ME1200-DHCP-SNOOPING-MIB

All MIBs › ME1200-DHCP-SNOOPING-MIB

Organization: Cisco Systems, Inc

Last Updated: 2014-03-28

Category: Domain: Security, Protocol: DHCP, Vendor: Cisco

Description: Cisco ME1200 Metro Ethernet switch MIB for DHCP snooping configuration to prevent rogue DHCP server attacks.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is ME1200-DHCP-SNOOPING-MIB?

ME1200-DHCP-SNOOPING-MIB is a Cisco private MIB for the ME 1200 Metro Ethernet access device family, providing SNMP configuration and monitoring of the DHCP Snooping security feature that filters untrusted DHCP traffic to prevent rogue-server and IP-spoofing attacks. It exposes configuration data such as global snooping mode and per-interface trust settings, along with a dynamically learned binding table recording which IP address has been assigned to which MAC address, VLAN, and interface. Its monitoring value lies in security/configuration status: an operator can confirm whether snooping is enabled globally and per port, and audit the live DHCP binding table to detect anomalies such as unexpected leases or an untrusted port issuing DHCP offers. It builds on the same conceptual model as standard DHCP Snooping MIBs and standard IF-MIB ifIndex references for interface identification. It is deployed on Cisco ME 1200 metro/carrier Ethernet switches used by service providers for DHCP access-layer security, per the ME1200-DHCP-SNOOPING-MIB MIB definition.

IPNetwork Monitor allows you to monitor SNMP objects defined in ME1200-DHCP-SNOOPING-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Cisco ME 1200 Metro Ethernet access switch

Monitoring Examples

Polling me1200DhcpSnoopingGlobalsMode confirms whether DHCP snooping is active device-wide, while me1200DhcpSnoopingInterfaceTable (keyed by me1200DhcpSnoopingInterfaceIfIndex) shows which ports are trusted versus untrusted via me1200DhcpSnoopingInterfaceTrustMode. The me1200DhcpSnoopingAssignedIpTable then lists live bindings (me1200DhcpSnoopingAssignedIpMacAddress, me1200DhcpSnoopingAssignedIpIpAddress, me1200DhcpSnoopingAssignedIpVlanId) that an administrator can audit to spot an unexpected or duplicate IP assignment indicating a rogue DHCP server or spoofing attempt on an untrusted port.

What Can Be Monitored

DHCP snooping global mode
per-interface trust mode
DHCP-assigned IP-to-MAC bindings
VLAN ID of bindings
interface associated with each binding

Imported Objects

From CISCOME1200-MIB

me1200SwitchMgmt

OBJECT-IDENTITY

From ME1200-TC

ME1200InterfaceIndex

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Integer32
IpAddress
MODULE-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

MacAddress
TEXTUAL-CONVENTION
TruthValue

OIDs

OID symbolic	OID numeric	Type	Access	Description
me1200DhcpSnoopingMIB	1.3.6.1.4.1.9.9.815.1.56			This is a private version of the DHCP Snooping MIB
me1200DhcpSnoopingMIBObjects	1.3.6.1.4.1.9.9.815.1.56.1
me1200DhcpSnoopingConfig	1.3.6.1.4.1.9.9.815.1.56.1.2
me1200DhcpSnoopingGlobals	1.3.6.1.4.1.9.9.815.1.56.1.2.1
T/F me1200DhcpSnoopingGlobalsMode	1.3.6.1.4.1.9.9.815.1.56.1.2.1.1	TruthValue	read-write	Indicates the DHCP snooping mode operation. Possible modes are - true(1): Enable DHCP snooping mode operation. When DHCP snooping mode operation is enabled, the DHCP request messages will be forwarded to trusted ports and only allow reply packets from trusted ports. false(2): Disable DHCP snooping mode operation.
me1200DhcpSnoopingInterfaceTable	1.3.6.1.4.1.9.9.815.1.56.1.2.2		not-accessible	This is a table of DHCP Snooping port configuration parameters
me1200DhcpSnoopingInterfaceEntry	1.3.6.1.4.1.9.9.815.1.56.1.2.2.1		not-accessible	Each port has a set of parameters
NUM me1200DhcpSnoopingInterfaceIfIndex	1.3.6.1.4.1.9.9.815.1.56.1.2.2.1.1	ME1200InterfaceIndex	not-accessible	Logical interface number of the physical port.
T/F me1200DhcpSnoopingInterfaceTrustMode	1.3.6.1.4.1.9.9.815.1.56.1.2.2.1.2	TruthValue	read-write	Indicates the DHCP snooping port mode. Possible port modes are - true(1): Configures the port as trusted source of the DHCP messages. false(2): Configures the port as untrusted source of the DHCP messages.
me1200DhcpSnoopingStatus	1.3.6.1.4.1.9.9.815.1.56.1.3
me1200DhcpSnoopingAssignedIpTable	1.3.6.1.4.1.9.9.815.1.56.1.3.1		not-accessible	This is a table of assigned IP information in DHCP Snooping
me1200DhcpSnoopingAssignedIpEntry	1.3.6.1.4.1.9.9.815.1.56.1.3.1.1		not-accessible	Each entry has a set of parameters
MAC me1200DhcpSnoopingAssignedIpMacAddress	1.3.6.1.4.1.9.9.815.1.56.1.3.1.1.1	MacAddress	not-accessible	MAC address.
I32 me1200DhcpSnoopingAssignedIpVlanId	1.3.6.1.4.1.9.9.815.1.56.1.3.1.1.2	Integer32	not-accessible	The VLAN id of the VLAN.
NUM me1200DhcpSnoopingAssignedIpIfIndex	1.3.6.1.4.1.9.9.815.1.56.1.3.1.1.3	ME1200InterfaceIndex	read-only	Logical interface number of the physical port of the DHCP client.
IP me1200DhcpSnoopingAssignedIpIpAddress	1.3.6.1.4.1.9.9.815.1.56.1.3.1.1.4	IpAddress	read-only	IP address assigned to DHCP client by DHCP server.
IP me1200DhcpSnoopingAssignedIpNetmask	1.3.6.1.4.1.9.9.815.1.56.1.3.1.1.5	IpAddress	read-only	Netmask assigned to DHCP client by DHCP server.
IP me1200DhcpSnoopingAssignedIpDhcpServerIp	1.3.6.1.4.1.9.9.815.1.56.1.3.1.1.6	IpAddress	read-only	IP address of the DHCP server that assigns the IP address and netmask.
me1200DhcpSnoopingInterfaceStatisticsTable	1.3.6.1.4.1.9.9.815.1.56.1.3.2		not-accessible	This is a table of port statistics in DHCP Snooping
me1200DhcpSnoopingInterfaceStatisticsEntry	1.3.6.1.4.1.9.9.815.1.56.1.3.2.1		not-accessible	Each entry has a set of parameters
NUM me1200DhcpSnoopingInterfaceStatisticsIfIndex	1.3.6.1.4.1.9.9.815.1.56.1.3.2.1.1	ME1200InterfaceIndex	not-accessible	Logical interface number of the physical port.
U32 me1200DhcpSnoopingInterfaceStatisticsRxDiscover	1.3.6.1.4.1.9.9.815.1.56.1.3.2.1.2	Unsigned32	read-only	The number of discover (option 53 with value 1) packets received.
U32 me1200DhcpSnoopingInterfaceStatisticsRxOffer	1.3.6.1.4.1.9.9.815.1.56.1.3.2.1.3	Unsigned32	read-only	The number of offer (option 53 with value 2) packets received.
U32 me1200DhcpSnoopingInterfaceStatisticsRxRequest	1.3.6.1.4.1.9.9.815.1.56.1.3.2.1.4	Unsigned32	read-only	The number of request (option 53 with value 3) packets received.
U32 me1200DhcpSnoopingInterfaceStatisticsRxDecline	1.3.6.1.4.1.9.9.815.1.56.1.3.2.1.5	Unsigned32	read-only	The number of decline (option 53 with value 4) packets received.
U32 me1200DhcpSnoopingInterfaceStatisticsRxAck	1.3.6.1.4.1.9.9.815.1.56.1.3.2.1.6	Unsigned32	read-only	The number of ACK (option 53 with value 5) packets received.
U32 me1200DhcpSnoopingInterfaceStatisticsRxNak	1.3.6.1.4.1.9.9.815.1.56.1.3.2.1.7	Unsigned32	read-only	The number of NAK (option 53 with value 6) packets received.
U32 me1200DhcpSnoopingInterfaceStatisticsRxRelease	1.3.6.1.4.1.9.9.815.1.56.1.3.2.1.8	Unsigned32	read-only	The number of release (option 53 with value 7) packets received.
U32 me1200DhcpSnoopingInterfaceStatisticsRxInform	1.3.6.1.4.1.9.9.815.1.56.1.3.2.1.9	Unsigned32	read-only	The number of inform (option 53 with value 8) packets received.
U32 me1200DhcpSnoopingInterfaceStatisticsRxLeaseQuery	1.3.6.1.4.1.9.9.815.1.56.1.3.2.1.10	Unsigned32	read-only	The number of lease query (option 53 with value 10) packets received.
U32 me1200DhcpSnoopingInterfaceStatisticsRxLeaseUnassigned	1.3.6.1.4.1.9.9.815.1.56.1.3.2.1.11	Unsigned32	read-only	The number of lease unassigned (option 53 with value 11) packets received.
U32 me1200DhcpSnoopingInterfaceStatisticsRxLeaseUnknown	1.3.6.1.4.1.9.9.815.1.56.1.3.2.1.12	Unsigned32	read-only	The number of lease unknown (option 53 with value 12) packets received.
U32 me1200DhcpSnoopingInterfaceStatisticsRxLeaseActive	1.3.6.1.4.1.9.9.815.1.56.1.3.2.1.13	Unsigned32	read-only	The number of lease active (option 53 with value 13) packets received.
U32 me1200DhcpSnoopingInterfaceStatisticsRxDiscardChksumErr	1.3.6.1.4.1.9.9.815.1.56.1.3.2.1.14	Unsigned32	read-only	The number of discard packet that IP/UDP checksum is error.
U32 me1200DhcpSnoopingInterfaceStatisticsRxDiscardUntrust	1.3.6.1.4.1.9.9.815.1.56.1.3.2.1.15	Unsigned32	read-only	The number of discard packet that are coming from untrusted port.
U32 me1200DhcpSnoopingInterfaceStatisticsTxDiscover	1.3.6.1.4.1.9.9.815.1.56.1.3.2.1.16	Unsigned32	read-only	The number of discover (option 53 with value 1) packets transmited.
U32 me1200DhcpSnoopingInterfaceStatisticsTxOffer	1.3.6.1.4.1.9.9.815.1.56.1.3.2.1.17	Unsigned32	read-only	The number of offer (option 53 with value 2) packets transmited.
U32 me1200DhcpSnoopingInterfaceStatisticsTxRequest	1.3.6.1.4.1.9.9.815.1.56.1.3.2.1.18	Unsigned32	read-only	The number of request (option 53 with value 3) packets transmited.
U32 me1200DhcpSnoopingInterfaceStatisticsTxDecline	1.3.6.1.4.1.9.9.815.1.56.1.3.2.1.19	Unsigned32	read-only	The number of decline (option 53 with value 4) packets transmited.
U32 me1200DhcpSnoopingInterfaceStatisticsTxAck	1.3.6.1.4.1.9.9.815.1.56.1.3.2.1.20	Unsigned32	read-only	The number of ACK (option 53 with value 5) packets transmited.
U32 me1200DhcpSnoopingInterfaceStatisticsTxNak	1.3.6.1.4.1.9.9.815.1.56.1.3.2.1.21	Unsigned32	read-only	The number of NAK (option 53 with value 6) packets transmited.
U32 me1200DhcpSnoopingInterfaceStatisticsTxRelease	1.3.6.1.4.1.9.9.815.1.56.1.3.2.1.22	Unsigned32	read-only	The number of release (option 53 with value 7) packets transmited.
U32 me1200DhcpSnoopingInterfaceStatisticsTxInform	1.3.6.1.4.1.9.9.815.1.56.1.3.2.1.23	Unsigned32	read-only	The number of inform (option 53 with value 8) packets transmited.
U32 me1200DhcpSnoopingInterfaceStatisticsTxLeaseQuery	1.3.6.1.4.1.9.9.815.1.56.1.3.2.1.24	Unsigned32	read-only	The number of lease query (option 53 with value 10) packets transmited.
U32 me1200DhcpSnoopingInterfaceStatisticsTxLeaseUnassigned	1.3.6.1.4.1.9.9.815.1.56.1.3.2.1.25	Unsigned32	read-only	The number of lease unassigned (option 53 with value 11) packets transmited.
U32 me1200DhcpSnoopingInterfaceStatisticsTxLeaseUnknown	1.3.6.1.4.1.9.9.815.1.56.1.3.2.1.26	Unsigned32	read-only	The number of lease unknown (option 53 with value 12) packets transmited.
U32 me1200DhcpSnoopingInterfaceStatisticsTxLeaseActive	1.3.6.1.4.1.9.9.815.1.56.1.3.2.1.27	Unsigned32	read-only	The number of lease active (option 53 with value 13) packets transmited.
me1200DhcpSnoopingControl	1.3.6.1.4.1.9.9.815.1.56.1.4
me1200DhcpSnoopingInterfaceClearStatisticsTable	1.3.6.1.4.1.9.9.815.1.56.1.4.1		not-accessible	This is a table to clear port statistics in DHCP Snooping
me1200DhcpSnoopingInterfaceClearStatisticsEntry	1.3.6.1.4.1.9.9.815.1.56.1.4.1.1		not-accessible	Each port has a set of parameters
NUM me1200DhcpSnoopingInterfaceClearStatisticsIfIndex	1.3.6.1.4.1.9.9.815.1.56.1.4.1.1.1	ME1200InterfaceIndex	not-accessible	Logical interface number of the physical port.
T/F me1200DhcpSnoopingInterfaceClearStatisticsClear	1.3.6.1.4.1.9.9.815.1.56.1.4.1.1.2	TruthValue	read-write	clear statistics per physical port.
me1200DhcpSnoopingMIBConformance	1.3.6.1.4.1.9.9.815.1.56.2
me1200DhcpSnoopingMIBCompliances	1.3.6.1.4.1.9.9.815.1.56.2.1
me1200DhcpSnoopingMIBCompliance	1.3.6.1.4.1.9.9.815.1.56.2.1.1			The compliance statement for the implementation.
me1200DhcpSnoopingMIBGroups	1.3.6.1.4.1.9.9.815.1.56.2.2
me1200DhcpSnoopingGlobalsInfoGroup	1.3.6.1.4.1.9.9.815.1.56.2.2.1			A collection of objects suitable for bulk operations.
me1200DhcpSnoopingInterfaceInfoGroup	1.3.6.1.4.1.9.9.815.1.56.2.2.2			A collection of objects suitable for bulk operations.
me1200DhcpSnoopingAssignedIpTableInfoGroup	1.3.6.1.4.1.9.9.815.1.56.2.2.3			A collection of objects suitable for bulk operations.
me1200DhcpSnoopingInterfaceStatisticsTableInfoGroup	1.3.6.1.4.1.9.9.815.1.56.2.2.4			A collection of objects suitable for bulk operations.
me1200DhcpSnoopingInterfaceClearStatisticsTableInfoGroup	1.3.6.1.4.1.9.9.815.1.56.2.2.5			A collection of objects suitable for bulk operations.

RFC description

SNMP MIB for Microsemi/Microchip ME1200 Ethernet switch platforms that monitors and manages DHCP snooping functionality, which blocks unauthorized DHCP servers and prevents DHCP spoofing attacks on network switches.

Start monitoring Cisco ME1200 Metro Ethernet access switch (DHCP snooping) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download ME1200-DHCP-SNOOPING-MIB

What Is ME1200-DHCP-SNOOPING-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description