idsSmurf
Module: TOS-IDS
OID (symbolic): TOS-IDS::idsSmurf
OID (numeric): 1.3.6.1.4.1.14331.5.5.1.11.8
Node type: OBJECT-TYPE
Type: Counter32
Access: read-only
Description: smurf.
What is idsSmurf?
This counter tracks the total number of Smurf attacks the Topsec IDS has detected, a denial-of-service technique that spoofs a victim's source address in broadcast ICMP echo requests to flood the victim with replies. An admin monitors this counter to detect if the network is being used as, or targeted by, a Smurf amplification attack. For example, a spike in idsSmurf detections would prompt the admin to check for spoofed broadcast ICMP traffic traversing the network.
Examples
Walk all instances (SNMPv2c):
snmpwalk -v2c -c public <target> 1.3.6.1.4.1.14331.5.5.1.11.8 snmpwalk -v2c -c public <target> TOS-IDS::idsSmurf
Get a specific instance (index 1):
snmpget -v2c -c public <target> 1.3.6.1.4.1.14331.5.5.1.11.8.1 snmpget -v2c -c public <target> TOS-IDS::idsSmurf.1
Start monitoring TOPSEC firewall/UTM appliance (IDS rule/alert-threshold status) with a free 30-day trial of IPNetwork Monitor. Create custom SNMP monitor using the TOS-IDS::idsSmurf OID value, configure state conditions and alerts, and monitor any TOPSEC firewall/UTM appliance (IDS rule/alert-threshold status) from a single console.
OID Breakdown
Upper-level ancestors (10 from the standard OID tree / other modules)
| Numeric OID | Name | Module |
|---|---|---|
| 1 | iso | LANART-AGENT |
| 1.3 | org | AirPair-MIB |
| 1.3.6 | dod | AirPair-MIB |
| 1.3.6.1 | internet | AirPair-MIB |
| 1.3.6.1.4 | private | AirPair-MIB |
| 1.3.6.1.4.1 | enterprises | AirPair-MIB |
| 1.3.6.1.4.1.14331 | topsec | TOS-SMI |
| 1.3.6.1.4.1.14331.5 | topsecMgmt | TOS-SMI |
| 1.3.6.1.4.1.14331.5.5 | objects | TOS-SMI |
| 1.3.6.1.4.1.14331.5.5.1 | tosMib | TOS-SMI |
| Numeric OID | Name | Module |
|---|---|---|
| 1.3.6.1.4.1.14331.5.5.1.11 | tosIDS | TOS-IDS |
| 1.3.6.1.4.1.14331.5.5.1.11.8 | idsSmurf | TOS-IDS |