PCAP-MIB

All MIBs › PCAP-MIB

Organization: Stef Walter

Last Updated: 2009-03-01

Category: Security

Description: Provides SNMP management of a pcap/libpcap-based network capture agent, exposing capture filter configuration and packet counters.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is PCAP-MIB?

PCAP-MIB is a vendor-neutral MIB module for the bsnmp-pcap module of the BSD bsnmp SNMP agent, which exposes packet-capture filters running on top of libpcap. It is a niche network-monitoring/instrumentation MIB rather than a device-health MIB: it exposes a table of configured capture filters along with per-filter packet and byte counters. It is used to monitor traffic matching specific capture filters (e.g., counting packets of a particular protocol or pattern) rather than hardware status such as temperature or CPU load, though the counters can indirectly flag abnormal traffic volumes. It depends on the bsnmp agent framework and libpcap filter syntax, and is specific to FreeBSD/BSD systems running bsnmp with the pcap module loaded. Typical deployment is a FreeBSD-based network appliance, firewall, or monitoring probe where operators want lightweight, filter-based traffic counters accessible via SNMP. Engineers can download the PCAP-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in PCAP-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

vendor-neutral, standards-based MIB, not tied to a specific manufacturer
FreeBSD-based network appliance or monitoring probe running bsnmp

Monitoring Examples

Polling pcapTable/pcapEntry lets an operator enumerate configured filters via pcapDescr and pcapDevice, and watch pcapPackets/pcapOctets increment to confirm that a specific traffic pattern (defined in pcapFilter) is actually being seen on the monitored interface. A sudden halt in counter growth for a filter that should always see traffic (e.g., matching broadcast ARP) would indicate the capture device or interface has stopped receiving packets.

What Can Be Monitored

configured capture filters
per-filter packet count
per-filter byte count
capture device/interface binding

Imported Objects

From BEGEMOT-MIB

begemot

MODULE-IDENTITY

From SNMPv2-SMI

Counter64
Integer32
MODULE-IDENTITY
OBJECT-TYPE
TimeTicks
Unsigned32

How to Use in IPNetwork Monitor

Example using pcapOctets OID:

Select a device implementing PCAP-MIB as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type pcapOctets into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. It reports the number of octets seen by the network monitor. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter64-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
pcap	1.3.6.1.4.1.12325.1.1112			The MIB for the bsnmp-pcap module.
I32 pcapCount	1.3.6.1.4.1.12325.1.1112.1	Integer32	read-only	The number network monitors.
pcapTable	1.3.6.1.4.1.12325.1.1112.2		not-accessible	A list of entries representing network monitors. The number of entries is given by the value of jailCount.
pcapEntry	1.3.6.1.4.1.12325.1.1112.2.1		not-accessible	An entry containing information about a network monitor.
I32 pcapIndex	1.3.6.1.4.1.12325.1.1112.2.1.0	Integer32	read-only	Index of this pcapEntry.
OCT pcapDescr	1.3.6.1.4.1.12325.1.1112.2.1.1	OCTET STRING	read-only	A readable description of this network monitor.
OCT pcapDevice	1.3.6.1.4.1.12325.1.1112.2.1.2	OCTET STRING	read-only	The device network traffic is being monitored on.
OCT pcapFilter	1.3.6.1.4.1.12325.1.1112.2.1.3	OCTET STRING	read-only	The (tcpdump style) filter for traffic to monitor.
C64 pcapOctetsEx	1.3.6.1.4.1.12325.1.1112.2.1.10	Counter64	read-only	Number of octets seen by the network monitor.
C64 pcapPackets	1.3.6.1.4.1.12325.1.1112.2.1.11	Counter64	read-only	Number of packets seen by the network monitor.

RFC description

Manages packet capture network monitors and traffic monitoring statistics via bsnmp-pcap module.

Start monitoring vendor-neutral, standards-based MIB (BSD bsnmp-pcap packet-capture filter counters) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download PCAP-MIB