a detection
INT rsIDSThreshold	1.3.6.1.4.1.89.35.1.65.1.1.3	INTEGER	read-write	This variable indicates the threshold
INT rsIDSFilterGroupType	1.3.6.1.4.1.89.35.1.65.1.1.4	INTEGER	read-write	This variable indicates the object type- whether it is a filter or group
INT rsIDSTrackingType	1.3.6.1.4.1.89.35.1.65.1.1.5	INTEGER	read-write	This variable indicates how to count
ROW rsIDSStatus	1.3.6.1.4.1.89.35.1.65.1.1.6	RowStatus	read-write	This variable indicates the administrative status of this entry. Used to delete an entry of this table.
INT rsIDSDummy1	1.3.6.1.4.1.89.35.1.65.1.2	INTEGER	read-only	Dummy variable for stopping getnext.
INT rsIDSMechanismStatus	1.3.6.1.4.1.89.35.1.65.2	INTEGER	read-write	the IDS trigger
INT rsIDSTCPAgingTimeFreq	1.3.6.1.4.1.89.35.1.65.3	INTEGER	read-write	the TCP table aging time frequency
INT rsIDSNCPsAgingTimeFreq	1.3.6.1.4.1.89.35.1.65.4	INTEGER	read-write	the NCP's tables aging time frequency
INT rsIDSStatsAgingTimeFreq	1.3.6.1.4.1.89.35.1.65.5	INTEGER	read-write	the statistics table aging time frequency
INT rsIDSNCPSTableSize	1.3.6.1.4.1.89.35.1.65.6	INTEGER	read-write	the NCPS table size
INT rsIDSNCPDTableSize	1.3.6.1.4.1.89.35.1.65.7	INTEGER	read-write	the NCPD table size
INT rsIDSNCPSDTableSize	1.3.6.1.4.1.89.35.1.65.8	INTEGER	read-write	the NCPSD table size
INT rsIDSTCPTableSize	1.3.6.1.4.1.89.35.1.65.9	INTEGER	read-write	the TCP table size
INT rsIDSSTATSTableSize	1.3.6.1.4.1.89.35.1.65.10	INTEGER	read-write	the statistics table size
INT rsIDSBasic	1.3.6.1.4.1.89.35.1.65.11	INTEGER	read-write	the basic protection rule trigger
INT rsIDSAllServers	1.3.6.1.4.1.89.35.1.65.12	INTEGER	read-write	the All servers rule trigger
INT rsIDSUNIXServers	1.3.6.1.4.1.89.35.1.65.13	INTEGER	read-write	the unix servers rule trigger
INT rsIDSLotusServers	1.3.6.1.4.1.89.35.1.65.14	INTEGER	read-write	the Lotus servers rule trigger
INT rsIDSMSIISServers	1.3.6.1.4.1.89.35.1.65.15	INTEGER	read-write	the MS_IIS servers rule trigger
INT rsIDSMSFrontPageServers	1.3.6.1.4.1.89.35.1.65.16	INTEGER	read-write	the MS front page servers rule trigger
INT rsIDSApacheServers	1.3.6.1.4.1.89.35.1.65.17	INTEGER	read-write	the Apache servers rule trigger
INT rsIDSNetscapeWebServers	1.3.6.1.4.1.89.35.1.65.18	INTEGER	read-write	the Netscape_Web servers rule trigger
INT rsIDSNovellServers	1.3.6.1.4.1.89.35.1.65.19	INTEGER	read-write	the Novell servers rule trigger
INT rsIDSOracleServers	1.3.6.1.4.1.89.35.1.65.20	INTEGER	read-write	the Oracle servers rule trigger
INT rsIDSOmniHTTPDServers	1.3.6.1.4.1.89.35.1.65.21	INTEGER	read-write	the OmniHTTPD servers rule trigger
INT rsIDSWebSiteServers	1.3.6.1.4.1.89.35.1.65.22	INTEGER	read-write	the WebSite_WebSitePro servers rule trigger
INT rsIDSColdfusionServers	1.3.6.1.4.1.89.35.1.65.23	INTEGER	read-write	the Allaire_Coldfusion servers rule trigger
INT rsIDSIRIXServers	1.3.6.1.4.1.89.35.1.65.24	INTEGER	read-write	the IRIX servers rule trigger
INT rsIDSNCSAServers	1.3.6.1.4.1.89.35.1.65.25	INTEGER	read-write	the NCSA servers rule trigger
INT rsIDSCompaqServers	1.3.6.1.4.1.89.35.1.65.26	INTEGER	read-write	the Compaq_Web_Servers servers rule trigger
INT rsIDSbackdoors	1.3.6.1.4.1.89.35.1.65.27	INTEGER	read-write	the backdoors rule trigger
INT rsIDSTraps	1.3.6.1.4.1.89.35.1.65.28	INTEGER	read-write	the traps sending mechanism trigger
rsIDSStatsTable	1.3.6.1.4.1.89.35.1.65.29		not-accessible	Table containing the intrusion detection statistics
rsIDSStatsEntry	1.3.6.1.4.1.89.35.1.65.29.1		not-accessible	The row definition for this table.
INT rsIDSAttackIndex	1.3.6.1.4.1.89.35.1.65.29.1.1	INTEGER	read-only	The index of the attack that was detected
STR rsIDSAttackName	1.3.6.1.4.1.89.35.1.65.29.1.2	DisplayString	read-only	The Name for the attack
IP rsIDSAttackSrcAddr	1.3.6.1.4.1.89.35.1.65.29.1.3	IpAddress	read-only	The src address of the attack
IP rsIDSAttackDstAddr	1.3.6.1.4.1.89.35.1.65.29.1.4	IpAddress	read-only	The dest address of the attack
STR rsIDSAttackStatus	1.3.6.1.4.1.89.35.1.65.29.1.5	DisplayString	read-only	The status of the attack(started/terminated/occured)
STR rsIDSAttacktime	1.3.6.1.4.1.89.35.1.65.29.1.6	DisplayString	read-only	The time of the attack
ROW rsIDSStatsStatus	1.3.6.1.4.1.89.35.1.65.29.1.7	RowStatus	read-write	This variable indicates the administrative status of this entry. Used to delete an entry of this table.
INT rsIDSDummy2	1.3.6.1.4.1.89.35.1.65.29.2	INTEGER	read-only	Dummy variable for stopping getnext.
INT rsIDSNCPDTableSizeAfterReset	1.3.6.1.4.1.89.35.1.65.30	INTEGER	read-write	the NCPD after-reset table size
INT rsIDSNCPSDTableSizeAfterReset	1.3.6.1.4.1.89.35.1.65.31	INTEGER	read-write	the NCPS after-reset table size
INT rsIDSTCPTableSizeAfterReset	1.3.6.1.4.1.89.35.1.65.32	INTEGER	read-write	the NCPS after-reset table size
INT rsIDSSTATSTableSizeAfterReset	1.3.6.1.4.1.89.35.1.65.33	INTEGER	read-write	the NCPS after-reset table size

RFC description

Intrusion Detection System vendor-private MIB defining IDS-specific management objects and alert notifications.

Start monitoring Router/firewall with embedded IDS (Nortel/Bay Networks-style) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download IDS-MIB

What Is IDS-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description