All MIBs › IEEE8021-SECY-MIB
Organization: IEEE 802.1 Working Group
Last Updated: 2017-12-07
Category: Standard: IEEE 802, VPN and Security
Description: IEEE 802.1 MIB for MAC Security (MACsec/802.1AE) managing encryption keys, secure channels, and security associations.
Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.
What Is IEEE8021-SECY-MIB?
IEEE8021-SECY-MIB is a vendor-neutral IEEE 802.1 standards MIB for the MAC Security Entity (SecY), the protocol shim that implements 802.1AE MACsec encryption on an interface to protect Ethernet frames between peers on a LAN. It exposes per-interface SecY configuration and capability data, including how many peer Secure Channels (SCs) and cryptographic keys are supported, whether frame protection/validation and replay protection are enabled, and which cipher suite is currently in use. Its monitoring relevance is primarily security-posture and link-protection status: secyIfProtectFramesEnable and secyIfValidateFrames confirm MACsec encryption is actually active rather than silently bypassed, secyIfReplayProtectEnable/Window reveal whether anti-replay defenses are configured as expected, and secyIfCurrentCipherSuite lets an operator verify the negotiated encryption strength—faults here manifest as unprotected traffic or interoperability failures rather than classic hardware alarms. It is layered on top of the standard IEEE 802.1X/802.1AE architecture and typically coexists with related SecY-CP and dot1x MIBs managing the surrounding key-agreement and port-authentication context. It is deployed on Ethernet switches, routers, and NICs across any vendor that implement hardware or software MACsec encryption on point-to-point or shared-media links. Security teams new to MACsec instrumentation often consult an IEEE8021-SECY-MIB guide to understand how the SecY objects map to the underlying 802.1AE encryption state before deploying monitoring.
IPNetwork Monitor allows you to monitor SNMP objects defined in IEEE8021-SECY-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.
Supported Devices
- vendor-neutral, standards-based MIB, not tied to a specific manufacturer
- Ethernet switches, routers, and NICs implementing IEEE 802.1AE MACsec
Monitoring Examples
An operator would poll secyIfTable/secyIfEntry per secyIfInterfaceIndex, checking secyIfProtectFramesEnable to confirm MACsec protection is actually turned on for a link that is supposed to be encrypted, and secyIfCurrentCipherSuite to verify it matches the expected cipher rather than a weaker fallback. secyIfReplayProtectEnable combined with secyIfReplayProtectWindow would be checked to confirm the anti-replay window is set per policy, while secyIfRxMaxKeys/secyIfTxMaxKeys reveal how many keys the interface can hold during a key rollover, useful when diagnosing a failed rekey event.
What Can Be Monitored
- MACsec frame protection enable status
- frame validation mode
- replay protection enable/window
- current cipher suite in use
- max supported peer secure channels
- max Rx/Tx keys per interface
This MIB depends on
Related MIBs
Imported Objects
From IF-MIB
| InterfaceIndex | |
| ifCounterDiscontinuityGroup | OBJECT-GROUP |
From SNMP-FRAMEWORK-MIB
| SnmpAdminString |
From SNMPv2-CONF
| MODULE-COMPLIANCE | |
| OBJECT-GROUP |
From SNMPv2-SMI
| Counter32 | |
| Counter64 | |
| Integer32 | |
| MODULE-IDENTITY | |
| OBJECT-TYPE | |
| Unsigned32 |
From SNMPv2-TC
| RowPointer | |
| RowStatus | |
| TEXTUAL-CONVENTION | |
| TimeStamp | |
| TruthValue |
OIDs
| OID symbolic | OID numeric | Type | Access | Description |
|---|---|---|---|---|
| ieee8021SecyMIB | 1.0.8802.1.1.3 | The MAC security entity (SecY) MIB module. A SecY is a protocol shim providing MAC Security (MACsec) in an interface stack. Each SecY transmits MACsec protected frames on one or more Secure Channels (SCs) to each of the other SecYs attached to the same LAN and participating in the same Secure Connectivity Association (CA). The CA is a security relationship, that is established and maintained by key agreement protocols and supported by MACsec to provide full connectivity between its participants. Each SC provides unidirectional point to multipoint connectivity from one participant to all the others and is supported by a succession of similarly point to multipoint Secure Associations (SAs). The Secure Association Key (SAK) used to protect frames is changed as an SA is replaced by its (overlapping) successor so fresh keys can be used without disrupting a long lived SC and CA. Two different upper interfaces, a Controlled Port (for frames protected by MACsec, providing an instance of the secure MAC service) and an Uncontrolled Port (for frames not requiring protection, like the key agreement frames used to establish the CA and distribute keys) are associated with a SecY shim. For each instance of a SecY two ifTable rows (one for each interface) run on top of an ifTable row representing the 'Common Port' interface, such as a row with ifType ='ethernetCsmacd(6)'. ___________________________________________________________________ | | | | Controlled Port Interface | Uncontrolled Port Interface | | (ifEntry = j,ifType = | (ifEntry = k, ifType = | | macSecControlledIF(231)) | macSecUncontrolledIF(232)) | |________________________________________________________________| | | | Physical Interface | | (ifEntry = i) | | (ifType = ethernetCsmacd(6)) | |________________________________________________________________| Example MACsec Interface Stack. i, j, k are ifIndexes each indicating a row in the ifTable. | ||
| secyCipherInfoGroup | 1.0.8802.1.1.3.2.2.21 | Cipher Suite implementation information (secyCipherSuiteTable objects). | ||
| secyCipherStatsGroup | 1.0.8802.1.1.3.2.2.24 | Cipher Suite performance statistics (from secyStatsTable). | ||
| BIT secyCipherSuiteCapability | 1.0.8802.1.1.3.1.1.6.1.4 | Bits | read-create | Cipher Suite implementation capability information. integrity(0) : integrity protection. confidentiality(1) : confidentiality protection. offsetConfidentiality(2) : offset confidentiality protection. |
| T/F secyCipherSuiteDataLengthChange | 1.0.8802.1.1.3.1.1.6.1.7 | TruthValue | read-create | True if cipher suite changes the length of the data. |
| secyCipherSuiteEntry | 1.0.8802.1.1.3.1.1.6.1 | not-accessible | An entry for a Cipher Suite implementation. | |
| secyCipherSuiteGroup | 1.0.8802.1.1.3.2.2.6 | Cipher Suite information objects. | ||
| U32 secyCipherSuiteICVLength | 1.0.8802.1.1.3.1.1.6.1.8 | Unsigned32 | read-create | The length of the integrity check value (ICV) field. |
| OCT secyCipherSuiteId | 1.0.8802.1.1.3.1.1.6.1.2 | OCTET STRING | read-create | A unique 64-bit (EUI-64) identifier for the Cipher Suite. |
| U32 secyCipherSuiteIndex | 1.0.8802.1.1.3.1.1.6.1.1 | Unsigned32 | not-accessible | The CipherSuiteTable entry index. |
| STR secyCipherSuiteName | 1.0.8802.1.1.3.1.1.6.1.3 | SnmpAdminString | read-create | The Cipher Suite Name, 128 octets or fewer. |
| BIT secyCipherSuiteProtection | 1.0.8802.1.1.3.1.1.6.1.5 | Bits | read-create | The secyIfCipherSuite table should be used instead of this object to allow per SecY Cipher Suite configuration. The options provided by this control are a subset of those defined by the object secyCipherSuiteCapability. If secyCipherSuiteCapability has the integrity bit on,the integrity bit can be turned on for this object. If secyCipherSuiteCapability has the integrity and confidentiality bits on, the confidentiality bit of this object can be turned on and the integrity bit must be on. If secyCipherSuiteCapability has the integrity and offsetConfidentiality bits on, the offsetConfidentiality bit can be turned on and the integrity bit must be on. integrity(0) : on or off the function of supporting integrity protection for this cipher suite. confidentiality(1) : on or off the function of supporting confidentiality for this cipher suite. offsetConfidentiality(2) : on or off the function of supporting offset confidentiality for this cipher suite. |
| I32 secyCipherSuiteProtectionOffset | 1.0.8802.1.1.3.1.1.6.1.6 | Integer32 | read-create | The confidentiality protection offset options of this cipher suite. Options should depend on the choice of secyCipherSuiteProtection. If the value of secyCipherSuiteProtection only turns on integrity bit, users can only choose 0 byte for this object. If the value of secyCipherSuiteProtection only turns on integrity and confidentiality bits, users can only choose 0 byte for this object. If the value of secyCipherSuiteProtection only turns on integrity and offsetConfidentiality bits, users can choose 30 or 50 bytes for this object. If the value of secyCipherSuiteProtection turns on integrity and confidentiality and offsetConfidentiality bits, users can choose 0 or 30 or 50 bytes for this object. |
| ROW secyCipherSuiteRowStatus | 1.0.8802.1.1.3.1.1.6.1.9 | RowStatus | read-create | The secyIfCipherTable (if implemented) avoids the need for network manager creation of entries in the secyCipherSuiteTable, and RowStatus should always be valid(1), with any per SecY unavailability indicated by an absence of a corresponding secyIfCipherTable entry or one with secyCipherSuiteAvailable false (the latter can indicate temporary unavailability). |
| secyCipherSuiteTable | 1.0.8802.1.1.3.1.1.6 | not-accessible | A table of the system's Cipher Suite capabilities, which can differ by Cipher Suite implementation, so there can be more than one entry with the same secyCipherSuiteId. The secyIfCipherTable lists available entries by SecY, avoiding the need for remote network management to write objects or create rows in this table. Any configured values shall be stored in persistent memory and remain unchanged across a re-initialization of the management system. | |
| INT secyIfAdminPt2PtMAC | 1.0.8802.1.1.3.1.1.1.1.10 | INTEGER | read-write | Controls the value of operPointToPointMAC (secyOperPt2PtMAC) reported to the user(s) of this SecY's Controlled Port. forceTrue(1) : operPointToPointMAC is True, regardless of the configuration and status of the SecY. forceFalse(2) : operPointToPointMAC is False, regardless of the configuration and status of the SecY. auto(3) : OperPointMAC is True if secyIfvalidateFrames is strict and reception is from at most one peer SecY, or if secyIfvalidateFrames is not strict and operPointToPointMAC is True for the Common Port, and is False otherwise. |
| I32 secyIfAPAccessPCP | 1.0.8802.1.1.3.1.1.9.1.2 | Integer32 | read-write | The Access Priority Code Point for this SecY and User PCP. Defaults to the User PCP value. |
| secyIfAPEntry | 1.0.8802.1.1.3.1.1.9.1 | not-accessible | A table entry selecting the Access Priority Code Point for a given SecY and User Priority Code Point. | |
| secyIfAPGroup | 1.0.8802.1.1.3.2.2.15 | Access Priority Code Point control (secyIfAPTable). | ||
| secyIfAPTable | 1.0.8802.1.1.3.1.1.9 | not-accessible | The Access Priority Table for each SecY in this system. The configured value of writable objects in each table entry shall be stored in persistent memory and remain unchanged across a re-initialization of the system's management entity. | |
| I32 secyIfAPUserPCP | 1.0.8802.1.1.3.1.1.9.1.1 | Integer32 | not-accessible | A User Priority Code Point. |
| T/F secyIfCipherEnableUse | 1.0.8802.1.1.3.1.1.7.1.2 | TruthValue | read-write | Enables use of the Cipher Suite by this SecY. |
| secyIfCipherEntry | 1.0.8802.1.1.3.1.1.7.1 | not-accessible | A table entry with Cipher Suite control for a SecY. | |
| secyIfCipherGroup | 1.0.8802.1.1.3.2.2.13 | Cipher Suite use control (secyIfCipherTable objects). | ||
| T/F secyIfCipherImplemented | 1.0.8802.1.1.3.1.1.7.1.1 | TruthValue | read-only | True if the Cipher Suite implementation can be used by this SecY (if secIfCipherEnableUse is true). |
| T/F secyIfCipherRqConfidentiality | 1.0.8802.1.1.3.1.1.7.1.3 | TruthValue | read-write | True if confidentiality protection (without an offset) is required if this Cipher Suite is used. |
| secyIfCipherTable | 1.0.8802.1.1.3.1.1.7 | not-accessible | A table with an entry for the Cipher Suite capabilities implemented for each SecY in this system, providing per SecY control of Cipher Suite use. The configured value of writable objects in each table entry shall be stored in persistent memory and remain unchanged across a re-initialization of the system's management entity. | |
| secyIfCtrlGroup | 1.0.8802.1.1.3.2.2.1 | SecY service management (secyIfTable) objects. | ||
| U32 secyIfCurrentCipherSuite | 1.0.8802.1.1.3.1.1.1.1.9 | Unsigned32 | read-write | The Cipher Suite currently used by this SecY, identified by the secyCipherSuiteTable entry index. Should be read-only if secyIfCipherTable implemented. |
| secyIfEntry | 1.0.8802.1.1.3.1.1.1.1 | not-accessible | A table entry with service information for a particular SecY. | |
| secyIfGroup | 1.0.8802.1.1.3.2.2.12 | SecY service management (secyIfTable objects) for systems supporting traffic class SCs. | ||
| T/F secyIfIncludeSCIEnable | 1.0.8802.1.1.3.1.1.1.1.12 | TruthValue | read-write | Mandates inclusion of an explicit SCI in the SecTAG when transmitting protected frames. |
| T/F secyIfIncludingSCI | 1.0.8802.1.1.3.1.1.1.1.16 | TruthValue | read-only | True if an explicit SCI is included in the SecTAG when transmitting protected frames. |
| NUM secyIfInterfaceIndex | 1.0.8802.1.1.3.1.1.1.1.1 | InterfaceIndex | not-accessible | An interface index, aligned with ifIndex in the ifTable, pointing to the SecY's Controlled Port. |
| U32 secyIfMaxPeerSCs | 1.0.8802.1.1.3.1.1.1.1.2 | Unsigned32 | read-only | The maximum number of peer SCs for this SecY. |
| U32 secyIfMaxTSCs | 1.0.8802.1.1.3.1.1.1.1.17 | Unsigned32 | read-only | The maximum number of transmit SCs for this SecY. |
| T/F secyIfOperPt2PtMAC | 1.0.8802.1.1.3.1.1.1.1.11 | TruthValue | read-only | Reflects the current service connectivity to be assumed by the user(s) of the SecY's Controlled Port. true(1) : connectivity is to at most one other system. false(2) : connectivity is to one or more other systems. |
| T/F secyIfProtectFramesEnable | 1.0.8802.1.1.3.1.1.1.1.5 | TruthValue | read-write | Enables or disables protection of transmitted frames. |
| T/F secyIfReplayProtectEnable | 1.0.8802.1.1.3.1.1.1.1.7 | TruthValue | read-write | Enables or disables replay protection. |
| U32 secyIfReplayProtectWindow | 1.0.8802.1.1.3.1.1.1.1.8 | Unsigned32 | read-write | The replay protection window size. |
| U32 secyIfRxMaxKeys | 1.0.8802.1.1.3.1.1.1.1.3 | Unsigned32 | read-only | The maximum number of keys in simultaneous use for reception for this SecY. |
| SEC secyIfSCI | 1.0.8802.1.1.3.1.1.1.1.15 | SecySCI | read-only | The SCI for the SecY's default traffic class. |
| secyIfStatsGroup | 1.0.8802.1.1.3.2.2.20 | SecY statistics (secyStatsTable objects). | ||
| secyIfTable | 1.0.8802.1.1.3.1.1.1 | not-accessible | A table with an entry for each service interface in this system with MAC Security capability, i.e. for each SecY. The configured value of writable objects in each table entry shall be stored in persistent memory and remain unchanged across a re-initialization of the system's management entity. | |
| secyIfTCEntry | 1.0.8802.1.1.3.1.1.8.1 | not-accessible | A table entry providing Traffic Class selection for a given SecY and User Priority. | |
| secyIfTCGroup | 1.0.8802.1.1.3.2.2.14 | Traffic class control (secyIfTCTable). | ||
| secyIfTCTable | 1.0.8802.1.1.3.1.1.8 | not-accessible | The Traffic Class Table for each SecY in this system. The configured value of writable objects in each table entry shall be stored in persistent memory and remain unchanged across a re-initialization of the system's management entity. | |
| I32 secyIfTCTrafficClass | 1.0.8802.1.1.3.1.1.8.1.2 | Integer32 | read-write | The Traffic Class for this SecY and User Priority, as transmitted in the four most significant bits of the Port Identifier component of the SCI of protected frames. |
| I32 secyIfTCUserPriority | 1.0.8802.1.1.3.1.1.8.1.1 | Integer32 | not-accessible | One of the possible User Priority values for a frame. |
| U32 secyIfTxMaxKeys | 1.0.8802.1.1.3.1.1.1.1.4 | Unsigned32 | read-only | The maximum number of keys in simultaneous use for transmission for this SecY. |
| T/F secyIfUseESEnable | 1.0.8802.1.1.3.1.1.1.1.13 | TruthValue | read-write | Enables use of the ES bit in the SecTAG when transmitting protected frames. |
| T/F secyIfUseSCBEnable | 1.0.8802.1.1.3.1.1.1.1.14 | TruthValue | read-write | Enables use of the SCB bit in the SecTAG when transmitting protected frames. |
| INT secyIfValidateFrames | 1.0.8802.1.1.3.1.1.1.1.6 | INTEGER | read-write | Controls validation of received frames. disabled(1) : disable validation, remove SecTAGs and ICVs (if present) from received frames. check(2) : enable validation, do not discard invalid frames. strict(3) : enable validation and discard invalid frames. null(4) : no processing, do not remove SecTAGs or ICVs. |
| secyMgmtMIBObjects | 1.0.8802.1.1.3.1.1 | |||
| secyMIBCompliance | 1.0.8802.1.1.3.2.1.1 | The compliance statement for the IEEE8021-SECY-MIB as specified in IEEE Std 802.1AE-2006. | ||
| secyMIBCompliances | 1.0.8802.1.1.3.2.1 | |||
| secyMIBConformance | 1.0.8802.1.1.3.2 | |||
| secyMIBGroups | 1.0.8802.1.1.3.2.2 | |||
| secyMIBNotifications | 1.0.8802.1.1.3.0 | |||
| secyMIBObjects | 1.0.8802.1.1.3.1 | |||
| secyMIBTcCompliance | 1.0.8802.1.1.3.2.1.2 | The compliance statement for an IEEE8021-SECY-MIB supporting traffic class transmit SCs, added by IEEE 802.1AEcg. | ||
| secyRSAGroup | 1.0.8802.1.1.3.2.2.19 | Receive SA (secyRxSATable objects). | ||
| secyRSCGroup | 1.0.8802.1.1.3.2.2.18 | Receive SC management (secyRxSCTable objects). | ||
| secyRSCStatsGroup | 1.0.8802.1.1.3.2.2.23 | Receive SC statistics (secyRxSCStatsTable objects). | ||
| SEC secyRxSA | 1.0.8802.1.1.3.1.1.5.1.1 | SecyAN | not-accessible | The association number (AN) for this receive SA. |
| TIM secyRxSACreatedTime | 1.0.8802.1.1.3.1.1.5.1.5 | TimeStamp | read-only | The system time when this receiving SA was created. |
| secyRxSAEntry | 1.0.8802.1.1.3.1.1.5.1 | not-accessible | An entry for one of the SAs used by one of the system's SecY's to receive protected frames. | |
| secyRxSAGroup | 1.0.8802.1.1.3.2.2.5 | Receive SA management objects. | ||
| STR secyRxSAKeyIdentifier | 1.0.8802.1.1.3.1.1.5.1.10 | SnmpAdminString | read-only | The Key Identifier (KI) for the SAK for this SA. |
| C64 secyRxSALowestXPN | 1.0.8802.1.1.3.1.1.5.1.9 | Counter64 | read-only | The lowest acceptable packet number. A received frame with a lower PN is discarded if secyIfReplayProtectEnable is enabled. |
| U32 secyRxSANextPN | 1.0.8802.1.1.3.1.1.5.1.3 | Unsigned32 | read-write | One more than the highest PN conveyed in the SecTAG of a frame received on this SA that has been successfully validated (if validateFrames has not been disabled). Deprecated: use secyRxSANextXPN for both 32-bit PN and 64-bit XPN PN values. If this object is implemented and an XPN Cipher Suite is used, it contains the lowest 32-bits of the XPN. |
| C64 secyRxSANextXPN | 1.0.8802.1.1.3.1.1.5.1.8 | Counter64 | read-only | One more than the highest PN conveyed in the SecTAG of successfully validates frames received on this SA. |
| T/F secyRxSASAKUnchanged | 1.0.8802.1.1.3.1.1.5.1.4 | TruthValue | read-only | A reference to an SAK that is unchanged for the life of the receiving SA. |
| I32 secyRxSASSCI | 1.0.8802.1.1.3.1.1.5.1.11 | Integer32 | read-only | The SSCI for this SA, 0 if an XPN Cipher Suite is not being used. |
| TIM secyRxSAStartedTime | 1.0.8802.1.1.3.1.1.5.1.6 | TimeStamp | read-only | The system time when this receiving SA last started receiving MACsec frames. |
| INT secyRxSAState | 1.0.8802.1.1.3.1.1.5.1.2 | INTEGER | read-only | The current state for this receive SA. |
| secyRxSAStatsEntry | 1.0.8802.1.1.3.1.2.3.1 | not-accessible | An entry with statistics for a receive SA. The AN that identifies an SA (for a given SC) and this corresponding entry can be reused. When creating the SA and before (re)using the entry, the SA counters are (re)set to 0. When the SA is stopped (secyRxSA notInuse) the counters will be stop incrementing. The secyRxSATable timestamps SA creation, start, and stop. | |
| secyRxSAStatsGroup | 1.0.8802.1.1.3.2.2.8 | Receive SA statistics objects. | ||
| C32 secyRxSAStatsInvalidPkts | 1.0.8802.1.1.3.1.2.3.1.16 | Counter32 | read-only | For this SA, the number of packets with the condition that the packets are not valid and secyValidateFrames is in check mode. |
| C32 secyRxSAStatsNotValidPkts | 1.0.8802.1.1.3.1.2.3.1.13 | Counter32 | read-only | For this SA, the number discarded packets with the condition that the packets are not valid and one of the following conditions are true: either secyValidateFrames in strict mode or the packets encrypted. |
| C32 secyRxSAStatsNoUsingSAPkts | 1.0.8802.1.1.3.1.2.3.1.4 | Counter32 | read-only | For this SA which is not currently in use, the number of received packets that have been discarded, and have either the packets encrypted or secyValidateFrames set to strict mode. |
| C32 secyRxSAStatsOKPkts | 1.0.8802.1.1.3.1.2.3.1.25 | Counter32 | read-only | For this SA, the number of validated packets. |
| secyRxSAStatsTable | 1.0.8802.1.1.3.1.2.3 | not-accessible | A table that contains the statistics objects for each receiving SA in the MAC security entity. | |
| C32 secyRxSAStatsUnusedSAPkts | 1.0.8802.1.1.3.1.2.3.1.1 | Counter32 | read-only | For this SA which is not currently in use, the number of received, unencrypted, packets with secyValidateFrames not in the strict mode. |
| TIM secyRxSAStoppedTime | 1.0.8802.1.1.3.1.1.5.1.7 | TimeStamp | read-only | The system time when this receiving SA last stopped receiving MACsec frames. |
| secyRxSATable | 1.0.8802.1.1.3.1.1.5 | not-accessible | A table with entries for the system's receive SAs. | |
| TIM secyRxSCCreatedTime | 1.0.8802.1.1.3.1.1.4.1.4 | TimeStamp | read-only | The system time when this receiving SC was created. |
| NUM secyRxSCCurrentSA | 1.0.8802.1.1.3.1.1.4.1.3 | RowPointer | read-only | The current receiving association number of the SC in use. The row pointer will point to an entry in the secyRxSATable. If no such information can be identified, the value of this object shall be the OBJECT IDENTIFIER { 0 0 }. |
| secyRxSCEntry | 1.0.8802.1.1.3.1.1.4.1 | not-accessible | An entry for one of the SCs used by one of the system's SecY's to receive protected frames. | |
| secyRxSCGroup | 1.0.8802.1.1.3.2.2.4 | Receive SC management objects. | ||
| SEC secyRxSCI | 1.0.8802.1.1.3.1.1.4.1.1 | SecySCI | not-accessible | The SCI for the receive SC. |
| TIM secyRxSCStartedTime | 1.0.8802.1.1.3.1.1.4.1.5 | TimeStamp | read-only | The system time when this receiving SC last started receiving MACsec frames. |
| INT secyRxSCState | 1.0.8802.1.1.3.1.1.4.1.2 | INTEGER | read-only | The state of the receive SC. inUse(1) : one or more SAs for this SC are in use. notInUse(2) : no SAs for this SC is in use. |
| C64 secyRxSCStatsDelayedPkts | 1.0.8802.1.1.3.1.2.4.1.6 | Counter64 | read-only | The number of received packets, for this SC, with PN lower than the lowest acceptable PN (secyRxSALowestXPN) and secyIfReplayProtectEnable false. |
| secyRxSCStatsEntry | 1.0.8802.1.1.3.1.2.4.1 | not-accessible | An entry containing counts for a receive SC. SA counters are reset when the SA's AN is reused, so these SC counts are a summation for all current and prior SAs belonging to the SC. | |
| secyRxSCStatsGroup | 1.0.8802.1.1.3.2.2.10 | Receive SC statistics objects. | ||
| C64 secyRxSCStatsInvalidPkts | 1.0.8802.1.1.3.1.2.4.1.5 | Counter64 | read-only | The number of packets, for this SC, that failed validation but could be received because secyIfvalidateFrames was 'check' and the data was not encrypted (so the original frame could be recovered). |
| C64 secyRxSCStatsLatePkts | 1.0.8802.1.1.3.1.2.4.1.3 | Counter64 | read-only | The number of packets discarded, for this SC, because the the received PN was lower than the lowest acceptable PN (secyRxSALowestXPN) and secyIfReplayProtectEnable was true. |
| C64 secyRxSCStatsNotValidPkts | 1.0.8802.1.1.3.1.2.4.1.4 | Counter64 | read-only | The number of packets discarded, for this SC, because validation failed and secyIfvalidateFrames was 'strict' or the data was encrypted (so the original frame could not be recovered). |
| C64 secyRxSCStatsNoUsingSAPkts | 1.0.8802.1.1.3.1.2.4.1.2 | Counter64 | read-only | The sum of secyRxSAStatsNoUsingSAPkts counts for all current and prior SAs belonging to this SC. |
| C64 secyRxSCStatsOctetsDecrypted | 1.0.8802.1.1.3.1.2.4.1.10 | Counter64 | read-only | The number of plaintext octets recovered from packets that were integrity protected and encrypted. |
| C64 secyRxSCStatsOctetsValidated | 1.0.8802.1.1.3.1.2.4.1.9 | Counter64 | read-only | The number of plaintext octets recovered from packets that were integrity protected but not encrypted. |
| C64 secyRxSCStatsOKPkts | 1.0.8802.1.1.3.1.2.4.1.8 | Counter64 | read-only | The number of packets received for this SC successfully validated and within the replay window. |
| secyRxSCStatsTable | 1.0.8802.1.1.3.1.2.4 | not-accessible | A table of statistics for each receive SC for each of the system's SecYs. | |
| C64 secyRxSCStatsUncheckedPkts | 1.0.8802.1.1.3.1.2.4.1.7 | Counter64 | read-only | The number of packets received for this SC, while secyValidateFrames was 'disabled'. |
| C64 secyRxSCStatsUnusedSAPkts | 1.0.8802.1.1.3.1.2.4.1.1 | Counter64 | read-only | The sum of secyRxSAStatsUnusedSAPkts counts for all current and prior SAs belonging to this SC. |
| TIM secyRxSCStoppedTime | 1.0.8802.1.1.3.1.1.4.1.6 | TimeStamp | read-only | The system time when this receiving SC last stopped receiving MACsec frames. |
| secyRxSCTable | 1.0.8802.1.1.3.1.1.4 | not-accessible | A table for the system's SecY's receive SCs. | |
| secyStatsEntry | 1.0.8802.1.1.3.1.2.5.1 | not-accessible | An entry containing counts for a SecY. | |
| secyStatsGroup | 1.0.8802.1.1.3.2.2.11 | SecY statistics objects. | ||
| secyStatsMIBObjects | 1.0.8802.1.1.3.1.2 | |||
| C64 secyStatsRxBadTagPkts | 1.0.8802.1.1.3.1.2.5.1.5 | Counter64 | read-only | The number of received packets discarded with an invalid SecTAG, zero value PN, or invalid ICV. |
| C64 secyStatsRxNoSAErrorPkts | 1.0.8802.1.1.3.1.2.5.1.10 | Counter64 | read-only | The number of packets discarded because the received SCI is unknown or the SA is not in use. |
| C64 secyStatsRxNoSAPkts | 1.0.8802.1.1.3.1.2.5.1.9 | Counter64 | read-only | The number of received packets with an unknown SCI or for an unused SA. |
| C64 secyStatsRxNoSCIPkts | 1.0.8802.1.1.3.1.2.5.1.7 | Counter64 | read-only | The number of discarded packets with an unknown SCI. |
| C64 secyStatsRxNoTagPkts | 1.0.8802.1.1.3.1.2.5.1.4 | Counter64 | read-only | The number of received packets without a SecTAG discarded because secyValidateFrames was 'strict'. |
| C64 secyStatsRxOctetsDecrypted | 1.0.8802.1.1.3.1.2.5.1.14 | Counter64 | read-only | The number of plaintext octets recovered from packets that were integrity protected and encrypted. |
| C64 secyStatsRxOctetsValidated | 1.0.8802.1.1.3.1.2.5.1.13 | Counter64 | read-only | The number of plaintext octets recovered from packets that were integrity protected but not encrypted. |
| C64 secyStatsRxOverrunPkts | 1.0.8802.1.1.3.1.2.5.1.8 | Counter64 | read-only | The number of packets discarded because they exceeded cryptographic performance capabilities. |
| C64 secyStatsRxUnknownSCIPkts | 1.0.8802.1.1.3.1.2.5.1.6 | Counter64 | read-only | The number of received packets with an unknown SCI. |
| C64 secyStatsRxUntaggedPkts | 1.0.8802.1.1.3.1.2.5.1.3 | Counter64 | read-only | The number of packets without the MACsec tag (SecTAG) received while secyValidateFrames was not 'strict'. |
| secyStatsTable | 1.0.8802.1.1.3.1.2.5 | not-accessible | A table of statistics for each of the system's SecYs. | |
| C64 secyStatsTxOctetsEncrypted | 1.0.8802.1.1.3.1.2.5.1.12 | Counter64 | read-only | The number of plain text octets integrity protected and encrypted in transmitted frames. |
| C64 secyStatsTxOctetsProtected | 1.0.8802.1.1.3.1.2.5.1.11 | Counter64 | read-only | The number of plain text octets integrity protected but not encrypted in transmitted frames. |
| C64 secyStatsTxTooLongPkts | 1.0.8802.1.1.3.1.2.5.1.2 | Counter64 | read-only | The number of transmit packets discarded because their length is greater than the ifMtu of the Common Port. |
| C64 secyStatsTxUntaggedPkts | 1.0.8802.1.1.3.1.2.5.1.1 | Counter64 | read-only | The number of packets transmitted without a SecTAG because secyProtectFramesEnable is configured false. |
| SEC secyTSA | 1.0.8802.1.1.3.1.1.11.1.1 | SecyAN | not-accessible | The association number (AN) for this transmit SA. |
| T/F secyTSAConfidentiality | 1.0.8802.1.1.3.1.1.11.1.4 | TruthValue | read-only | True if the SA provides confidentiality as well as integrity for transmitted frames. |
| TIM secyTSACreatedTime | 1.0.8802.1.1.3.1.1.11.1.7 | TimeStamp | read-only | The system time when this transmit SA was created. |
| secyTSAEntry | 1.0.8802.1.1.3.1.1.11.1 | not-accessible | An entry for a transmit SA. | |
| secyTSAGroup | 1.0.8802.1.1.3.2.2.17 | Transmit SA management (secyTSATable objects) for systems supporting traffic class SCs. | ||
| STR secyTSAKeyIdentifier | 1.0.8802.1.1.3.1.1.11.1.5 | SnmpAdminString | read-only | The Key Identifier (KI) for the SAK for this SA. |
| C64 secyTSANextXPN | 1.0.8802.1.1.3.1.1.11.1.3 | Counter64 | read-only | The next packet number (PN) for this SA. |
| I32 secyTSASSCI | 1.0.8802.1.1.3.1.1.11.1.6 | Integer32 | read-only | The SSCI for this SA, 0 if an XPN Cipher Suite is not being used. |
| TIM secyTSAStartedTime | 1.0.8802.1.1.3.1.1.11.1.8 | TimeStamp | read-only | The system time when this transmit SA last started transmitting MACsec frames. |
| INT secyTSAState | 1.0.8802.1.1.3.1.1.11.1.2 | INTEGER | read-only | The current status of the transmit SA. inUse(1) : this SA is in use. notInUse(2) : this SA is not in use. |
| TIM secyTSAStoppedTime | 1.0.8802.1.1.3.1.1.11.1.9 | TimeStamp | read-only | The system time when this transmit SA last stopped transmitting MACsec frames. |
| secyTSATable | 1.0.8802.1.1.3.1.1.11 | not-accessible | A table with an entry for each transmit SA for each of the system's SecYs. | |
| TIM secyTSCCreatedTime | 1.0.8802.1.1.3.1.1.10.1.4 | TimeStamp | read-only | The system time when this transmitting SC was created. |
| NUM secyTSCEncodingSA | 1.0.8802.1.1.3.1.1.10.1.3 | RowPointer | read-only | The SA currently used to encode the SecTAG for frames awaiting transmission. The row pointer will point to an entry in the secyTxSATable. If no such information is available, the value shall be the OBJECT IDENTIFIER { 0 0 }. |
| secyTSCEntry | 1.0.8802.1.1.3.1.1.10.1 | not-accessible | An entry with transmit SC information for one of the system's SecYs and one of its traffic classes. | |
| secyTSCGroup | 1.0.8802.1.1.3.2.2.16 | Transmit SC management (secyTSCTable objects) for systems supporting traffic class SCs. | ||
| SEC secyTSCI | 1.0.8802.1.1.3.1.1.10.1.1 | SecySCI | not-accessible | The SCI for the transmit SC for this SecY and traffic class. |
| TIM secyTSCStartedTime | 1.0.8802.1.1.3.1.1.10.1.5 | TimeStamp | read-only | The system time when this transmitting SC last started transmitting MACsec frames. |
| INT secyTSCState | 1.0.8802.1.1.3.1.1.10.1.2 | INTEGER | read-only | The state of the transmit SC for this SecY and traffic class. inUse(1) : one or more SAs for the traffic class SC are in use. notInUse(2) : no SAs for the traffic class SC are in use. |
| C64 secyTSCStatsEncryptedPkts | 1.0.8802.1.1.3.1.2.12.1.2 | Counter64 | read-only | The number of integrity protected and encrypted packets for this transmit SC. |
| secyTSCStatsEntry | 1.0.8802.1.1.3.1.2.12.1 | not-accessible | A entry containing counts for a transmit SC, since SA counters are reset when the SA's AN is reused these are a summation for all current and prior SAs belonging to the SC. | |
| secyTSCStatsGroup | 1.0.8802.1.1.3.2.2.22 | Transmit SC statistics (secyTSCStatsTable objects). | ||
| C64 secyTSCStatsProtectedPkts | 1.0.8802.1.1.3.1.2.12.1.1 | Counter64 | read-only | The number of integrity protected but not encrypted packets for this transmit SC. |
| secyTSCStatsTable | 1.0.8802.1.1.3.1.2.12 | not-accessible | A table of statistics for each SecY's transmit SCs. | |
| TIM secyTSCStoppedTime | 1.0.8802.1.1.3.1.1.10.1.6 | TimeStamp | read-only | The system time when this transmitting SC last stopped transmitting MACsec frames. |
| secyTSCTable | 1.0.8802.1.1.3.1.1.10 | not-accessible | A table of entries for each SecY's traffic class SCs. | |
| SEC secyTxSA | 1.0.8802.1.1.3.1.1.3.1.1 | SecyAN | not-accessible | The association number (AN) for this transmit SA. |
| T/F secyTxSAConfidentiality | 1.0.8802.1.1.3.1.1.3.1.4 | TruthValue | read-only | True if the SA provides confidentiality as well as integrity for transmitted frames. |
| TIM secyTxSACreatedTime | 1.0.8802.1.1.3.1.1.3.1.6 | TimeStamp | read-only | The system time when this transmit SA was created. |
| secyTxSAEntry | 1.0.8802.1.1.3.1.1.3.1 | not-accessible | An entry for a transmit SA. | |
| secyTxSAGroup | 1.0.8802.1.1.3.2.2.3 | Transmit SA management objects (for systems without traffic class SC capabilities). | ||
| U32 secyTxSANextPN | 1.0.8802.1.1.3.1.1.3.1.3 | Unsigned32 | read-only | The next packet number (PN) for this SA. |
| T/F secyTxSASAKUnchanged | 1.0.8802.1.1.3.1.1.3.1.5 | TruthValue | read-only | A reference to an SAK that is unchanged for the life of the transmitting SA. |
| TIM secyTxSAStartedTime | 1.0.8802.1.1.3.1.1.3.1.7 | TimeStamp | read-only | The system time when this transmit SA last started transmitting MACsec frames. |
| INT secyTxSAState | 1.0.8802.1.1.3.1.1.3.1.2 | INTEGER | read-only | The current status of the transmitting SA. inUse(1) : this SA is in use. notInUse(2) : this SA is not in use. |
| C32 secyTxSAStatsEncryptedPkts | 1.0.8802.1.1.3.1.2.1.1.2 | Counter32 | read-only | The number of integrity protected and encrypted packets for this transmit SA. Zero if secyTxSAConfidentiality is False, and one less than secyTxSANextPN otherwise. |
| secyTxSAStatsEntry | 1.0.8802.1.1.3.1.2.1.1 | not-accessible | An entry with statistics for a transmit SA. The AN that identifies an SA (for a given SC) and this corresponding entry can be reused. When creating the SA and before (re)using the entry, the SA counters are (re)set to 0. When the SA is stopped (secyTxSA notInuse) the counters will be stop incrementing. The secyTxSATable timestamps SA creation, start, and stop. | |
| secyTxSAStatsGroup | 1.0.8802.1.1.3.2.2.7 | Transmit SA statistics objects. | ||
| C32 secyTxSAStatsProtectedPkts | 1.0.8802.1.1.3.1.2.1.1.1 | Counter32 | read-only | The number of integrity protected but not encrypted packets for this transmit SA. Zero if secyTxSAConfidentiality is True, and one less than secyTxSANextPN otherwise. |
| secyTxSAStatsTable | 1.0.8802.1.1.3.1.2.1 | not-accessible | A table of statistics for each transmit SA for each of the system's SecYs. | |
| TIM secyTxSAStoppedTime | 1.0.8802.1.1.3.1.1.3.1.8 | TimeStamp | read-only | The system time when this transmit SA last stopped transmitting MACsec frames. |
| secyTxSATable | 1.0.8802.1.1.3.1.1.3 | not-accessible | A table with an entry for each transmit SA for each of the system's SecYs. | |
| TIM secyTxSCCreatedTime | 1.0.8802.1.1.3.1.1.2.1.5 | TimeStamp | read-only | The system time when this transmitting SC was created. |
| NUM secyTxSCEncipheringSA | 1.0.8802.1.1.3.1.1.2.1.4 | RowPointer | read-only | The SA currently used to encipher frames for transmission. The row pointer will point to an entry in the secyTxSATable. If no such information is available, the value shall be the OBJECT IDENTIFIER { 0 0 }. |
| NUM secyTxSCEncodingSA | 1.0.8802.1.1.3.1.1.2.1.3 | RowPointer | read-only | The SA currently used to encode the SecTAG for frames awaiting transmission. The row pointer will point to an entry in the secyTxSATable. If no such information is available, the value shall be the OBJECT IDENTIFIER { 0 0 }. |
| secyTxSCEntry | 1.0.8802.1.1.3.1.1.2.1 | not-accessible | An entry with transmit SC information for a SecY. | |
| secyTxSCGroup | 1.0.8802.1.1.3.2.2.2 | Transmit SC management objects (for systems without traffic class SC capabilities). | ||
| SEC secyTxSCI | 1.0.8802.1.1.3.1.1.2.1.1 | SecySCI | read-only | The SCI for the SecY's transmit SC. |
| TIM secyTxSCStartedTime | 1.0.8802.1.1.3.1.1.2.1.6 | TimeStamp | read-only | The system time when this transmitting SC last started transmitting MACsec frames. |
| INT secyTxSCState | 1.0.8802.1.1.3.1.1.2.1.2 | INTEGER | read-only | The transmitting state of the SecY's transmit SC. inUse(1) : one or more SAs are in use. notInUse(2) : no SAs are in use. |
| C64 secyTxSCStatsEncryptedPkts | 1.0.8802.1.1.3.1.2.2.1.4 | Counter64 | read-only | The number of integrity protected and encrypted packets for this transmit SC. |
| secyTxSCStatsEntry | 1.0.8802.1.1.3.1.2.2.1 | not-accessible | An entry containing counts for a transmit SC. SA counters are reset when the SA's AN is reused, so these SC counts are a summation for all current and prior SAs belonging to the SC. | |
| secyTxSCStatsGroup | 1.0.8802.1.1.3.2.2.9 | Transmit SC statistics objects. | ||
| C64 secyTxSCStatsOctetsEncrypted | 1.0.8802.1.1.3.1.2.2.1.11 | Counter64 | read-only | The number of plain text octets that are integrity protected and encrypted on the transmit SC. |
| C64 secyTxSCStatsOctetsProtected | 1.0.8802.1.1.3.1.2.2.1.10 | Counter64 | read-only | The number of plain text octets that are integrity protected but not encrypted for this transmit SC. |
| C64 secyTxSCStatsProtectedPkts | 1.0.8802.1.1.3.1.2.2.1.1 | Counter64 | read-only | The number of integrity protected but not encrypted packets for this transmit SC. |
| secyTxSCStatsTable | 1.0.8802.1.1.3.1.2.2 | not-accessible | A table of statistics for each SecY's transmit SC. | |
| TIM secyTxSCStoppedTime | 1.0.8802.1.1.3.1.1.2.1.7 | TimeStamp | read-only | The system time when this transmitting SC last stopped transmitting MACsec frames. |
| secyTxSCTable | 1.0.8802.1.1.3.1.1.2 | not-accessible | A table with an entry for each SecY's transmit SC. |
RFC description
Defines MAC security entity (SecY) managed objects supporting IEEE 802.1AE MACsec protocol for MAC-layer security and secure channels.
Start monitoring Vendor-neutral IEEE 802.1AE standard (Ethernet switch/router/NIC implementing MACsec) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.