OPENBSD-PF-MIB

All MIBs › OPENBSD-PF-MIB

Organization: OpenBSD

Last Updated: 2015-06-09

Category: Operating Systems

Description:

Monitors pf packet filter rule counters, state table usage, and traffic statistics on OpenBSD hosts.

Imported Objects

openBSD

MODULE-IDENTITY

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Counter64
Integer32
IpAddress
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
TimeTicks
Unsigned32
enterprises

From SNMPv2-TC

TruthValue

What Is OPENBSD-PF-MIB?

OPENBSD-PF-MIB is a vendor-neutral-in-spirit but platform-specific SNMP module maintained by the OpenBSD project that exposes statistics from OpenBSD's built-in packet filter (pf) firewall subsystem. It provides data on firewall engine status, uptime/runtime, debug level, host identifier, and a rich set of packet-processing counters covering rule matches, bad offsets, fragmentation, short packets, normalization events, memory pressure, timestamp issues, and congestion, along with overall state table usage. Its monitoring focus is squarely on software/service status and performance: whether the pf engine is running (pfRunning), how long it has been active (pfRuntime), and counters that reveal packet-processing anomalies or resource exhaustion in the firewall's state table. It is specific to OpenBSD hosts and has no dependency on other vendor MIBs, though it complements standard host/interface MIBs used on the same system. It is deployed on OpenBSD systems acting as firewalls, routers, or gateways where administrators want SNMP visibility into pf's operational health and traffic-filtering behavior. Network engineers evaluating or troubleshooting this functionality can download the OPENBSD-PF-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in OPENBSD-PF-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

What Can Be Monitored

pf engine running status
pf engine runtime/uptime
packet counters (matched, fragmented, malformed)
state table utilization
memory/congestion related drop counts

Supported Devices

OpenBSD firewall/router host

Monitoring Examples

An admin would poll pfRunning to confirm the packet filter is active and pfRuntime to see how long it has been running since last restart, then check pfCntMemory and pfCntCongestion under pfCounters to detect resource pressure. Rising values in pfCntFragment, pfCntShort, or pfCntBadOffset would indicate an increase in malformed or attack-like traffic hitting the firewall. Monitoring the pfStateTable alongside pfInfo would reveal whether the firewall's connection state table is approaching capacity, which could cause new connections to be dropped.

OIDs

OID symbolic	OID numeric	Type	Access	Description
C64 pfCntBadOffset	1.3.6.1.4.1.30155.1.2.2	Counter64	read-only	The number of packets that have had a bad offset value.
C64 pfCntCongestion	1.3.6.1.4.1.30155.1.2.8	Counter64	read-only	The number of packets that were dropped due to congestion on the interface.
C64 pfCntFragment	1.3.6.1.4.1.30155.1.2.3	Counter64	read-only	The number of packet fragments.
C64 pfCntIpOption	1.3.6.1.4.1.30155.1.2.9	Counter64	read-only	The number of packets that were dropped due to having options set in the IP header.
C64 pfCntMatch	1.3.6.1.4.1.30155.1.2.1	Counter64	read-only	The number of packets that have matched a filter rule.
C64 pfCntMemory	1.3.6.1.4.1.30155.1.2.6	Counter64	read-only	The number of packets that were dropped due to memory limitations.
C64 pfCntNormalize	1.3.6.1.4.1.30155.1.2.5	Counter64	read-only	The number of packets that were normalized using the packet scrubber.
C64 pfCntNoRoute	1.3.6.1.4.1.30155.1.2.17	Counter64	read-only	The number of packets that were dropped because policy based routing was requested but no target addresses were available.
C64 pfCntProtoCksum	1.3.6.1.4.1.30155.1.2.10	Counter64	read-only	The number of packets that were dropped due to memory limitations.
C64 pfCntShort	1.3.6.1.4.1.30155.1.2.4	Counter64	read-only	The number of packets that were too short to contain a valid header.
C64 pfCntSrcLimit	1.3.6.1.4.1.30155.1.2.14	Counter64	read-only	The number of packets that were dropped due to stateful connection tracking. A packet could be dropped due to resource limits (memory) or due to a tracking limit being reached.
C64 pfCntStateInsert	1.3.6.1.4.1.30155.1.2.12	Counter64	read-only	The number of packets that were dropped due to errors creating a state table entry.
C64 pfCntStateLimit	1.3.6.1.4.1.30155.1.2.13	Counter64	read-only	The number of packets that were dropped due to the per-rule max state limit being reached.
C64 pfCntStateMismatch	1.3.6.1.4.1.30155.1.2.11	Counter64	read-only	The number of packets that were dropped due to a state table mismatch.
C64 pfCntSynproxy	1.3.6.1.4.1.30155.1.2.15	Counter64	read-only	The number of packets that were dropped during the TCP synproxy process.
C64 pfCntTimestamp	1.3.6.1.4.1.30155.1.2.7	Counter64	read-only	The number of packets that were dropped due to improper RFC1323 timestamp.
C64 pfCntTranslate	1.3.6.1.4.1.30155.1.2.16	Counter64	read-only	The number of packets that were dropped because network address translation was requested and no unused port was available.
pfCounters	1.3.6.1.4.1.30155.1.2
INT pfDebug	1.3.6.1.4.1.30155.1.1.3	INTEGER	read-only	Indicates the debug level that pf is running at.
OCT pfHostid	1.3.6.1.4.1.30155.1.1.4	OCTET STRING	read-only	The (unique) host id of the machine running pf.
OCT pfIfDescr	1.3.6.1.4.1.30155.1.8.128.1.2	OCTET STRING	read-only	The name of the interface.
pfIfEntry	1.3.6.1.4.1.30155.1.8.128.1		not-accessible	An entry containing management information applicable to a particular interface.
C64 pfIfIn4BlockBytes	1.3.6.1.4.1.30155.1.8.128.1.9	Counter64	read-only	The number of incoming IPv4 bytes blocked.
C64 pfIfIn4BlockPkts	1.3.6.1.4.1.30155.1.8.128.1.8	Counter64	read-only	The number of incoming IPv4 packets blocked.
C64 pfIfIn4PassBytes	1.3.6.1.4.1.30155.1.8.128.1.7	Counter64	read-only	The number of IPv4 bytes passed in.
C64 pfIfIn4PassPkts	1.3.6.1.4.1.30155.1.8.128.1.6	Counter64	read-only	The number of IPv4 packets passed in.
C64 pfIfIn6BlockBytes	1.3.6.1.4.1.30155.1.8.128.1.17	Counter64	read-only	The number of incoming IPv6 bytes blocked.
C64 pfIfIn6BlockPkts	1.3.6.1.4.1.30155.1.8.128.1.16	Counter64	read-only	The number of incoming IPv6 packets blocked.
C64 pfIfIn6PassBytes	1.3.6.1.4.1.30155.1.8.128.1.15	Counter64	read-only	The number of IPv6 bytes passed in.
C64 pfIfIn6PassPkts	1.3.6.1.4.1.30155.1.8.128.1.14	Counter64	read-only	The number of IPv6 packets passed in.
I32 pfIfIndex	1.3.6.1.4.1.30155.1.8.128.1.1	Integer32	read-only	A unique value, greater than zero, for each interface. It is recommended that values are assigned contiguously starting from 1. The value for each interface sub-layer must remain constant at least from one re-initialization of the entity's network management system to the next re- initialization.
I32 pfIfNumber	1.3.6.1.4.1.30155.1.8.1	Integer32	read-only	The number of network interfaces present on this system.
C64 pfIfOut4BlockBytes	1.3.6.1.4.1.30155.1.8.128.1.13	Counter64	read-only	The number of outgoing IPv4 bytes blocked.
C64 pfIfOut4BlockPkts	1.3.6.1.4.1.30155.1.8.128.1.12	Counter64	read-only	The number of outgoing IPv4 bytes blocked.
C64 pfIfOut4PassBytes	1.3.6.1.4.1.30155.1.8.128.1.11	Counter64	read-only	The number of IPv4 bytes passed out.
C64 pfIfOut4PassPkts	1.3.6.1.4.1.30155.1.8.128.1.10	Counter64	read-only	The number of IPv4 bytes passed out.
C64 pfIfOut6BlockBytes	1.3.6.1.4.1.30155.1.8.128.1.21	Counter64	read-only	The number of outgoing IPv6 bytes blocked.
C64 pfIfOut6BlockPkts	1.3.6.1.4.1.30155.1.8.128.1.20	Counter64	read-only	The number of outgoing IPv6 bytes blocked.
C64 pfIfOut6PassBytes	1.3.6.1.4.1.30155.1.8.128.1.19	Counter64	read-only	The number of IPv6 bytes passed out.
C64 pfIfOut6PassPkts	1.3.6.1.4.1.30155.1.8.128.1.18	Counter64	read-only	The number of IPv6 bytes passed out.
U32 pfIfRefs	1.3.6.1.4.1.30155.1.8.128.1.4	Unsigned32	read-only	The number of state and/or source track entries which reference the interface.
U32 pfIfRules	1.3.6.1.4.1.30155.1.8.128.1.5	Unsigned32	read-only	The number of rules which reference the interface.
pfIfTable	1.3.6.1.4.1.30155.1.8.128		not-accessible	A list of individual interfaces. The number of entries is given by the value of pfIfNumber.
INT pfIfType	1.3.6.1.4.1.30155.1.8.128.1.3	INTEGER	read-only	Denotes whether the interface is a group interface, an interface instance, or whether it's been removed or destroyed.
pfInfo	1.3.6.1.4.1.30155.1.1
pfInterfaces	1.3.6.1.4.1.30155.1.8
C64 pfLabelBytes	1.3.6.1.4.1.30155.1.10.128.1.5	Counter64	read-only	The total number of bytes matched by the rule.
pfLabelEntry	1.3.6.1.4.1.30155.1.10.128.1		not-accessible	An entry containing management information applicable to a particular label.
C64 pfLabelEvals	1.3.6.1.4.1.30155.1.10.128.1.3	Counter64	read-only	The number of rule evaluations.
C64 pfLabelInBytes	1.3.6.1.4.1.30155.1.10.128.1.7	Counter64	read-only	The number of incoming bytes matched by the rule.
I32 pfLabelIndex	1.3.6.1.4.1.30155.1.10.128.1.1	Integer32	read-only	A unique value, greater than zero, for each label.
C64 pfLabelInPkts	1.3.6.1.4.1.30155.1.10.128.1.6	Counter64	read-only	The number of incoming packets matched by the rule.
OCT pfLabelName	1.3.6.1.4.1.30155.1.10.128.1.2	OCTET STRING	read-only	The name of the label.
I32 pfLabelNumber	1.3.6.1.4.1.30155.1.10.1	Integer32	read-only	The number of labels in the active pf ruleset.
C64 pfLabelOutBytes	1.3.6.1.4.1.30155.1.10.128.1.9	Counter64	read-only	The number of outgoing bytes matched by the rule.
C64 pfLabelOutPkts	1.3.6.1.4.1.30155.1.10.128.1.8	Counter64	read-only	The number of outgoing packets matched by the rule.
C64 pfLabelPkts	1.3.6.1.4.1.30155.1.10.128.1.4	Counter64	read-only	The total number of packets matched by the rule.
pfLabels	1.3.6.1.4.1.30155.1.10
pfLabelTable	1.3.6.1.4.1.30155.1.10.128		not-accessible	A list of individual labels. The number of entries is given by the value of pfLabelNumber.
C32 pfLabelTotalStates	1.3.6.1.4.1.30155.1.10.128.1.10	Counter32	read-only	The total number of state table entries created by this rule since the ruleset was loaded.
U32 pfLimitFragments	1.3.6.1.4.1.30155.1.6.3	Unsigned32	read-only	The maximum number of entries in the memory pool used for packet reassembly (scrub rules).
U32 pfLimitMaxTableEntries	1.3.6.1.4.1.30155.1.6.5	Unsigned32	read-only	The overall maximum number of addresses that can be stored in tables.
U32 pfLimitMaxTables	1.3.6.1.4.1.30155.1.6.4	Unsigned32	read-only	The maximum number of tables that can be created as part of the active ruleset.
pfLimits	1.3.6.1.4.1.30155.1.6
U32 pfLimitSourceNodes	1.3.6.1.4.1.30155.1.6.2	Unsigned32	read-only	The maximum number of entries in the memory pool used for tracking source IP addresses (filter rules that specify 'sticky-address' or 'source-track' options).
U32 pfLimitStates	1.3.6.1.4.1.30155.1.6.1	Unsigned32	read-only	The maximum number of entries in the memory pool used by state table entries (filter rules that specify 'keep state').
C64 pfLogIfIp6BytesIn	1.3.6.1.4.1.30155.1.4.8	Counter64	read-only	The number of IPv6 bytes passed in on the loginterface.
C64 pfLogIfIp6BytesOut	1.3.6.1.4.1.30155.1.4.9	Counter64	read-only	The number of IPv6 bytes passed out on the loginterface.
C64 pfLogIfIp6PktsInDrop	1.3.6.1.4.1.30155.1.4.11	Counter64	read-only	The number of dropped IPv6 packets coming in on the loginterface.
C64 pfLogIfIp6PktsInPass	1.3.6.1.4.1.30155.1.4.10	Counter64	read-only	The number of IPv6 packets passed in on the loginterface.
C64 pfLogIfIp6PktsOutDrop	1.3.6.1.4.1.30155.1.4.13	Counter64	read-only	The number of dropped IPv6 packets going out on the loginterface.
C64 pfLogIfIp6PktsOutPass	1.3.6.1.4.1.30155.1.4.12	Counter64	read-only	The number of IPv6 packets passed out on the loginterface.
C64 pfLogIfIpBytesIn	1.3.6.1.4.1.30155.1.4.2	Counter64	read-only	The number of IPv4 bytes passed in on the loginterface.
C64 pfLogIfIpBytesOut	1.3.6.1.4.1.30155.1.4.3	Counter64	read-only	The number of IPv4 bytes passed out on the loginterface.
C64 pfLogIfIpPktsInDrop	1.3.6.1.4.1.30155.1.4.5	Counter64	read-only	The number of dropped IPv4 packets coming in on the loginterface.
C64 pfLogIfIpPktsInPass	1.3.6.1.4.1.30155.1.4.4	Counter64	read-only	The number of IPv4 packets passed in on the loginterface.
C64 pfLogIfIpPktsOutDrop	1.3.6.1.4.1.30155.1.4.7	Counter64	read-only	The number of dropped IPv4 packets going out on the loginterface.
C64 pfLogIfIpPktsOutPass	1.3.6.1.4.1.30155.1.4.6	Counter64	read-only	The number of IPv4 packets passed out on the loginterface.
OCT pfLogIfName	1.3.6.1.4.1.30155.1.4.1	OCTET STRING	read-only	The name of the interface configured using 'set loginterface'. If no interface has been configured, the object will be empty.
pfLogInterface	1.3.6.1.4.1.30155.1.4
pfMIBObjects	1.3.6.1.4.1.30155.1			The MIB module for gathering information from OpenBSD's packet filter.
T/F pfRunning	1.3.6.1.4.1.30155.1.1.1	TruthValue	read-only	Indicates whether pf is enabled or not.
TIK pfRuntime	1.3.6.1.4.1.30155.1.1.2	TimeTicks	read-only	Indicates how long pf has been enabled. If pf is not enabled, indicates how long pf has been disabled. If pf has not been explicitly enabled or disabled since the system was booted, the value will be 0.
U32 pfSrcTrackCount	1.3.6.1.4.1.30155.1.5.1	Unsigned32	read-only	The number of entries in the source tracking table.
pfSrcTracking	1.3.6.1.4.1.30155.1.5
C64 pfSrcTrackInserts	1.3.6.1.4.1.30155.1.5.3	Counter64	read-only	The number of inserts into the source tracking table.
C64 pfSrcTrackRemovals	1.3.6.1.4.1.30155.1.5.4	Counter64	read-only	The number of removals from the source tracking table.
C64 pfSrcTrackSearches	1.3.6.1.4.1.30155.1.5.2	Counter64	read-only	The number of searches against the source tracking table.
U32 pfStateCount	1.3.6.1.4.1.30155.1.3.1	Unsigned32	read-only	The number of entries in the state table.
C64 pfStateInserts	1.3.6.1.4.1.30155.1.3.3	Counter64	read-only	The number of inserts into the state table.
C64 pfStateRemovals	1.3.6.1.4.1.30155.1.3.4	Counter64	read-only	The number of removals from the state table.
C64 pfStateSearches	1.3.6.1.4.1.30155.1.3.2	Counter64	read-only	The number of searches against the state table.
pfStateTable	1.3.6.1.4.1.30155.1.3
C64 pfsyncIp6PktsRecv	1.3.6.1.4.1.30155.1.11.2	Counter64	read-only	Number of IPv6 pfsync packets received on all interfaces.
C64 pfsyncIp6PktsSent	1.3.6.1.4.1.30155.1.11.14	Counter64	read-only	Number of IPv6 pfsync packets sent on all interfaces.
C64 pfsyncIpPktsRecv	1.3.6.1.4.1.30155.1.11.1	Counter64	read-only	Number of IPv4 pfsync packets received on all interfaces.
C64 pfsyncIpPktsSent	1.3.6.1.4.1.30155.1.11.13	Counter64	read-only	Number of IPv4 pfsync packets sent on all interfaces.
C64 pfsyncNoMemory	1.3.6.1.4.1.30155.1.11.15	Counter64	read-only	Number of pfsync packets which could not be sent due to insufficient memory.
C64 pfsyncOutputErrors	1.3.6.1.4.1.30155.1.11.16	Counter64	read-only	Number of pfsync packets which could not be sent.
C64 pfsyncPktDiscardsForBadAction	1.3.6.1.4.1.30155.1.11.7	Counter64	read-only	Number of pfsync packets discarded due to an invalid pfsync action in the header.
C64 pfsyncPktDiscardsForBadAuth	1.3.6.1.4.1.30155.1.11.9	Counter64	read-only	Number of pfsync packets discarded due to authentication failure.
C64 pfsyncPktDiscardsForBadInterface	1.3.6.1.4.1.30155.1.11.3	Counter64	read-only	Number of pfsync packets discarded because it was received on an interface that is not running pfsync.
C64 pfsyncPktDiscardsForBadLength	1.3.6.1.4.1.30155.1.11.8	Counter64	read-only	Number of pfsync packets discarded due to incorrect size.
C64 pfsyncPktDiscardsForBadState	1.3.6.1.4.1.30155.1.11.12	Counter64	read-only	Number of pfsync packets discarded due to state insert/lookup failure.
C64 pfsyncPktDiscardsForBadTtl	1.3.6.1.4.1.30155.1.11.4	Counter64	read-only	Number of pfsync packets discarded due to having a TTL less than 255.
C64 pfsyncPktDiscardsForBadValues	1.3.6.1.4.1.30155.1.11.11	Counter64	read-only	Number of pfsync packets discarded due to containing bad values.
C64 pfsyncPktDiscardsForBadVersion	1.3.6.1.4.1.30155.1.11.6	Counter64	read-only	Number of pfsync packets discarded due to incorrect protocol version.
C64 pfsyncPktDiscardsForStaleState	1.3.6.1.4.1.30155.1.11.10	Counter64	read-only	Number of pfsync packets discarded because they tried to update a stale state entry.
C64 pfsyncPktShorterThanHeader	1.3.6.1.4.1.30155.1.11.5	Counter64	read-only	Number of pfsync packets received that had a length shorter than the pfsync packet header.
pfsyncStats	1.3.6.1.4.1.30155.1.11
pfTables	1.3.6.1.4.1.30155.1.9
TIK pfTblAddrCleared	1.3.6.1.4.1.30155.1.9.129.1.4	TimeTicks	read-only	The time that's passed since the statistics where last cleared, or since the pfTblAddrNet/pfTblAddrMask pair was loaded into the table, whichever is sooner.
pfTblAddrEntry	1.3.6.1.4.1.30155.1.9.129.1		not-accessible	An entry containing management information applicable to a particular table.
I32 pfTblAddresses	1.3.6.1.4.1.30155.1.9.128.1.3	Integer32	read-only	The number of addresses currently stored in the table.
C64 pfTblAddrInBlockBytes	1.3.6.1.4.1.30155.1.9.129.1.6	Counter64	read-only	The number of inbound bytes blocked as a result of matching this table entry.
C64 pfTblAddrInBlockPkts	1.3.6.1.4.1.30155.1.9.129.1.5	Counter64	read-only	The number of inbound packets blocked as a result of matching this table entry.
C64 pfTblAddrInMatchBytes	1.3.6.1.4.1.30155.1.9.129.1.14	Counter64	read-only	The total size in bytes of all inbound packets that hit a 'match' rule where this table entry was referenced.
C64 pfTblAddrInMatchPkts	1.3.6.1.4.1.30155.1.9.129.1.13	Counter64	read-only	The number of inbound packets that hit a 'match' rule where this table entry was referenced.
C64 pfTblAddrInPassBytes	1.3.6.1.4.1.30155.1.9.129.1.8	Counter64	read-only	The number of inbound bytes passed as a result of matching this table entry.
C64 pfTblAddrInPassPkts	1.3.6.1.4.1.30155.1.9.129.1.7	Counter64	read-only	The number of inbound packets passed as a result of matching this table entry.
I32 pfTblAddrMask	1.3.6.1.4.1.30155.1.9.129.1.3	Integer32	read-only	The CIDR bitmask for this particular table entry.
IP pfTblAddrNet	1.3.6.1.4.1.30155.1.9.129.1.2	IpAddress	read-only	The IP address portion of the CIDR network for this particular table entry.
C64 pfTblAddrOutBlockBytes	1.3.6.1.4.1.30155.1.9.129.1.10	Counter64	read-only	The number of outbound bytes blocked as a result of matching this table entry.
C64 pfTblAddrOutBlockPkts	1.3.6.1.4.1.30155.1.9.129.1.9	Counter64	read-only	The number of outbound packets blocked as a result of matching this table entry.
C64 pfTblAddrOutMatchBytes	1.3.6.1.4.1.30155.1.9.129.1.16	Counter64	read-only	The total size in bytes of all outbound packets that hit a 'match' rule where this table entry was referenced.
C64 pfTblAddrOutMatchPkts	1.3.6.1.4.1.30155.1.9.129.1.15	Counter64	read-only	The number of outbound packets that hit a 'match' rule where this table entry was referenced.
C64 pfTblAddrOutPassBytes	1.3.6.1.4.1.30155.1.9.129.1.12	Counter64	read-only	The number of outbound bytes passed as a result of matchg this table entry.
C64 pfTblAddrOutPassPkts	1.3.6.1.4.1.30155.1.9.129.1.11	Counter64	read-only	The number of outbound packets passed as a result of matchin this table entry.
pfTblAddrTable	1.3.6.1.4.1.30155.1.9.129		not-accessible	A table containing the addresses/CIDR network blocks from every table on the system.
I32 pfTblAddrTblIndex	1.3.6.1.4.1.30155.1.9.129.1.1	Integer32	read-only	The index value which uniquely identifies the table which contains this pfTblAddrNet/pfTblAddrMask pair.
I32 pfTblAnchorRefs	1.3.6.1.4.1.30155.1.9.128.1.4	Integer32	read-only	The number of anchors which reference the table.
pfTblEntry	1.3.6.1.4.1.30155.1.9.128.1		not-accessible	An entry containing management information applicable to a particular table.
C64 pfTblEvalsMatch	1.3.6.1.4.1.30155.1.9.128.1.6	Counter64	read-only	The number of table evaluations that produced a match.
C64 pfTblEvalsNoMatch	1.3.6.1.4.1.30155.1.9.128.1.7	Counter64	read-only	The number of table evaluations that didn't match.
C64 pfTblInBlockBytes	1.3.6.1.4.1.30155.1.9.128.1.11	Counter64	read-only	The number incoming bytes blocked that matched the table.
C64 pfTblInBlockPkts	1.3.6.1.4.1.30155.1.9.128.1.10	Counter64	read-only	The number of incoming packets blocked that matched the table.
I32 pfTblIndex	1.3.6.1.4.1.30155.1.9.128.1.1	Integer32	read-only	A unique value, greater than zero, for each table.
C64 pfTblInMatchBytes	1.3.6.1.4.1.30155.1.9.128.1.22	Counter64	read-only	The total size in bytes of all inbound packets that hit a 'match' rule where this particular table was referenced by the rule.
C64 pfTblInMatchPkts	1.3.6.1.4.1.30155.1.9.128.1.21	Counter64	read-only	The number of inbound packets that hit a 'match' rule where this particular table was referenced by the rule.
C64 pfTblInPassBytes	1.3.6.1.4.1.30155.1.9.128.1.9	Counter64	read-only	The number of bytes passed in that matched the table.
C64 pfTblInPassPkts	1.3.6.1.4.1.30155.1.9.128.1.8	Counter64	read-only	The number of packets passed in that matched the table.
C64 pfTblInXPassBytes	1.3.6.1.4.1.30155.1.9.128.1.13	Counter64	read-only	The number of bytes statefully passed in where the state entry refers to the table, but the table no longer contains the address in question.
C64 pfTblInXPassPkts	1.3.6.1.4.1.30155.1.9.128.1.12	Counter64	read-only	The number of packets statefully passed in where the state entry refers to the table, but the table no longer contains the address in question.
OCT pfTblName	1.3.6.1.4.1.30155.1.9.128.1.2	OCTET STRING	read-only	The name of the table.
I32 pfTblNumber	1.3.6.1.4.1.30155.1.9.1	Integer32	read-only	The number of tables present on this system.
C64 pfTblOutBlockBytes	1.3.6.1.4.1.30155.1.9.128.1.17	Counter64	read-only	The number outgoing bytes blocked that matched the table.
C64 pfTblOutBlockPkts	1.3.6.1.4.1.30155.1.9.128.1.16	Counter64	read-only	The number of outgoing packets blocked that matched the table.
C64 pfTblOutMatchBytes	1.3.6.1.4.1.30155.1.9.128.1.24	Counter64	read-only	The total size in bytes of all outbound packets that hit a 'match' rule where this particular table was referenced by the rule.
C64 pfTblOutMatchPkts	1.3.6.1.4.1.30155.1.9.128.1.23	Counter64	read-only	The number of outbound packets that hit a 'match' rule where this particular table was referenced by the rule.
C64 pfTblOutPassBytes	1.3.6.1.4.1.30155.1.9.128.1.15	Counter64	read-only	The number of bytes passed out that matched the table.
C64 pfTblOutPassPkts	1.3.6.1.4.1.30155.1.9.128.1.14	Counter64	read-only	The number of packets passed out that matched the table.
C64 pfTblOutXPassBytes	1.3.6.1.4.1.30155.1.9.128.1.19	Counter64	read-only	The number of bytes statefully passed out where the state entry refers to the table, but the table no longer contains the address in question.
C64 pfTblOutXPassPkts	1.3.6.1.4.1.30155.1.9.128.1.18	Counter64	read-only	The number of packets statefully passed out where the state entry refers to the table, but the table no longer contains the address in question.
I32 pfTblRuleRefs	1.3.6.1.4.1.30155.1.9.128.1.5	Integer32	read-only	The number of rules which reference the table.
TIK pfTblStatsCleared	1.3.6.1.4.1.30155.1.9.128.1.20	TimeTicks	read-only	The number of seconds that have passed since the statistics for this pf table were zeroed.
pfTblTable	1.3.6.1.4.1.30155.1.9.128		not-accessible	A list of individual tables. The number of entries is given by the value of tblNumber.
I32 pfTimeoutAdaptiveEnd	1.3.6.1.4.1.30155.1.7.18	Integer32	read-only	When reaching this number of state entries, all timeout values become zero, effectively purging all state entries immediately.
I32 pfTimeoutAdaptiveStart	1.3.6.1.4.1.30155.1.7.17	Integer32	read-only	When the number of state entries exceeds this value, adaptive scaling begins.
I32 pfTimeoutFragment	1.3.6.1.4.1.30155.1.7.15	Integer32	read-only	How long before an unassembled fragment is expired.
I32 pfTimeoutIcmpError	1.3.6.1.4.1.30155.1.7.11	Integer32	read-only	State when an ICMP error comes back in response to an ICMP packet.
I32 pfTimeoutIcmpFirst	1.3.6.1.4.1.30155.1.7.10	Integer32	read-only	State after receiving the first ICMP packet.
I32 pfTimeoutInterval	1.3.6.1.4.1.30155.1.7.16	Integer32	read-only	Interval before purging expired states and fragments.
I32 pfTimeoutOtherFirst	1.3.6.1.4.1.30155.1.7.12	Integer32	read-only	State after receiving the first packet.
I32 pfTimeoutOtherMultiple	1.3.6.1.4.1.30155.1.7.14	Integer32	read-only	State when both hosts have sent packets.
I32 pfTimeoutOtherSingle	1.3.6.1.4.1.30155.1.7.13	Integer32	read-only	State if the source sends more than 1 packet but the destination has never sent a packet back.
pfTimeouts	1.3.6.1.4.1.30155.1.7
I32 pfTimeoutSrcTrack	1.3.6.1.4.1.30155.1.7.19	Integer32	read-only	Time that a source tracking entry will stay around after the last state expires.
I32 pfTimeoutTcpClosed	1.3.6.1.4.1.30155.1.7.6	Integer32	read-only	State after the first RST has been sent.
I32 pfTimeoutTcpClosing	1.3.6.1.4.1.30155.1.7.4	Integer32	read-only	State after the first FIN has been sent.
I32 pfTimeoutTcpEstablished	1.3.6.1.4.1.30155.1.7.3	Integer32	read-only	State when a TCP connection is fully established.
I32 pfTimeoutTcpFinWait	1.3.6.1.4.1.30155.1.7.5	Integer32	read-only	State after both FINs are sent and the connection is closed.
I32 pfTimeoutTcpFirst	1.3.6.1.4.1.30155.1.7.1	Integer32	read-only	State after receiving the first TCP packet in a new connection.
I32 pfTimeoutTcpOpening	1.3.6.1.4.1.30155.1.7.2	Integer32	read-only	State before the destination host ever sends a packet in response to a new connection from this host.
I32 pfTimeoutUdpFirst	1.3.6.1.4.1.30155.1.7.7	Integer32	read-only	State after receiving the first UDP packet.
I32 pfTimeoutUdpMultiple	1.3.6.1.4.1.30155.1.7.9	Integer32	read-only	State when both hosts have sent packets.
I32 pfTimeoutUdpSingle	1.3.6.1.4.1.30155.1.7.8	Integer32	read-only	State if the source sends more than 1 packet but the destination has never sent a packet back.

OID symbolic	OID numeric	Type	Access	Description
pfMIBObjects	1.3.6.1.4.1.30155.1			The MIB module for gathering information from OpenBSD's packet filter.
pfInfo	1.3.6.1.4.1.30155.1.1
T/F pfRunning	1.3.6.1.4.1.30155.1.1.1	TruthValue	read-only	Indicates whether pf is enabled or not.
TIK pfRuntime	1.3.6.1.4.1.30155.1.1.2	TimeTicks	read-only	Indicates how long pf has been enabled. If pf is not enabled, indicates how long pf has been disabled. If pf has not been explicitly enabled or disabled since the system was booted, the value will be 0.
INT pfDebug	1.3.6.1.4.1.30155.1.1.3	INTEGER	read-only	Indicates the debug level that pf is running at.
OCT pfHostid	1.3.6.1.4.1.30155.1.1.4	OCTET STRING	read-only	The (unique) host id of the machine running pf.
pfCounters	1.3.6.1.4.1.30155.1.2
C64 pfCntMatch	1.3.6.1.4.1.30155.1.2.1	Counter64	read-only	The number of packets that have matched a filter rule.
C64 pfCntBadOffset	1.3.6.1.4.1.30155.1.2.2	Counter64	read-only	The number of packets that have had a bad offset value.
C64 pfCntFragment	1.3.6.1.4.1.30155.1.2.3	Counter64	read-only	The number of packet fragments.
C64 pfCntShort	1.3.6.1.4.1.30155.1.2.4	Counter64	read-only	The number of packets that were too short to contain a valid header.
C64 pfCntNormalize	1.3.6.1.4.1.30155.1.2.5	Counter64	read-only	The number of packets that were normalized using the packet scrubber.
C64 pfCntMemory	1.3.6.1.4.1.30155.1.2.6	Counter64	read-only	The number of packets that were dropped due to memory limitations.
C64 pfCntTimestamp	1.3.6.1.4.1.30155.1.2.7	Counter64	read-only	The number of packets that were dropped due to improper RFC1323 timestamp.
C64 pfCntCongestion	1.3.6.1.4.1.30155.1.2.8	Counter64	read-only	The number of packets that were dropped due to congestion on the interface.
C64 pfCntIpOption	1.3.6.1.4.1.30155.1.2.9	Counter64	read-only	The number of packets that were dropped due to having options set in the IP header.
C64 pfCntProtoCksum	1.3.6.1.4.1.30155.1.2.10	Counter64	read-only	The number of packets that were dropped due to memory limitations.
C64 pfCntStateMismatch	1.3.6.1.4.1.30155.1.2.11	Counter64	read-only	The number of packets that were dropped due to a state table mismatch.
C64 pfCntStateInsert	1.3.6.1.4.1.30155.1.2.12	Counter64	read-only	The number of packets that were dropped due to errors creating a state table entry.
C64 pfCntStateLimit	1.3.6.1.4.1.30155.1.2.13	Counter64	read-only	The number of packets that were dropped due to the per-rule max state limit being reached.
C64 pfCntSrcLimit	1.3.6.1.4.1.30155.1.2.14	Counter64	read-only	The number of packets that were dropped due to stateful connection tracking. A packet could be dropped due to resource limits (memory) or due to a tracking limit being reached.
C64 pfCntSynproxy	1.3.6.1.4.1.30155.1.2.15	Counter64	read-only	The number of packets that were dropped during the TCP synproxy process.
C64 pfCntTranslate	1.3.6.1.4.1.30155.1.2.16	Counter64	read-only	The number of packets that were dropped because network address translation was requested and no unused port was available.
C64 pfCntNoRoute	1.3.6.1.4.1.30155.1.2.17	Counter64	read-only	The number of packets that were dropped because policy based routing was requested but no target addresses were available.
pfStateTable	1.3.6.1.4.1.30155.1.3
U32 pfStateCount	1.3.6.1.4.1.30155.1.3.1	Unsigned32	read-only	The number of entries in the state table.
C64 pfStateSearches	1.3.6.1.4.1.30155.1.3.2	Counter64	read-only	The number of searches against the state table.
C64 pfStateInserts	1.3.6.1.4.1.30155.1.3.3	Counter64	read-only	The number of inserts into the state table.
C64 pfStateRemovals	1.3.6.1.4.1.30155.1.3.4	Counter64	read-only	The number of removals from the state table.
pfLogInterface	1.3.6.1.4.1.30155.1.4
OCT pfLogIfName	1.3.6.1.4.1.30155.1.4.1	OCTET STRING	read-only	The name of the interface configured using 'set loginterface'. If no interface has been configured, the object will be empty.
C64 pfLogIfIpBytesIn	1.3.6.1.4.1.30155.1.4.2	Counter64	read-only	The number of IPv4 bytes passed in on the loginterface.
C64 pfLogIfIpBytesOut	1.3.6.1.4.1.30155.1.4.3	Counter64	read-only	The number of IPv4 bytes passed out on the loginterface.
C64 pfLogIfIpPktsInPass	1.3.6.1.4.1.30155.1.4.4	Counter64	read-only	The number of IPv4 packets passed in on the loginterface.
C64 pfLogIfIpPktsInDrop	1.3.6.1.4.1.30155.1.4.5	Counter64	read-only	The number of dropped IPv4 packets coming in on the loginterface.
C64 pfLogIfIpPktsOutPass	1.3.6.1.4.1.30155.1.4.6	Counter64	read-only	The number of IPv4 packets passed out on the loginterface.
C64 pfLogIfIpPktsOutDrop	1.3.6.1.4.1.30155.1.4.7	Counter64	read-only	The number of dropped IPv4 packets going out on the loginterface.
C64 pfLogIfIp6BytesIn	1.3.6.1.4.1.30155.1.4.8	Counter64	read-only	The number of IPv6 bytes passed in on the loginterface.
C64 pfLogIfIp6BytesOut	1.3.6.1.4.1.30155.1.4.9	Counter64	read-only	The number of IPv6 bytes passed out on the loginterface.
C64 pfLogIfIp6PktsInPass	1.3.6.1.4.1.30155.1.4.10	Counter64	read-only	The number of IPv6 packets passed in on the loginterface.
C64 pfLogIfIp6PktsInDrop	1.3.6.1.4.1.30155.1.4.11	Counter64	read-only	The number of dropped IPv6 packets coming in on the loginterface.
C64 pfLogIfIp6PktsOutPass	1.3.6.1.4.1.30155.1.4.12	Counter64	read-only	The number of IPv6 packets passed out on the loginterface.
C64 pfLogIfIp6PktsOutDrop	1.3.6.1.4.1.30155.1.4.13	Counter64	read-only	The number of dropped IPv6 packets going out on the loginterface.
pfSrcTracking	1.3.6.1.4.1.30155.1.5
U32 pfSrcTrackCount	1.3.6.1.4.1.30155.1.5.1	Unsigned32	read-only	The number of entries in the source tracking table.
C64 pfSrcTrackSearches	1.3.6.1.4.1.30155.1.5.2	Counter64	read-only	The number of searches against the source tracking table.
C64 pfSrcTrackInserts	1.3.6.1.4.1.30155.1.5.3	Counter64	read-only	The number of inserts into the source tracking table.
C64 pfSrcTrackRemovals	1.3.6.1.4.1.30155.1.5.4	Counter64	read-only	The number of removals from the source tracking table.
pfLimits	1.3.6.1.4.1.30155.1.6
U32 pfLimitStates	1.3.6.1.4.1.30155.1.6.1	Unsigned32	read-only	The maximum number of entries in the memory pool used by state table entries (filter rules that specify 'keep state').
U32 pfLimitSourceNodes	1.3.6.1.4.1.30155.1.6.2	Unsigned32	read-only	The maximum number of entries in the memory pool used for tracking source IP addresses (filter rules that specify 'sticky-address' or 'source-track' options).
U32 pfLimitFragments	1.3.6.1.4.1.30155.1.6.3	Unsigned32	read-only	The maximum number of entries in the memory pool used for packet reassembly (scrub rules).
U32 pfLimitMaxTables	1.3.6.1.4.1.30155.1.6.4	Unsigned32	read-only	The maximum number of tables that can be created as part of the active ruleset.
U32 pfLimitMaxTableEntries	1.3.6.1.4.1.30155.1.6.5	Unsigned32	read-only	The overall maximum number of addresses that can be stored in tables.
pfTimeouts	1.3.6.1.4.1.30155.1.7
I32 pfTimeoutTcpFirst	1.3.6.1.4.1.30155.1.7.1	Integer32	read-only	State after receiving the first TCP packet in a new connection.
I32 pfTimeoutTcpOpening	1.3.6.1.4.1.30155.1.7.2	Integer32	read-only	State before the destination host ever sends a packet in response to a new connection from this host.
I32 pfTimeoutTcpEstablished	1.3.6.1.4.1.30155.1.7.3	Integer32	read-only	State when a TCP connection is fully established.
I32 pfTimeoutTcpClosing	1.3.6.1.4.1.30155.1.7.4	Integer32	read-only	State after the first FIN has been sent.
I32 pfTimeoutTcpFinWait	1.3.6.1.4.1.30155.1.7.5	Integer32	read-only	State after both FINs are sent and the connection is closed.
I32 pfTimeoutTcpClosed	1.3.6.1.4.1.30155.1.7.6	Integer32	read-only	State after the first RST has been sent.
I32 pfTimeoutUdpFirst	1.3.6.1.4.1.30155.1.7.7	Integer32	read-only	State after receiving the first UDP packet.
I32 pfTimeoutUdpSingle	1.3.6.1.4.1.30155.1.7.8	Integer32	read-only	State if the source sends more than 1 packet but the destination has never sent a packet back.
I32 pfTimeoutUdpMultiple	1.3.6.1.4.1.30155.1.7.9	Integer32	read-only	State when both hosts have sent packets.
I32 pfTimeoutIcmpFirst	1.3.6.1.4.1.30155.1.7.10	Integer32	read-only	State after receiving the first ICMP packet.
I32 pfTimeoutIcmpError	1.3.6.1.4.1.30155.1.7.11	Integer32	read-only	State when an ICMP error comes back in response to an ICMP packet.
I32 pfTimeoutOtherFirst	1.3.6.1.4.1.30155.1.7.12	Integer32	read-only	State after receiving the first packet.
I32 pfTimeoutOtherSingle	1.3.6.1.4.1.30155.1.7.13	Integer32	read-only	State if the source sends more than 1 packet but the destination has never sent a packet back.
I32 pfTimeoutOtherMultiple	1.3.6.1.4.1.30155.1.7.14	Integer32	read-only	State when both hosts have sent packets.
I32 pfTimeoutFragment	1.3.6.1.4.1.30155.1.7.15	Integer32	read-only	How long before an unassembled fragment is expired.
I32 pfTimeoutInterval	1.3.6.1.4.1.30155.1.7.16	Integer32	read-only	Interval before purging expired states and fragments.
I32 pfTimeoutAdaptiveStart	1.3.6.1.4.1.30155.1.7.17	Integer32	read-only	When the number of state entries exceeds this value, adaptive scaling begins.
I32 pfTimeoutAdaptiveEnd	1.3.6.1.4.1.30155.1.7.18	Integer32	read-only	When reaching this number of state entries, all timeout values become zero, effectively purging all state entries immediately.
I32 pfTimeoutSrcTrack	1.3.6.1.4.1.30155.1.7.19	Integer32	read-only	Time that a source tracking entry will stay around after the last state expires.
pfInterfaces	1.3.6.1.4.1.30155.1.8
I32 pfIfNumber	1.3.6.1.4.1.30155.1.8.1	Integer32	read-only	The number of network interfaces present on this system.
pfIfTable	1.3.6.1.4.1.30155.1.8.128		not-accessible	A list of individual interfaces. The number of entries is given by the value of pfIfNumber.
pfIfEntry	1.3.6.1.4.1.30155.1.8.128.1		not-accessible	An entry containing management information applicable to a particular interface.
I32 pfIfIndex	1.3.6.1.4.1.30155.1.8.128.1.1	Integer32	read-only	A unique value, greater than zero, for each interface. It is recommended that values are assigned contiguously starting from 1. The value for each interface sub-layer must remain constant at least from one re-initialization of the entity's network management system to the next re- initialization.
OCT pfIfDescr	1.3.6.1.4.1.30155.1.8.128.1.2	OCTET STRING	read-only	The name of the interface.
INT pfIfType	1.3.6.1.4.1.30155.1.8.128.1.3	INTEGER	read-only	Denotes whether the interface is a group interface, an interface instance, or whether it's been removed or destroyed.
U32 pfIfRefs	1.3.6.1.4.1.30155.1.8.128.1.4	Unsigned32	read-only	The number of state and/or source track entries which reference the interface.
U32 pfIfRules	1.3.6.1.4.1.30155.1.8.128.1.5	Unsigned32	read-only	The number of rules which reference the interface.
C64 pfIfIn4PassPkts	1.3.6.1.4.1.30155.1.8.128.1.6	Counter64	read-only	The number of IPv4 packets passed in.
C64 pfIfIn4PassBytes	1.3.6.1.4.1.30155.1.8.128.1.7	Counter64	read-only	The number of IPv4 bytes passed in.
C64 pfIfIn4BlockPkts	1.3.6.1.4.1.30155.1.8.128.1.8	Counter64	read-only	The number of incoming IPv4 packets blocked.
C64 pfIfIn4BlockBytes	1.3.6.1.4.1.30155.1.8.128.1.9	Counter64	read-only	The number of incoming IPv4 bytes blocked.
C64 pfIfOut4PassPkts	1.3.6.1.4.1.30155.1.8.128.1.10	Counter64	read-only	The number of IPv4 bytes passed out.
C64 pfIfOut4PassBytes	1.3.6.1.4.1.30155.1.8.128.1.11	Counter64	read-only	The number of IPv4 bytes passed out.
C64 pfIfOut4BlockPkts	1.3.6.1.4.1.30155.1.8.128.1.12	Counter64	read-only	The number of outgoing IPv4 bytes blocked.
C64 pfIfOut4BlockBytes	1.3.6.1.4.1.30155.1.8.128.1.13	Counter64	read-only	The number of outgoing IPv4 bytes blocked.
C64 pfIfIn6PassPkts	1.3.6.1.4.1.30155.1.8.128.1.14	Counter64	read-only	The number of IPv6 packets passed in.
C64 pfIfIn6PassBytes	1.3.6.1.4.1.30155.1.8.128.1.15	Counter64	read-only	The number of IPv6 bytes passed in.
C64 pfIfIn6BlockPkts	1.3.6.1.4.1.30155.1.8.128.1.16	Counter64	read-only	The number of incoming IPv6 packets blocked.
C64 pfIfIn6BlockBytes	1.3.6.1.4.1.30155.1.8.128.1.17	Counter64	read-only	The number of incoming IPv6 bytes blocked.
C64 pfIfOut6PassPkts	1.3.6.1.4.1.30155.1.8.128.1.18	Counter64	read-only	The number of IPv6 bytes passed out.
C64 pfIfOut6PassBytes	1.3.6.1.4.1.30155.1.8.128.1.19	Counter64	read-only	The number of IPv6 bytes passed out.
C64 pfIfOut6BlockPkts	1.3.6.1.4.1.30155.1.8.128.1.20	Counter64	read-only	The number of outgoing IPv6 bytes blocked.
C64 pfIfOut6BlockBytes	1.3.6.1.4.1.30155.1.8.128.1.21	Counter64	read-only	The number of outgoing IPv6 bytes blocked.
pfTables	1.3.6.1.4.1.30155.1.9
I32 pfTblNumber	1.3.6.1.4.1.30155.1.9.1	Integer32	read-only	The number of tables present on this system.
pfTblTable	1.3.6.1.4.1.30155.1.9.128		not-accessible	A list of individual tables. The number of entries is given by the value of tblNumber.
pfTblEntry	1.3.6.1.4.1.30155.1.9.128.1		not-accessible	An entry containing management information applicable to a particular table.
I32 pfTblIndex	1.3.6.1.4.1.30155.1.9.128.1.1	Integer32	read-only	A unique value, greater than zero, for each table.
OCT pfTblName	1.3.6.1.4.1.30155.1.9.128.1.2	OCTET STRING	read-only	The name of the table.
I32 pfTblAddresses	1.3.6.1.4.1.30155.1.9.128.1.3	Integer32	read-only	The number of addresses currently stored in the table.
I32 pfTblAnchorRefs	1.3.6.1.4.1.30155.1.9.128.1.4	Integer32	read-only	The number of anchors which reference the table.
I32 pfTblRuleRefs	1.3.6.1.4.1.30155.1.9.128.1.5	Integer32	read-only	The number of rules which reference the table.
C64 pfTblEvalsMatch	1.3.6.1.4.1.30155.1.9.128.1.6	Counter64	read-only	The number of table evaluations that produced a match.
C64 pfTblEvalsNoMatch	1.3.6.1.4.1.30155.1.9.128.1.7	Counter64	read-only	The number of table evaluations that didn't match.
C64 pfTblInPassPkts	1.3.6.1.4.1.30155.1.9.128.1.8	Counter64	read-only	The number of packets passed in that matched the table.
C64 pfTblInPassBytes	1.3.6.1.4.1.30155.1.9.128.1.9	Counter64	read-only	The number of bytes passed in that matched the table.
C64 pfTblInBlockPkts	1.3.6.1.4.1.30155.1.9.128.1.10	Counter64	read-only	The number of incoming packets blocked that matched the table.
C64 pfTblInBlockBytes	1.3.6.1.4.1.30155.1.9.128.1.11	Counter64	read-only	The number incoming bytes blocked that matched the table.
C64 pfTblInXPassPkts	1.3.6.1.4.1.30155.1.9.128.1.12	Counter64	read-only	The number of packets statefully passed in where the state entry refers to the table, but the table no longer contains the address in question.
C64 pfTblInXPassBytes	1.3.6.1.4.1.30155.1.9.128.1.13	Counter64	read-only	The number of bytes statefully passed in where the state entry refers to the table, but the table no longer contains the address in question.
C64 pfTblOutPassPkts	1.3.6.1.4.1.30155.1.9.128.1.14	Counter64	read-only	The number of packets passed out that matched the table.
C64 pfTblOutPassBytes	1.3.6.1.4.1.30155.1.9.128.1.15	Counter64	read-only	The number of bytes passed out that matched the table.
C64 pfTblOutBlockPkts	1.3.6.1.4.1.30155.1.9.128.1.16	Counter64	read-only	The number of outgoing packets blocked that matched the table.
C64 pfTblOutBlockBytes	1.3.6.1.4.1.30155.1.9.128.1.17	Counter64	read-only	The number outgoing bytes blocked that matched the table.
C64 pfTblOutXPassPkts	1.3.6.1.4.1.30155.1.9.128.1.18	Counter64	read-only	The number of packets statefully passed out where the state entry refers to the table, but the table no longer contains the address in question.
C64 pfTblOutXPassBytes	1.3.6.1.4.1.30155.1.9.128.1.19	Counter64	read-only	The number of bytes statefully passed out where the state entry refers to the table, but the table no longer contains the address in question.
TIK pfTblStatsCleared	1.3.6.1.4.1.30155.1.9.128.1.20	TimeTicks	read-only	The number of seconds that have passed since the statistics for this pf table were zeroed.
C64 pfTblInMatchPkts	1.3.6.1.4.1.30155.1.9.128.1.21	Counter64	read-only	The number of inbound packets that hit a 'match' rule where this particular table was referenced by the rule.
C64 pfTblInMatchBytes	1.3.6.1.4.1.30155.1.9.128.1.22	Counter64	read-only	The total size in bytes of all inbound packets that hit a 'match' rule where this particular table was referenced by the rule.
C64 pfTblOutMatchPkts	1.3.6.1.4.1.30155.1.9.128.1.23	Counter64	read-only	The number of outbound packets that hit a 'match' rule where this particular table was referenced by the rule.
C64 pfTblOutMatchBytes	1.3.6.1.4.1.30155.1.9.128.1.24	Counter64	read-only	The total size in bytes of all outbound packets that hit a 'match' rule where this particular table was referenced by the rule.
pfTblAddrTable	1.3.6.1.4.1.30155.1.9.129		not-accessible	A table containing the addresses/CIDR network blocks from every table on the system.
pfTblAddrEntry	1.3.6.1.4.1.30155.1.9.129.1		not-accessible	An entry containing management information applicable to a particular table.
I32 pfTblAddrTblIndex	1.3.6.1.4.1.30155.1.9.129.1.1	Integer32	read-only	The index value which uniquely identifies the table which contains this pfTblAddrNet/pfTblAddrMask pair.
IP pfTblAddrNet	1.3.6.1.4.1.30155.1.9.129.1.2	IpAddress	read-only	The IP address portion of the CIDR network for this particular table entry.
I32 pfTblAddrMask	1.3.6.1.4.1.30155.1.9.129.1.3	Integer32	read-only	The CIDR bitmask for this particular table entry.
TIK pfTblAddrCleared	1.3.6.1.4.1.30155.1.9.129.1.4	TimeTicks	read-only	The time that's passed since the statistics where last cleared, or since the pfTblAddrNet/pfTblAddrMask pair was loaded into the table, whichever is sooner.
C64 pfTblAddrInBlockPkts	1.3.6.1.4.1.30155.1.9.129.1.5	Counter64	read-only	The number of inbound packets blocked as a result of matching this table entry.
C64 pfTblAddrInBlockBytes	1.3.6.1.4.1.30155.1.9.129.1.6	Counter64	read-only	The number of inbound bytes blocked as a result of matching this table entry.
C64 pfTblAddrInPassPkts	1.3.6.1.4.1.30155.1.9.129.1.7	Counter64	read-only	The number of inbound packets passed as a result of matching this table entry.
C64 pfTblAddrInPassBytes	1.3.6.1.4.1.30155.1.9.129.1.8	Counter64	read-only	The number of inbound bytes passed as a result of matching this table entry.
C64 pfTblAddrOutBlockPkts	1.3.6.1.4.1.30155.1.9.129.1.9	Counter64	read-only	The number of outbound packets blocked as a result of matching this table entry.
C64 pfTblAddrOutBlockBytes	1.3.6.1.4.1.30155.1.9.129.1.10	Counter64	read-only	The number of outbound bytes blocked as a result of matching this table entry.
C64 pfTblAddrOutPassPkts	1.3.6.1.4.1.30155.1.9.129.1.11	Counter64	read-only	The number of outbound packets passed as a result of matchin this table entry.
C64 pfTblAddrOutPassBytes	1.3.6.1.4.1.30155.1.9.129.1.12	Counter64	read-only	The number of outbound bytes passed as a result of matchg this table entry.
C64 pfTblAddrInMatchPkts	1.3.6.1.4.1.30155.1.9.129.1.13	Counter64	read-only	The number of inbound packets that hit a 'match' rule where this table entry was referenced.
C64 pfTblAddrInMatchBytes	1.3.6.1.4.1.30155.1.9.129.1.14	Counter64	read-only	The total size in bytes of all inbound packets that hit a 'match' rule where this table entry was referenced.
C64 pfTblAddrOutMatchPkts	1.3.6.1.4.1.30155.1.9.129.1.15	Counter64	read-only	The number of outbound packets that hit a 'match' rule where this table entry was referenced.
C64 pfTblAddrOutMatchBytes	1.3.6.1.4.1.30155.1.9.129.1.16	Counter64	read-only	The total size in bytes of all outbound packets that hit a 'match' rule where this table entry was referenced.
pfLabels	1.3.6.1.4.1.30155.1.10
I32 pfLabelNumber	1.3.6.1.4.1.30155.1.10.1	Integer32	read-only	The number of labels in the active pf ruleset.
pfLabelTable	1.3.6.1.4.1.30155.1.10.128		not-accessible	A list of individual labels. The number of entries is given by the value of pfLabelNumber.
pfLabelEntry	1.3.6.1.4.1.30155.1.10.128.1		not-accessible	An entry containing management information applicable to a particular label.
I32 pfLabelIndex	1.3.6.1.4.1.30155.1.10.128.1.1	Integer32	read-only	A unique value, greater than zero, for each label.
OCT pfLabelName	1.3.6.1.4.1.30155.1.10.128.1.2	OCTET STRING	read-only	The name of the label.
C64 pfLabelEvals	1.3.6.1.4.1.30155.1.10.128.1.3	Counter64	read-only	The number of rule evaluations.
C64 pfLabelPkts	1.3.6.1.4.1.30155.1.10.128.1.4	Counter64	read-only	The total number of packets matched by the rule.
C64 pfLabelBytes	1.3.6.1.4.1.30155.1.10.128.1.5	Counter64	read-only	The total number of bytes matched by the rule.
C64 pfLabelInPkts	1.3.6.1.4.1.30155.1.10.128.1.6	Counter64	read-only	The number of incoming packets matched by the rule.
C64 pfLabelInBytes	1.3.6.1.4.1.30155.1.10.128.1.7	Counter64	read-only	The number of incoming bytes matched by the rule.
C64 pfLabelOutPkts	1.3.6.1.4.1.30155.1.10.128.1.8	Counter64	read-only	The number of outgoing packets matched by the rule.
C64 pfLabelOutBytes	1.3.6.1.4.1.30155.1.10.128.1.9	Counter64	read-only	The number of outgoing bytes matched by the rule.
C32 pfLabelTotalStates	1.3.6.1.4.1.30155.1.10.128.1.10	Counter32	read-only	The total number of state table entries created by this rule since the ruleset was loaded.
pfsyncStats	1.3.6.1.4.1.30155.1.11
C64 pfsyncIpPktsRecv	1.3.6.1.4.1.30155.1.11.1	Counter64	read-only	Number of IPv4 pfsync packets received on all interfaces.
C64 pfsyncIp6PktsRecv	1.3.6.1.4.1.30155.1.11.2	Counter64	read-only	Number of IPv6 pfsync packets received on all interfaces.
C64 pfsyncPktDiscardsForBadInterface	1.3.6.1.4.1.30155.1.11.3	Counter64	read-only	Number of pfsync packets discarded because it was received on an interface that is not running pfsync.
C64 pfsyncPktDiscardsForBadTtl	1.3.6.1.4.1.30155.1.11.4	Counter64	read-only	Number of pfsync packets discarded due to having a TTL less than 255.
C64 pfsyncPktShorterThanHeader	1.3.6.1.4.1.30155.1.11.5	Counter64	read-only	Number of pfsync packets received that had a length shorter than the pfsync packet header.
C64 pfsyncPktDiscardsForBadVersion	1.3.6.1.4.1.30155.1.11.6	Counter64	read-only	Number of pfsync packets discarded due to incorrect protocol version.
C64 pfsyncPktDiscardsForBadAction	1.3.6.1.4.1.30155.1.11.7	Counter64	read-only	Number of pfsync packets discarded due to an invalid pfsync action in the header.
C64 pfsyncPktDiscardsForBadLength	1.3.6.1.4.1.30155.1.11.8	Counter64	read-only	Number of pfsync packets discarded due to incorrect size.
C64 pfsyncPktDiscardsForBadAuth	1.3.6.1.4.1.30155.1.11.9	Counter64	read-only	Number of pfsync packets discarded due to authentication failure.
C64 pfsyncPktDiscardsForStaleState	1.3.6.1.4.1.30155.1.11.10	Counter64	read-only	Number of pfsync packets discarded because they tried to update a stale state entry.
C64 pfsyncPktDiscardsForBadValues	1.3.6.1.4.1.30155.1.11.11	Counter64	read-only	Number of pfsync packets discarded due to containing bad values.
C64 pfsyncPktDiscardsForBadState	1.3.6.1.4.1.30155.1.11.12	Counter64	read-only	Number of pfsync packets discarded due to state insert/lookup failure.
C64 pfsyncIpPktsSent	1.3.6.1.4.1.30155.1.11.13	Counter64	read-only	Number of IPv4 pfsync packets sent on all interfaces.
C64 pfsyncIp6PktsSent	1.3.6.1.4.1.30155.1.11.14	Counter64	read-only	Number of IPv6 pfsync packets sent on all interfaces.
C64 pfsyncNoMemory	1.3.6.1.4.1.30155.1.11.15	Counter64	read-only	Number of pfsync packets which could not be sent due to insufficient memory.
C64 pfsyncOutputErrors	1.3.6.1.4.1.30155.1.11.16	Counter64	read-only	Number of pfsync packets which could not be sent.

Counter32 (1)
C32 pfLabelTotalStates	1.3.6.1.4.1.30155.1.10.128.1.10	Counter32	read-only	The total number of state table entries created by this rule since the ruleset was loaded.
Counter64 (104)
C64 pfCntBadOffset	1.3.6.1.4.1.30155.1.2.2	Counter64	read-only	The number of packets that have had a bad offset value.
C64 pfCntCongestion	1.3.6.1.4.1.30155.1.2.8	Counter64	read-only	The number of packets that were dropped due to congestion on the interface.
C64 pfCntFragment	1.3.6.1.4.1.30155.1.2.3	Counter64	read-only	The number of packet fragments.
C64 pfCntIpOption	1.3.6.1.4.1.30155.1.2.9	Counter64	read-only	The number of packets that were dropped due to having options set in the IP header.
C64 pfCntMatch	1.3.6.1.4.1.30155.1.2.1	Counter64	read-only	The number of packets that have matched a filter rule.
C64 pfCntMemory	1.3.6.1.4.1.30155.1.2.6	Counter64	read-only	The number of packets that were dropped due to memory limitations.
C64 pfCntNormalize	1.3.6.1.4.1.30155.1.2.5	Counter64	read-only	The number of packets that were normalized using the packet scrubber.
C64 pfCntNoRoute	1.3.6.1.4.1.30155.1.2.17	Counter64	read-only	The number of packets that were dropped because policy based routing was requested but no target addresses were available.
C64 pfCntProtoCksum	1.3.6.1.4.1.30155.1.2.10	Counter64	read-only	The number of packets that were dropped due to memory limitations.
C64 pfCntShort	1.3.6.1.4.1.30155.1.2.4	Counter64	read-only	The number of packets that were too short to contain a valid header.
C64 pfCntSrcLimit	1.3.6.1.4.1.30155.1.2.14	Counter64	read-only	The number of packets that were dropped due to stateful connection tracking. A packet could be dropped due to resource limits (memory) or due to a tracking limit being reached.
C64 pfCntStateInsert	1.3.6.1.4.1.30155.1.2.12	Counter64	read-only	The number of packets that were dropped due to errors creating a state table entry.
C64 pfCntStateLimit	1.3.6.1.4.1.30155.1.2.13	Counter64	read-only	The number of packets that were dropped due to the per-rule max state limit being reached.
C64 pfCntStateMismatch	1.3.6.1.4.1.30155.1.2.11	Counter64	read-only	The number of packets that were dropped due to a state table mismatch.
C64 pfCntSynproxy	1.3.6.1.4.1.30155.1.2.15	Counter64	read-only	The number of packets that were dropped during the TCP synproxy process.
C64 pfCntTimestamp	1.3.6.1.4.1.30155.1.2.7	Counter64	read-only	The number of packets that were dropped due to improper RFC1323 timestamp.
C64 pfCntTranslate	1.3.6.1.4.1.30155.1.2.16	Counter64	read-only	The number of packets that were dropped because network address translation was requested and no unused port was available.
C64 pfIfIn4BlockBytes	1.3.6.1.4.1.30155.1.8.128.1.9	Counter64	read-only	The number of incoming IPv4 bytes blocked.
C64 pfIfIn4BlockPkts	1.3.6.1.4.1.30155.1.8.128.1.8	Counter64	read-only	The number of incoming IPv4 packets blocked.
C64 pfIfIn4PassBytes	1.3.6.1.4.1.30155.1.8.128.1.7	Counter64	read-only	The number of IPv4 bytes passed in.
C64 pfIfIn4PassPkts	1.3.6.1.4.1.30155.1.8.128.1.6	Counter64	read-only	The number of IPv4 packets passed in.
C64 pfIfIn6BlockBytes	1.3.6.1.4.1.30155.1.8.128.1.17	Counter64	read-only	The number of incoming IPv6 bytes blocked.
C64 pfIfIn6BlockPkts	1.3.6.1.4.1.30155.1.8.128.1.16	Counter64	read-only	The number of incoming IPv6 packets blocked.
C64 pfIfIn6PassBytes	1.3.6.1.4.1.30155.1.8.128.1.15	Counter64	read-only	The number of IPv6 bytes passed in.
C64 pfIfIn6PassPkts	1.3.6.1.4.1.30155.1.8.128.1.14	Counter64	read-only	The number of IPv6 packets passed in.
C64 pfIfOut4BlockBytes	1.3.6.1.4.1.30155.1.8.128.1.13	Counter64	read-only	The number of outgoing IPv4 bytes blocked.
C64 pfIfOut4BlockPkts	1.3.6.1.4.1.30155.1.8.128.1.12	Counter64	read-only	The number of outgoing IPv4 bytes blocked.
C64 pfIfOut4PassBytes	1.3.6.1.4.1.30155.1.8.128.1.11	Counter64	read-only	The number of IPv4 bytes passed out.
C64 pfIfOut4PassPkts	1.3.6.1.4.1.30155.1.8.128.1.10	Counter64	read-only	The number of IPv4 bytes passed out.
C64 pfIfOut6BlockBytes	1.3.6.1.4.1.30155.1.8.128.1.21	Counter64	read-only	The number of outgoing IPv6 bytes blocked.
C64 pfIfOut6BlockPkts	1.3.6.1.4.1.30155.1.8.128.1.20	Counter64	read-only	The number of outgoing IPv6 bytes blocked.
C64 pfIfOut6PassBytes	1.3.6.1.4.1.30155.1.8.128.1.19	Counter64	read-only	The number of IPv6 bytes passed out.
C64 pfIfOut6PassPkts	1.3.6.1.4.1.30155.1.8.128.1.18	Counter64	read-only	The number of IPv6 bytes passed out.
C64 pfLabelBytes	1.3.6.1.4.1.30155.1.10.128.1.5	Counter64	read-only	The total number of bytes matched by the rule.
C64 pfLabelEvals	1.3.6.1.4.1.30155.1.10.128.1.3	Counter64	read-only	The number of rule evaluations.
C64 pfLabelInBytes	1.3.6.1.4.1.30155.1.10.128.1.7	Counter64	read-only	The number of incoming bytes matched by the rule.
C64 pfLabelInPkts	1.3.6.1.4.1.30155.1.10.128.1.6	Counter64	read-only	The number of incoming packets matched by the rule.
C64 pfLabelOutBytes	1.3.6.1.4.1.30155.1.10.128.1.9	Counter64	read-only	The number of outgoing bytes matched by the rule.
C64 pfLabelOutPkts	1.3.6.1.4.1.30155.1.10.128.1.8	Counter64	read-only	The number of outgoing packets matched by the rule.
C64 pfLabelPkts	1.3.6.1.4.1.30155.1.10.128.1.4	Counter64	read-only	The total number of packets matched by the rule.
C64 pfLogIfIp6BytesIn	1.3.6.1.4.1.30155.1.4.8	Counter64	read-only	The number of IPv6 bytes passed in on the loginterface.
C64 pfLogIfIp6BytesOut	1.3.6.1.4.1.30155.1.4.9	Counter64	read-only	The number of IPv6 bytes passed out on the loginterface.
C64 pfLogIfIp6PktsInDrop	1.3.6.1.4.1.30155.1.4.11	Counter64	read-only	The number of dropped IPv6 packets coming in on the loginterface.
C64 pfLogIfIp6PktsInPass	1.3.6.1.4.1.30155.1.4.10	Counter64	read-only	The number of IPv6 packets passed in on the loginterface.
C64 pfLogIfIp6PktsOutDrop	1.3.6.1.4.1.30155.1.4.13	Counter64	read-only	The number of dropped IPv6 packets going out on the loginterface.
C64 pfLogIfIp6PktsOutPass	1.3.6.1.4.1.30155.1.4.12	Counter64	read-only	The number of IPv6 packets passed out on the loginterface.
C64 pfLogIfIpBytesIn	1.3.6.1.4.1.30155.1.4.2	Counter64	read-only	The number of IPv4 bytes passed in on the loginterface.
C64 pfLogIfIpBytesOut	1.3.6.1.4.1.30155.1.4.3	Counter64	read-only	The number of IPv4 bytes passed out on the loginterface.
C64 pfLogIfIpPktsInDrop	1.3.6.1.4.1.30155.1.4.5	Counter64	read-only	The number of dropped IPv4 packets coming in on the loginterface.
C64 pfLogIfIpPktsInPass	1.3.6.1.4.1.30155.1.4.4	Counter64	read-only	The number of IPv4 packets passed in on the loginterface.
C64 pfLogIfIpPktsOutDrop	1.3.6.1.4.1.30155.1.4.7	Counter64	read-only	The number of dropped IPv4 packets going out on the loginterface.
C64 pfLogIfIpPktsOutPass	1.3.6.1.4.1.30155.1.4.6	Counter64	read-only	The number of IPv4 packets passed out on the loginterface.
C64 pfSrcTrackInserts	1.3.6.1.4.1.30155.1.5.3	Counter64	read-only	The number of inserts into the source tracking table.
C64 pfSrcTrackRemovals	1.3.6.1.4.1.30155.1.5.4	Counter64	read-only	The number of removals from the source tracking table.
C64 pfSrcTrackSearches	1.3.6.1.4.1.30155.1.5.2	Counter64	read-only	The number of searches against the source tracking table.
C64 pfStateInserts	1.3.6.1.4.1.30155.1.3.3	Counter64	read-only	The number of inserts into the state table.
C64 pfStateRemovals	1.3.6.1.4.1.30155.1.3.4	Counter64	read-only	The number of removals from the state table.
C64 pfStateSearches	1.3.6.1.4.1.30155.1.3.2	Counter64	read-only	The number of searches against the state table.
C64 pfsyncIp6PktsRecv	1.3.6.1.4.1.30155.1.11.2	Counter64	read-only	Number of IPv6 pfsync packets received on all interfaces.
C64 pfsyncIp6PktsSent	1.3.6.1.4.1.30155.1.11.14	Counter64	read-only	Number of IPv6 pfsync packets sent on all interfaces.
C64 pfsyncIpPktsRecv	1.3.6.1.4.1.30155.1.11.1	Counter64	read-only	Number of IPv4 pfsync packets received on all interfaces.
C64 pfsyncIpPktsSent	1.3.6.1.4.1.30155.1.11.13	Counter64	read-only	Number of IPv4 pfsync packets sent on all interfaces.
C64 pfsyncNoMemory	1.3.6.1.4.1.30155.1.11.15	Counter64	read-only	Number of pfsync packets which could not be sent due to insufficient memory.
C64 pfsyncOutputErrors	1.3.6.1.4.1.30155.1.11.16	Counter64	read-only	Number of pfsync packets which could not be sent.
C64 pfsyncPktDiscardsForBadAction	1.3.6.1.4.1.30155.1.11.7	Counter64	read-only	Number of pfsync packets discarded due to an invalid pfsync action in the header.
C64 pfsyncPktDiscardsForBadAuth	1.3.6.1.4.1.30155.1.11.9	Counter64	read-only	Number of pfsync packets discarded due to authentication failure.
C64 pfsyncPktDiscardsForBadInterface	1.3.6.1.4.1.30155.1.11.3	Counter64	read-only	Number of pfsync packets discarded because it was received on an interface that is not running pfsync.
C64 pfsyncPktDiscardsForBadLength	1.3.6.1.4.1.30155.1.11.8	Counter64	read-only	Number of pfsync packets discarded due to incorrect size.
C64 pfsyncPktDiscardsForBadState	1.3.6.1.4.1.30155.1.11.12	Counter64	read-only	Number of pfsync packets discarded due to state insert/lookup failure.
C64 pfsyncPktDiscardsForBadTtl	1.3.6.1.4.1.30155.1.11.4	Counter64	read-only	Number of pfsync packets discarded due to having a TTL less than 255.
C64 pfsyncPktDiscardsForBadValues	1.3.6.1.4.1.30155.1.11.11	Counter64	read-only	Number of pfsync packets discarded due to containing bad values.
C64 pfsyncPktDiscardsForBadVersion	1.3.6.1.4.1.30155.1.11.6	Counter64	read-only	Number of pfsync packets discarded due to incorrect protocol version.
C64 pfsyncPktDiscardsForStaleState	1.3.6.1.4.1.30155.1.11.10	Counter64	read-only	Number of pfsync packets discarded because they tried to update a stale state entry.
C64 pfsyncPktShorterThanHeader	1.3.6.1.4.1.30155.1.11.5	Counter64	read-only	Number of pfsync packets received that had a length shorter than the pfsync packet header.
C64 pfTblAddrInBlockBytes	1.3.6.1.4.1.30155.1.9.129.1.6	Counter64	read-only	The number of inbound bytes blocked as a result of matching this table entry.
C64 pfTblAddrInBlockPkts	1.3.6.1.4.1.30155.1.9.129.1.5	Counter64	read-only	The number of inbound packets blocked as a result of matching this table entry.
C64 pfTblAddrInMatchBytes	1.3.6.1.4.1.30155.1.9.129.1.14	Counter64	read-only	The total size in bytes of all inbound packets that hit a 'match' rule where this table entry was referenced.
C64 pfTblAddrInMatchPkts	1.3.6.1.4.1.30155.1.9.129.1.13	Counter64	read-only	The number of inbound packets that hit a 'match' rule where this table entry was referenced.
C64 pfTblAddrInPassBytes	1.3.6.1.4.1.30155.1.9.129.1.8	Counter64	read-only	The number of inbound bytes passed as a result of matching this table entry.
C64 pfTblAddrInPassPkts	1.3.6.1.4.1.30155.1.9.129.1.7	Counter64	read-only	The number of inbound packets passed as a result of matching this table entry.
C64 pfTblAddrOutBlockBytes	1.3.6.1.4.1.30155.1.9.129.1.10	Counter64	read-only	The number of outbound bytes blocked as a result of matching this table entry.
C64 pfTblAddrOutBlockPkts	1.3.6.1.4.1.30155.1.9.129.1.9	Counter64	read-only	The number of outbound packets blocked as a result of matching this table entry.
C64 pfTblAddrOutMatchBytes	1.3.6.1.4.1.30155.1.9.129.1.16	Counter64	read-only	The total size in bytes of all outbound packets that hit a 'match' rule where this table entry was referenced.
C64 pfTblAddrOutMatchPkts	1.3.6.1.4.1.30155.1.9.129.1.15	Counter64	read-only	The number of outbound packets that hit a 'match' rule where this table entry was referenced.
C64 pfTblAddrOutPassBytes	1.3.6.1.4.1.30155.1.9.129.1.12	Counter64	read-only	The number of outbound bytes passed as a result of matchg this table entry.
C64 pfTblAddrOutPassPkts	1.3.6.1.4.1.30155.1.9.129.1.11	Counter64	read-only	The number of outbound packets passed as a result of matchin this table entry.
C64 pfTblEvalsMatch	1.3.6.1.4.1.30155.1.9.128.1.6	Counter64	read-only	The number of table evaluations that produced a match.
C64 pfTblEvalsNoMatch	1.3.6.1.4.1.30155.1.9.128.1.7	Counter64	read-only	The number of table evaluations that didn't match.
C64 pfTblInBlockBytes	1.3.6.1.4.1.30155.1.9.128.1.11	Counter64	read-only	The number incoming bytes blocked that matched the table.
C64 pfTblInBlockPkts	1.3.6.1.4.1.30155.1.9.128.1.10	Counter64	read-only	The number of incoming packets blocked that matched the table.
C64 pfTblInMatchBytes	1.3.6.1.4.1.30155.1.9.128.1.22	Counter64	read-only	The total size in bytes of all inbound packets that hit a 'match' rule where this particular table was referenced by the rule.
C64 pfTblInMatchPkts	1.3.6.1.4.1.30155.1.9.128.1.21	Counter64	read-only	The number of inbound packets that hit a 'match' rule where this particular table was referenced by the rule.
C64 pfTblInPassBytes	1.3.6.1.4.1.30155.1.9.128.1.9	Counter64	read-only	The number of bytes passed in that matched the table.
C64 pfTblInPassPkts	1.3.6.1.4.1.30155.1.9.128.1.8	Counter64	read-only	The number of packets passed in that matched the table.
C64 pfTblInXPassBytes	1.3.6.1.4.1.30155.1.9.128.1.13	Counter64	read-only	The number of bytes statefully passed in where the state entry refers to the table, but the table no longer contains the address in question.
C64 pfTblInXPassPkts	1.3.6.1.4.1.30155.1.9.128.1.12	Counter64	read-only	The number of packets statefully passed in where the state entry refers to the table, but the table no longer contains the address in question.
C64 pfTblOutBlockBytes	1.3.6.1.4.1.30155.1.9.128.1.17	Counter64	read-only	The number outgoing bytes blocked that matched the table.
C64 pfTblOutBlockPkts	1.3.6.1.4.1.30155.1.9.128.1.16	Counter64	read-only	The number of outgoing packets blocked that matched the table.
C64 pfTblOutMatchBytes	1.3.6.1.4.1.30155.1.9.128.1.24	Counter64	read-only	The total size in bytes of all outbound packets that hit a 'match' rule where this particular table was referenced by the rule.
C64 pfTblOutMatchPkts	1.3.6.1.4.1.30155.1.9.128.1.23	Counter64	read-only	The number of outbound packets that hit a 'match' rule where this particular table was referenced by the rule.
C64 pfTblOutPassBytes	1.3.6.1.4.1.30155.1.9.128.1.15	Counter64	read-only	The number of bytes passed out that matched the table.
C64 pfTblOutPassPkts	1.3.6.1.4.1.30155.1.9.128.1.14	Counter64	read-only	The number of packets passed out that matched the table.
C64 pfTblOutXPassBytes	1.3.6.1.4.1.30155.1.9.128.1.19	Counter64	read-only	The number of bytes statefully passed out where the state entry refers to the table, but the table no longer contains the address in question.
C64 pfTblOutXPassPkts	1.3.6.1.4.1.30155.1.9.128.1.18	Counter64	read-only	The number of packets statefully passed out where the state entry refers to the table, but the table no longer contains the address in question.
INTEGER (2)
INT pfDebug	1.3.6.1.4.1.30155.1.1.3	INTEGER	read-only	Indicates the debug level that pf is running at.
INT pfIfType	1.3.6.1.4.1.30155.1.8.128.1.3	INTEGER	read-only	Denotes whether the interface is a group interface, an interface instance, or whether it's been removed or destroyed.
Integer32 (30)
I32 pfIfIndex	1.3.6.1.4.1.30155.1.8.128.1.1	Integer32	read-only	A unique value, greater than zero, for each interface. It is recommended that values are assigned contiguously starting from 1. The value for each interface sub-layer must remain constant at least from one re-initialization of the entity's network management system to the next re- initialization.
I32 pfIfNumber	1.3.6.1.4.1.30155.1.8.1	Integer32	read-only	The number of network interfaces present on this system.
I32 pfLabelIndex	1.3.6.1.4.1.30155.1.10.128.1.1	Integer32	read-only	A unique value, greater than zero, for each label.
I32 pfLabelNumber	1.3.6.1.4.1.30155.1.10.1	Integer32	read-only	The number of labels in the active pf ruleset.
I32 pfTblAddresses	1.3.6.1.4.1.30155.1.9.128.1.3	Integer32	read-only	The number of addresses currently stored in the table.
I32 pfTblAddrMask	1.3.6.1.4.1.30155.1.9.129.1.3	Integer32	read-only	The CIDR bitmask for this particular table entry.
I32 pfTblAddrTblIndex	1.3.6.1.4.1.30155.1.9.129.1.1	Integer32	read-only	The index value which uniquely identifies the table which contains this pfTblAddrNet/pfTblAddrMask pair.
I32 pfTblAnchorRefs	1.3.6.1.4.1.30155.1.9.128.1.4	Integer32	read-only	The number of anchors which reference the table.
I32 pfTblIndex	1.3.6.1.4.1.30155.1.9.128.1.1	Integer32	read-only	A unique value, greater than zero, for each table.
I32 pfTblNumber	1.3.6.1.4.1.30155.1.9.1	Integer32	read-only	The number of tables present on this system.
I32 pfTblRuleRefs	1.3.6.1.4.1.30155.1.9.128.1.5	Integer32	read-only	The number of rules which reference the table.
I32 pfTimeoutAdaptiveEnd	1.3.6.1.4.1.30155.1.7.18	Integer32	read-only	When reaching this number of state entries, all timeout values become zero, effectively purging all state entries immediately.
I32 pfTimeoutAdaptiveStart	1.3.6.1.4.1.30155.1.7.17	Integer32	read-only	When the number of state entries exceeds this value, adaptive scaling begins.
I32 pfTimeoutFragment	1.3.6.1.4.1.30155.1.7.15	Integer32	read-only	How long before an unassembled fragment is expired.
I32 pfTimeoutIcmpError	1.3.6.1.4.1.30155.1.7.11	Integer32	read-only	State when an ICMP error comes back in response to an ICMP packet.
I32 pfTimeoutIcmpFirst	1.3.6.1.4.1.30155.1.7.10	Integer32	read-only	State after receiving the first ICMP packet.
I32 pfTimeoutInterval	1.3.6.1.4.1.30155.1.7.16	Integer32	read-only	Interval before purging expired states and fragments.
I32 pfTimeoutOtherFirst	1.3.6.1.4.1.30155.1.7.12	Integer32	read-only	State after receiving the first packet.
I32 pfTimeoutOtherMultiple	1.3.6.1.4.1.30155.1.7.14	Integer32	read-only	State when both hosts have sent packets.
I32 pfTimeoutOtherSingle	1.3.6.1.4.1.30155.1.7.13	Integer32	read-only	State if the source sends more than 1 packet but the destination has never sent a packet back.
I32 pfTimeoutSrcTrack	1.3.6.1.4.1.30155.1.7.19	Integer32	read-only	Time that a source tracking entry will stay around after the last state expires.
I32 pfTimeoutTcpClosed	1.3.6.1.4.1.30155.1.7.6	Integer32	read-only	State after the first RST has been sent.
I32 pfTimeoutTcpClosing	1.3.6.1.4.1.30155.1.7.4	Integer32	read-only	State after the first FIN has been sent.
I32 pfTimeoutTcpEstablished	1.3.6.1.4.1.30155.1.7.3	Integer32	read-only	State when a TCP connection is fully established.
I32 pfTimeoutTcpFinWait	1.3.6.1.4.1.30155.1.7.5	Integer32	read-only	State after both FINs are sent and the connection is closed.
I32 pfTimeoutTcpFirst	1.3.6.1.4.1.30155.1.7.1	Integer32	read-only	State after receiving the first TCP packet in a new connection.
I32 pfTimeoutTcpOpening	1.3.6.1.4.1.30155.1.7.2	Integer32	read-only	State before the destination host ever sends a packet in response to a new connection from this host.
I32 pfTimeoutUdpFirst	1.3.6.1.4.1.30155.1.7.7	Integer32	read-only	State after receiving the first UDP packet.
I32 pfTimeoutUdpMultiple	1.3.6.1.4.1.30155.1.7.9	Integer32	read-only	State when both hosts have sent packets.
I32 pfTimeoutUdpSingle	1.3.6.1.4.1.30155.1.7.8	Integer32	read-only	State if the source sends more than 1 packet but the destination has never sent a packet back.
IpAddress (1)
IP pfTblAddrNet	1.3.6.1.4.1.30155.1.9.129.1.2	IpAddress	read-only	The IP address portion of the CIDR network for this particular table entry.
OCTET STRING (5)
OCT pfHostid	1.3.6.1.4.1.30155.1.1.4	OCTET STRING	read-only	The (unique) host id of the machine running pf.
OCT pfIfDescr	1.3.6.1.4.1.30155.1.8.128.1.2	OCTET STRING	read-only	The name of the interface.
OCT pfLabelName	1.3.6.1.4.1.30155.1.10.128.1.2	OCTET STRING	read-only	The name of the label.
OCT pfLogIfName	1.3.6.1.4.1.30155.1.4.1	OCTET STRING	read-only	The name of the interface configured using 'set loginterface'. If no interface has been configured, the object will be empty.
OCT pfTblName	1.3.6.1.4.1.30155.1.9.128.1.2	OCTET STRING	read-only	The name of the table.
TimeTicks (3)
TIK pfRuntime	1.3.6.1.4.1.30155.1.1.2	TimeTicks	read-only	Indicates how long pf has been enabled. If pf is not enabled, indicates how long pf has been disabled. If pf has not been explicitly enabled or disabled since the system was booted, the value will be 0.
TIK pfTblAddrCleared	1.3.6.1.4.1.30155.1.9.129.1.4	TimeTicks	read-only	The time that's passed since the statistics where last cleared, or since the pfTblAddrNet/pfTblAddrMask pair was loaded into the table, whichever is sooner.
TIK pfTblStatsCleared	1.3.6.1.4.1.30155.1.9.128.1.20	TimeTicks	read-only	The number of seconds that have passed since the statistics for this pf table were zeroed.
TruthValue (1)
T/F pfRunning	1.3.6.1.4.1.30155.1.1.1	TruthValue	read-only	Indicates whether pf is enabled or not.
Unsigned32 (9)
U32 pfIfRefs	1.3.6.1.4.1.30155.1.8.128.1.4	Unsigned32	read-only	The number of state and/or source track entries which reference the interface.
U32 pfIfRules	1.3.6.1.4.1.30155.1.8.128.1.5	Unsigned32	read-only	The number of rules which reference the interface.
U32 pfLimitFragments	1.3.6.1.4.1.30155.1.6.3	Unsigned32	read-only	The maximum number of entries in the memory pool used for packet reassembly (scrub rules).
U32 pfLimitMaxTableEntries	1.3.6.1.4.1.30155.1.6.5	Unsigned32	read-only	The overall maximum number of addresses that can be stored in tables.
U32 pfLimitMaxTables	1.3.6.1.4.1.30155.1.6.4	Unsigned32	read-only	The maximum number of tables that can be created as part of the active ruleset.
U32 pfLimitSourceNodes	1.3.6.1.4.1.30155.1.6.2	Unsigned32	read-only	The maximum number of entries in the memory pool used for tracking source IP addresses (filter rules that specify 'sticky-address' or 'source-track' options).
U32 pfLimitStates	1.3.6.1.4.1.30155.1.6.1	Unsigned32	read-only	The maximum number of entries in the memory pool used by state table entries (filter rules that specify 'keep state').
U32 pfSrcTrackCount	1.3.6.1.4.1.30155.1.5.1	Unsigned32	read-only	The number of entries in the source tracking table.
U32 pfStateCount	1.3.6.1.4.1.30155.1.3.1	Unsigned32	read-only	The number of entries in the state table.
No type (20)
pfCounters	1.3.6.1.4.1.30155.1.2
pfIfEntry	1.3.6.1.4.1.30155.1.8.128.1		not-accessible	An entry containing management information applicable to a particular interface.
pfIfTable	1.3.6.1.4.1.30155.1.8.128		not-accessible	A list of individual interfaces. The number of entries is given by the value of pfIfNumber.
pfInfo	1.3.6.1.4.1.30155.1.1
pfInterfaces	1.3.6.1.4.1.30155.1.8
pfLabelEntry	1.3.6.1.4.1.30155.1.10.128.1		not-accessible	An entry containing management information applicable to a particular label.
pfLabels	1.3.6.1.4.1.30155.1.10
pfLabelTable	1.3.6.1.4.1.30155.1.10.128		not-accessible	A list of individual labels. The number of entries is given by the value of pfLabelNumber.
pfLimits	1.3.6.1.4.1.30155.1.6
pfLogInterface	1.3.6.1.4.1.30155.1.4
pfMIBObjects	1.3.6.1.4.1.30155.1			The MIB module for gathering information from OpenBSD's packet filter.
pfSrcTracking	1.3.6.1.4.1.30155.1.5
pfStateTable	1.3.6.1.4.1.30155.1.3
pfsyncStats	1.3.6.1.4.1.30155.1.11
pfTables	1.3.6.1.4.1.30155.1.9
pfTblAddrEntry	1.3.6.1.4.1.30155.1.9.129.1		not-accessible	An entry containing management information applicable to a particular table.
pfTblAddrTable	1.3.6.1.4.1.30155.1.9.129		not-accessible	A table containing the addresses/CIDR network blocks from every table on the system.
pfTblEntry	1.3.6.1.4.1.30155.1.9.128.1		not-accessible	An entry containing management information applicable to a particular table.
pfTblTable	1.3.6.1.4.1.30155.1.9.128		not-accessible	A list of individual tables. The number of entries is given by the value of tblNumber.
pfTimeouts	1.3.6.1.4.1.30155.1.7

RFC description

OpenBSD packet filter (pf) MIB for monitoring and managing firewall rules, state tables, and filtering statistics.

Start monitoring OpenBSD firewall/router host (pf packet filter statistics) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download OPENBSD-PF-MIB

This MIB depends on

Related MIBs

What Is OPENBSD-PF-MIB?

What Can Be Monitored

Supported Devices

Monitoring Examples

RFC description