All MIBs › IPFWACC-MIB
Category: Domain: Security, IP and Core Protocols, Technology: Traffic Monitoring, VPN and Security
Description: IP firewall accounting MIB providing SNMP objects for collecting per-rule traffic accounting statistics from IP firewall implementations.
Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.
What Is IPFWACC-MIB?
IPFWACC-MIB is a vendor-neutral MIB providing SNMP objects for per-rule IP firewall traffic accounting, commonly associated with ipfwadm/ipchains/ipfw-style firewall accounting tools. It belongs to the network security/traffic-accounting monitoring category. It exposes a single accounting table listing each firewall rule's source/destination address and netmask, forwarding interface, protocol, and direction/bidirectionality flags along with associated traffic counters. Its monitoring value is in tracking software-level firewall activity - how much traffic each accounting rule has matched by source/destination/protocol - helping an administrator spot unexpected traffic spikes, a misfiring firewall rule, or unauthorized traffic patterns. It relies on the underlying host's firewall/packet-filter subsystem for its accounting data rather than another SNMP MIB, and is typically deployed on Linux or BSD-based routers/firewalls used for network security policy enforcement. Engineers implementing or auditing this functionality typically reference the IPFWACC-MIB RFC/standard documentation for the authoritative specification.
IPNetwork Monitor allows you to monitor SNMP objects defined in IPFWACC-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.
Supported Devices
- Linux or BSD-based firewall/router
- vendor-neutral, standards-based MIB implemented by firewall software, not a specific manufacturer's hardware
Monitoring Examples
An administrator can poll ipFwAccTable/ipFwAccEntry indexed by ipFwAccIndex, examining ipFwAccSrcAddr/ipFwAccSrcNetMask and ipFwAccDstAddr/ipFwAccDstNetMask to identify which traffic pattern a given accounting rule matches. The ipFwAccProto and ipFwAccDir/ipFwAccBidir fields show which protocol and direction is being counted, and a rapidly climbing counter associated with an ipFwAccViaName/ipFwAccViaAddr entry pointing at an unexpected interface would flag unusual or unauthorized traffic flowing through the firewall.
What Can Be Monitored
- per-rule source/destination address and mask
- per-rule protocol matched
- per-rule traffic direction
- outbound interface per rule
Imported Objects
From RFC1155-SMI
| Counter |
From SNMPv2-SMI
| IpAddress | |
| OBJECT-TYPE |
From SNMPv2-TC
| DisplayString |
From UCD-SNMP-MIB
| ucdExperimental | OBJECT-IDENTITY |
| ucdavis | MODULE-IDENTITY |
OIDs
RFC description
Accounting rules and traffic statistics for IP Firewall with packet and byte counters.
Start monitoring Linux/BSD-based firewall/router (ipfwadm/ipchains/ipfw-style accounting) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.