PEAKFLOW-SP-MIB

All MIBs › PEAKFLOW-SP-MIB

Organization: Arbor Networks, Inc.

Last Updated: 2013-08-19

Category: Security

Description: Manages Arbor Networks Peakflow SP service-provider traffic analysis platform, providing flow-based anomaly alerts and network-wide visibility data.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is PEAKFLOW-SP-MIB?

PEAKFLOW-SP-MIB supports Arbor Networks' Peakflow SP platform, a service-provider-grade traffic analysis and DDoS/anomaly detection system deployed by ISPs and large enterprises. It exposes flow-collection and routing-visibility data: collector and router inventory, monitored interfaces, and BGP-related event and instability notifications. Rather than reporting classic hardware health like CPU or fan status, its monitoring value centers on software/service-level state -- BGP session instability events, route-attribute changes, and traffic anomaly durations that indicate the health of the network being observed and of the Peakflow collection pipeline itself. It depends conceptually on BGP and interface identification conventions (ifIndex-style interface references) shared with standard routing MIBs, since its traps reference specific routers and interfaces by index. It is typically deployed at ISP or large-enterprise network operations centers as part of a centralized traffic-anomaly and DDoS-detection monitoring system. Network engineers evaluating or troubleshooting this functionality can download the PEAKFLOW-SP-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in PEAKFLOW-SP-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Arbor Networks Peakflow SP appliance
service-provider traffic analysis / DDoS detection platform

Monitoring Examples

An NOC would monitor spBGPEvent and spBGPInstability traps carrying spBGPTrapName, spBGPTrapPrefix, spBGPTrapOldAttributes, and spBGPTrapNewAttributes to detect route flapping or hijack-like attribute changes on a monitored spRouter. Correlating spInterface and spInterfaceIndex with spDuration lets an analyst see how long an anomalous traffic condition persisted on a given collector's monitored interface. A burst of spBGPTrapEvent notifications referencing the same spBGPTrapPrefix in a short window would indicate route instability worth escalating.

What Can Be Monitored

BGP instability events
BGP route attribute changes
monitored router/interface inventory
anomaly event duration
collector status

Imported Objects

From ARBOR-SMI

arbornetworksProducts

OBJECT-IDENTITY

From INET-ADDRESS-MIB

InetAddress
InetAddressType

From PEAKFLOW-DOS-MIB

pdosAnomalyClassification	OBJECT-TYPE
pdosAnomalyDirection	OBJECT-TYPE
pdosAnomalyDuration	OBJECT-TYPE
pdosAnomalyStart	OBJECT-TYPE
pdosUrl	OBJECT-TYPE

From SNMPv2-SMI

Counter32
Integer32
IpAddress
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
TimeTicks
Unsigned32

From SNMPv2-TC

DisplayString

How to Use in IPNetwork Monitor

Example using deviceTotalFlows OID:

Select an Arbor Networks traffic analysis/DDoS detection appliance as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type deviceTotalFlows into the Find box to locate it in the OID tree, then select it and click OK. It reports the accumulative flow count per SP device. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
peakflowSPMIB	1.3.6.1.4.1.9694.1.4			Peakflow SP MIB
peakflowSPCMI	1.3.6.1.4.1.9694.1.4.1
STR spCollector	1.3.6.1.4.1.9694.1.4.1.1	DisplayString	accessible-for-notify	SP Device name
STR spRouter	1.3.6.1.4.1.9694.1.4.1.2	DisplayString	accessible-for-notify	Router name
STR spInterface	1.3.6.1.4.1.9694.1.4.1.3	DisplayString	accessible-for-notify	Interface name
U32 spInterfaceIndex	1.3.6.1.4.1.9694.1.4.1.4	Unsigned32	accessible-for-notify	Interface SNMP Index
TIK spDuration	1.3.6.1.4.1.9694.1.4.1.5	TimeTicks	accessible-for-notify	Duration (in centi-seconds)
STR spBGPEvent	1.3.6.1.4.1.9694.1.4.1.6	DisplayString	accessible-for-notify	The event that caused a BGP transition
U32 spBGPInstability	1.3.6.1.4.1.9694.1.4.1.7	Unsigned32	accessible-for-notify	BGP instability update count
STR spBGPTrapName	1.3.6.1.4.1.9694.1.4.1.8	DisplayString	accessible-for-notify	The name of the triggered trap
STR spBGPTrapEvent	1.3.6.1.4.1.9694.1.4.1.9	DisplayString	accessible-for-notify	The event that triggered the trap
STR spBGPTrapPrefix	1.3.6.1.4.1.9694.1.4.1.10	DisplayString	accessible-for-notify	The prefix that experienced the trap event
STR spBGPTrapOldAttributes	1.3.6.1.4.1.9694.1.4.1.11	DisplayString	accessible-for-notify	The old attributes for the affected prefix
STR spBGPTrapNewAttributes	1.3.6.1.4.1.9694.1.4.1.12	DisplayString	accessible-for-notify	The new attributes for the affected prefix
U32 spInterfaceSpeed	1.3.6.1.4.1.9694.1.4.1.13	Unsigned32	accessible-for-notify	Configured Interface Speed (bps)
U32 spInterfaceUsage	1.3.6.1.4.1.9694.1.4.1.14	Unsigned32	accessible-for-notify	Actual interface usage (bps)
STR spReportURL	1.3.6.1.4.1.9694.1.4.1.15	DisplayString	accessible-for-notify	URL to view/download a report
STR spReportName	1.3.6.1.4.1.9694.1.4.1.16	DisplayString	accessible-for-notify	The name of the report
STR spReportID	1.3.6.1.4.1.9694.1.4.1.17	DisplayString	accessible-for-notify	The queue id of the report
U32 spAlertID	1.3.6.1.4.1.9694.1.4.1.18	Unsigned32	accessible-for-notify	The id of the alert
STR spHijackRoute	1.3.6.1.4.1.9694.1.4.1.19	DisplayString	accessible-for-notify	The BGP route prefix of the hijacking announcement
STR spHijackAttr	1.3.6.1.4.1.9694.1.4.1.20	DisplayString	accessible-for-notify	BGP attributes of the hijacking announcement
STR spHijackLocal	1.3.6.1.4.1.9694.1.4.1.21	DisplayString	accessible-for-notify	The local prefix that matched the possibly-hijacked route
STR spUsername	1.3.6.1.4.1.9694.1.4.1.22	DisplayString	accessible-for-notify	Name of a Peakflow SP user account.
STR spVersion	1.3.6.1.4.1.9694.1.4.1.23	DisplayString	accessible-for-notify	Version number of the described object.
STR spUsageType	1.3.6.1.4.1.9694.1.4.1.24	DisplayString	accessible-for-notify	Type of resource usage (high/low).
STR spManagedObject	1.3.6.1.4.1.9694.1.4.1.25	DisplayString	accessible-for-notify	Managed Object name
STR spManagedObjectFamily	1.3.6.1.4.1.9694.1.4.1.26	DisplayString	accessible-for-notify	Managed Object family
U32 spThreshold	1.3.6.1.4.1.9694.1.4.1.27	Unsigned32	accessible-for-notify	Configured threshold
U32 spUsage	1.3.6.1.4.1.9694.1.4.1.28	Unsigned32	accessible-for-notify	Observed per-object traffic usage
STR spUnit	1.3.6.1.4.1.9694.1.4.1.29	DisplayString	accessible-for-notify	Unit of measurement (bps/pps)
STR spHardwareFailureDescription	1.3.6.1.4.1.9694.1.4.1.30	DisplayString	accessible-for-notify	Description of hardware failure
STR spFingerprintName	1.3.6.1.4.1.9694.1.4.1.31	DisplayString	accessible-for-notify	Fingerprint name
STR spFingerprintFeedback	1.3.6.1.4.1.9694.1.4.1.32	DisplayString	accessible-for-notify	Feedback regarding a shared fingerprint
STR spFingerprintSender	1.3.6.1.4.1.9694.1.4.1.33	DisplayString	accessible-for-notify	Sender of a shared fingerprint
STR spFingerprintMessage	1.3.6.1.4.1.9694.1.4.1.34	DisplayString	accessible-for-notify	Message accompanying shared fingerprint
U32 spMitigationID	1.3.6.1.4.1.9694.1.4.1.35	Unsigned32	accessible-for-notify	The ID of the mitigation event
STR spDNSName	1.3.6.1.4.1.9694.1.4.1.36	DisplayString	accessible-for-notify	Domain name
U32 spDNSExpected	1.3.6.1.4.1.9694.1.4.1.37	Unsigned32	accessible-for-notify	Expected query count
U32 spDNSObserved	1.3.6.1.4.1.9694.1.4.1.38	Unsigned32	accessible-for-notify	Observed query count
U32 spDNSObservedMean	1.3.6.1.4.1.9694.1.4.1.39	Unsigned32	accessible-for-notify	Observed mean query count
U32 spDNSObservedMax	1.3.6.1.4.1.9694.1.4.1.40	Unsigned32	accessible-for-notify	Observed max query count
STR spMitigationName	1.3.6.1.4.1.9694.1.4.1.41	DisplayString	accessible-for-notify	Mitigation name
STR spScriptCommand	1.3.6.1.4.1.9694.1.4.1.42	DisplayString	accessible-for-notify	Alert script name
STR spScriptHost	1.3.6.1.4.1.9694.1.4.1.43	DisplayString	accessible-for-notify	Host on which alert script runs
STR spScriptPort	1.3.6.1.4.1.9694.1.4.1.44	DisplayString	accessible-for-notify	Port to connect to spScriptHost on
STR spScriptStart	1.3.6.1.4.1.9694.1.4.1.45	DisplayString	accessible-for-notify	Textual description of the time the script started
STR spTMSPrefix	1.3.6.1.4.1.9694.1.4.1.46	DisplayString	accessible-for-notify	The offramp prefix associated with the TMS mitigation
STR spTMSCommunity	1.3.6.1.4.1.9694.1.4.1.47	DisplayString	accessible-for-notify	The offramp community associated with the TMS mitigation. In the event the string is longer than 255 octets, the number of communities in this object may be truncated.
STR spTMSTimeout	1.3.6.1.4.1.9694.1.4.1.48	DisplayString	accessible-for-notify	Textual representation of TMS timeout, in minutes
STR spThirdPartyZone	1.3.6.1.4.1.9694.1.4.1.49	DisplayString	accessible-for-notify	Third party mitigation destination zone
STR spThirdPartyAddr	1.3.6.1.4.1.9694.1.4.1.50	DisplayString	accessible-for-notify	Third party mitigation destination address
STR spMitigationStart	1.3.6.1.4.1.9694.1.4.1.51	DisplayString	accessible-for-notify	Textual representation of mitigation start time
STR spBlackholeCommunity	1.3.6.1.4.1.9694.1.4.1.52	DisplayString	accessible-for-notify	The offramp community associated with the blackhole mitigation
STR spBlackholeTimeout	1.3.6.1.4.1.9694.1.4.1.53	DisplayString	accessible-for-notify	Textual representation of blackhole timeout, in minutes
STR spBlackholePrefix	1.3.6.1.4.1.9694.1.4.1.54	DisplayString	accessible-for-notify	The offramp prefix associated with the blackhole mitigation
STR spBlackholeNexthop	1.3.6.1.4.1.9694.1.4.1.55	DisplayString	accessible-for-notify	The offramp next hop associated with the blackhole mitigation
STR spFlowspecCommunity	1.3.6.1.4.1.9694.1.4.1.56	DisplayString	accessible-for-notify	The offramp community associated with flowspec mitigation
STR spFlowspecTimeout	1.3.6.1.4.1.9694.1.4.1.57	DisplayString	accessible-for-notify	Textual representation of flowspec timeout, in minutes
STR spCommFailureDestination	1.3.6.1.4.1.9694.1.4.1.58	DisplayString	accessible-for-notify	Destination of internal SP communication failure
STR spCommFailureDescription	1.3.6.1.4.1.9694.1.4.1.59	DisplayString	accessible-for-notify	Description of internal SP communication failure
IP spGreTunnelDestination	1.3.6.1.4.1.9694.1.4.1.60	IpAddress	accessible-for-notify	GRE Tunnel destination
STR spSystemErrorType	1.3.6.1.4.1.9694.1.4.1.61	DisplayString	accessible-for-notify	Textual name of system error alert type
STR spSystemErrorDescription	1.3.6.1.4.1.9694.1.4.1.62	DisplayString	accessible-for-notify	Description of the system error alert
STR spServiceName	1.3.6.1.4.1.9694.1.4.1.63	DisplayString	accessible-for-notify	Service name
STR spServiceElement	1.3.6.1.4.1.9694.1.4.1.64	DisplayString	accessible-for-notify	Service element
STR spApplicationName	1.3.6.1.4.1.9694.1.4.1.65	DisplayString	accessible-for-notify	Application
STR spAlertDetectionSignatures	1.3.6.1.4.1.9694.1.4.1.66	DisplayString	accessible-for-notify	A comma separated string of all alert detection signatures that make up a specific alert. May be 1 or more set, depending on the alert type.
STR spManagedObjects	1.3.6.1.4.1.9694.1.4.1.67	DisplayString	accessible-for-notify	A comma-separated list of managed object names.
IPt spInetAddressType	1.3.6.1.4.1.9694.1.4.1.68	InetAddressType	accessible-for-notify	An InetAddressType INTEGER value that specifies the type of Internet address specific in an spInetAddress object. Generally, this will be used by Peakflow SP to specify IPv4 (1) or IPv6 (2) addresses. See RFC3291 for a detailed description.
IP spInetAddress	1.3.6.1.4.1.9694.1.4.1.69	InetAddress	accessible-for-notify	An InetAddress string that specifies an Internet address, of a type specified by spInetAddressType. See RFC3291 for a detailed description.
U32 spImpactBps	1.3.6.1.4.1.9694.1.4.1.70	Unsigned32	accessible-for-notify	The maximum observed bps of traffic for a given DoS alert type.
U32 spImpactPps	1.3.6.1.4.1.9694.1.4.1.71	Unsigned32	accessible-for-notify	The maximum observed pps of traffic for a given DoS alert type.
STR spDetectedCountries	1.3.6.1.4.1.9694.1.4.1.72	DisplayString	accessible-for-notify	A comma separated string of ISO 3166 country codes that have been detected as part of the alert. May be 0 to 50 set. If more than 50 countries have been detected, the string will end in '...'.
STR spRoutingFailoverInterfaces	1.3.6.1.4.1.9694.1.4.1.73	DisplayString	accessible-for-notify	A comma separated string of interfaces involved in failover routing.
STR spPravail	1.3.6.1.4.1.9694.1.4.1.74	DisplayString	accessible-for-notify	Pravail device name
STR spDetector	1.3.6.1.4.1.9694.1.4.1.75	DisplayString	accessible-for-notify	SP detector device name
STR spTMSMultiPrefix	1.3.6.1.4.1.9694.1.4.1.76	DisplayString	accessible-for-notify	A comma seperated list of the offramp prefixes associated with the TMS multi-prefix mitigation. This field does not include the first prefix which is included in spTMSPrefix.
STR spLicenseErrType	1.3.6.1.4.1.9694.1.4.1.77	DisplayString	accessible-for-notify	Textual name of the license error alert type
U32 spLicenseErrCount	1.3.6.1.4.1.9694.1.4.1.78	Unsigned32	accessible-for-notify	Deployment-wide License Device Count
U32 spLicenseErrLimit	1.3.6.1.4.1.9694.1.4.1.79	Unsigned32	accessible-for-notify	Deployment-wide License Device Limit
STR spLicenseErrDescription	1.3.6.1.4.1.9694.1.4.1.80	DisplayString	accessible-for-notify	Description of the License alert
peakflowSPMgr	1.3.6.1.4.1.9694.1.4.2
deviceHealth	1.3.6.1.4.1.9694.1.4.2.1
I32 deviceCpuLoadAvg1min	1.3.6.1.4.1.9694.1.4.2.1.1	Integer32	read-only	Load average during last 1 minute. This value is calculated by taking the average number of processes in run queue during last 1 minute and multiplying by 100, then rounding the result into an integer.
I32 deviceCpuLoadAvg5min	1.3.6.1.4.1.9694.1.4.2.1.2	Integer32	read-only	Load average during last 5 minutes. This value is calculated by taking the average number of processes in run queue during last 5 minutes and multiplying by 100, then rounding the result into an integer.
I32 deviceCpuLoadAvg15min	1.3.6.1.4.1.9694.1.4.2.1.3	Integer32	read-only	Load average during last 15 minutes. This value is calculated by taking the average number of processes in run queue during last 15 minutes and multiplying by 100, then rounding the result into an integer.
I32 deviceDiskUsage	1.3.6.1.4.1.9694.1.4.2.1.4	Integer32	read-only	Percentage of primary data partition used.
I32 devicePhysicalMemory	1.3.6.1.4.1.9694.1.4.2.1.5	Integer32	read-only	Total physical memeory installed (in KiB).
I32 devicePhysicalMemoryInUse	1.3.6.1.4.1.9694.1.4.2.1.6	Integer32	read-only	Physical memeory being used (in KiB).
I32 devicePhysicalMemoryUsage	1.3.6.1.4.1.9694.1.4.2.1.7	Integer32	read-only	Percentage of physical memory used.
I32 deviceSwapSpace	1.3.6.1.4.1.9694.1.4.2.1.8	Integer32	read-only	Total swap space available (in KiB).
I32 deviceSwapSpaceInUse	1.3.6.1.4.1.9694.1.4.2.1.9	Integer32	read-only	Used swap space (in KiB).
I32 deviceSwapSpaceUsage	1.3.6.1.4.1.9694.1.4.2.1.10	Integer32	read-only	Percentage of swap space used.
C32 deviceTotalFlowsEx	1.3.6.1.4.1.9694.1.4.2.1.11	Counter32	read-only	Accumulative flow count per SP device.
peakflowSPTraps	1.3.6.1.4.1.9694.1.4.3
peakflowSPTrapsEnumerate	1.3.6.1.4.1.9694.1.4.3.0
NTF flowDown	1.3.6.1.4.1.9694.1.4.3.0.1			Flow data has not been received from a Flow transmitting router
NTF flowUp	1.3.6.1.4.1.9694.1.4.3.0.2			Flow data has resumed from a router which previously was not forwarding Flow data
NTF snmpDown	1.3.6.1.4.1.9694.1.4.3.0.3			SNMP requests are not being answered by the router
NTF snmpUp	1.3.6.1.4.1.9694.1.4.3.0.4			SNMP requests are again being answered by the router
NTF bgpDown	1.3.6.1.4.1.9694.1.4.3.0.5			The BGP session with the router has transitioned down
NTF bgpUp	1.3.6.1.4.1.9694.1.4.3.0.6			The BGP session with the router has transitioned up
NTF collectorDown	1.3.6.1.4.1.9694.1.4.3.0.7			The SP device is down. Heartbeats are missing.
NTF collectorUp	1.3.6.1.4.1.9694.1.4.3.0.8			The SP device is up. Heartbeats have resumed.
NTF collectorStart	1.3.6.1.4.1.9694.1.4.3.0.9			The SP device is started. Heartbeats have been received.
NTF bgpInstability	1.3.6.1.4.1.9694.1.4.3.0.10			The BGP session with this router is exhibiting instability
NTF bgpInstabilityDone	1.3.6.1.4.1.9694.1.4.3.0.11			The BGP instability associated with this router has ended
NTF bgpTrap	1.3.6.1.4.1.9694.1.4.3.0.12			A BGP event matching this trap definition has occurred.
NTF interfaceUsage	1.3.6.1.4.1.9694.1.4.3.0.13			The interface exceeded the configured traffic rate threshold.
NTF interfaceUsageDone	1.3.6.1.4.1.9694.1.4.3.0.14			The interface is now within configured traffic thresholds
NTF autoclassifyStart	1.3.6.1.4.1.9694.1.4.3.0.15			Autoclassification started on this Peakflow SP leader.
NTF configChange	1.3.6.1.4.1.9694.1.4.3.0.16			Configuration updated from this Peakflow SP leader.
NTF notificationLimit	1.3.6.1.4.1.9694.1.4.3.0.17			Too many alerts have been generated by this Peakflow SP leader. Alerts will be temporarily suppressed. For more information about alerts that are being generated, please go to the Alerts page in the leader's UI.
NTF reportDone	1.3.6.1.4.1.9694.1.4.3.0.18			The indicated report is finished and available for viewing at the listed URL.
NTF bgpHijack	1.3.6.1.4.1.9694.1.4.3.0.19			A BGP announcement was seen for a prefix that is part of the configured local address space.
NTF managedObjectUsage	1.3.6.1.4.1.9694.1.4.3.0.20			The managed object exceeded the configured traffic rate threshold.
NTF managedObjectUsageDone	1.3.6.1.4.1.9694.1.4.3.0.21			The manged object is no longer exceeding the traffic rate threshold.
NTF hardwareFailure	1.3.6.1.4.1.9694.1.4.3.0.22			A hardware failure has been detected on an SP device.
NTF hardwareFailureDone	1.3.6.1.4.1.9694.1.4.3.0.23			A hardware failure is no longer detected on an SP device.
NTF fingerprintFeedback	1.3.6.1.4.1.9694.1.4.3.0.24			Feedback received regarding a shared fingerprint.
NTF fingerprintReceive	1.3.6.1.4.1.9694.1.4.3.0.25			A shared fingerprint was received.
NTF dnsBaseline	1.3.6.1.4.1.9694.1.4.3.0.26			An excessive number of queries for a domain name detected.
NTF dnsBaselineDone	1.3.6.1.4.1.9694.1.4.3.0.27			Query count for domain name has returned to normal levels.
NTF alertScript	1.3.6.1.4.1.9694.1.4.3.0.28			Alert script has been executed
NTF mitigationDone	1.3.6.1.4.1.9694.1.4.3.0.29			Mitigation has completed
NTF mitigationTMSStart	1.3.6.1.4.1.9694.1.4.3.0.30			TMS Mitigation has started
NTF mitigationThirdPartyStart	1.3.6.1.4.1.9694.1.4.3.0.31			Third Party Mitigation has started
NTF mitigationBlackholeStart	1.3.6.1.4.1.9694.1.4.3.0.32			Blackhole Mitigation has started
NTF mitigationFlowspecStart	1.3.6.1.4.1.9694.1.4.3.0.33			Flowspec Mitigation has started
NTF spcommFailure	1.3.6.1.4.1.9694.1.4.3.0.34			An SP internal communication failure has occurred.
NTF spcommFailureDone	1.3.6.1.4.1.9694.1.4.3.0.35			An SP internal communication failure has ended.
NTF greDown	1.3.6.1.4.1.9694.1.4.3.0.36			The GRE tunnel is down
NTF greDownDone	1.3.6.1.4.1.9694.1.4.3.0.37			The GRE tunnel is back up
NTF deviceSystemError	1.3.6.1.4.1.9694.1.4.3.0.38			An SP device system error alert has started.
NTF deviceSystemErrorDone	1.3.6.1.4.1.9694.1.4.3.0.39			An SP device system error alert has ended.
NTF fingerprintUsage	1.3.6.1.4.1.9694.1.4.3.0.40			The fingerprint exceeded the configured traffic rate threshold.
NTF fingerprintUsageDone	1.3.6.1.4.1.9694.1.4.3.0.41			The fingerprint is no longer exceeding the traffic rate threshold.
NTF serviceUsage	1.3.6.1.4.1.9694.1.4.3.0.42			The service exceeded the configured traffic rate threshold.
NTF serviceUsageDone	1.3.6.1.4.1.9694.1.4.3.0.43			The service is no longer exceeding the traffic rate threshold.
NTF dosNetworkProfiledAlert	1.3.6.1.4.1.9694.1.4.3.0.44			The managed object exceeded network and/or country baseline thresholds.
NTF dosNetworkProfiledAlertDone	1.3.6.1.4.1.9694.1.4.3.0.45			The managed object is no longer exceeding the network and/or country baseline thresholds.
NTF dosHostDetectionAlert	1.3.6.1.4.1.9694.1.4.3.0.46			A Host alert was started after one or more signatures exceeded their thresholds.
NTF dosHostDetectionAlertDone	1.3.6.1.4.1.9694.1.4.3.0.47			The Host alert ended and is no longer exceeding signature thresholds.
NTF routingFailover	1.3.6.1.4.1.9694.1.4.3.0.48			A routing failover event occurred on a collector.
NTF routingFailoverInterfaceDownAlert	1.3.6.1.4.1.9694.1.4.3.0.49			One or more interfaces involved in routing failover for a collector are down. The spRoutingFailoverInterfaces object documents the list of interfaces that are down.
NTF routingFailoverInterfaceDownAlertDone	1.3.6.1.4.1.9694.1.4.3.0.50			A previously started alert for down routing failover interfaces has finished.
NTF trafficAutoMitigation	1.3.6.1.4.1.9694.1.4.3.0.51			Traffic has been seen by a TMS for a Managed Object which has been configured for traffic-based auto-mitigation.
NTF cloudSignalingMitigationRequest	1.3.6.1.4.1.9694.1.4.3.0.52			A cloud signaling mitigation request has been seen and an alert created.
NTF licenseError	1.3.6.1.4.1.9694.1.4.3.0.53			An SP Deployment License error alert has started.
NTF licenseErrorDone	1.3.6.1.4.1.9694.1.4.3.0.54			An SP Deployment License error alert has ended.

RFC description

Provides management and monitoring of Arbor Peakflow SP DDoS detection and mitigation appliance operations and anomaly alerts.

Start monitoring Arbor Networks traffic analysis/DDoS detection appliances with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download PEAKFLOW-SP-MIB