Juniper-DOS-PROTECTION-PLATFORM-MIB

All MIBs › Juniper-DOS-PROTECTION-PLATFORM-MIB

Organization: Juniper Networks, Inc.

Last Updated: 2006-07-01

Category: Domain: Security, Vendor: Juniper

Description: Provides platform-specific managed objects for hardware-accelerated DoS protection on Juniper Networks E-series router platforms.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is Juniper-DOS-PROTECTION-PLATFORM-MIB?

Juniper-DOS-PROTECTION-PLATFORM-MIB is a Juniper Networks enterprise MIB providing platform-specific managed objects for hardware-accelerated Denial-of-Service (DoS) protection on E-series routers, covering the SCFDS (a hardware DoS-filtering subsystem) per-slot protocol and flow state. It exposes per-slot, per-protocol state and transition counters, as well as per-slot flow entries tied to interface index, group ID, and protocol. This MIB directly supports hardware/software fault monitoring: juniDosProtectionScfdsSlotProtocolState and its transition counters reveal whether the hardware DoS-protection engine on a given line-card slot is functioning normally or has flapped/failed, which is critical for detecting a DoS-mitigation subsystem outage. It is platform-specific and complements the general Juniper DOS Protection MIB, tying protection state to physical slot and interface identifiers from the chassis/interface MIBs. It is deployed on Juniper E-series routers with hardware-based DoS protection enabled on line cards handling high volumes of subscriber or transit traffic. Engineers can download the Juniper-DOS-PROTECTION-PLATFORM-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in Juniper-DOS-PROTECTION-PLATFORM-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Juniper E-series broadband access routers

Monitoring Examples

An operator would poll juniDosProtectionScfdsSlotProtocolTable/juniDosProtectionScfdsSlotProtocolEntry to check juniDosProtectionScfdsSlotProtocolState per juniDosProtectionScfdsSlotProtocolSlot and juniDosProtectionScfdsSlotProtocolIndex, where an increasing juniDosProtectionScfdsSlotProtocolTransitions count signals instability in the hardware DoS-protection engine for that protocol on that slot. juniDosProtectionScfdsSlotFlowTable/juniDosProtectionScfdsSlotFlowEntry lets the admin inspect juniDosProtectionScfdsSlotFlowGroupId and juniDosProtectionScfdsSlotFlowProtocol per juniDosProtectionScfdsSlotFlowIfIndex to see which flows are being tracked/filtered on a given slot and interface, useful for confirming DoS mitigation is engaged on the expected traffic.

What Can Be Monitored

per-slot DoS protection protocol state
protocol state transition count
per-slot flow group/protocol tracking
interface-level DoS filter association

Imported Objects

From IF-MIB

InterfaceIndex

From Juniper-DOS-PROTECTION-MIB

JuniDosProtectionPriorityType
JuniDosProtectionProtocolState
JuniDosProtectionProtocolType
JuniDosProtectionScfdsTableOverflowState

From Juniper-MIBs

juniMibs

MODULE-IDENTITY

From Juniper-TC

JuniEnable

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Integer32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DisplayString
MacAddress
TEXTUAL-CONVENTION
TruthValue

How to Use in IPNetwork Monitor

Example using juniDosProtectionScfdsSlotProtocolTransitions OID:

Select a Juniper E-series broadband access router (hardware-accelerated DoS protection) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type juniDosProtectionScfdsSlotProtocolTransitions into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. The number of transitions to 'inTrouble' that this control protocol has made for this slot. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
juniDosProtectionPlatformMIB	1.3.6.1.4.1.4874.2.2.81			The DOS Protection MIB for the Juniper E-Series product family. This MIB contains managed objects for the DOS Protection application, which are platform specific. Management objects are provided to control and monitor the DOS protection application.
juniDosProtectionPlatformTraps	1.3.6.1.4.1.4874.2.2.81.0
juniDosProtectionPlatformScfdsTraps	1.3.6.1.4.1.4874.2.2.81.0.0
NTF juniDosProtectionScfdsSuspiciousControlFlow	1.3.6.1.4.1.4874.2.2.81.0.0.1			This trap will be generated when a control flow becomes suspicious.
NTF juniDosProtectionScfdsNonSuspiciousControlFlow	1.3.6.1.4.1.4874.2.2.81.0.0.2			This trap will be generated when a control flow becomes no longer suspicious
NTF juniDosProtectionScfdsSuspiciousControlFlowGroup	1.3.6.1.4.1.4874.2.2.81.0.0.3			This trap will be generated when a control flow that represents a group becomes suspicious.
NTF juniDosProtectionScfdsNonSuspiciousControlFlowGroup	1.3.6.1.4.1.4874.2.2.81.0.0.4			This trap will be generated when a control flow that represents a group becomes no longer suspicious.
NTF juniDosProtectionScfdsTableFull	1.3.6.1.4.1.4874.2.2.81.0.0.5			This trap will be generated when the suspicious flow control table becomes full on a slot.
NTF juniDosProtectionScfdsTableNotFull	1.3.6.1.4.1.4874.2.2.81.0.0.6			This trap will be generated when the suspicious flow control table is no longer full on a slot.
NTF juniDosProtectionScfdsGroupingInUse	1.3.6.1.4.1.4874.2.2.81.0.0.7			This trap will be generated when the suspicious flow control system begins to group flow controls on a slot, due to the suspicious flow control table being full.
NTF juniDosProtectionScfdsSuspiciousProtocol	1.3.6.1.4.1.4874.2.2.81.0.0.8			This trap will be generated when a control protocol becomes suspicious on a slot, and therefore the suspicious control flow system begins to watch flows of this control protocol type.
NTF juniDosProtectionScfdsNonSuspiciousProtocol	1.3.6.1.4.1.4874.2.2.81.0.0.9			This trap will be generated when a control protocol becomes no longer suspicious on a slot, and therefore the suspicious control flow system will no longer watch flows of this control protocol type.
NTF juniDosProtectionScfdsSuspiciousPriority	1.3.6.1.4.1.4874.2.2.81.0.0.10			This trap will be generated when a control priority becomes suspicious on a slot.
NTF juniDosProtectionScfdsNonSuspiciousPriority	1.3.6.1.4.1.4874.2.2.81.0.0.11			This trap will be generated when a control priority becomes no longer suspicious on a slot.
NTF juniDosProtectionScfdsSuspiciousControlFlowMac	1.3.6.1.4.1.4874.2.2.81.0.0.12			This trap will be generated when a control flow becomes suspicious.
NTF juniDosProtectionScfdsNonSuspiciousControlFlowMac	1.3.6.1.4.1.4874.2.2.81.0.0.13			This trap will be generated when a control flow becomes no longer suspicious
juniDosProtectionPlatformObjects	1.3.6.1.4.1.4874.2.2.81.1
juniDosProtectionPlatformScfdsGroup	1.3.6.1.4.1.4874.2.2.81.1.1
juniDosProtectionScfdsSlotProtocolTable	1.3.6.1.4.1.4874.2.2.81.1.1.1		not-accessible	The information for the DOS protection control protocols for a specific slot.
juniDosProtectionScfdsSlotProtocolEntry	1.3.6.1.4.1.4874.2.2.81.1.1.1.1		not-accessible	The information for an individual control protocol on a specific slot.
U32 juniDosProtectionScfdsSlotProtocolSlot	1.3.6.1.4.1.4874.2.2.81.1.1.1.1.1	Unsigned32	not-accessible	The slot value for the entry.
JUN juniDosProtectionScfdsSlotProtocolIndex	1.3.6.1.4.1.4874.2.2.81.1.1.1.1.2	JuniDosProtectionProtocolType	not-accessible	The control protocol value for the entry.
JUN juniDosProtectionScfdsSlotProtocolState	1.3.6.1.4.1.4874.2.2.81.1.1.1.1.3	JuniDosProtectionProtocolState	read-only	The current state of the protocol. This object will return inTrouble(2) if the specific slot referenced is reporting that the protocol is currently being watched for suspicious flows. If the module is not reporting that this protocol is being watched this object will return ok(1). A protocol is in trouble for a slot when the sum of the rate of all flows for the protocol is over the limit for that protocol.
C32 juniDosProtectionScfdsSlotProtocolTransitionsEx	1.3.6.1.4.1.4874.2.2.81.1.1.1.1.4	Counter32	read-only	The number of transitions to 'inTrouble' that this control protocol has made for this slot.
juniDosProtectionScfdsSlotFlowTable	1.3.6.1.4.1.4874.2.2.81.1.1.2		not-accessible	Information about suspicious control flows.
juniDosProtectionScfdsSlotFlowEntry	1.3.6.1.4.1.4874.2.2.81.1.1.2.1		not-accessible	Information about a suspicious control flow.
U32 juniDosProtectionScfdsSlotFlowSlot	1.3.6.1.4.1.4874.2.2.81.1.1.2.1.1	Unsigned32	not-accessible	The slot value for the flow.
NUM juniDosProtectionScfdsSlotFlowIfIndex	1.3.6.1.4.1.4874.2.2.81.1.1.2.1.2	InterfaceIndex	not-accessible	The ifIndex value for the flow. For group flows, this value will be zero.
U32 juniDosProtectionScfdsSlotFlowGroupId	1.3.6.1.4.1.4874.2.2.81.1.1.2.1.3	Unsigned32	not-accessible	The group id for the flow. The group id will be zero for an individual flow. It is non-zero when the entry represents a group of flows.
JUN juniDosProtectionScfdsSlotFlowProtocol	1.3.6.1.4.1.4874.2.2.81.1.1.2.1.4	JuniDosProtectionProtocolType	not-accessible	The control protocol for the flow.
U32 juniDosProtectionScfdsSlotFlowRate	1.3.6.1.4.1.4874.2.2.81.1.1.2.1.5	Unsigned32	read-only	The current rate in packets per second for the flow.
U32 juniDosProtectionScfdsSlotFlowPeakRate	1.3.6.1.4.1.4874.2.2.81.1.1.2.1.6	Unsigned32	read-only	The peak rate in packets per second for the flow.
U32 juniDosProtectionScfdsSlotFlowTimeFlagged	1.3.6.1.4.1.4874.2.2.81.1.1.2.1.7	Unsigned32	read-only	The sysUpTime value for the time when the flow was determined to be suspicious.
I32 juniDosProtectionScfdsSlotFlowIngressSlot	1.3.6.1.4.1.4874.2.2.81.1.1.2.1.8	Integer32	read-only	For control flow that are monitored on the egress processor in the forwarding path, this value will indicate the possible ingress slot for data stream that is possibly causing this suspicious flow control. This object will report -1 when it is undefined
T/F juniDosProtectionScfdsSlotFlowGroup	1.3.6.1.4.1.4874.2.2.81.1.1.2.1.9	TruthValue	read-only	Indicates whether the flow is a group flow or not. A value of true(1) indicates that the flow represents a group of flows. A value of false(2) indicates that the flow is an individual flow.
INT juniDosProtectionScfdsSlotFlowClearEntry	1.3.6.1.4.1.4874.2.2.81.1.1.2.1.10	INTEGER	read-write	When set to clear(1), the suspicious control flow is removed from the suspicious control flow table. When set to ok(0), there is no effect and the suspicious control flow is unchanged. When read, always returns a value of ok(0).
juniDosProtectionScfdsSlotTable	1.3.6.1.4.1.4874.2.2.81.1.1.3		not-accessible	The suspicious control flow information for each slot.
juniDosProtectionScfdsSlotEntry	1.3.6.1.4.1.4874.2.2.81.1.1.3.1		not-accessible	The information for a specific slot.
U32 juniDosProtectionScfdsSlotSlot	1.3.6.1.4.1.4874.2.2.81.1.1.3.1.1	Unsigned32	not-accessible	The slot value for this entry.
INT juniDosProtectionScfdsSlotClearAll	1.3.6.1.4.1.4874.2.2.81.1.1.3.1.2	INTEGER	read-write	When set to clear(1), the suspicious control flow detection system is cleared for this slot. When set to ok(0), there is no effect and the suspicious control flow detection system is unchanged. By clearing the suspicious control flow detection system all flows on the slot are removed from the suspicious flow table. When read, always returns a value of ok(0).
U32 juniDosProtectionScfdsSlotDiscontinuityTime	1.3.6.1.4.1.4874.2.2.81.1.1.3.1.3	Unsigned32	read-only	The sysUpTime at which the counters were re-adjusted due to slot restart.
JUN juniDosProtectionScfdsSlotTableOverflowState	1.3.6.1.4.1.4874.2.2.81.1.1.3.1.4	JuniDosProtectionScfdsTableOverflowState	read-only	Indicates whether this slot is under a resource shortage situation. A value of notOverflowingOrGrouping(1) indicates that there is no resource shortage on the slot. A value of grouping(2) or overflowing(3) indicates that this module is suffering from a resource shortage and has acted according to the state of the juniDosProtectionScfdsGlobalGrouping object.
C32 juniDosProtectionScfdsSlotCurrentSuspiciousFlows	1.3.6.1.4.1.4874.2.2.81.1.1.3.1.5	Counter32	read-only	The number of flows currently marked as suspicious for this slot.
C32 juniDosProtectionScfdsSlotNumberSuspiciousFlows	1.3.6.1.4.1.4874.2.2.81.1.1.3.1.6	Counter32	read-only	The number of suspicious flows seen on this slot, since slot restart
C32 juniDosProtectionScfdsSlotNumberSuspiciousFlowGroups	1.3.6.1.4.1.4874.2.2.81.1.1.3.1.7	Counter32	read-only	The number of suspicius flow groups seen on this slot since slot restart.
C32 juniDosProtectionScfdsSlotCurrentSuspiciousFlowGroups	1.3.6.1.4.1.4874.2.2.81.1.1.3.1.8	Counter32	read-only	The number of flows currently falsely considered suspicious for this slot.
C32 juniDosProtectionScfdsSlotCurrentFalseNegativeFlows	1.3.6.1.4.1.4874.2.2.81.1.1.3.1.9	Counter32	read-only	The number of flows currently falsely considered suspicious on this slot.
C32 juniDosProtectionScfdsSlotNumberFalseNegativeFlows	1.3.6.1.4.1.4874.2.2.81.1.1.3.1.10	Counter32	read-only	The number of suspicious flows seen on this slot, since this slot restart.
C32 juniDosProtectionScfdsSlotOverflows	1.3.6.1.4.1.4874.2.2.81.1.1.3.1.11	Counter32	read-only	The number of times this slot has had a table overflow.
juniDosProtectionScfdsSlotFlowMacTable	1.3.6.1.4.1.4874.2.2.81.1.1.4		not-accessible	Information about suspicious control flows.
juniDosProtectionScfdsSlotFlowMacEntry	1.3.6.1.4.1.4874.2.2.81.1.1.4.1		not-accessible	Information about a suspicious control flow.
U32 juniDosProtectionScfdsSlotFlowMacSlot	1.3.6.1.4.1.4874.2.2.81.1.1.4.1.1	Unsigned32	not-accessible	The slot value for the flow.
NUM juniDosProtectionScfdsSlotFlowMacIfIndex	1.3.6.1.4.1.4874.2.2.81.1.1.4.1.2	InterfaceIndex	not-accessible	The ifIndex value for the flow. For group flows, this value will be zero.
U32 juniDosProtectionScfdsSlotFlowMacGroupId	1.3.6.1.4.1.4874.2.2.81.1.1.4.1.3	Unsigned32	not-accessible	The group id for the flow. The group id will be zero for an individual flow. It is non-zero when the entry represents a group of flows.
JUN juniDosProtectionScfdsSlotFlowMacProtocol	1.3.6.1.4.1.4874.2.2.81.1.1.4.1.4	JuniDosProtectionProtocolType	not-accessible	The control protocol for the flow.
MAC juniDosProtectionScfdsSlotFlowMacSrcMac	1.3.6.1.4.1.4874.2.2.81.1.1.4.1.5	MacAddress	not-accessible	The source MAC address for the flow. A null source MAC address indicates that no source physical address was available.
U32 juniDosProtectionScfdsSlotFlowMacRate	1.3.6.1.4.1.4874.2.2.81.1.1.4.1.6	Unsigned32	read-only	The current rate in packets per second for the flow.
U32 juniDosProtectionScfdsSlotFlowMacPeakRate	1.3.6.1.4.1.4874.2.2.81.1.1.4.1.7	Unsigned32	read-only	The peak rate in packets per second for the flow.
U32 juniDosProtectionScfdsSlotFlowMacTimeFlagged	1.3.6.1.4.1.4874.2.2.81.1.1.4.1.8	Unsigned32	read-only	The sysUpTime value for the time when the flow was determined to be suspicious.
I32 juniDosProtectionScfdsSlotFlowMacIngressSlot	1.3.6.1.4.1.4874.2.2.81.1.1.4.1.9	Integer32	read-only	For control flow that are monitored on the egress processor in the forwarding path, this value will indicate the possible ingress slot for data stream that is possibly causing this suspicious flow control. This object will report -1 when it is undefined
T/F juniDosProtectionScfdsSlotFlowMacGroup	1.3.6.1.4.1.4874.2.2.81.1.1.4.1.10	TruthValue	read-only	Indicates whether the flow is a group flow or not. A value of true(1) indicates that the flow represents a group of flows. A value of false(0) indicates that the flow is an individual flow.
INT juniDosProtectionScfdsSlotFlowMacClearEntry	1.3.6.1.4.1.4874.2.2.81.1.1.4.1.11	INTEGER	read-write	When set to clear(1), the suspicious control flow is removed from the suspicious control flow table. When set to ok(0), there is no effect and the suspicious control flow is unchanged. When read, always returns a value of ok(0).
juniDosProtectionPlatformDpgGroup	1.3.6.1.4.1.4874.2.2.81.1.2
juniDosProtectionDpgSlotRateTable	1.3.6.1.4.1.4874.2.2.81.1.2.1		not-accessible	This table provides information about the calculated minimum rates (as well as the maximum rates) for each dos-protection-group control protocol for each line module.
juniDosProtectionDpgSlotRateEntry	1.3.6.1.4.1.4874.2.2.81.1.2.1.1		not-accessible	The rates for an individual dos-protection-group on an line module for a control protocol.
U32 juniDosProtectionDpgSlotRateSlot	1.3.6.1.4.1.4874.2.2.81.1.2.1.1.1	Unsigned32	not-accessible	The slot value for this entry.
STR juniDosProtectionDpgSlotRateDpgName	1.3.6.1.4.1.4874.2.2.81.1.2.1.1.2	DisplayString	not-accessible	The dos-protection-group name for this entry.
JUN juniDosProtectionDpgSlotRateProtocol	1.3.6.1.4.1.4874.2.2.81.1.2.1.1.3	JuniDosProtectionProtocolType	not-accessible	The control protocol for this entry.
U32 juniDosProtectionDpgSlotRateMinRate	1.3.6.1.4.1.4874.2.2.81.1.2.1.1.4	Unsigned32	read-only	The minimum rate for this control protocol on this slot for this dos-protection-group. This value is calculated based on the priority rate and oversubscription as well as the control protocol weight
U32 juniDosProtectionDpgSlotRateMaxRate	1.3.6.1.4.1.4874.2.2.81.1.2.1.1.5	Unsigned32	read-only	The maximum rate for this protocol on this slot for this dos-protection-group. This is equivalent to the configured rate for the dos-protection-group
U32 juniDosProtectionDpgSlotRateMinBurst	1.3.6.1.4.1.4874.2.2.81.1.2.1.1.6	Unsigned32	read-only	The minimum burst for this control protocol on this slot for this dos-protection-group. This value is calculated based on the priority burst and oversubscription as well as the control protocol weight
U32 juniDosProtectionDpgSlotRateMaxBurst	1.3.6.1.4.1.4874.2.2.81.1.2.1.1.7	Unsigned32	read-only	The maximum burst for this protocol on this slot for this dos-protection-group. This is equivalent to the configured burst for the dos-protection-group
juniDosProtectionPlatformTrapControl	1.3.6.1.4.1.4874.2.2.81.2
U32 juniDosProtectionScfdsSlot	1.3.6.1.4.1.4874.2.2.81.2.1	Unsigned32	accessible-for-notify	The slot value.
JUN juniDosProtectionPriority	1.3.6.1.4.1.4874.2.2.81.2.2	JuniDosProtectionPriorityType	accessible-for-notify	The control priority value.
JUN juniDosProtectionProtocol	1.3.6.1.4.1.4874.2.2.81.2.3	JuniDosProtectionProtocolType	accessible-for-notify	The control protocol value.
NUM juniDosProtectionIfIndex	1.3.6.1.4.1.4874.2.2.81.2.4	InterfaceIndex	accessible-for-notify	The ifIndex value.
U32 juniDosProtectionGroupId	1.3.6.1.4.1.4874.2.2.81.2.5	Unsigned32	accessible-for-notify	The group id value.
MAC juniDosProtectionSrcPhysAddr	1.3.6.1.4.1.4874.2.2.81.2.6	MacAddress	accessible-for-notify	The source physical MAC address.
U32 juniDosProtectionScfdsFlowRate	1.3.6.1.4.1.4874.2.2.81.2.7	Unsigned32	accessible-for-notify	The flow rate at the creation time.
juniDosProtectionPlatformMIBConformance	1.3.6.1.4.1.4874.2.2.81.4
juniDosProtectionPlatformMIBCompliances	1.3.6.1.4.1.4874.2.2.81.4.1
juniDosProtectionCompliance	1.3.6.1.4.1.4874.2.2.81.4.1.1			The compliance statement for entities which implement the Juniper Dos Protection Platform specific MIB. Obsoleted with the addition of dos-protection groups.
juniDosProtectionCompliance2	1.3.6.1.4.1.4874.2.2.81.4.1.2			The compliance statement for entities which implement the Juniper Dos Protection Platform specific MIB.
juniDosProtectionPlatformMIBGroups	1.3.6.1.4.1.4874.2.2.81.4.2
juniDosProtectionGroup	1.3.6.1.4.1.4874.2.2.81.4.2.1			A collection of objects providing management of platform specific aspects of the DOS protection application in a Juniper product. This became obsolete with the addition of MAC address in the flow table and the addition of dos-protection-groups.
juniDosProtectionNotificationGroup	1.3.6.1.4.1.4874.2.2.81.4.2.2			Collection of objects for DOS protection application notifications in a Juniper product.This became obsolete with the addition of MAC address in flow traps.
juniDosProtectionGroup1	1.3.6.1.4.1.4874.2.2.81.4.2.3			A collection of objects providing management of platform specific aspects of the DOS protection application in a Juniper product.
juniDosProtectionNotificationGroup1	1.3.6.1.4.1.4874.2.2.81.4.2.4			Collection of objects for DOS protection application notifications in a Juniper product.

RFC description

Juniper vendor-private MIB for platform-specific DOS (Denial-of-Service) protection management on E-Series routers.

Start monitoring Juniper E-series broadband access router (hardware-accelerated DoS protection) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download Juniper-DOS-PROTECTION-PLATFORM-MIB