NTWS-INFO-RF-DETECT-MIB

All MIBs › NTWS-INFO-RF-DETECT-MIB

Organization: Nortel Networks

Last Updated: 2007-09-25

Category: Nortel WLAN

Description: Provides RF interference detection, rogue AP classification, and WIDS scan data on Nortel NTWS controllers.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is NTWS-INFO-RF-DETECT-MIB?

NTWS-INFO-RF-DETECT-MIB is a Nortel NTWS wireless security MIB that exposes RF interference and wireless intrusion detection (WIDS) data gathered by APs managed under an NTWS controller, including rogue access point classification. Its core ntwsInfoRFDetectXmtrTable lists detected RF transmitters with the transmitting and listening (detecting) MAC addresses, channel, signal strength (RSSI), SSID, networking mode, and a classification (e.g., rogue, known, ad-hoc) with a reason code, alongside a table-size object for scan capacity. This is fundamentally a software/security status monitoring MIB: it reports the wireless RF environment's status rather than device hardware health, letting security staff detect unauthorized or rogue transmitters, ad-hoc networks, and RF interference sources near the managed WLAN. It's tightly coupled to the AP inventory exposed by NTWS-AP-STATUS-MIB (the listener AP detecting the signal) and generates events surfaced via NTWS-TRAP-MIB. It is deployed on Nortel NTWS wireless controllers as part of an enterprise wireless security/RF monitoring deployment, generally starting with an NTWS-INFO-RF-DETECT-MIB download used to load its object definitions into a MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in NTWS-INFO-RF-DETECT-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Nortel NTWS wireless LAN controllers (Access Controllers) and managed Access Points

Monitoring Examples

A security analyst would walk ntwsInfoRFDetectXmtrTable filtering on ntwsInfoRFDetectXmtrClassification to find entries marked as rogue, then inspect ntwsInfoRFDetectXmtrRssi and ntwsInfoRFDetectXmtrChannelNum to locate the transmitter, using ntwsInfoRFDetectXmtrListenerMacAddress to identify which managed AP detected it. A sudden spike in ntwsInfoRFDetectCurrentXmtrTableSize combined with new rogue classifications would reveal an active RF/rogue-AP attack or a nearby unauthorized wireless deployment.

What Can Be Monitored

detected RF transmitters (rogue/known/ad-hoc)
signal strength (RSSI) of detected transmitters
channel of detected transmitters
SSID of detected networks
rogue classification and reason
current RF-detection table size (scan load)

Imported Objects

From NTWS-AP-TC

NtwsChannelNum
NtwsRssi

From NTWS-RF-DETECT-TC

NtwsRFDetectClassification
NtwsRFDetectClassificationReason
NtwsRFDetectNetworkingMode

From NTWS-ROOT-MIB

ntwsMibs

OBJECT-IDENTITY

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Gauge32
MODULE-IDENTITY
OBJECT-TYPE

From SNMPv2-TC

DisplayString
MacAddress

How to Use in IPNetwork Monitor

Example using ntwsInfoRFDetectCurrentXmtrTableSize OID:

Select a Nortel NTWS wireless LAN controller and managed Access Point (RF/rogue AP detection) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type ntwsInfoRFDetectCurrentXmtrTableSize into the Find box to locate it in the OID tree, then select it and click OK. It reports the current number of Transmitter-Listener-Channel combinations found and recorded by RF detection. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Gauge32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
ntwsInfoRFDetectMib	1.3.6.1.4.1.45.6.1.4.9			RF Detect MIB. Copyright 2007 Nortel Networks. All rights reserved. This Nortel Networks SNMP Management Information Base Specification (Specification) embodies Nortel Networks' confidential and proprietary intellectual property. This Specification is supplied 'AS IS' and Nortel Networks makes no warranty, either express or implied, as to the use, operation, condition, or performance of the Specification.
ntwsInfoRFDetectObjects	1.3.6.1.4.1.45.6.1.4.9.1
ntwsInfoRFDetectDataObjects	1.3.6.1.4.1.45.6.1.4.9.1.1
ntwsInfoRFDetectXmtrTable	1.3.6.1.4.1.45.6.1.4.9.1.1.1		not-accessible	Transmitter table. May contain tens of thousands of entries (different Transmitter-Listener-Channel combinations).
ntwsInfoRFDetectXmtrEntry	1.3.6.1.4.1.45.6.1.4.9.1.1.1.1		not-accessible	Transmitter-Listener-Channel combination.
MAC ntwsInfoRFDetectXmtrTransmitterMacAddress	1.3.6.1.4.1.45.6.1.4.9.1.1.1.1.1	MacAddress	not-accessible	The MAC Address of this Transmitter.
MAC ntwsInfoRFDetectXmtrListenerMacAddress	1.3.6.1.4.1.45.6.1.4.9.1.1.1.1.2	MacAddress	not-accessible	The MAC Address of this Listener.
NTW ntwsInfoRFDetectXmtrChannelNum	1.3.6.1.4.1.45.6.1.4.9.1.1.1.1.3	NtwsChannelNum	not-accessible	Channel Number this transmitter was using when this listener detected it.
NTW ntwsInfoRFDetectXmtrRssi	1.3.6.1.4.1.45.6.1.4.9.1.1.1.1.4	NtwsRssi	read-only	Received Signal Strength Indicator at this listener.
STR ntwsInfoRFDetectXmtrSsid	1.3.6.1.4.1.45.6.1.4.9.1.1.1.1.5	DisplayString	read-only	The service/SSID name this transmitter was using. Zero-length string when unknown or not applicable.
NTW ntwsInfoRFDetectXmtrNetworkingMode	1.3.6.1.4.1.45.6.1.4.9.1.1.1.1.6	NtwsRFDetectNetworkingMode	read-only	The way this transmitter is doing wireless networking: ad-hoc mode networking or infrastructure mode networking.
NTW ntwsInfoRFDetectXmtrClassification	1.3.6.1.4.1.45.6.1.4.9.1.1.1.1.7	NtwsRFDetectClassification	read-only	The RF classification of this transmitter.
NTW ntwsInfoRFDetectXmtrClassificationReason	1.3.6.1.4.1.45.6.1.4.9.1.1.1.1.8	NtwsRFDetectClassificationReason	read-only	The reason why this transmitter was classified by RF detection the way it is.
G32 ntwsInfoRFDetectCurrentXmtrTableSizeEx	1.3.6.1.4.1.45.6.1.4.9.1.1.2	Gauge32	read-only	Current number of Transmitter-Listener-Channel combinations found and recorded by RF detection.
ntwsInfoRFDetectConformance	1.3.6.1.4.1.45.6.1.4.9.1.2
ntwsInfoRFDetectCompliances	1.3.6.1.4.1.45.6.1.4.9.1.2.1
ntwsInfoRFDetectCompliance	1.3.6.1.4.1.45.6.1.4.9.1.2.1.1			The compliance statement for devices that implement the RF Detect MIB.
ntwsInfoRFDetectGroups	1.3.6.1.4.1.45.6.1.4.9.1.2.2
ntwsInfoRFDetectXmtrGroup	1.3.6.1.4.1.45.6.1.4.9.1.2.2.1			Mandatory group of objects implemented to provide RF Detect Transmitter info.
ntwsInfoRFDetectXmtrClassificationGroup	1.3.6.1.4.1.45.6.1.4.9.1.2.2.2			Group of objects implemented to provide RF Detect Classification info. Introduced in 6.2 release.
ntwsInfoRFDetectCurrentXmtrTableSizeGroup	1.3.6.1.4.1.45.6.1.4.9.1.2.2.3			Group for one object that provides the current number of Transmitter-Listener-Channel combinations found and recorded by RF detection. Introduced in 6.2 release.

RFC description

RF Detect MIB for Nortel Networks wireless access points. Monitors RF transmitters and interference detection in wireless networks.

Start monitoring Nortel NTWS wireless LAN controller and managed Access Points (RF/rogue AP detection) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download NTWS-INFO-RF-DETECT-MIB