All MIBs › RBN-SYS-SECURITY-MIB › rbnMaliciousPktsThresholdHi
rbnMaliciousPktsThresholdHi
Module: RBN-SYS-SECURITY-MIB
OID (symbolic): RBN-SYS-SECURITY-MIB::rbnMaliciousPktsThresholdHi
OID (numeric): 1.3.6.1.4.1.2352.5.54.1.1.3
Node type: OBJECT-TYPE
Type: RbnUnsigned64
Access: read-write
Description: When the current sampling interval delta value of the malicious packets counter is greater than or equal to this threshold, and the delta value at the last sampling interval was less than this threshold, a single high threshold exceeded event will be generated. A single high threshold exceeded event will also be generated if the first sampling interval delta value of the malicious IP packets counter is greater than or equal to this threshold.
After a high threshold exceeded event is generated, another such event will not be generated until the delta value falls below this threshold and reaches the rbnMaliciousPktsThresholdLow, generating a low threshold exceeded event. In other words there cannot be successive high threshold events without an intervening low threshold event.
What is rbnMaliciousPktsThresholdHi?
This object sets the high threshold, in packets, that the delta value of the malicious-packets counter must reach to trigger a single high-threshold-exceeded event, and no further high event fires until the delta first drops to rbnMaliciousPktsThresholdLow. An admin tunes this value to decide how much malicious traffic per rbnMeasurementInterval counts as an active attack worth alerting on. For example, setting this to 500 packets per interval would flag a sudden burst of spoofed traffic exceeding that rate.
Examples
Walk all instances (SNMPv2c):
snmpwalk -v2c -c public <target> 1.3.6.1.4.1.2352.5.54.1.1.3 snmpwalk -v2c -c public <target> RBN-SYS-SECURITY-MIB::rbnMaliciousPktsThresholdHi
Get a specific instance (index 1):
snmpget -v2c -c public <target> 1.3.6.1.4.1.2352.5.54.1.1.3.1 snmpget -v2c -c public <target> RBN-SYS-SECURITY-MIB::rbnMaliciousPktsThresholdHi.1
Set instance 1 (SNMPv2c):
snmpset -v2c -c private <target> 1.3.6.1.4.1.2352.5.54.1.1.3.1 i <value>
SNMPv3 example:
snmpget -v3 -l authPriv -u snmpv3-user -a SHA -A "AuthPassword1" -x AES -X "PrivPassword1" <target> rbnMaliciousPktsThresholdHi.1
Start monitoring Ericsson (Redback) SmartEdge BRAS/edge router (malicious-packet/security threshold alarms) with a free 30-day trial of IPNetwork Monitor. Create custom SNMP monitor using the RBN-SYS-SECURITY-MIB::rbnMaliciousPktsThresholdHi OID value, configure state conditions and alerts, and monitor any Ericsson (Redback) SmartEdge BRAS/edge router (malicious-packet/security threshold alarms) from a single console.
OID Breakdown
Upper-level ancestors (8 from the standard OID tree / other modules)
| Numeric OID | Name | Module |
|---|---|---|
| 1 | iso | LANART-AGENT |
| 1.3 | org | AirPair-MIB |
| 1.3.6 | dod | AirPair-MIB |
| 1.3.6.1 | internet | AirPair-MIB |
| 1.3.6.1.4 | private | AirPair-MIB |
| 1.3.6.1.4.1 | enterprises | AirPair-MIB |
| 1.3.6.1.4.1.2352 | redBackNetworks | RBN-SMI |
| 1.3.6.1.4.1.2352.5 | rbnModules | RBN-SMI |
| Numeric OID | Name | Module |
|---|---|---|
| 1.3.6.1.4.1.2352.5.54 | rbnSysSecurityMib | RBN-SYS-SECURITY-MIB |
| 1.3.6.1.4.1.2352.5.54.1 | rbnSysSecObjects | RBN-SYS-SECURITY-MIB |
| 1.3.6.1.4.1.2352.5.54.1.1 | rbnSysSecThresholdObjects | RBN-SYS-SECURITY-MIB |
| 1.3.6.1.4.1.2352.5.54.1.1.3 | rbnMaliciousPktsThresholdHi | RBN-SYS-SECURITY-MIB |