TELDAT-TRAP-SCFW-MIB

All MIBs › TELDAT-TRAP-SCFW-MIB

Organization: Teldat, S.A.

Last Updated: 2014-01-20

Category: IP Security and VPN, Teldat Router Management, Teldat Trap Notifications

Description: Defines Teldat router SCFW (stateful firewall) event trap notifications.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is TELDAT-TRAP-SCFW-MIB?

TELDAT-TRAP-SCFW-MIB is a vendor-specific MIB from Teldat defining SNMP trap notifications from the router's SCFW (stateful firewall) event subsystem. It is a notifications-only module exposing trap variable bindings such as TCP port, data length, center/remote IP addresses and ports, direction, event load, and serial/center address fields. Its monitoring purpose is software/security event visibility: it alerts a management station in real time about stateful firewall events, such as connections through specific TCP ports or traffic between a 'center' and remote endpoint, helping operators spot firewall rule triggers, unusual traffic direction, or load spikes as they happen. It depends on the stateful firewall (connection-tracking) feature implemented within Teldat router software rather than on other standard MIBs. It is typically deployed on Teldat routers at network edges or branch offices where a stateful firewall inspects and filters traffic, and the TELDAT-TRAP-SCFW-MIB download lets administrators load it directly into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in TELDAT-TRAP-SCFW-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Teldat enterprise/carrier routers

Monitoring Examples

A monitoring system would receive a trap carrying scfw1-tcp-port or scfw2-tcp-port to identify which port a firewall event concerns, and a trap with scfw3-data-leng, scfw3-cent-ip, and scfw3-cent-port to see how much data was involved and which center-side endpoint was affected. A trap containing scfw5-directon and scfw5-event-load would indicate the traffic direction and relative event load, useful for spotting an unusual spike of connections in one direction that might indicate a scan or attack.

Imported Objects

From SNMPv2-SMI

Integer32
IpAddress
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-IDENTITY
OBJECT-TYPE

From SNMPv2-TC

DisplayString

From TELDAT-MIB

telEventTraps

OBJECT-IDENTITY

OIDs

OID symbolic	OID numeric	Type	Access	Description
scfwTrapsMIB	1.3.6.1.4.1.2007.1.4.189			This Module Information Base file is defined for managing received SNMP notifications generated by the SCFW event subsystem.
scfwEventsGroup	1.3.6.1.4.1.2007.1.4.189.1
scfwEventObjects1	1.3.6.1.4.1.2007.1.4.189.1.1			Event SCFW.1 TCP listen for incoming RTU's connections has not been make.
I32 scfw1_tcp_port	1.3.6.1.4.1.2007.1.4.189.1.1.1	Integer32	accessible-for-notify	Parameter 'tcp-port' in event SCFW.1
scfwEventObjects2	1.3.6.1.4.1.2007.1.4.189.1.2			Event SCFW.2 TCP listen for incoming Control Centers connections has not been make.
I32 scfw2_tcp_port	1.3.6.1.4.1.2007.1.4.189.1.2.1	Integer32	accessible-for-notify	Parameter 'tcp-port' in event SCFW.2
scfwEventObjects3	1.3.6.1.4.1.2007.1.4.189.1.3			Event SCFW.3 A message with LRC/CRC error has been received from Control Center.
I32 scfw3_data_leng	1.3.6.1.4.1.2007.1.4.189.1.3.1	Integer32	accessible-for-notify	Parameter 'data-leng' in event SCFW.3
IP scfw3_cent_ip	1.3.6.1.4.1.2007.1.4.189.1.3.2	IpAddress	accessible-for-notify	Parameter 'cent-ip' in event SCFW.3
I32 scfw3_cent_port	1.3.6.1.4.1.2007.1.4.189.1.3.3	Integer32	accessible-for-notify	Parameter 'cent-port' in event SCFW.3
scfwEventObjects4	1.3.6.1.4.1.2007.1.4.189.1.4			Event SCFW.4 A message with LRC/CRC error has been received from RTU.
I32 scfw4_data_leng	1.3.6.1.4.1.2007.1.4.189.1.4.1	Integer32	accessible-for-notify	Parameter 'data-leng' in event SCFW.4
IP scfw4_rtu_ip	1.3.6.1.4.1.2007.1.4.189.1.4.2	IpAddress	accessible-for-notify	Parameter 'rtu-ip' in event SCFW.4
I32 scfw4_rtu_port	1.3.6.1.4.1.2007.1.4.189.1.4.3	Integer32	accessible-for-notify	Parameter 'rtu-port' in event SCFW.4
scfwEventObjects5	1.3.6.1.4.1.2007.1.4.189.1.5			Event SCFW.5 TCP session to direcction especified not found when an event occur.
STR scfw5_directon	1.3.6.1.4.1.2007.1.4.189.1.5.1	DisplayString	accessible-for-notify	Parameter 'directon' in event SCFW.5
I32 scfw5_event_load	1.3.6.1.4.1.2007.1.4.189.1.5.2	Integer32	accessible-for-notify	Parameter 'event-load' in event SCFW.5
scfwEventObjects6	1.3.6.1.4.1.2007.1.4.189.1.6			Event SCFW.6 Addres received from Control Center is not included in configuration registers list.
I32 scfw6_serial_address	1.3.6.1.4.1.2007.1.4.189.1.6.1	Integer32	accessible-for-notify	Parameter 'serial-address' in event SCFW.6
IP scfw6_center_addr	1.3.6.1.4.1.2007.1.4.189.1.6.2	IpAddress	accessible-for-notify	Parameter 'center-addr' in event SCFW.6
I32 scfw6_tcp_port	1.3.6.1.4.1.2007.1.4.189.1.6.3	Integer32	accessible-for-notify	Parameter 'tcp-port' in event SCFW.6
scfwEventObjects7	1.3.6.1.4.1.2007.1.4.189.1.7			Event SCFW.7 It's trying the connection against remote IP and P port.
I32 scfw7_serial_address	1.3.6.1.4.1.2007.1.4.189.1.7.1	Integer32	accessible-for-notify	Parameter 'serial-address' in event SCFW.7
IP scfw7_rtu_ip_address	1.3.6.1.4.1.2007.1.4.189.1.7.2	IpAddress	accessible-for-notify	Parameter 'rtu-ip-address' in event SCFW.7
I32 scfw7_port	1.3.6.1.4.1.2007.1.4.189.1.7.3	Integer32	accessible-for-notify	Parameter 'port' in event SCFW.7
scfwEventObjects8	1.3.6.1.4.1.2007.1.4.189.1.8			Event SCFW.8 Trying to send message to a RTU.
I32 scfw8_bytes	1.3.6.1.4.1.2007.1.4.189.1.8.1	Integer32	accessible-for-notify	Parameter 'bytes' in event SCFW.8
IP scfw8_rem_ip_addr	1.3.6.1.4.1.2007.1.4.189.1.8.2	IpAddress	accessible-for-notify	Parameter 'rem-ip-addr' in event SCFW.8
I32 scfw8_rem_tcp_port	1.3.6.1.4.1.2007.1.4.189.1.8.3	Integer32	accessible-for-notify	Parameter 'rem-tcp-port' in event SCFW.8
scfwEventObjects9	1.3.6.1.4.1.2007.1.4.189.1.9			Event SCFW.9 Trying to send message to Remote end.
I32 scfw9_bytes	1.3.6.1.4.1.2007.1.4.189.1.9.1	Integer32	accessible-for-notify	Parameter 'bytes' in event SCFW.9
IP scfw9_rem_ip_addr	1.3.6.1.4.1.2007.1.4.189.1.9.2	IpAddress	accessible-for-notify	Parameter 'rem-ip-addr' in event SCFW.9
I32 scfw9_rem_tcp_port	1.3.6.1.4.1.2007.1.4.189.1.9.3	Integer32	accessible-for-notify	Parameter 'rem-tcp-port' in event SCFW.9
scfwEventObjects10	1.3.6.1.4.1.2007.1.4.189.1.10			Event SCFW.10 A TCP Packet has been received from Control Center.
STR scfw10_message_type	1.3.6.1.4.1.2007.1.4.189.1.10.1	DisplayString	accessible-for-notify	Parameter 'message-type' in event SCFW.10
I32 scfw10_bytes	1.3.6.1.4.1.2007.1.4.189.1.10.2	Integer32	accessible-for-notify	Parameter 'bytes' in event SCFW.10
IP scfw10_foreign_host	1.3.6.1.4.1.2007.1.4.189.1.10.3	IpAddress	accessible-for-notify	Parameter 'foreign-host' in event SCFW.10
I32 scfw10_remote_port	1.3.6.1.4.1.2007.1.4.189.1.10.4	Integer32	accessible-for-notify	Parameter 'remote-port' in event SCFW.10
scfwEventObjects11	1.3.6.1.4.1.2007.1.4.189.1.11			Event SCFW.11 A TCP Packet has been received from RTU.
STR scfw11_message_type	1.3.6.1.4.1.2007.1.4.189.1.11.1	DisplayString	accessible-for-notify	Parameter 'message-type' in event SCFW.11
I32 scfw11_bytes	1.3.6.1.4.1.2007.1.4.189.1.11.2	Integer32	accessible-for-notify	Parameter 'bytes' in event SCFW.11
IP scfw11_foreign_host	1.3.6.1.4.1.2007.1.4.189.1.11.3	IpAddress	accessible-for-notify	Parameter 'foreign-host' in event SCFW.11
I32 scfw11_remote_port	1.3.6.1.4.1.2007.1.4.189.1.11.4	Integer32	accessible-for-notify	Parameter 'remote-port' in event SCFW.11
scfwEventObjects12	1.3.6.1.4.1.2007.1.4.189.1.12			Event SCFW.12 A TCP Packet has been received from RTU.
STR scfw12_message_type	1.3.6.1.4.1.2007.1.4.189.1.12.1	DisplayString	accessible-for-notify	Parameter 'message-type' in event SCFW.12
I32 scfw12_bytes	1.3.6.1.4.1.2007.1.4.189.1.12.2	Integer32	accessible-for-notify	Parameter 'bytes' in event SCFW.12
IP scfw12_foreign_host	1.3.6.1.4.1.2007.1.4.189.1.12.3	IpAddress	accessible-for-notify	Parameter 'foreign-host' in event SCFW.12
I32 scfw12_remote_port	1.3.6.1.4.1.2007.1.4.189.1.12.4	Integer32	accessible-for-notify	Parameter 'remote-port' in event SCFW.12
scfwEventObjects13	1.3.6.1.4.1.2007.1.4.189.1.13			Event SCFW.13 The TCP session to RTU/Control Center has been closed.
STR scfw13_type_host	1.3.6.1.4.1.2007.1.4.189.1.13.1	DisplayString	accessible-for-notify	Parameter 'type-host' in event SCFW.13
IP scfw13_foreign_host	1.3.6.1.4.1.2007.1.4.189.1.13.2	IpAddress	accessible-for-notify	Parameter 'foreign-host' in event SCFW.13
I32 scfw13_remote_port	1.3.6.1.4.1.2007.1.4.189.1.13.3	Integer32	accessible-for-notify	Parameter 'remote-port' in event SCFW.13
scfwEventObjects14	1.3.6.1.4.1.2007.1.4.189.1.14			Event SCFW.14 The TCP session has been closed by the Remote end.
IP scfw14_foreign_host	1.3.6.1.4.1.2007.1.4.189.1.14.1	IpAddress	accessible-for-notify	Parameter 'foreign-host' in event SCFW.14
I32 scfw14_remote_port	1.3.6.1.4.1.2007.1.4.189.1.14.2	Integer32	accessible-for-notify	Parameter 'remote-port' in event SCFW.14
scfwEventObjects15	1.3.6.1.4.1.2007.1.4.189.1.15			Event SCFW.15 The TCP session to RTU/Ctrl. Center has been opened.
STR scfw15_type_host	1.3.6.1.4.1.2007.1.4.189.1.15.1	DisplayString	accessible-for-notify	Parameter 'type-host' in event SCFW.15
IP scfw15_remote_ip	1.3.6.1.4.1.2007.1.4.189.1.15.2	IpAddress	accessible-for-notify	Parameter 'remote-ip' in event SCFW.15
I32 scfw15_remote_port	1.3.6.1.4.1.2007.1.4.189.1.15.3	Integer32	accessible-for-notify	Parameter 'remote-port' in event SCFW.15
scfwEventObjects16	1.3.6.1.4.1.2007.1.4.189.1.16			Event SCFW.16 A packet was lost, due TCP Tx overrun error.
STR scfw16_type_host	1.3.6.1.4.1.2007.1.4.189.1.16.1	DisplayString	accessible-for-notify	Parameter 'type-host' in event SCFW.16
IP scfw16_rem_ip	1.3.6.1.4.1.2007.1.4.189.1.16.2	IpAddress	accessible-for-notify	Parameter 'rem-ip' in event SCFW.16
I32 scfw16_remp_tcp_port	1.3.6.1.4.1.2007.1.4.189.1.16.3	Integer32	accessible-for-notify	Parameter 'remp-tcp-port' in event SCFW.16
scfwEventObjects17	1.3.6.1.4.1.2007.1.4.189.1.17			Event SCFW.17 TCP generic event was occurred.
STR scfw17_event	1.3.6.1.4.1.2007.1.4.189.1.17.1	DisplayString	accessible-for-notify	Parameter 'event' in event SCFW.17
IP scfw17_ip	1.3.6.1.4.1.2007.1.4.189.1.17.2	IpAddress	accessible-for-notify	Parameter 'ip' in event SCFW.17
I32 scfw17_port	1.3.6.1.4.1.2007.1.4.189.1.17.3	Integer32	accessible-for-notify	Parameter 'port' in event SCFW.17
scfwEventObjects18	1.3.6.1.4.1.2007.1.4.189.1.18			Event SCFW.18 TCP Listen to Control Center has been closed, due max session number has been reached.
I32 scfw18_port	1.3.6.1.4.1.2007.1.4.189.1.18.1	Integer32	accessible-for-notify	Parameter 'port' in event SCFW.18
scfwEventObjects19	1.3.6.1.4.1.2007.1.4.189.1.19			Event SCFW.19 TCP Listen to RTUs has been closed, due max session number has been reached.
I32 scfw19_port	1.3.6.1.4.1.2007.1.4.189.1.19.1	Integer32	accessible-for-notify	Parameter 'port' in event SCFW.19
scfwEventObjects20	1.3.6.1.4.1.2007.1.4.189.1.20			Event SCFW.20 An input TCP session has been rejet.
STR scfw20_event	1.3.6.1.4.1.2007.1.4.189.1.20.1	DisplayString	accessible-for-notify	Parameter 'event' in event SCFW.20
IP scfw20_ip	1.3.6.1.4.1.2007.1.4.189.1.20.2	IpAddress	accessible-for-notify	Parameter 'ip' in event SCFW.20
I32 scfw20_port	1.3.6.1.4.1.2007.1.4.189.1.20.3	Integer32	accessible-for-notify	Parameter 'port' in event SCFW.20
scfwNotifications	1.3.6.1.4.1.2007.1.4.189.2
scfwNotificationsPrefix	1.3.6.1.4.1.2007.1.4.189.2.0
NTF scfwNotification1	1.3.6.1.4.1.2007.1.4.189.2.0.1			Notification of Event SCFW.1 Message: 'Can't open TCP listen for RTU's connections. Port $1' Parameters list: $1: scfw1-tcp-port TCP listen for incoming RTU's connections has not been make.
NTF scfwNotification2	1.3.6.1.4.1.2007.1.4.189.2.0.2			Notification of Event SCFW.2 Message: 'Can't make TCP listen for Control Centers connections. Port $1' Parameters list: $1: scfw2-tcp-port TCP listen for incoming Control Centers connections has not been make.
NTF scfwNotification3	1.3.6.1.4.1.2007.1.4.189.2.0.3			Notification of Event SCFW.3 Message: 'A block with LRC/CRC error has been received from Control Center. Data length:$1, IP Address:$2, Port: $3' Parameters list: $1: scfw3-data-leng $2: scfw3-cent-ip $3: scfw3-cent-port A message with LRC/CRC error has been received from Control Center.
NTF scfwNotification4	1.3.6.1.4.1.2007.1.4.189.2.0.4			Notification of Event SCFW.4 Message: 'A block with LRC/CRC error has been received from RTU, Data length:$1, IP Address:$2, Port: $3' Parameters list: $1: scfw4-data-leng $2: scfw4-rtu-ip $3: scfw4-rtu-port A message with LRC/CRC error has been received from RTU.
NTF scfwNotification5	1.3.6.1.4.1.2007.1.4.189.2.0.5			Notification of Event SCFW.5 Message: 'TCP session to $1 not found for eve.:$2' Parameters list: $1: scfw5-directon $2: scfw5-event-load TCP session to direcction especified not found when an event occur.
NTF scfwNotification6	1.3.6.1.4.1.2007.1.4.189.2.0.6			Notification of Event SCFW.6 Message: 'Address $1 received from Serial Terminal is not included in config. regiters. Ctrl Center IP address: $2, port: $3' Parameters list: $1: scfw6-serial-address $2: scfw6-center-addr $3: scfw6-tcp-port Addres received from Control Center is not included in configuration registers list.
NTF scfwNotification7	1.3.6.1.4.1.2007.1.4.189.2.0.7			Notification of Event SCFW.7 Message: 'Address $1 is trying the connection against IP $2, Port $3' Parameters list: $1: scfw7-serial-address $2: scfw7-rtu-ip-address $3: scfw7-port It's trying the connection against remote IP and P port.
NTF scfwNotification8	1.3.6.1.4.1.2007.1.4.189.2.0.8			Notification of Event SCFW.8 Message: 'Trying to send a message to RTU with $1 bytes. IP $2, Port $3' Parameters list: $1: scfw8-bytes $2: scfw8-rem-ip-addr $3: scfw8-rem-tcp-port Trying to send message to a RTU.
NTF scfwNotification9	1.3.6.1.4.1.2007.1.4.189.2.0.9			Notification of Event SCFW.9 Message: 'Trying to send a message to Control Center with $1 bytes. IP $2, Port $3' Parameters list: $1: scfw9-bytes $2: scfw9-rem-ip-addr $3: scfw9-rem-tcp-port Trying to send message to Remote end.
NTF scfwNotification10	1.3.6.1.4.1.2007.1.4.189.2.0.10			Notification of Event SCFW.10 Message: 'A TCP packet $1 has been received from Cntrl. Center, $2 bytes. rem. IP: $3, Port: $4' Parameters list: $1: scfw10-message-type $2: scfw10-bytes $3: scfw10-foreign-host $4: scfw10-remote-port A TCP Packet has been received from Control Center.
NTF scfwNotification11	1.3.6.1.4.1.2007.1.4.189.2.0.11			Notification of Event SCFW.11 Message: 'A TCP packet $1 has been received from RTU, $2 bytes. rem. IP: $3, Port: $4' Parameters list: $1: scfw11-message-type $2: scfw11-bytes $3: scfw11-foreign-host $4: scfw11-remote-port A TCP Packet has been received from RTU.
NTF scfwNotification12	1.3.6.1.4.1.2007.1.4.189.2.0.12			Notification of Event SCFW.12 Message: 'A TCP packet $1 has been received from RTU, $2 bytes. rem. IP: $3, Port: $4' Parameters list: $1: scfw12-message-type $2: scfw12-bytes $3: scfw12-foreign-host $4: scfw12-remote-port A TCP Packet has been received from RTU.
NTF scfwNotification13	1.3.6.1.4.1.2007.1.4.189.2.0.13			Notification of Event SCFW.13 Message: 'The TCP session to $1 has been closed. rem. IP: $2, Port: $3' Parameters list: $1: scfw13-type-host $2: scfw13-foreign-host $3: scfw13-remote-port The TCP session to RTU/Control Center has been closed.
NTF scfwNotification14	1.3.6.1.4.1.2007.1.4.189.2.0.14			Notification of Event SCFW.14 Message: 'The TCP session has been closed by the Remote end. rem. IP: $1, Port: $2' Parameters list: $1: scfw14-foreign-host $2: scfw14-remote-port The TCP session has been closed by the Remote end.
NTF scfwNotification15	1.3.6.1.4.1.2007.1.4.189.2.0.15			Notification of Event SCFW.15 Message: 'The TCP session has been opened to $1. Remote IP:$2 , Port: $3' Parameters list: $1: scfw15-type-host $2: scfw15-remote-ip $3: scfw15-remote-port The TCP session to RTU/Ctrl. Center has been opened.
NTF scfwNotification16	1.3.6.1.4.1.2007.1.4.189.2.0.16			Notification of Event SCFW.16 Message: 'Packet lost due TCP Tx overrun error to $1: rem. IP $2, Port $3' Parameters list: $1: scfw16-type-host $2: scfw16-rem-ip $3: scfw16-remp-tcp-port A packet was lost, due TCP Tx overrun error.
NTF scfwNotification17	1.3.6.1.4.1.2007.1.4.189.2.0.17			Notification of Event SCFW.17 Message: 'The TCP event: $1 . Rem. IP: $2, Port: $3' Parameters list: $1: scfw17-event $2: scfw17-ip $3: scfw17-port TCP generic event was occurred.
NTF scfwNotification18	1.3.6.1.4.1.2007.1.4.189.2.0.18			Notification of Event SCFW.18 Message: 'Max sessions number has been reached to Control Centers, port $1' Parameters list: $1: scfw18-port TCP Listen to Control Center has been closed, due max session number has been reached.
NTF scfwNotification19	1.3.6.1.4.1.2007.1.4.189.2.0.19			Notification of Event SCFW.19 Message: 'Max sessions number has been reached to RTUs, port $1' Parameters list: $1: scfw19-port TCP Listen to RTUs has been closed, due max session number has been reached.
NTF scfwNotification20	1.3.6.1.4.1.2007.1.4.189.2.0.20			Notification of Event SCFW.20 Message: 'TCP inout session rejet: $1 . Rem. IP: $2, Port: $3' Parameters list: $1: scfw20-event $2: scfw20-ip $3: scfw20-port An input TCP session has been rejet.

RFC description

Manages SNMP notifications from SCFW event subsystem including TCP connection and message errors.

Start monitoring Teldat enterprise/carrier routers (stateful firewall connection event traps) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download TELDAT-TRAP-SCFW-MIB

What Is TELDAT-TRAP-SCFW-MIB?

Supported Devices

Monitoring Examples

This MIB depends on

Related MIBs

RFC description