IPFILTER

Description: BSD IP filter MIB providing SNMP objects for monitoring ipfilter packet filtering rule counters and state table on Unix/BSD systems.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

IPFILTER is a vendor-neutral MIB for monitoring the ipfilter (ipf) packet-filtering firewall found on BSD and other Unix systems. It exposes inbound and outbound rule tables with per-rule hit counters and accounting tables that tally matched traffic. Its monitoring focus is squarely on software firewall/security-service health: per-rule hit counts reveal which filtering rules are actively matching traffic, helping validate that firewall policy is behaving as intended and surfacing anomalies such as a deny rule with rapidly rising hits that suggests a scan or attack. It has no significant dependency on other MIBs beyond the standard SNMP framework, since ipfilter accounting is fundamentally self-contained. It is deployed on BSD/Unix-based firewalls and routers running the ipfilter packet filter. Engineers can download the IPFILTER file directly to load it into their MIB browser.

ipfInTable/ipfInEntry keyed by ipfInIndex exposes ipfInRule and ipfInHits to show how many packets matched a specific inbound filter rule, while the corresponding ipfOutTable/ipfOutEntry does the same for outbound traffic. A sudden spike in ipfInHits for a deny rule, or in the related ipfAccInTable accounting entries, would indicate a scan or attack being blocked, whereas an unexpectedly low hit count on a rule could reveal it stopped matching after a routing change.

Monitors IP Filter rules and packet statistics for incoming and outgoing firewall rules.