JUNIPER-EX-MAC-NOTIFICATION-MIB

All MIBs › JUNIPER-EX-MAC-NOTIFICATION-MIB

Organization: Juniper Networks, Inc.

Last Updated: 2010-04-28

Category: Technology: Switching/L2, Vendor: Juniper

Description: Defines MAC address change notification objects for Juniper Networks EX-series Ethernet switches.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is JUNIPER-EX-MAC-NOTIFICATION-MIB?

JUNIPER-EX-MAC-NOTIFICATION-MIB is a Juniper Networks enterprise MIB for the EX-series Ethernet switch family, implementing MAC address notification -- a feature that informs monitoring systems when MAC addresses are learned or removed from the switch's forwarding database. It exposes global feature-enable flags, a notification interval, running counters of MAC addresses learned and removed, and a history table recording each MAC change event with a timestamp. This is a software/network-state monitoring MIB used to detect endpoint churn, unauthorized device connections, or unexpected MAC flapping on switch ports, which is valuable for security monitoring and troubleshooting network topology changes. It builds on the standard forwarding-database concept shared with BRIDGE-MIB but is a Juniper-specific enterprise extension for EX-series switches. Typical deployment is enterprise or campus network access-layer switches where visibility into device connect/disconnect events is needed. Engineers can download the JUNIPER-EX-MAC-NOTIFICATION-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in JUNIPER-EX-MAC-NOTIFICATION-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Juniper EX-series Ethernet switch

Monitoring Examples

An administrator would enable jnxMacGlobalFeatureEnabled and set jnxMacNotificationInterval, then monitor jnxMacAddressesLearnt and jnxMacAddressesRemoved to see aggregate churn, walking jnxMacHistoryTable/jnxMacHistoryEntry (jnxHistIndex, jnxHistMacChangedMsg, jnxHistTimestamp) to identify exactly which MAC address appeared or disappeared and when. A sudden spike in jnxMacAddressesLearnt combined with rapid history-table entries could indicate a MAC-flooding attack or a rogue device being plugged into an access port. jnxMacNotificationsSent confirms whether traps are actually being generated as expected, and jnxMacHistTableMaxLength bounds how much history is retained.

What Can Be Monitored

MAC addresses learned/removed counts
MAC change history log
notification interval configuration
notifications sent count
per-port MAC learning events

Imported Objects

From JUNIPER-EX-SMI

jnxMacNotificationRoot

OBJECT-IDENTITY

From SNMPv2-SMI

Counter64
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-IDENTITY
OBJECT-TYPE
TimeTicks
Unsigned32

From SNMPv2-TC

TruthValue

How to Use in IPNetwork Monitor

Example using jnxMacAddressesLearnt OID:

Select a Juniper EX-series Ethernet switch (MAC address notification) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type jnxMacAddressesLearnt into the Find box to locate it in the OID tree, then select it and click OK. Indicates the number of MAC addresses learnt by the device. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter64-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
jnxMacNotificationMIB	1.3.6.1.4.1.2636.3.40.1.7.1			This MIB module is for configuration of the MAC notification feature. MAC notification is a mechanism to inform monitoring devices when there are MAC addresses learnt or removed from the forwarding database of the monitored devices.
jnxMacNotificationMIBObjects	1.3.6.1.4.1.2636.3.40.1.7.1.1
jnxMacNotificationMIBGlobalObjects	1.3.6.1.4.1.2636.3.40.1.7.1.1.1
T/F jnxMacGlobalFeatureEnabled	1.3.6.1.4.1.2636.3.40.1.7.1.1.1.1	TruthValue	read-only	Indicates whether the MAC notification feature is currently running in the device. Setting this object to false(2) disables the MAC notification feature globally. Setting this object to true(1) will start the MAC notification feature running in the device. If the feature is already running, setting to true(1) has no effect.
U32 jnxMacNotificationInterval	1.3.6.1.4.1.2636.3.40.1.7.1.1.1.2	Unsigned32	read-only	This object specifies the maximum interval of time between jnxMacChangedNotifications being generated by the device. If the value of jnxNotificationsEnabled is true(1), the device will send out the generated jnxMacChangedNotifications and archive the MAC change notification events in the jnxMacHistoryTable. If the value of jnxNotificationEnabled is false(2), the device will not send out the generated jnxMacChangedNotifications but it will archive these events in the jnxMacHistoryTable. If the value of this object is equal to 0, the device will generate jnxMacChangedNotifications and archive the MAC change notification events in the jnxMacHistoryTable as soon as there is MAC address learnt or removed by the device. If the value of this object is greater than 0, the device will wait for a period of time equal to the value of this object before generate the jnxMacChangedNotifications and archive the MAC change notification events in the jnxMacHistoryTable.
C64 jnxMacAddressesLearntEx	1.3.6.1.4.1.2636.3.40.1.7.1.1.1.3	Counter64	read-only	Indicates the number of MAC addresses learnt by the device.
C64 jnxMacAddressesRemoved	1.3.6.1.4.1.2636.3.40.1.7.1.1.1.4	Counter64	read-only	Indicates the number of MAC addresses removed from the forwarding database.
T/F jnxMacNotificationsEnabled	1.3.6.1.4.1.2636.3.40.1.7.1.1.1.5	TruthValue	read-only	Indicates whether jnxMacChangedNotification notifications will or will not be sent when there are MAC addresses learnt or removed from the device's forwarding database. Disabling notifications does not prevent the MAC address info from being added to the jnxMacHistoryTable.
C64 jnxMacNotificationsSent	1.3.6.1.4.1.2636.3.40.1.7.1.1.1.6	Counter64	read-only	Indicates the number of jnxMacChangedNotifications sent out by the device.
U32 jnxMacHistTableMaxLength	1.3.6.1.4.1.2636.3.40.1.7.1.1.1.7	Unsigned32	read-only	The upper limit on the number of entries that the jnxMacHistoryTable may contain. A value of 0 will prevent any history from being retained. When this table is full, the oldest entry will be deleted and a new one will be created.
jnxMacHistoryTable	1.3.6.1.4.1.2636.3.40.1.7.1.1.1.8		not-accessible	This table will archive the MAC change notification events generated by this device. The MAC change notification events are archived here even if jnxMacChangesNotifications are not actually sent.
jnxMacHistoryEntry	1.3.6.1.4.1.2636.3.40.1.7.1.1.1.8.1		not-accessible	A MAC change notification message that was previously generated by this device. Each entry is indexed by a message index.
U32 jnxHistIndex	1.3.6.1.4.1.2636.3.40.1.7.1.1.1.8.1.1	Unsigned32	not-accessible	An index that uniquely identifies a MAC change notification event previously generated by the device. This index starts at 1 and increases by one when a MAC change notification is generated. When it reaches the maximum value, the agent wraps the value back to 1.
OCT jnxHistMacChangedMsg	1.3.6.1.4.1.2636.3.40.1.7.1.1.1.8.1.2	OCTET STRING	read-only	This object contains the information of a MAC change notification event. It consists of several tuples packed together in the format of '...'. Each tuple consist of 13 octets in the format of '' where is of size 1 octet and supports the following values 0 - End of MIB object. 1 - MAC learnt. 2 - MAC removed. 3 - MAC updated. is VLAN number of the VLAN which the MAC address is belonged to and has size of 2 octet. is the Layer2 Mac Address and has size of 6 octets. is the value of dot1dBasePort for the interface from which the MAC address is learnt and has size of 4 octets.
TIK jnxHistTimestamp	1.3.6.1.4.1.2636.3.40.1.7.1.1.1.8.1.3	TimeTicks	read-only	The value of sysUpTime when the jnxMacChangedNotification containing the information denoted by the jnxHistMacChangedMsg object in this entry was generated.
C64 jnxMacAddressesUpdated	1.3.6.1.4.1.2636.3.40.1.7.1.1.1.9	Counter64	read-only	Indicates the number of MAC addresses updated by the device.
jnxMacNotifications	1.3.6.1.4.1.2636.3.40.1.7.2
jnxMacNotificationsPrefix	1.3.6.1.4.1.2636.3.40.1.7.2.0			All Mac Notifications are registered under this branch.
NTF jnxMacChangedNotification	1.3.6.1.4.1.2636.3.40.1.7.2.0.1			This notification is generated when there is enough MAC address information to fully occupy a maximum size SNMP trap message. This notification is also generated when there is at least one MAC address changed or removed and the amount of time elapsed from the previous notification is greater than the maximum wait time denoted by jnxNotificationInterval object. If there are more MAC addresses information than can fit into one cmmHistTrapContent object, then multiple notifications will be generated.

RFC description

Enables notification when MAC addresses are learned or removed from forwarding database on Juniper EX switches.

Start monitoring Juniper EX-series Ethernet switch (MAC address notification) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download JUNIPER-EX-MAC-NOTIFICATION-MIB