All MIBs › NMS-FILTER-TRAP
Category: Security
Description: Defines NMS Communications packet filter event traps for ACL matches and policy violations.
Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.
What Is NMS-FILTER-TRAP?
NMS-FILTER-TRAP is an NMS Communications vendor-specific MIB that models packet-filtering/ACL enforcement events on NMS devices. Its single nmsFilterTable records each blocked-traffic event with the matching criteria (filterIpAddress, filterPhyAddress MAC, portNum, vlanID), the type of traffic blocked (message, an enumeration of arp/bpdu/dhcp/ip/igmp), the action taken (action: off/on), and timing (timeOcr occurrence time, timeHold hold duration), and it emits a corresponding nmsFilterNotification trap carrying all of these objects whenever a filter match occurs. This makes it useful for monitoring security/ACL enforcement activity on the device — which hosts or MAC addresses are being blocked, on which port/VLAN, and for how long — supporting intrusion or misconfiguration diagnosis. It depends on NMS-SMI for its OID placement and on RFC1213-MIB/RFC1155-SMI for base types (IpAddress, PhysAddress, TimeTicks), and administrators can search for the NMS-FILTER-TRAP MIB reference when integrating these traps into a trap receiver.
IPNetwork Monitor allows you to monitor SNMP objects defined in NMS-FILTER-TRAP. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.
Supported Devices
- NMS Communications devices (voice/network gateway platforms with packet-filtering ACL support)
Monitoring Examples
An operator subscribes to nmsFilterNotification traps and inspects filterIpAddress, portNum, and message for each event; a burst of traps with message=dhcp and action=on from a single portNum would indicate a rogue DHCP server or misbehaving host being actively blocked on that port.
What Can Be Monitored
- blocked-traffic event notifications
- filter match IP/MAC address
- blocked port and VLAN identifiers
- filter type classification (ARP/BPDU/DHCP/IP/IGMP)
- block action state and hold duration
Imported Objects
From NMS-SMI
| nmslocal | OBJECT-IDENTITY |
From RFC1155-SMI
| IpAddress | |
| TimeTicks |
From RFC1213-MIB
| PhysAddress |
From SNMPv2-CONF
| MODULE-COMPLIANCE | |
| NOTIFICATION-GROUP | |
| OBJECT-GROUP |
From SNMPv2-SMI
| Integer32 | |
| MODULE-IDENTITY | |
| NOTIFICATION-TYPE | |
| OBJECT-TYPE | |
| Unsigned32 |
OIDs
RFC description
Manages traffic filtering rules for ARP, BPDU, DHCP, IP, and IGMP protocols on NMS network devices.
Start monitoring NMS Communications device (voice/network gateway with packet-filtering ACL) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.