RBN-SYS-SECURITY-MIB

All MIBs › RBN-SYS-SECURITY-MIB

Organization: Ericsson Inc.

Last Updated: 2009-11-09

Category: Security, Vendor: Ericsson

Description: Manages system security access control lists and login authentication policies on Ericsson SmartEdge BRAS platforms.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is RBN-SYS-SECURITY-MIB?

RBN-SYS-SECURITY-MIB is an Ericsson (formerly Redback Networks, RBN) enterprise MIB for the SmartEdge family of BRAS/edge routers, covering system and network-level security monitoring such as login access control and malicious packet detection. It exposes threshold-based counters for malicious packet activity (rbnMaliciousPktsCounter, rbnMaliciousPktsDelta) along with configurable high/low thresholds and a measurement interval, plus notification controls. This is primarily a security/fault-monitoring MIB: it lets an operator watch for spikes in malicious traffic that could indicate an attack in progress, and it issues SNMP notifications when configured thresholds are crossed, functioning like a software-based intrusion/anomaly alarm rather than a hardware sensor. Object values are scoped per SNMP context (community string in v1/v2c, contextName in v3), tying it to the standard SNMPv3 context model. It is deployed on Ericsson SmartEdge BRAS platforms at broadband aggregation edges where subscriber-facing security threats need real-time counting and alerting. Engineers can download the RBN-SYS-SECURITY-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in RBN-SYS-SECURITY-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Ericsson SmartEdge BRAS/edge router

Monitoring Examples

An operator would monitor rbnMaliciousPktsCounter and rbnMaliciousPktsDelta over each rbnMeasurementInterval, comparing against rbnMaliciousPktsThresholdHi and rbnMaliciousPktsThresholdLow to detect when malicious packet rates cross into an alarm condition. When the high threshold is exceeded, rbnSysSecNotifications fires (gated by rbnSysSecNotifyEnable), and rbnThresholdNotifyTime records when the crossing occurred, letting a NOC correlate a security event with a subsequent traffic anomaly or DoS attempt on the BRAS.

What Can Be Monitored

malicious packet counter
malicious packet delta rate
high/low alarm thresholds
measurement interval
security notification enable state
last threshold-crossing timestamp

Imported Objects

From HCNUM-TC

CounterBasedGauge64

From RBN-SMI

rbnModules

OBJECT-IDENTITY

From RBN-TC

RbnUnsigned64

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Counter64
Gauge32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE

From SNMPv2-TC

DateAndTime

How to Use in IPNetwork Monitor

Example using rbnMaliciousPktsCounter OID:

Select an Ericsson (Redback) SmartEdge BRAS/edge router (malicious-packet/security threshold alarms) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type rbnMaliciousPktsCounter into the Find box to locate it in the OID tree, then select it and click OK. It reports a count of all malicious pkts. This includes but is not limited to malformed IP packets, malformed layer 4 IP, packets filtered by ACLs for specific faults, IP packets identified as attempting to spoof a system, and IP packets which failed reassembly. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter64-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases between polls, since a rising count of errors, failures, or discards often points to a real underlying problem. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
rbnSysSecurityMib	1.3.6.1.4.1.2352.5.54			This MIB module defines attributes and notifications related to system and network level security issues. All mib objects defined in the module are viewed within the context identified in the SNMP protocol (i.e. the community string in v1/v2c or the contextName in v3).
rbnSysSecNotifications	1.3.6.1.4.1.2352.5.54.0
NTF rbnMaliciousPktThresholdHiExceeded	1.3.6.1.4.1.2352.5.54.0.1			This notification signifies that one of the delta values is equal to or greater than the corresponding high threshold value. The specific delta value is the last object in the notification varbind list.
NTF rbnMaliciousPktThresholdLowExceeded	1.3.6.1.4.1.2352.5.54.0.2			This notification signifies that one of the delta values is less than or equal to the corresponding low threshold value. The specific delta value is the last object in the notification varbind list.
rbnSysSecObjects	1.3.6.1.4.1.2352.5.54.1
rbnSysSecThresholdObjects	1.3.6.1.4.1.2352.5.54.1.1
BIT rbnSysSecNotifyEnable	1.3.6.1.4.1.2352.5.54.1.1.1	Bits	read-write	The bit mask to enable/disable notifications for crossing specific threshold.
G32 rbnMeasurementInterval	1.3.6.1.4.1.2352.5.54.1.1.2	Gauge32	read-write	Data is sampled at the start and end of a specified interval. The difference between the start and end values \|end - start\| is called the delta value. When setting the interval, care should be taken that the interval should be short enough that the sampled variable is very unlikely to increase or decrease by more than range of the variable.
RBN rbnMaliciousPktsThresholdHi	1.3.6.1.4.1.2352.5.54.1.1.3	RbnUnsigned64	read-write	When the current sampling interval delta value of the malicious packets counter is greater than or equal to this threshold, and the delta value at the last sampling interval was less than this threshold, a single high threshold exceeded event will be generated. A single high threshold exceeded event will also be generated if the first sampling interval delta value of the malicious IP packets counter is greater than or equal to this threshold. After a high threshold exceeded event is generated, another such event will not be generated until the delta value falls below this threshold and reaches the rbnMaliciousPktsThresholdLow, generating a low threshold exceeded event. In other words there cannot be successive high threshold events without an intervening low threshold event.
RBN rbnMaliciousPktsThresholdLow	1.3.6.1.4.1.2352.5.54.1.1.4	RbnUnsigned64	read-write	When the current sampling interval delta value of the malicious packets counter is less than or equal to this threshold, and the delta value at the last sampling interval was greater than this threshold, a single low threshold exceeded event will be generated. In addition, a high threshold exceeded event must occur before a low threshold exceeded event can be generated.
rbnSysSecStatsObjects	1.3.6.1.4.1.2352.5.54.1.2
C64 rbnMaliciousPktsCounterEx	1.3.6.1.4.1.2352.5.54.1.2.1	Counter64	read-only	A count of all malicious pkts. This includes but is not limited to malformed IP packets, malformed layer 4 IP, packets filtered by ACLs for specific faults, IP packets identified as attempting to spoof a system, and IP packets which failed reassembly.
NUM rbnMaliciousPktsDelta	1.3.6.1.4.1.2352.5.54.1.2.2	CounterBasedGauge64	accessible-for-notify	The delta value of rbnMaliciousPktsCounter at the most recently completed measurement interval.
rbnSysSecNotifyObjects	1.3.6.1.4.1.2352.5.54.1.4
DAT rbnThresholdNotifyTime	1.3.6.1.4.1.2352.5.54.1.4.1	DateAndTime	accessible-for-notify	The DateAndTime of the notification.
rbnSysSecConformance	1.3.6.1.4.1.2352.5.54.2
rbnSysSecCompliances	1.3.6.1.4.1.2352.5.54.2.1
rbnSysSecCompliance	1.3.6.1.4.1.2352.5.54.2.1.1			The compliance statement for support of this mib module.
rbnSysSecGroups	1.3.6.1.4.1.2352.5.54.2.2
rbnMaliciousPktGroup	1.3.6.1.4.1.2352.5.54.2.2.1			Set of objects for the group.
rbnSysSecNotifyObjectsGroup	1.3.6.1.4.1.2352.5.54.2.2.4			Set of objects for the group.
rbnSysSecNotificationGroup	1.3.6.1.4.1.2352.5.54.2.2.5			Set of notifications for the group.

RFC description

Redback Networks system security MIB for monitoring security-related system events and notifications on Redback routers. Part of Redback Networks enterprise SNMP management framework for security monitoring.

Start monitoring Ericsson (Redback) SmartEdge BRAS/edge router (malicious-packet/security threshold alarms) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download RBN-SYS-SECURITY-MIB