PEAKFLOW-TMS-MIB

All MIBs › PEAKFLOW-TMS-MIB

Organization: Arbor Networks, Inc.

Last Updated: 2013-08-19

Category: Security

Description: Monitors Arbor Networks Peakflow TMS (Threat Management System) DDoS scrubbing appliance, tracking diversion, scrubbing, and re-injection statistics.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is PEAKFLOW-TMS-MIB?

PEAKFLOW-TMS-MIB is a vendor MIB from Arbor Networks (now NETSCOUT) for the Peakflow TMS (Threat Management System), a DDoS mitigation appliance that diverts, scrubs, and re-injects attack traffic. It exposes both device-health objects (CPU load, memory, disk, swap usage, uptime) and TMS-specific fault/trap objects describing scrubbing and mitigation events. It is heavily oriented toward monitoring hardware and software status: deviceCpuLoadAvg1min/5min/15min and devicePhysicalMemoryUsage/deviceSwapSpaceUsage reveal resource exhaustion, deviceDiskUsage flags storage pressure, and tmsHostUpTime tracks appliance availability, while tmsHostFault and the trap objects surface mitigation-related faults. It is a standalone vendor MIB with its own private enterprise objects rather than leaning heavily on IETF host-resources conventions, though the naming mirrors common host-monitoring practice. It is typically deployed in ISP or enterprise DDoS-scrubbing centers where TMS appliances sit inline or off-path from core routing infrastructure. Network engineers evaluating or troubleshooting this functionality can download the PEAKFLOW-TMS-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in PEAKFLOW-TMS-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Arbor Networks (NETSCOUT) Peakflow TMS DDoS scrubbing appliance

Monitoring Examples

An administrator would poll deviceCpuLoadAvg1min/5min/15min and devicePhysicalMemoryUsage on a Peakflow TMS appliance to detect resource exhaustion during a large-scale scrubbing event, and check deviceDiskUsage and deviceSwapSpaceUsage to catch storage or memory pressure before it degrades mitigation performance. tmsHostFault combined with tmsTrapString, tmsTrapDetail, tmsTrapSubhostName, and tmsTrapComponentName would be used to pinpoint which subhost or component raised a fault during an active DDoS mitigation. tmsHostUpTime confirms the appliance has not silently restarted mid-mitigation.

What Can Be Monitored

CPU load averages
physical memory usage
swap space usage
disk usage
appliance uptime
TMS fault/trap events

Imported Objects

From ARBOR-SMI

arbornetworksProducts

OBJECT-IDENTITY

From IF-MIB

ifName

OBJECT-TYPE

From IPV6-TC

Ipv6Address
Ipv6AddressPrefix

From SNMPv2-MIB

sysName

OBJECT-TYPE

From SNMPv2-SMI

Integer32
IpAddress
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
TimeTicks
Unsigned32

From SNMPv2-TC

DisplayString
TEXTUAL-CONVENTION

How to Use in IPNetwork Monitor

Example using tmsHostUpTime OID:

Select an Arbor Networks (NETSCOUT) Peakflow TMS DDoS scrubbing appliance as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type tmsHostUpTime into the Find box to locate it in the OID tree, then select it and click OK. It reports uptime of this host. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a TimeTicks-type OID, Value bounds is the most useful condition here — trigger an alert if the value is unexpectedly low (e.g. under 10 minutes), since that indicates a recent, possibly unplanned, reboot or restart. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
peakflowTmsMIB	1.3.6.1.4.1.9694.1.5			Peakflow TMS MIB
peakflowTmsMgr	1.3.6.1.4.1.9694.1.5.2
STR tmsHostFault	1.3.6.1.4.1.9694.1.5.2.1	DisplayString	read-only	state of faults within a TMS device
TIK tmsHostUpTimeEx	1.3.6.1.4.1.9694.1.5.2.2	TimeTicks	read-only	uptime of this host
TMS deviceCpuLoadAvg1min	1.3.6.1.4.1.9694.1.5.2.3	TmsHundredths	read-only	Average number of processes in run queue during last 1 min.
TMS deviceCpuLoadAvg5min	1.3.6.1.4.1.9694.1.5.2.4	TmsHundredths	read-only	Average number of processes in run queue during last 5 min.
TMS deviceCpuLoadAvg15min	1.3.6.1.4.1.9694.1.5.2.5	TmsHundredths	read-only	Average number of processes in run queue during last 15 min.
TMS deviceDiskUsage	1.3.6.1.4.1.9694.1.5.2.6	TmsPercentage	read-only	Percentage of primary data partition used.
TMS devicePhysicalMemoryUsage	1.3.6.1.4.1.9694.1.5.2.7	TmsPercentage	read-only	Percentage of physical memory used.
TMS deviceSwapSpaceUsage	1.3.6.1.4.1.9694.1.5.2.8	TmsPercentage	read-only	Percentage of swap space used.
STR tmsTrapString	1.3.6.1.4.1.9694.1.5.2.9	DisplayString	read-only	Temporary string for reporting information in traps
STR tmsTrapDetail	1.3.6.1.4.1.9694.1.5.2.10	DisplayString	read-only	Temporary string for reporting additional detail (if any) about a trap
STR tmsTrapSubhostName	1.3.6.1.4.1.9694.1.5.2.11	DisplayString	read-only	Temporary string for reporting the name of a subhost
STR tmsTrapComponentName	1.3.6.1.4.1.9694.1.5.2.12	DisplayString	read-only	Temporary string for reporting the name of a program or device
IP tmsTrapBgpPeer	1.3.6.1.4.1.9694.1.5.2.13	IpAddress	read-only	IP address of a BGP peer
IP tmsTrapGreSource	1.3.6.1.4.1.9694.1.5.2.14	IpAddress	read-only	GRE source IP address
IP tmsTrapGreDestination	1.3.6.1.4.1.9694.1.5.2.15	IpAddress	read-only	GRE destination IP address
IP tmsTrapNexthop	1.3.6.1.4.1.9694.1.5.2.16	IpAddress	read-only	Nexthop IP address
ADR tmsTrapIpv6BgpPeer	1.3.6.1.4.1.9694.1.5.2.17	Ipv6Address	read-only	IPv6 address of a BGP peer
ADR tmsTrapIpv6GreSource	1.3.6.1.4.1.9694.1.5.2.18	Ipv6Address	read-only	GRE source IPv6 address
ADR tmsTrapIpv6GreDestination	1.3.6.1.4.1.9694.1.5.2.19	Ipv6Address	read-only	GRE destination IPv6 address
ADR tmsTrapIpv6Nexthop	1.3.6.1.4.1.9694.1.5.2.20	Ipv6Address	read-only	Nexthop IPv6 address
peakflowTmsTraps	1.3.6.1.4.1.9694.1.5.3
peakflowTmsTrapsEnumerate	1.3.6.1.4.1.9694.1.5.3.0
NTF hostFault	1.3.6.1.4.1.9694.1.5.3.0.1			Obsolete; replaced by a number of more specific traps.
NTF greTunnelDown	1.3.6.1.4.1.9694.1.5.3.0.2			The greTunnelDown/greTunnelUp traps are generated when a GRE tunnel changes state.
NTF greTunnelUp	1.3.6.1.4.1.9694.1.5.3.0.3			The greTunnelDown/greTunnelUp traps are generated when a GRE tunnel changes state.
NTF tmsLinkUp	1.3.6.1.4.1.9694.1.5.3.0.4			Obsolete; IF-MIB::linkUp is now used instead
NTF tmsLinkDown	1.3.6.1.4.1.9694.1.5.3.0.5			Obsolete; IF-MIB::linkDown is now used instead
NTF subHostUp	1.3.6.1.4.1.9694.1.5.3.0.6			Generated when a subhost transitions to active
NTF subHostDown	1.3.6.1.4.1.9694.1.5.3.0.7			Generated when a subhost transitions to inactive
NTF tmsBgpNeighborDown	1.3.6.1.4.1.9694.1.5.3.0.8			Generated when a BGP neighbor transitions out of the ESTABLISHED state
NTF tmsBgpNeighborUp	1.3.6.1.4.1.9694.1.5.3.0.9			Generated when a BGP neighbor transitions into the ESTABLISHED state
NTF tmsNexthopDown	1.3.6.1.4.1.9694.1.5.3.0.10			Generated when the nexthop host cannot be contacted
NTF tmsNexthopUp	1.3.6.1.4.1.9694.1.5.3.0.11			Generated when the nexthop host cannot be contacted
NTF tmsMitigationError	1.3.6.1.4.1.9694.1.5.3.0.12			A mitigation cannot run because of a configuration error
NTF tmsMitigationSuspended	1.3.6.1.4.1.9694.1.5.3.0.13			A mitigation has been suspended due to some external problem (nexthop not reachable, BGP down, etc.)
NTF tmsMitigationRunning	1.3.6.1.4.1.9694.1.5.3.0.14			A previously-detected mitigation problem has been cleared and the mitigation is now running
NTF tmsConfigMissing	1.3.6.1.4.1.9694.1.5.3.0.15			Generated when a TMS configuration file cannot be found.
NTF tmsConfigError	1.3.6.1.4.1.9694.1.5.3.0.16			Generated when an error in a TMS configuration file is detected.
NTF tmsConfigOk	1.3.6.1.4.1.9694.1.5.3.0.17			All configuration problems have been corrected.
NTF tmsHwDeviceDown	1.3.6.1.4.1.9694.1.5.3.0.18			A hardware device has failed.
NTF tmsHwDeviceUp	1.3.6.1.4.1.9694.1.5.3.0.19			A hardware device failure has been corrected.
NTF tmsHwSensorCritical	1.3.6.1.4.1.9694.1.5.3.0.20			A hardware sensor is reading an alarm condition.
NTF tmsHwSensorOk	1.3.6.1.4.1.9694.1.5.3.0.21			A hardware sensor is no longer reading an alarm condition.
NTF tmsSwComponentDown	1.3.6.1.4.1.9694.1.5.3.0.22			A software program has failed.
NTF tmsSwComponentUp	1.3.6.1.4.1.9694.1.5.3.0.23			A software program failure has been corrected.
NTF tmsSystemStatusCritical	1.3.6.1.4.1.9694.1.5.3.0.24			The TMS system is experiencing a critical failure.
NTF tmsSystemStatusDegraded	1.3.6.1.4.1.9694.1.5.3.0.25			The TMS system is experiencing degraded performance.
NTF tmsSystemStatusNominal	1.3.6.1.4.1.9694.1.5.3.0.26			The TMS system has returned to normal behavior.
NTF tmsFilesystemCritical	1.3.6.1.4.1.9694.1.5.3.0.27			A filesystem is near capacity.
NTF tmsFilesystemNominal	1.3.6.1.4.1.9694.1.5.3.0.28			A filesystem is back below capacity alarm threshold.
NTF tmsHwSensorUnknown	1.3.6.1.4.1.9694.1.5.3.0.29			A hardware sensor is in an unknown state.
NTF tmsSpCommunicationUp	1.3.6.1.4.1.9694.1.5.3.0.30			Communication with SP host is up.
NTF tmsSpCommunicationDown	1.3.6.1.4.1.9694.1.5.3.0.31			Communication with SP host is down.
NTF tmsSystemStatusError	1.3.6.1.4.1.9694.1.5.3.0.32			The TMS system is experiencing an error.
NTF tmsAutomitigationBgpEnabled	1.3.6.1.4.1.9694.1.5.3.0.33			A previously-detected automitigation problem has been cleared and the automitigation BGP announcements have resumed.
NTF tmsAutomitigationBgpDisabled	1.3.6.1.4.1.9694.1.5.3.0.34			Automitigation BGP announcements have been administratively disabled.
NTF tmsAutomitigationBgpSuspended	1.3.6.1.4.1.9694.1.5.3.0.35			Automitigation BGP announcements have been suspended due to some external problem (nexthop not reachable, BGP down, etc.)
NTF tmsIpv6GreTunnelDown	1.3.6.1.4.1.9694.1.5.3.0.36			The greTunnelDown/greTunnelUp traps are generated when a GRE tunnel changes state.
NTF tmsIpv6GreTunnelUp	1.3.6.1.4.1.9694.1.5.3.0.37			The greTunnelDown/greTunnelUp traps are generated when a GRE tunnel changes state.
NTF tmsIpv6BgpNeighborDown	1.3.6.1.4.1.9694.1.5.3.0.38			Generated when a BGP neighbor transitions out of the ESTABLISHED state.
NTF tmsIpv6BgpNeighborUp	1.3.6.1.4.1.9694.1.5.3.0.39			Generated when a BGP neighbor transitions into the ESTABLISHED state.
NTF tmsIpv6NexthopDown	1.3.6.1.4.1.9694.1.5.3.0.40			Generated when the nexthop host becomes unreachable.
NTF tmsIpv6NexthopUp	1.3.6.1.4.1.9694.1.5.3.0.41			Generated when the nexthop host becomes reachable.
NTF tmsPerformanceOk	1.3.6.1.4.1.9694.1.5.3.0.42			Generated when the processed traffic rate matches the offered traffic rate.
NTF tmsPerformanceLossy	1.3.6.1.4.1.9694.1.5.3.0.43			Generated when the processed traffic rate is lower than the offered traffic rate.
NTF tmsSystemPrefixesOk	1.3.6.1.4.1.9694.1.5.3.0.44			BGP is currently advertising all mitigation prefixes.
NTF tmsSystemPrefixesMissing	1.3.6.1.4.1.9694.1.5.3.0.45			BGP is not currently advertising all mitigation prefixes.
peakflowTmsObj	1.3.6.1.4.1.9694.1.5.5
tmsDpiConfig	1.3.6.1.4.1.9694.1.5.5.1
STR tmsVersion	1.3.6.1.4.1.9694.1.5.5.1.1	DisplayString	read-only	TMS software version
STR tmsLastUpdate	1.3.6.1.4.1.9694.1.5.5.1.2	DisplayString	read-only	Time of the last configuration change
tmsMitigationConfig	1.3.6.1.4.1.9694.1.5.5.2
STR tmsMitigationLastUpdate	1.3.6.1.4.1.9694.1.5.5.2.1	DisplayString	read-only	Last time Mitigation configuration was updated
TMS tmsMitigationNumber	1.3.6.1.4.1.9694.1.5.5.2.2	TmsTableIndexOrZero	read-only	Number of entries in the tmsMitigation table
tmsMitigationTable	1.3.6.1.4.1.9694.1.5.5.2.3		not-accessible	Table of all mitigations in the TMS system
tmsMitigationEntry	1.3.6.1.4.1.9694.1.5.5.2.3.1		not-accessible	Information about a single mitigation
TMS tmsMitigationIndex	1.3.6.1.4.1.9694.1.5.5.2.3.1.1	TmsTableIndex	read-only	Index in the tmsMitigation table. As of release 5.0 this is the same as the tmsMitigationId.
U32 tmsMitigationId	1.3.6.1.4.1.9694.1.5.5.2.3.1.2	Unsigned32	read-only	ID number of this mitigation
IP tmsDestinationPrefix	1.3.6.1.4.1.9694.1.5.5.2.3.1.3	IpAddress	read-only	Destination IPv4 prefix to which this mitigation applies. The value 0.0.0.0/32 indicates that the mitigation has no IPv4 prefix.
U32 tmsDestinationPrefixMask	1.3.6.1.4.1.9694.1.5.5.2.3.1.4	Unsigned32	read-only	Destination IPv4 prefix to which this mitigation applies. The value 0.0.0.0/32 indicates that the mitigation has no IPv4 prefix.
STR tmsMitigationName	1.3.6.1.4.1.9694.1.5.5.2.3.1.5	DisplayString	read-only	Name of this mitigation
ADR tmsIpv6DestinationPrefix	1.3.6.1.4.1.9694.1.5.5.2.3.1.6	Ipv6AddressPrefix	read-only	Destination IPv6 prefix to which this mitigation applies. The value 0::/128 indicates that the mitigation has no IPv6 prefix.
U32 tmsIpv6DestinationPrefixMask	1.3.6.1.4.1.9694.1.5.5.2.3.1.7	Unsigned32	read-only	Destination IPv6 prefix to which this mitigation applies. The value 0::/128 indicates that the mitigation has no IPv6 prefix.

RFC description

Peakflow TMS (Traffic Management System) MIB for monitoring traffic management appliances.

Start monitoring Arbor Networks (NETSCOUT) Peakflow TMS DDoS scrubbing appliance with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download PEAKFLOW-TMS-MIB