Juniper-DOS-PROTECTION-MIB

All MIBs › Juniper-DOS-PROTECTION-MIB

Organization: Juniper Networks, Inc.

Last Updated: 2008-05-06

Category: Domain: Security, Vendor: Juniper

Description: Provides managed objects for DoS attack detection, filtering, and mitigation statistics on Juniper Networks E-series routers.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is Juniper-DOS-PROTECTION-MIB?

Juniper-DOS-PROTECTION-MIB is a Juniper Networks proprietary MIB for the DoS Protection application on the Juniper E-Series (ERX) product family, which detects suspicious flows via state-change/flow-detection-and-suppression (SCFDS) heuristics. Its objects cover a global state, grouping mode, clear-all action, discontinuity time, table-overflow state, and current/cumulative counts of suspicious flows, suspicious-flow groups, false-negative flows, and table overflows, while a per-protocol table sets detection/clear thresholds and back-off time with a state and transition count, and a DoS-protection-group (DPG) table defines canned or custom protection profiles. As a configuration/security-status MIB it lets an administrator confirm DoS protection thresholds per protocol and watch suspicious-flow counts for an active attack. It is deployed on Juniper Networks E-Series (ERX) routers. Engineers can download the Juniper-DOS-PROTECTION-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in Juniper-DOS-PROTECTION-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Juniper Networks E-Series (ERX) routers

Monitoring Examples

An administrator monitors juniDosProtectionScfdsGlobalCurrentSuspiciousFlows to catch an active DoS attack in progress against a Juniper E-Series router.

What Can Be Monitored

DoS protection thresholds and suspicious-flow counts

Imported Objects

From IF-MIB

InterfaceIndex

From Juniper-MIBs

juniMibs

MODULE-IDENTITY

From Juniper-TC

JuniEnable

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Counter32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DisplayString
RowStatus
TEXTUAL-CONVENTION
TruthValue

How to Use in IPNetwork Monitor

Example using juniDosProtectionScfdsGlobalCurrentSuspiciousFlows OID:

Select a Juniper Networks E-Series (ERX) router (DoS Protection application) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type juniDosProtectionScfdsGlobalCurrentSuspiciousFlows into the Find box to locate it in the OID tree, then select it and click OK. The number of flows currently marked as suspicious. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
juniDosProtectionMIB	1.3.6.1.4.1.4874.2.2.80			The DOS Protection MIB for the Juniper E-Series product family. This MIB contains managed objects for the DOS Protection application. Management objects are provided to control and monitor the DOS protection application.
juniDosProtectionObjects	1.3.6.1.4.1.4874.2.2.80.1
juniDosProtectionScfdsGroup	1.3.6.1.4.1.4874.2.2.80.1.1
JUN juniDosProtectionScfdsGlobalState	1.3.6.1.4.1.4874.2.2.80.1.1.1	JuniEnable	read-write	Controls whether the suspicious control flow detection system is enabled or disabled. Setting the value to enable(1) enables the suspicious control flow detection system. Setting the value to disable(0) disables the system. When read this object returns the current state of the system.
JUN juniDosProtectionScfdsGlobalGrouping	1.3.6.1.4.1.4874.2.2.80.1.1.2	JuniEnable	read-write	When set to enable(1), the suspicious flow control system will group flows when resources are unavailable to treat each suspicious flow individually. When set to disable(0), this feature will be inhibited and the suspicious control flow system may not recognize all suspicious flows during a resource shortage. When read this object will return the current state of the object.
INT juniDosProtectionScfdsGlobalClearAll	1.3.6.1.4.1.4874.2.2.80.1.1.3	INTEGER	read-write	When set to clear(1), the suspicious control flow detection system is cleared. When set to ok(0), there is no effect and the suspicious control flow detection system is unchanged. By clearing the suspicious control flow detection system all flows are removed from the suspicious flow table. When read, always returns a value of ok(0).
U32 juniDosProtectionScfdsGlobalDiscontinuityTime	1.3.6.1.4.1.4874.2.2.80.1.1.4	Unsigned32	read-only	The sysUpTime at which the counters were last re-initialized on any slot due to a restart.
JUN juniDosProtectionScfdsGlobalTableOverflowState	1.3.6.1.4.1.4874.2.2.80.1.1.5	JuniDosProtectionScfdsTableOverflowState	read-only	Indicates whether any module in the system is in under a resource shortage situation. A value of notOverflowingOrGrouping(1) indicates that there is no resource shortage on any module. A value of grouping(2) or overflowing(3) indicates that at least one module is suffering from a resource shortage, and has acted according to the state of the juniDosProtectionScfdsGlobalGrouping object.
C32 juniDosProtectionScfdsGlobalCurrentSuspiciousFlowsEx	1.3.6.1.4.1.4874.2.2.80.1.1.6	Counter32	read-only	The number of flows currently marked as suspicious.
C32 juniDosProtectionScfdsGlobalNumberSuspiciousFlows	1.3.6.1.4.1.4874.2.2.80.1.1.7	Counter32	read-only	The number of suspicious flows seen since system restart.
C32 juniDosProtectionScfdsGlobalCurrentSuspiciousFlowGroups	1.3.6.1.4.1.4874.2.2.80.1.1.8	Counter32	read-only	The number of flow groups currently marked as suspicious.
C32 juniDosProtectionScfdsGlobalNumberSuspiciousFlowGroups	1.3.6.1.4.1.4874.2.2.80.1.1.9	Counter32	read-only	The number of suspicius flow groups seen since system restart.
C32 juniDosProtectionScfdsGlobalCurrentFalseNegativeFlows	1.3.6.1.4.1.4874.2.2.80.1.1.10	Counter32	read-only	The number of flows currently falsely considered suspicious. A false negative indicates that the flow was seen as possibly suspicious, but did not pass all the tests to be considered suspicious. This is a normal condition of the system.
C32 juniDosProtectionScfdsGlobalNumberFalseNegativeFlows	1.3.6.1.4.1.4874.2.2.80.1.1.11	Counter32	read-only	The number of flows falsely considered possibly suspicious seen since system restart.
C32 juniDosProtectionScfdsGlobalNumberTableOverflows	1.3.6.1.4.1.4874.2.2.80.1.1.12	Counter32	read-only	The total number of times the system had a table overflow on any slot.
juniDosProtectionScfdsProtocolTable	1.3.6.1.4.1.4874.2.2.80.1.1.13		not-accessible	The information for the DOS protection control protocols.
juniDosProtectionScfdsProtocolEntry	1.3.6.1.4.1.4874.2.2.80.1.1.13.1		not-accessible	The information for an individual DOS protection control protocol.
JUN juniDosProtectionScfdsProtocolIndex	1.3.6.1.4.1.4874.2.2.80.1.1.13.1.1	JuniDosProtectionProtocolType	not-accessible	The control protocol value for this entry.
U32 juniDosProtectionScfdsProtocolThreshold	1.3.6.1.4.1.4874.2.2.80.1.1.13.1.2	Unsigned32	read-write	The threshold in packets per second for this control protocol. This is the rate at which a flow for this protocol is considered suspicious. Setting this object to zero will have the affect of excusing this protocol from suspicious control flow detection.
U32 juniDosProtectionScfdsProtocolLowThreshold	1.3.6.1.4.1.4874.2.2.80.1.1.13.1.3	Unsigned32	read-write	The low threshold in packets per second for this control protocol . This is the rate at which a flow must fall below to in order return to the normal state, after having been marked suspicious. A low threshold of zero disables this functionality.
U32 juniDosProtectionScfdsProtocolBackoffTime	1.3.6.1.4.1.4874.2.2.80.1.1.13.1.4	Unsigned32	read-write	The backoff time in seconds. A flow which is considered suspicious will be returned to normal after this amount of time regardless of the current rate of the flow. A backoff time of 0 disables this functionality.
JUN juniDosProtectionScfdsProtocolState	1.3.6.1.4.1.4874.2.2.80.1.1.13.1.5	JuniDosProtectionProtocolState	read-only	The current state of the protocol. This object will return inTrouble(2) if any module in the system has reported that the protocol is currently being watched for suspicious flows. If no module reports that this protocol is being watched this object will return ok(1). A protocol is in trouble on a module when the sum of the rate for all flows for the protocol is over the limit for that protocol.
C32 juniDosProtectionScfdsProtocolTransitions	1.3.6.1.4.1.4874.2.2.80.1.1.13.1.6	Counter32	read-only	The number of transitions to 'inTrouble' that this control protocol has made.
juniDosProtectionDpgGroup	1.3.6.1.4.1.4874.2.2.80.1.2
juniDosProtectionDpgTable	1.3.6.1.4.1.4874.2.2.80.1.2.1		not-accessible	The information for a dos-protection-group. A dos-protection-group defines a set of parameters that manage the handling of control protocols on the router.
juniDosProtectionDpgEntry	1.3.6.1.4.1.4874.2.2.80.1.2.1.1		not-accessible	The information for an individual dos-protection-group.
STR juniDosProtectionDpgIndex	1.3.6.1.4.1.4874.2.2.80.1.2.1.1.1	DisplayString	not-accessible	The dos-protection-group-name for this entry.
ROW juniDosProtectionDpgRowStatus	1.3.6.1.4.1.4874.2.2.80.1.2.1.1.2	RowStatus	read-create	Controls creation/deletion of entries in this table. Only the values 'createAndGo' and 'destroy' may be SET. When read this always returns a value of active
JUN juniDosProtectionDpgCanned	1.3.6.1.4.1.4874.2.2.80.1.2.1.1.3	JuniDosProtectionProtocolCannedType	read-create	Sets the default values based for the dos-protection-group based on the values from the canned group. Can only be used to set a different group. Using the current group will result in no changes to the dos-protection-group.
INT juniDosProtectionDpgRevert	1.3.6.1.4.1.4874.2.2.80.1.2.1.1.4	INTEGER	read-create	Revert this dos-protection-group to the canned values of the associated canned group by setting this object to revert(1). Reading this object will always return a value of no-revert(1)
T/F juniDosProtectionDpgModified	1.3.6.1.4.1.4874.2.2.80.1.2.1.1.5	TruthValue	read-only	When true is returned, some protocol or priority associated with this dos-protection-group, has been modified from the canned values associated with the group. When false is returned all settings associated with this dos-protection-group are at the defaults for the associated canned group.
INT juniDosProtectionDpgReferences	1.3.6.1.4.1.4874.2.2.80.1.2.1.1.6	INTEGER	read-only	The number of references for this dos-protection-group. References include the number of interfaces currently associated with the group, as well as the number of profile references.
juniDosProtectionDpgProtocolTable	1.3.6.1.4.1.4874.2.2.80.1.2.2		not-accessible	The information for the dos-protection-group control protocol table.
juniDosProtectionDpgProtocolEntry	1.3.6.1.4.1.4874.2.2.80.1.2.2.1		not-accessible	The information for an individual dos-protection-group control protocol entry.
STR juniDosProtectionDpgProtocolName	1.3.6.1.4.1.4874.2.2.80.1.2.2.1.1	DisplayString	not-accessible	The dos-protection-group name for this entry.
JUN juniDosProtectionDpgProtocolProtocol	1.3.6.1.4.1.4874.2.2.80.1.2.2.1.2	JuniDosProtectionProtocolType	not-accessible	The dos-protection-group control protocol for this entry.
U32 juniDosProtectionDpgProtocolBurst	1.3.6.1.4.1.4874.2.2.80.1.2.2.1.3	Unsigned32	read-write	The burst in packets for this control protocol in this dos-protection-group.
U32 juniDosProtectionDpgProtocolDropProbability	1.3.6.1.4.1.4874.2.2.80.1.2.2.1.4	Unsigned32	read-write	The drop probability for suspect packets for this control protocol in this dos-protection-group. This is probability that a packet belonging to a suspicious flow will be dropped. A drop probability of less than 100 indicates that the user wishes to have some packets from a suspect flow reach the control processor.
U32 juniDosProtectionDpgProtocolRate	1.3.6.1.4.1.4874.2.2.80.1.2.2.1.5	Unsigned32	read-write	The rate in packets per second for this control protocol in this dos-protection-group.
JUN juniDosProtectionDpgProtocolSkipPriorityRateLimiter	1.3.6.1.4.1.4874.2.2.80.1.2.2.1.6	JuniEnable	read-write	When set to enable, this control protocol in this dos-protection-group will skip the priority rate limiter. When set to disable, the protocol will not skip the priority rate-limiter.
U32 juniDosProtectionDpgProtocolWeight	1.3.6.1.4.1.4874.2.2.80.1.2.2.1.7	Unsigned32	read-write	The weight of this control protocol against others of the same priority in this dos-protection-group. The weight is used to determine the minimum rate and burst for the protocol within the priority group.
JUN juniDosProtectionDpgProtocolPriority	1.3.6.1.4.1.4874.2.2.80.1.2.2.1.8	JuniDosProtectionProtocolPriorityType	read-write	The priority for the control protocol. Packets of this control protocol on interfaces referencing this dos-protection-group will be categorized into the priority indicated.
T/F juniDosProtectionDpgProtocolModified	1.3.6.1.4.1.4874.2.2.80.1.2.2.1.9	TruthValue	read-only	When true is returned, the values for this control protocol in this dos-protection-group have been modified from the canned values associated with the group. When false is returned all settings associated with this control protocol in this dos-protection-group are at the defaults for the associated canned group.
JUN juniDosProtectionDpgProtocolDestination	1.3.6.1.4.1.4874.2.2.80.1.2.2.1.10	JuniDosProtectionControlProcessorDestination	read-only	The destination processor for packets of this control protocol.
juniDosProtectionDpgPriorityTable	1.3.6.1.4.1.4874.2.2.80.1.2.3		not-accessible	The information for a dos-protection-group priority table.
juniDosProtectionDpgPriorityEntry	1.3.6.1.4.1.4874.2.2.80.1.2.3.1		not-accessible	The information for an individual dos-protection-group priority table
STR juniDosProtectionDpgPriorityName	1.3.6.1.4.1.4874.2.2.80.1.2.3.1.1	DisplayString	not-accessible	The dos-proteciton-group name for this entry.
JUN juniDosProtectionDpgPriorityPriority	1.3.6.1.4.1.4874.2.2.80.1.2.3.1.2	JuniDosProtectionPriorityType	not-accessible	The priority for this entry.
U32 juniDosProtectionDpgPriorityBurst	1.3.6.1.4.1.4874.2.2.80.1.2.3.1.3	Unsigned32	read-write	The burst in packets for this priority in this dos-protection-group.
U32 juniDosProtectionDpgPriorityOverSubscriptionFactor	1.3.6.1.4.1.4874.2.2.80.1.2.3.1.4	Unsigned32	read-write	The over-subscription factor for this priority in this dos-protection-group. This is used when calculating the minimum rates for control protocols that use this priority.
U32 juniDosProtectionDpgPriorityRate	1.3.6.1.4.1.4874.2.2.80.1.2.3.1.5	Unsigned32	read-write	The rate in packets per second for this priority in this dos-protection-group.
T/F juniDosProtectionDpgPriorityModified	1.3.6.1.4.1.4874.2.2.80.1.2.3.1.6	TruthValue	read-only	When true is returned, the values for this priority in this dos-protection-group have been modified from the canned values associated with the group. When false is returned all settings associated with this priority in this dos-protection-group are at the defaults for the associated canned group.
juniDosProtectionDpgAttachTable	1.3.6.1.4.1.4874.2.2.80.1.2.4		not-accessible	The information for the DOS protection attachment table.
juniDosProtectionDpgAttachEntry	1.3.6.1.4.1.4874.2.2.80.1.2.4.1		not-accessible	The information for an individual DOS protection attachment entry.
NUM juniDosProtectionDpgAttachIndex	1.3.6.1.4.1.4874.2.2.80.1.2.4.1.1	InterfaceIndex	not-accessible	The interface index for the attachment.
ROW juniDosProtectionDpgAttachRowStatus	1.3.6.1.4.1.4874.2.2.80.1.2.4.1.2	RowStatus	read-create	Controls creation/deletion of entries in this table. Only the values 'createAndGo' and 'destroy' may be SET. When read this always returns a value of active
STR juniDosProtectionDpgAttachName	1.3.6.1.4.1.4874.2.2.80.1.2.4.1.3	DisplayString	read-create	The dos-protection-group for this entry. This is the dos-protection-group that is use by the interface.
T/F juniDosProtectionDpgAttachConfigured	1.3.6.1.4.1.4874.2.2.80.1.2.4.1.4	TruthValue	read-create	Indicates the configured status of the attachment. This object returns true when the attachment was statically configured, and returns false when the attachment was made via a profile attachment.
juniDosProtectionDpgProfileTable	1.3.6.1.4.1.4874.2.2.80.1.2.5		not-accessible	The information for the DOS protection profile table.
juniDosProtectionDpgProfileEntry	1.3.6.1.4.1.4874.2.2.80.1.2.5.1		not-accessible	The information for an individual DOS protection profile entry.
U32 juniDosProtectionDpgProfileProfileId	1.3.6.1.4.1.4874.2.2.80.1.2.5.1.1	Unsigned32	not-accessible	The profile ID for the profile entry. The profile ID identifies which profile is being accessed. A value for this identifier is determined by locating or creating a profile name in the juniProfileNameTable
JUN juniDosProtectionDpgProfileLayerId	1.3.6.1.4.1.4874.2.2.80.1.2.5.1.2	JuniDosProtectionLayerId	not-accessible	The layer ID for the profile entry. The layer ID indicates which interface type is being accessed.
ROW juniDosProtectionDpgProfileRowStatus	1.3.6.1.4.1.4874.2.2.80.1.2.5.1.3	RowStatus	read-create	Controls creation/deletion of entries in this table. Only the values 'createAndGo' and 'destroy' may be SET. When read this always returns a value of active
STR juniDosProtectionDpgProfileName	1.3.6.1.4.1.4874.2.2.80.1.2.5.1.4	DisplayString	read-create	The dos-protection-group that is associated with this profile/interface-type. This profile will be attached when dynamic instances of the interface type are created that reference the specific profile.
juniDosProtectionMIBConformance	1.3.6.1.4.1.4874.2.2.80.4
juniDosProtectionMIBCompliances	1.3.6.1.4.1.4874.2.2.80.4.1
juniDosProtectionCompliance	1.3.6.1.4.1.4874.2.2.80.4.1.1			The compliance statement for entities which implement the Juniper Dos Protection MIB. This was made obsolete with the addition of dos-protection-groups.
juniDosProtectionCompliance2	1.3.6.1.4.1.4874.2.2.80.4.1.2			The compliance statement for entities which implement the Juniper Dos Protection MIB.
juniDosProtectionMIBGroups	1.3.6.1.4.1.4874.2.2.80.4.2
juniDosProtectionGroup	1.3.6.1.4.1.4874.2.2.80.4.2.1			A collection of objects providing management of DOS protection application in a Juniper product. This object became obsolete with the addition of dos-protection-groups.
juniDosProtectionGroup2	1.3.6.1.4.1.4874.2.2.80.4.2.2			A collection of objects providing management of DOS protection application in a Juniper product.

RFC description

Manages DOS protection application on Juniper E-Series routers with control protocols and attack mitigation.

Start monitoring Juniper Networks E-Series (ERX) router (DoS Protection application) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download Juniper-DOS-PROTECTION-MIB