SAVI-MIB

All MIBs › SAVI-MIB

Organization: IETF SAVI Working Group

Last Updated: 2010-03-08

Category: IETF Standards MIBs, Security and Access Control

Description: Manages IETF SAVI source address validation binding table entries and enforcement state.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is SAVI-MIB?

SAVI-MIB is a vendor-neutral IETF standards-track module implementing management objects for Source Address Validation Improvement (SAVI), a mechanism that binds IP addresses to switch ports/MAC addresses to prevent address spoofing. It exposes configuration and status data organized around system-wide SAVI mode/settings and a per-interface table describing validation and trust status for each IP version. Its monitoring value is centered on security/configuration state rather than classic hardware health: an operator can check whether SAVI enforcement is active, in what mode, and whether individual interfaces are in a valid, trusted, or conflicted state, plus DAD (Duplicate Address Detection) delay tuning parameters. As an IETF MIB it depends on the general SNMPv2-SMI/TC framework and conceptually complements other anti-spoofing and neighbor-discovery standards it is meant to work alongside. It is typically deployed on enterprise or campus access-layer switches and routers that enforce IP source address validation to block spoofed traffic. Engineers implementing or auditing this functionality typically reference the SAVI-MIB RFC/standard documentation for the authoritative specification.

IPNetwork Monitor allows you to monitor SNMP objects defined in SAVI-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

vendor-neutral, standards-based IETF MIB, not tied to a specific manufacturer
switches/routers implementing SAVI source address validation

Monitoring Examples

An operator would poll saviObjectsIfTable/saviObjectsIfEntry using saviObjectsIfIfIndex to check saviObjectsIfValidationStatus and saviObjectsIfTrustStatus per interface, confirming that an access port is correctly validating bound source addresses; a status flip to an invalid/untrusted state signals a spoofing attempt or a misconfigured binding. saviObjectsSystemTable objects such as saviObjectsSystemMode and saviObjectsSystemMaxDadDelay let an admin confirm the validation mode and DAD timing are set as intended device-wide.

What Can Be Monitored

SAVI enforcement mode
per-interface validation status
per-interface trust status
max DAD delay settings
IP version validated (v4/v6)

Imported Objects

From IF-MIB

InterfaceIndex

From INET-ADDRESS-MIB

InetAddress
InetAddressType
InetVersion

From IP-MIB

ip	OBJECT-IDENTITY

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Counter32
MODULE-IDENTITY
OBJECT-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

MacAddress
RowStatus
TEXTUAL-CONVENTION
TimeInterval

OIDs

OID symbolic	OID numeric	Type	Access	Description
saviMIB	1.3.6.1.2.1.4.40			The MIB Module for managing SAVI implementations.
saviObjects	1.3.6.1.2.1.4.40.1
saviObjectsSystemTable	1.3.6.1.2.1.4.40.1.1		not-accessible	The table containing savi system-wide parameters.
saviObjectsSystemEntry	1.3.6.1.2.1.4.40.1.1.1		not-accessible	Each entry containing savi system-wide parameters for a particular IP version.
INE saviObjectsSystemIPVersion	1.3.6.1.2.1.4.40.1.1.1.1	InetVersion	not-accessible	The IP version
INT saviObjectsSystemMode	1.3.6.1.2.1.4.40.1.1.1.2	INTEGER	read-write	IP Address Assignment Methods.
NUM saviObjectsSystemMaxDadDelay	1.3.6.1.2.1.4.40.1.1.1.3	TimeInterval	read-write	A constant. When A gratuitous ARP Request or Duplicate Address Detection Neighbor Solicitation is received from anchor, the lifetime of the BST(Binding State Table) entry MUST be set to be MAX_ARP_DELAY or MAX_DAD_DELAY respectively.
NUM saviObjectsSystemMaxDadPrepareDelay	1.3.6.1.2.1.4.40.1.1.1.4	TimeInterval	read-write	A constant. When a DHCPv4 DHCPACK or DHCPv6 REPLY message is received, the lifetime of the BST(Binding State Table) entry MUST be set to be MAX_ARP_PREPARE_DELAY or MAX_DAD_PREPARE_DELAY respectively.
saviObjectsIfTable	1.3.6.1.2.1.4.40.1.2		not-accessible	The table containing SAVI running parameters of each anchor.
saviObjectsIfEntry	1.3.6.1.2.1.4.40.1.2.1		not-accessible	An entry containing SAVI running parameters of an anchor.
INE saviObjectsIfIPVersion	1.3.6.1.2.1.4.40.1.2.1.1	InetVersion	not-accessible	The IP version
NUM saviObjectsIfIfIndex	1.3.6.1.2.1.4.40.1.2.1.2	InterfaceIndex	not-accessible	The index value that uniquely identifies the interface to which this entry is applicable. The interface identified by a particular value of this index is the same interface as identified by the same value of the IF-MIB's ifIndex.
INT saviObjectsIfValidationStatus	1.3.6.1.2.1.4.40.1.2.1.3	INTEGER	read-write	The validation status of the interface. enable(1), check source address. disable(2), don't check source address.
INT saviObjectsIfTrustStatus	1.3.6.1.2.1.4.40.1.2.1.4	INTEGER	read-write	The trust status of the interface. no-trust(1), discard dhcp adv/reply and ra packet, dhcp-trust(2), permit dhcp adv/reply packet and discard ra packet, ra-trust(3), permit ra packet and discard dhcp adv/reply packet, dhcp-ra-trust(4), permit dhcp adv/reply and ra packet.
U32 saviObjectsIfFilteringNum	1.3.6.1.2.1.4.40.1.2.1.5	Unsigned32	read-write	The max filtering number of the Interface
saviObjectsBindingTable	1.3.6.1.2.1.4.40.1.3		not-accessible	The Binding State Table containing the state of binding between source address and anchor.
saviObjectsBindingEntry	1.3.6.1.2.1.4.40.1.3.1		not-accessible	An entry containing the state of binding between source address and anchor. Entries are keyed on the anchor, binding type, source IP address version, and source IP address.
IPt saviObjectsBindingIpAddressType	1.3.6.1.2.1.4.40.1.3.1.1	InetAddressType	not-accessible	IP address type of the binding source IP
INT saviObjectsBindingType	1.3.6.1.2.1.4.40.1.3.1.2	INTEGER	not-accessible	IP address assignment methods.
NUM saviObjectsBindingIfIndex	1.3.6.1.2.1.4.40.1.3.1.3	InterfaceIndex	not-accessible	The index value that uniquely identifies the interface to which this entry is applicable. The interface identified by a particular value of this index is the same interface as identified by the same value of the IF-MIB's ifIndex.
IP saviObjectsBindingIpAddress	1.3.6.1.2.1.4.40.1.3.1.4	InetAddress	not-accessible	The binding source IP address
MAC saviObjectsBindingMacAddr	1.3.6.1.2.1.4.40.1.3.1.5	MacAddress	read-create	The binding source mac address.
INT saviObjectsBindingState	1.3.6.1.2.1.4.40.1.3.1.6	INTEGER	read-create	The state of the binding entry.
NUM saviObjectsBindingLifetime	1.3.6.1.2.1.4.40.1.3.1.7	TimeInterval	read-create	The remaining lifetime of the entry. If saviObjectsBindingType=static, a value of 2147483647 represents infinity.
ROW saviObjectsBindingRowStatus	1.3.6.1.2.1.4.40.1.3.1.8	RowStatus	read-create	The status of this row, by which new entries may be created, or old entries deleted from this table. An Entry can be created or deleted only when saviObjectsBindingType=static.
saviObjectsFilteringTable	1.3.6.1.2.1.4.40.1.4		not-accessible	The Filtering Table is used to filter packets.
saviObjectsFilteringEntry	1.3.6.1.2.1.4.40.1.4.1		not-accessible	An entry containing the filtering parameters. Entries are keyed on the anchor.
IPt saviObjectsFilteringIpAddressType	1.3.6.1.2.1.4.40.1.4.1.1	InetAddressType	not-accessible	IP address type of the filtering source IP
NUM saviObjectsFilteringIfIndex	1.3.6.1.2.1.4.40.1.4.1.2	InterfaceIndex	not-accessible	The index value that uniquely identifies the interface to which this entry is applicable. The interface identified by a particular value of this index is the same interface as identified by the same value of the IF-MIB's ifIndex.
IP saviObjectsFilteringIpAddress	1.3.6.1.2.1.4.40.1.4.1.3	InetAddress	not-accessible	The filtering source IP address
MAC saviObjectsFilteringMacAddr	1.3.6.1.2.1.4.40.1.4.1.4	MacAddress	read-only	The filtering source mac address.
saviConformance	1.3.6.1.2.1.4.40.2
saviCompliances	1.3.6.1.2.1.4.40.2.1
saviCompliance	1.3.6.1.2.1.4.40.2.1.1			The compliance statement for entities which implement SAVI.
saviGroups	1.3.6.1.2.1.4.40.2.2
systemGroup	1.3.6.1.2.1.4.40.2.2.1			The system group of objects containing savi system parameter.
ifGroup	1.3.6.1.2.1.4.40.2.2.2			The if group of objects containing the savi running parameters of each anchor.
bindingGroup	1.3.6.1.2.1.4.40.2.2.3			The binding group of objects containing the binding information of anchor and soure ip address.
filteringGroup	1.3.6.1.2.1.4.40.2.2.4			The filtering group of objects containing the filtering information of anchor and soure ip address.

RFC description

Manages Source Address Validation Improvement (SAVI) implementations for IP address verification.

Start monitoring vendor-neutral, standards-based IETF MIB, switches/routers implementing SAVI source address validation with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download SAVI-MIB

What Is SAVI-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description