NETSCREEN-IDS-MIB

All MIBs › NETSCREEN-IDS-MIB

Organization: Juniper Networks, Inc.

Last Updated: 2004-05-03

Category: Firewall, Security

Description: Monitors intrusion detection system attack signatures, detected event counts, and prevention actions on NetScreen firewalls.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is NETSCREEN-IDS-MIB?

NETSCREEN-IDS-MIB is a Juniper Networks (NetScreen firewall heritage) proprietary MIB configuring per-zone Screen/IDS (intrusion detection/DoS-protection) settings. Its protect-set table, keyed by protected zone, enables detection/blocking for a long list of attack signatures — Ping of Death, TearDrop, WinNuke, IP source-route filtering, port scan, address sweep, LAND attack, IP spoofing, SYN flood, ICMP/UDP flood, SYN fragment, TCP no-flag, unknown IP protocol, and a range of suspicious IP-option types (record, timestamp, security, loose/strict source route, stream). As a configuration/security MIB it lets an administrator confirm which Screen/IDS protections are enabled on a given security zone. It is deployed on Juniper Networks NetScreen firewall/security appliances. Engineers can download the NETSCREEN-IDS-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in NETSCREEN-IDS-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Juniper Networks NetScreen firewall/security appliances

Monitoring Examples

An administrator checks nsIdsDetectSynFrag and nsIdsDetectPortScan per zone to confirm Screen/IDS protections are enabled on an untrusted interface on a Juniper NetScreen firewall.

What Can Be Monitored

per-zone Screen/IDS attack-detection settings

Imported Objects

From NETSCREEN-SMI

netscreenIDS

OBJECT-IDENTITY

From SNMPv2-SMI

Counter32
Integer32
MODULE-IDENTITY
OBJECT-TYPE

How to Use in IPNetwork Monitor

Example using nsIdsAttkMonSynAttk OID:

Select a Juniper NetScreen firewall/security appliance (Screen/IDS per-zone protection) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type nsIdsAttkMonSynAttk into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. It reports sync attack packet counter. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases between polls, since a rising count of errors, failures, or discards often points to a real underlying problem. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
C32 nsAttkMonHttpMalUrl	1.3.6.1.4.1.3224.3.2.1.28	Counter32	read-only	Detect malicious URL.
C32 nsAttkMonIcmpFrag	1.3.6.1.4.1.3224.3.2.1.24	Counter32	read-only	Detect ICMP fragment.
C32 nsAttkMonIcmpLarge	1.3.6.1.4.1.3224.3.2.1.25	Counter32	read-only	Detect large ICMP packet.
C32 nsAttkMonIpFrag	1.3.6.1.4.1.3224.3.2.1.31	Counter32	read-only	Block IP fragment packet.
C32 nsAttkMonIpOptBad	1.3.6.1.4.1.3224.3.2.1.17	Counter32	read-only	Detect IP bad option.
C32 nsAttkMonIpOptLSR	1.3.6.1.4.1.3224.3.2.1.21	Counter32	read-only	Detect Loose source route.
C32 nsAttkMonIpOptRecord	1.3.6.1.4.1.3224.3.2.1.18	Counter32	read-only	Detect IP record option.
C32 nsAttkMonIpOptSCHT	1.3.6.1.4.1.3224.3.2.1.20	Counter32	read-only	Detect IP security option.
C32 nsAttkMonIpOptSSR	1.3.6.1.4.1.3224.3.2.1.22	Counter32	read-only	Detect strict source route.
C32 nsAttkMonIpOptStream	1.3.6.1.4.1.3224.3.2.1.23	Counter32	read-only	Detect IP stream option.
C32 nsAttkMonIpOptTimestamp	1.3.6.1.4.1.3224.3.2.1.19	Counter32	read-only	Detect IP timestamp option.
C32 nsAttkMonIpUnknownProt	1.3.6.1.4.1.3224.3.2.1.16	Counter32	read-only	Detect Unknown protocol IP packet.
C32 nsAttkMonSessMalNum	1.3.6.1.4.1.3224.3.2.1.29	Counter32	read-only	Detect malicious session connection.
C32 nsAttkMonSynAckAck	1.3.6.1.4.1.3224.3.2.1.30	Counter32	read-only	Detect SYN ACK ACK attack.
C32 nsAttkMonSynFrag	1.3.6.1.4.1.3224.3.2.1.14	Counter32	read-only	Detect SYN fragment
C32 nsAttkMonTcpFinNoAck	1.3.6.1.4.1.3224.3.2.1.27	Counter32	read-only	Detect TCP fin set without ack bit set.
C32 nsAttkMonTcpNoFlag	1.3.6.1.4.1.3224.3.2.1.15	Counter32	read-only	Detect TCP without flag set.
C32 nsAttkMonTcpSynFin	1.3.6.1.4.1.3224.3.2.1.26	Counter32	read-only	Detect TCP syn fin both set.
C32 nsIdsAttkMonAddrSpoof	1.3.6.1.4.1.3224.3.2.1.7	Counter32	read-only	address spoofing attack packet counter.
nsIdsAttkMonEntry	1.3.6.1.4.1.3224.3.2.1		not-accessible	An entry containing intrusion attack couters.
C32 nsIdsAttkMonIcmpFlood	1.3.6.1.4.1.3224.3.2.1.9	Counter32	read-only	ICMP flood attack packet counter.
I32 nsIdsAttkMonIfIdx	1.3.6.1.4.1.3224.3.2.1.1	Integer32	read-only	unique interface id.
I32 nsIdsAttkMonIfInfo	1.3.6.1.4.1.3224.3.2.1.32	Integer32	read-only	Internal id assigned to this interface. Stays persistent across resets.
C32 nsIdsAttkMonIpSweep	1.3.6.1.4.1.3224.3.2.1.13	Counter32	read-only	address sweep attemp attack packet counter.
C32 nsIdsAttkMonLand	1.3.6.1.4.1.3224.3.2.1.8	Counter32	read-only	land attack packet counter.
C32 nsIdsAttkMonPingDeath	1.3.6.1.4.1.3224.3.2.1.6	Counter32	read-only	ping of death attack packet counter.
C32 nsIdsAttkMonPortScan	1.3.6.1.4.1.3224.3.2.1.12	Counter32	read-only	port scan attempt attack packet counter.
C32 nsIdsAttkMonSrcRoute	1.3.6.1.4.1.3224.3.2.1.5	Counter32	read-only	source route option attack packet counter.
C32 nsIdsAttkMonSynAttkEx	1.3.6.1.4.1.3224.3.2.1.3	Counter32	read-only	sync attack packet counter.
nsIdsAttkMonTable	1.3.6.1.4.1.3224.3.2		not-accessible	The table monitors the intrusion attack attemps amount to NetScreen Device.
C32 nsIdsAttkMonTearDrop	1.3.6.1.4.1.3224.3.2.1.4	Counter32	read-only	tear drop attack packet counter.
C32 nsIdsAttkMonUdpFlood	1.3.6.1.4.1.3224.3.2.1.10	Counter32	read-only	udp flood attack packet counter.
I32 nsIdsAttkMonVsys	1.3.6.1.4.1.3224.3.2.1.2	Integer32	read-only	according NetScreen's concepts. each interface belongs to one virtual system. This attribute displays the virtual system name an interface belongs to.
C32 nsIdsAttkMonWinnuke	1.3.6.1.4.1.3224.3.2.1.11	Counter32	read-only	weired netbios attack packet counter.
INT nsIdsBlockComponent	1.3.6.1.4.1.3224.3.1.1.1.9	INTEGER	read-only	Block Java/ActiveX/ZIP/EXE Component.
INT nsIdsDetectAddrSweep	1.3.6.1.4.1.3224.3.1.1.1.7	INTEGER	read-only	Detect Address Sweep Attack.
INT nsIdsDetectIcmpFlood	1.3.6.1.4.1.3224.3.1.1.1.12	INTEGER	read-only	Detect ICMP Flood attack.
INT nsIdsDetectIcmpFrag	1.3.6.1.4.1.3224.3.1.1.1.24	INTEGER	read-only	Detect ICMP fragment.
INT nsIdsDetectIcmpLarge	1.3.6.1.4.1.3224.3.1.1.1.25	INTEGER	read-only	Detect large ICMP packet.
INT nsIdsDetectIpFrag	1.3.6.1.4.1.3224.3.1.1.1.31	INTEGER	read-only	Block IP fragment packet.
INT nsIdsDetectIpOptBad	1.3.6.1.4.1.3224.3.1.1.1.17	INTEGER	read-only	Detect IP bad option.
INT nsIdsDetectIpOptLSR	1.3.6.1.4.1.3224.3.1.1.1.21	INTEGER	read-only	Detect Loose source route.
INT nsIdsDetectIpOptRecord	1.3.6.1.4.1.3224.3.1.1.1.18	INTEGER	read-only	Detect IP record option.
INT nsIdsDetectIpOptSCHT	1.3.6.1.4.1.3224.3.1.1.1.20	INTEGER	read-only	Detect IP security option.
INT nsIdsDetectIpOptSSR	1.3.6.1.4.1.3224.3.1.1.1.22	INTEGER	read-only	Detect strict source route.
INT nsIdsDetectIpOptStream	1.3.6.1.4.1.3224.3.1.1.1.23	INTEGER	read-only	Detect IP stream option.
INT nsIdsDetectIpOptTimestamp	1.3.6.1.4.1.3224.3.1.1.1.19	INTEGER	read-only	Detect IP timestamp option.
INT nsIdsDetectIpSpoof	1.3.6.1.4.1.3224.3.1.1.1.10	INTEGER	read-only	Detect IP Spoofing attack.
INT nsIdsDetectIpUnknownProt	1.3.6.1.4.1.3224.3.1.1.1.16	INTEGER	read-only	Detect Unknown protocol IP packet.
INT nsIdsDetectLand	1.3.6.1.4.1.3224.3.1.1.1.8	INTEGER	read-only	Detect Land Attack.
INT nsIdsDetectPingOfDeath	1.3.6.1.4.1.3224.3.1.1.1.2	INTEGER	read-only	Detect Ping of Death.
INT nsIdsDetectPortScan	1.3.6.1.4.1.3224.3.1.1.1.6	INTEGER	read-only	Detect Port Scan Death attack.
INT nsIdsDetectSyn	1.3.6.1.4.1.3224.3.1.1.1.11	INTEGER	read-only	Detect SYN attack.
INT nsIdsDetectSynAckAck	1.3.6.1.4.1.3224.3.1.1.1.30	INTEGER	read-only	Detect SYN ACK ACK DoS.
INT nsIdsDetectSynFrag	1.3.6.1.4.1.3224.3.1.1.1.14	INTEGER	read-only	Detect SYN fragment
INT nsIdsDetectTcpFinNoAck	1.3.6.1.4.1.3224.3.1.1.1.27	INTEGER	read-only	Detect TCP fin set without ack bit set.
INT nsIdsDetectTcpNoFlag	1.3.6.1.4.1.3224.3.1.1.1.15	INTEGER	read-only	Detect TCP without flag set.
INT nsIdsDetectTcpSynFin	1.3.6.1.4.1.3224.3.1.1.1.26	INTEGER	read-only	Detect TCP syn fin both set.
INT nsIdsDetectTearDrop	1.3.6.1.4.1.3224.3.1.1.1.3	INTEGER	read-only	Detect Tear Drop Attack.
INT nsIdsDetectUdpFlood	1.3.6.1.4.1.3224.3.1.1.1.13	INTEGER	read-only	Detect UDP Flood attack.
INT nsIdsDetectWinNuke	1.3.6.1.4.1.3224.3.1.1.1.4	INTEGER	read-only	Detect Win Nuke Attack.
INT nsIdsFilterIpSrcRoute	1.3.6.1.4.1.3224.3.1.1.1.5	INTEGER	read-only	Detect Filter IP Source Route Option attack.
INT nsIdsHttpMalUrl	1.3.6.1.4.1.3224.3.1.1.1.28	INTEGER	read-only	Detect malicious URL.
I32 nsIdsIcmpFloodThresh	1.3.6.1.4.1.3224.3.1.2.1.7	Integer32	read-only	ICMP attack alarm threshold.
I32 nsIdsIpSweepThresh	1.3.6.1.4.1.3224.3.1.2.1.10	Integer32	read-only	UDP attack alarm threshold.
I32 nsIdsPortScanThresh	1.3.6.1.4.1.3224.3.1.2.1.9	Integer32	read-only	ICMP attack alarm threshold.
nsIdsProtect	1.3.6.1.4.1.3224.3.1			This module defines NetScreen private MIBs DI Setting.
nsIdsProtectSetEntry	1.3.6.1.4.1.3224.3.1.1.1		not-accessible	Hold the DI setting attribute.
nsIdsProtectSetTable	1.3.6.1.4.1.3224.3.1.1		not-accessible	NetScreen ScreenOS can allow DI protection on each of NetScreen device's physical interface. This table collects the DI protection configuration on each physical interface.
nsIdsProtectThreshEntry	1.3.6.1.4.1.3224.3.1.2.1		not-accessible	Hold the DI setting attribute.
nsIdsProtectThreshTable	1.3.6.1.4.1.3224.3.1.2		not-accessible	NetScreen ScreenOS can allow DI protection on each of NetScreen device's physical interface. This table collects the DI protection configuration on each physical interface.
I32 nsIdsProtectThreshZoneIdx	1.3.6.1.4.1.3224.3.1.2.1.1	Integer32	read-only	unique zone id.
I32 nsIdsProtectZoneIdx	1.3.6.1.4.1.3224.3.1.1.1.1	Integer32	read-only	unique zone id.
INT nsIdsSessMalNum	1.3.6.1.4.1.3224.3.1.1.1.29	INTEGER	read-only	Detect malicious session connection.
I32 nsIdsSynAckAckThres	1.3.6.1.4.1.3224.3.1.2.1.11	Integer32	read-only	SYN ack ack alarm threshold.
I32 nsIdsSynAttackAgeTime	1.3.6.1.4.1.3224.3.1.2.1.6	Integer32	read-only	SYN flood age time.
I32 nsIdsSynAttackAlmTh	1.3.6.1.4.1.3224.3.1.2.1.4	Integer32	read-only	SYN attack alarm threshold.
I32 nsIdsSynAttackQueSize	1.3.6.1.4.1.3224.3.1.2.1.5	Integer32	read-only	SYN attack queue size.
I32 nsIdsSynAttackThresh	1.3.6.1.4.1.3224.3.1.2.1.2	Integer32	read-only	SYN attack threshold.
I32 nsIdsSynAttackTimeout	1.3.6.1.4.1.3224.3.1.2.1.3	Integer32	read-only	SYN attack timeout.
I32 nsIdsUdpFloodThresh	1.3.6.1.4.1.3224.3.1.2.1.8	Integer32	read-only	UDP attack alarm threshold.

RFC description

Monitors intrusion detection system (IDS) attack counters including DoS, port scan, and malformed packet detection on Juniper NetScreen devices.

Start monitoring Juniper NetScreen firewall/security appliance (Screen/IDS per-zone protection) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download NETSCREEN-IDS-MIB