MAC-NOTIFICATION-MIB

All MIBs › MAC-NOTIFICATION-MIB

Organization: New admin, Inc.

Last Updated: 2012-04-08

Category: LAN / Bridging & Switching

Description: Defines SNMP trap and notification objects for MAC address change events on managed network switches.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is MAC-NOTIFICATION-MIB?

MAC-NOTIFICATION-MIB defines objects and traps for the MAC address notification feature found on managed Ethernet switches, letting a device inform a network management system when MAC addresses are learned or removed from its forwarding database. It exposes global feature enable/disable state, notification interval/rate configuration, learned/removed MAC address counters, and a historical table of recent MAC change events with timestamps. It is used for security and fault monitoring rather than pure hardware health: tracking learned/removed MAC counts helps detect unauthorized device attachment, MAC flapping, or unexpected topology changes on access ports, while the notifications-sent counter confirms the notification pipeline itself is functioning. It relies on the underlying bridge forwarding-database concepts standardized in BRIDGE-MIB/Q-BRIDGE-MIB for the addresses it reports on. This type of MIB is commonly implemented across multiple switch vendors' Layer 2 access switches in enterprise and campus environments for port-security and change-tracking purposes. Engineers can download the MAC-NOTIFICATION-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in MAC-NOTIFICATION-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

managed Ethernet switch (implemented across multiple vendors)
Layer 2 access switch

Monitoring Examples

An admin would poll mnMacAddressesLearnt and mnMacAddressesRemoved to track churn in the forwarding database, where a sudden spike could indicate a rogue device, a loop, or a MAC-spoofing attack. The mnHistoryTable, indexed by mnHistIndex, stores individual mnHistMacChangedMsg/mnHistTimestamp entries that can be walked to reconstruct exactly which MAC address changed on which port and when. mnGlobalFeatureEnabled and mnNotificationsEnabled would be checked first to confirm the feature and trap delivery are actually turned on before relying on the history table.

What Can Be Monitored

MAC notification feature enabled state
MAC addresses learned count
MAC addresses removed count
notifications sent count
MAC change history log
notification interval configuration

Imported Objects

From ADMIN-MASTER-MIB

gbnServiceMACNotification

OBJECT-IDENTITY

From IF-MIB

ifIndex

OBJECT-TYPE

From Q-BRIDGE-MIB

VlanId

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Integer32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

MacAddress
TEXTUAL-CONVENTION
TimeStamp
TruthValue

How to Use in IPNetwork Monitor

Example using mnMacAddressesLearnt OID:

Select a Managed Ethernet switch, Layer 2 access switch (MAC address notification) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type mnMacAddressesLearnt into the Find box to locate it in the OID tree, then select it and click OK. Indicates the number of MAC addresses learnt by the device. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
macNotificationMIB	1.3.6.1.4.1.13464.1.2.3.3.1			This MIB module is for configuration of the MAC notification feature. MAC notification is a mechanism to inform monitoring devices when there are MAC addresses learnt or removed from the forwarding database of the monitored devices.
macNotificationMIBObjects	1.3.6.1.4.1.13464.1.2.3.3.1.1
mnGlobalObjects	1.3.6.1.4.1.13464.1.2.3.3.1.1.1
T/F mnGlobalFeatureEnabled	1.3.6.1.4.1.13464.1.2.3.3.1.1.1.1	TruthValue	read-write	Indicates whether the MAC notification feature is currently running in the device. Setting this object to false(2) disables the MAC notification feature globally thus disabling the feature at each interface. Setting this object to true(1) will start the MAC notification feature running in the device. If the feature is already running, setting to true(1) has no effect. Once the MAC notification is enabled, whether the feature is running at each interface is controlled by the mnIfConfigTable.
U32 mnNotificationInterval	1.3.6.1.4.1.13464.1.2.3.3.1.1.1.2	Unsigned32	read-write	This object specifies the maximum interval of time between mnMacChangedNotifications being generated by the device. If the value of mnNotificationsEnabled is true(1), the device will send out the generated mnMacChangedNotifications and archive the MAC change notification events in the mnHistoryTable. If the value of mnNotificationsEnabled is false(2), the device will not send out the generated mnMacChangedNotifications but it will archive these events in the mnHistoryTable. If the value of this object is equal to 0, the device will generate mnMacChangedNotifications and archive the MAC change notification events in the mnHistoryTable as soon as there is MAC address learnt or removed by the device. If the value of this object is greater than 0, the device will wait for a period of time equal to the value of this object before generate the mnMacChangedNotifications and archive the MAC change notification events in the mnHistoryTable.
C32 mnMacAddressesLearntEx	1.3.6.1.4.1.13464.1.2.3.3.1.1.1.3	Counter32	read-only	Indicates the number of MAC addresses learnt by the device.
C32 mnMacAddressesRemoved	1.3.6.1.4.1.13464.1.2.3.3.1.1.1.4	Counter32	read-only	Indicates the number of MAC addresses removed from the forwarding database.
T/F mnNotificationsEnabled	1.3.6.1.4.1.13464.1.2.3.3.1.1.1.5	TruthValue	read-write	Indicates whether mnMacChangedNotification notifications will or will not be sent when there are MAC addresses learnt or removed from the device's forwarding database. Disabling notifications does not prevent the MAC address info from being added to the mnHistoryTable.
C32 mnNotificationsSent	1.3.6.1.4.1.13464.1.2.3.3.1.1.1.6	Counter32	read-only	Indicates the number of mnMacChangedNotifications sent out by the device.
U32 mnHistTableMaxLength	1.3.6.1.4.1.13464.1.2.3.3.1.1.1.7	Unsigned32	read-write	The upper limit on the number of entries that the mnHistoryTable may contain. A value of 0 will prevent any history from being retained. When this table is full, the oldest entry will be deleted and a new one will be created.
mnHistoryTable	1.3.6.1.4.1.13464.1.2.3.3.1.1.1.8		not-accessible	This table will archive the MAC change notification events generated by this device. The MAC change notification events are archived here even if mnMacChangesNotifications are not actually sent.
mnHistoryEntry	1.3.6.1.4.1.13464.1.2.3.3.1.1.1.8.1		not-accessible	A MAC change notification message that was previously generated by this device. Each entry is indexed by a message index.
U32 mnHistIndex	1.3.6.1.4.1.13464.1.2.3.3.1.1.1.8.1.1	Unsigned32	not-accessible	An index that uniquely identifies a MAC change notification event previously generated by the device. This index starts at 1 and increases by one when a MAC change notification is generated. When it reaches the maximum value, the agent wraps the value back to 1.
OCT mnHistMacChangedMsg	1.3.6.1.4.1.13464.1.2.3.3.1.1.1.8.1.2	OCTET STRING	read-only	This object contains the information of a MAC change notification event. It consists of several tuples packed together in the format of '...'. Each tuple consist of 11 octets in the format of '' where is of size 1 octet and supports the following values 0 - End of MIB object. 1 - MAC learnt. 2 - MAC removed. is VLAN number of the VLAN which the MAC address is belonged to and has size of 2 octet. is the Layer2 Mac Address and has size of 6 octets. is the value of dot1dBasePort for the interface from which the MAC address is learnt and has size of 2 octets.
TIM mnHistTimestamp	1.3.6.1.4.1.13464.1.2.3.3.1.1.1.8.1.3	TimeStamp	read-only	The value of sysUpTime when the mnMacChangedNotification containing the information denoted by the mnHistMacChangedMsg object in this entry was generated.
mnInterfaceObjects	1.3.6.1.4.1.13464.1.2.3.3.1.1.2
mnIfConfigTable	1.3.6.1.4.1.13464.1.2.3.3.1.1.2.1		not-accessible	This table enables or disables the generation of notification at each interface when MAC address is learnt or removed.
mnIfConfigEntry	1.3.6.1.4.1.13464.1.2.3.3.1.1.2.1.1		not-accessible	Each entry contains the configuration for enabling the MAC notification at each interface that supports this feature.
T/F mnMacAddrLearntEnable	1.3.6.1.4.1.13464.1.2.3.3.1.1.2.1.1.1	TruthValue	read-write	Indicates whether this interface is enabled to send mnMacChangedNotification when it learns a new MAC address. This variable has no effect when the value of mnGlobalFeatureEnabled object is false(2). Setting this object to true(1) enables the sending of mnMacChangedNotification when this interface learns a new MAC address. Setting this object to false(2) disables the sending of mnMacChangedNotification when this interface learns a new MAC address.
T/F mnMacAddrRemovedEnable	1.3.6.1.4.1.13464.1.2.3.3.1.1.2.1.1.2	TruthValue	read-write	Indicates whether this interface is enabled to send mnMacChangedNotification when a MAC address which it learnt previously is removed from the forwarding table. This variable has no effect when the value of mnGlobalFeatureEnabled object is false(2). Setting this object to true(1) enables the sending of mnMacChangedNotification when a MAC address which this interface learnt previously is removed from the forwarding table. Setting this object to false(2) disables the sending of mnMacChangedNotification when a MAC address which this interface learnt previously is removed from the forwarding table.
mnMIBNotificationPrefix	1.3.6.1.4.1.13464.1.2.3.3.1.2
mnMIBNotifications	1.3.6.1.4.1.13464.1.2.3.3.1.2.0
NTF mnMacChangedNotification	1.3.6.1.4.1.13464.1.2.3.3.1.2.0.1			This notification is generated when there is enough MAC address information to fully occupy a maximum size SNMP trap message. This notification is also generated when there is at least one MAC address changed or removed and the amount of time elapsed from the previous notification is greater than the maximum wait time denoted by mnNotificationInterval object. If there are more MAC addresses information than can fit into one mmHistTrapContent object, then multiple notifications will be generated.
mnMIBConformance	1.3.6.1.4.1.13464.1.2.3.3.1.3
mnMIBCompliances	1.3.6.1.4.1.13464.1.2.3.3.1.3.1
mnMIBCompliance	1.3.6.1.4.1.13464.1.2.3.3.1.3.1.1			The compliance statement for the MAC-NOTIFICATION-MIB.
mnMIBComplianceVer1	1.3.6.1.4.1.13464.1.2.3.3.1.3.1.2			The compliance statement for the MAC-NOTIFICATION-MIB.
mnMIBGroups	1.3.6.1.4.1.13464.1.2.3.3.1.3.2
mnGlobalGroup	1.3.6.1.4.1.13464.1.2.3.3.1.3.2.1			A collection of objects providing the global configuration and information for MAC notification.
mnInterfaceGroup	1.3.6.1.4.1.13464.1.2.3.3.1.3.2.2			A collection of objects providing the configuration information for MAC notification at each interface.
mnNotificationGroup	1.3.6.1.4.1.13464.1.2.3.3.1.3.2.3			The notification generated by the MAC-NOTIFICATION-MIB.

RFC description

MAC address notification for network switching; informs management devices when MAC addresses are learned or removed from forwarding database.

Start monitoring Managed Ethernet switch, Layer 2 access switch (MAC address notification) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download MAC-NOTIFICATION-MIB