TPT-NPSTATS-MIB

All MIBs › TPT-NPSTATS-MIB

Organization: Trend Micro, Inc.

Last Updated: 2016-05-25

Category: Firewall and Intrusion Prevention, Network Monitoring and Statistics

Description: Monitors TippingPoint IPS network processor packet processing statistics and hardware performance counters.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is TPT-NPSTATS-MIB?

TPT-NPSTATS-MIB is a Trend Micro TippingPoint MIB exposing network processor (NP) hardware performance statistics on IPS appliances. It provides performance-counter data: per-rule inspection statistics (flow counts, success rates, percentage of total traffic) and per-tier throughput figures such as receive megabits per second. Its monitoring value is centered on hardware/software performance status of the inspection data path, letting administrators see how heavily specific filter rules or processing tiers are loaded and whether the network processor is keeping up with traffic. It relates to the broader TippingPoint TSE MIB (which covers filter/rule configuration) since these statistics are generated by the same inspection engine. It is deployed in high-throughput enterprise and carrier network security environments where NP-level performance needs to be monitored to detect inspection bottlenecks or overloaded rules. Engineers can download the TPT-NPSTATS-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in TPT-NPSTATS-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

TippingPoint (Trend Micro) IPS appliance

Monitoring Examples

An admin would poll npstatsRulesTable/npstatsRulesEntry (npstatsRulesRank, npstatsRulesFilter, npstatsRulesFlows, npstatsRulesSuccess, npstatsRulesTotalPercent) to identify which inspection rules are consuming the largest share of traffic or matching most frequently. The npstatsTiersTable's npstatsTiersReceiveMbps would be checked to see if a particular processing tier is approaching its throughput ceiling. A rule with unexpectedly high npstatsRulesTotalPercent combined with low npstatsRulesSuccessPer10K could indicate an inefficient or misconfigured filter consuming processor resources.

What Can Be Monitored

per-rule flow counts
per-rule match/success rate
percentage of total traffic per rule
per-tier receive throughput (Mbps)

Imported Objects

From SNMPv2-SMI

Counter64
Integer32
MODULE-IDENTITY
OBJECT-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DisplayString

From TPT-TPAMIBS-MIB

tpt-tpa-objs

How to Use in IPNetwork Monitor

Example using npstatsMiscTxPktsBestEffort OID:

Select a TippingPoint (Trend Micro) IPS appliance (network-processor rule/tier throughput status) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type npstatsMiscTxPktsBestEffort into the Find box to locate it in the OID tree, then select it and click OK. The number of packets transmitted due to best effort mode. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter64-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
npstatsMisc	1.3.6.1.4.1.10734.3.3.2.10.4			Miscellaneous network processor statistical information.
C64 npstatsMiscTxPktsBestEffortEx	1.3.6.1.4.1.10734.3.3.2.10.4.1	Counter64	read-only	The number of packets transmitted due to best effort mode.
npstatsRulesEntry	1.3.6.1.4.1.10734.3.3.2.10.1.1		not-accessible	An entry in the network processor statistics rules table. Rows cannot be created or deleted.
U32 npstatsRulesFilter	1.3.6.1.4.1.10734.3.3.2.10.1.1.2	Unsigned32	read-only	The filter number.
U32 npstatsRulesFlows	1.3.6.1.4.1.10734.3.3.2.10.1.1.3	Unsigned32	read-only	The number of flows that have triggered this filter.
U32 npstatsRulesRank	1.3.6.1.4.1.10734.3.3.2.10.1.1.1	Unsigned32	not-accessible	The numerical ranking in the network processor statistics rules table.
U32 npstatsRulesSuccess	1.3.6.1.4.1.10734.3.3.2.10.1.1.4	Unsigned32	read-only	The number of times this filter has been successfully matched.
U32 npstatsRulesSuccessPer10K	1.3.6.1.4.1.10734.3.3.2.10.1.1.6	Unsigned32	read-only	The number of matches for every 10000 flows triggered.
npstatsRulesTable	1.3.6.1.4.1.10734.3.3.2.10.1		not-accessible	Statistical information pertaining to network processor rules. Entries in the table are sorted in descending order of number of flows.
U32 npstatsRulesTotalPercent	1.3.6.1.4.1.10734.3.3.2.10.1.1.5	Unsigned32	read-only	The number of flows for this filter as a percentage of all flows.
npstatsSslInsp	1.3.6.1.4.1.10734.3.3.2.10.5			Sub-tree for all SSL inspection statistics.
C64 npstatsSslInspBlockedMaxConns	1.3.6.1.4.1.10734.3.3.2.10.5.3	Counter64	read-only	The number of blocked SSL sessions due to maximum connection limit.
STR npstatsSslInspConnectionRate	1.3.6.1.4.1.10734.3.3.2.10.5.2	DisplayString	read-only	The average SSL connection rate in connections per second. This value is not real-time and will lag approximately 2 minutes from actual due to the time interval for calculating the rate.
C64 npstatsSslInspCurrentSessions	1.3.6.1.4.1.10734.3.3.2.10.5.1	Counter64	read-only	The current number of active SSL sessions.
C64 npstatsSslInspPassedMaxConns	1.3.6.1.4.1.10734.3.3.2.10.5.4	Counter64	read-only	The number of passed (not inspected) SSL sessions due to maximum connection limit.
C64 npstatsSslInspTotalBytesIn	1.3.6.1.4.1.10734.3.3.2.10.5.5	Counter64	read-only	The number of inspected inbound SSL bytes.
C64 npstatsSslInspTotalBytesOut	1.3.6.1.4.1.10734.3.3.2.10.5.6	Counter64	read-only	The number of inspected outbound SSL bytes.
U32 npstatsStackBalance	1.3.6.1.4.1.10734.3.3.2.10.10.5	Unsigned32	read-only	The load balance percent accross all stack members
U32 npstatsStackMaxRxToSegmentTxMbps	1.3.6.1.4.1.10734.3.3.2.10.11.8	Unsigned32	read-only	Maximum return rate in Mbps for traffic coming in on the stacking ports and transmitted to the segment ports
U32 npstatsStackMaxRxToStackTxMbps	1.3.6.1.4.1.10734.3.3.2.10.11.6	Unsigned32	read-only	The maximum through traffic rate from segment ports to stacking ports
U32 npstatsStackMaxRxToTier1	1.3.6.1.4.1.10734.3.3.2.10.11.10	Unsigned32	read-only	Maximnum receive rate from stacking ports to tier one
OCT npstatsStackMemberHostname	1.3.6.1.4.1.10734.3.3.2.10.10.9.1.3	OCTET STRING	read-only	The stack member hostname
U32 npstatsStackMemberIndex	1.3.6.1.4.1.10734.3.3.2.10.10.9.1.1	Unsigned32	read-only	Stack member index
OCT npstatsStackMemberKey	1.3.6.1.4.1.10734.3.3.2.10.10.9.1.2	OCTET STRING	read-only	Unique stack member identifier.
U32 npstatsStackMemberMaxSegmentReceiveMbps	1.3.6.1.4.1.10734.3.3.2.10.10.9.1.5	Unsigned32	read-only	The maximum segment rx rate in Mbps for a stack member.
U32 npstatsStackMemberSegmentReceiveMbps	1.3.6.1.4.1.10734.3.3.2.10.10.9.1.4	Unsigned32	read-only	The current segment rx rate in Mbps for a stack member.
U32 npstatsStackMinBalance	1.3.6.1.4.1.10734.3.3.2.10.10.6	Unsigned32	read-only	The minimum, non-zero load balance percent accross all stack members
npstatsStackPorts	1.3.6.1.4.1.10734.3.3.2.10.11			Statistical information pertaining to stacking ports in a stack configuration.
U32 npstatsStackPortsMaxRecieveMbps	1.3.6.1.4.1.10734.3.3.2.10.11.2	Unsigned32	read-only	Maximum rx rate in Mbps from all stacking ports.
U32 npstatsStackPortsMaxTransmitMbps	1.3.6.1.4.1.10734.3.3.2.10.11.4	Unsigned32	read-only	Maximum tx rate in Mbps for all stacking ports.
U32 npstatsStackPortsRecieveMbps	1.3.6.1.4.1.10734.3.3.2.10.11.1	Unsigned32	read-only	Aggregate rx rate in Mbps from all stacking ports.
U32 npstatsStackPortsTransmitMbps	1.3.6.1.4.1.10734.3.3.2.10.11.3	Unsigned32	read-only	Aggregate tx rate in Mbps for all stacking ports.
U32 npstatsStackRxToSegmentTxMbps	1.3.6.1.4.1.10734.3.3.2.10.11.7	Unsigned32	read-only	Return rate in Mbps for traffic coming in on the stacking ports and transmitted to the segment ports
U32 npstatsStackRxToStackTxMbps	1.3.6.1.4.1.10734.3.3.2.10.11.5	Unsigned32	read-only	Aggregate through traffic rate from segment ports to stacking ports
U32 npstatsStackRxToTier1	1.3.6.1.4.1.10734.3.3.2.10.11.9	Unsigned32	read-only	Aggregate receive rate from stacking ports to tier one
U32 npstatsStackSegmentMaxRatioToTier1Per10K	1.3.6.1.4.1.10734.3.3.2.10.10.8	Unsigned32	read-only	The maximum ratio of this tier's throughput to tier 1 per 10K (percent * 100).
U32 npstatsStackSegmentMaxRecieveMbps	1.3.6.1.4.1.10734.3.3.2.10.10.2	Unsigned32	read-only	Maximum rx rate in Mbps from all customer facing segment ports.
U32 npstatsStackSegmentMaxTransmitMbps	1.3.6.1.4.1.10734.3.3.2.10.10.4	Unsigned32	read-only	Maximum tx rate in Mbps to all customer facing segment ports.
npstatsStackSegmentPortEntry	1.3.6.1.4.1.10734.3.3.2.10.10.9.1		not-accessible	An entry in the stacking port table.
npstatsStackSegmentPorts	1.3.6.1.4.1.10734.3.3.2.10.10			Statistical information pertaining to customer-facing segment ports for a stack configuration.
npstatsStackSegmentPortTable	1.3.6.1.4.1.10734.3.3.2.10.10.9		not-accessible	Statistical information related to customer-facing segment ports for each stack member
U32 npstatsStackSegmentRatioToTier1Per10K	1.3.6.1.4.1.10734.3.3.2.10.10.7	Unsigned32	read-only	The ratio of this tier's throughput to tier 1 per 10K (percent * 100).
U32 npstatsStackSegmentRecieveMbps	1.3.6.1.4.1.10734.3.3.2.10.10.1	Unsigned32	read-only	Aggregate rx rate in Mbps from all customer facing segment ports.
U32 npstatsStackSegmentTransmitMbps	1.3.6.1.4.1.10734.3.3.2.10.10.3	Unsigned32	read-only	Aggregate tx rate in Mbps to all customer facing segment ports.
U32 npstatsTier1Balance	1.3.6.1.4.1.10734.3.3.2.10.3.2	Unsigned32	read-only	The load balance among network processors (1000 = exactly balanced, 0 = all to one processor).
U32 npstatsTier1BypassMbps	1.3.6.1.4.1.10734.3.3.2.10.3.1	Unsigned32	read-only	The current bypass rate in Mbps.
U32 npstatsTier1BypassPktsPerSec	1.3.6.1.4.1.10734.3.3.2.10.3.15	Unsigned32	read-only	The inspection bypass rate in packets per second.
U32 npstatsTier1BypassToRxPktsPerSecRatio	1.3.6.1.4.1.10734.3.3.2.10.3.17	Unsigned32	read-only	The ratio of inspection bypass packets per second to Rx packets per second.
U32 npstatsTier1MaxBypassPktsPerSec	1.3.6.1.4.1.10734.3.3.2.10.3.16	Unsigned32	read-only	The maximum inspection bypass rate in packets per second.
U32 npstatsTier1MaxPatternMatchToRxPktsPerSecRatio	1.3.6.1.4.1.10734.3.3.2.10.3.22	Unsigned32	read-only	The maximum ratio of pattern match packets per second to Rx packets per second.
U32 npstatsTier1MaxPktsPerSecA	1.3.6.1.4.1.10734.3.3.2.10.3.3	Unsigned32	read-only	The maximum processor A receive rate in packets per second.
U32 npstatsTier1MaxPktsPerSecB	1.3.6.1.4.1.10734.3.3.2.10.3.4	Unsigned32	read-only	The maximum processor B receive rate in packets per second.
U32 npstatsTier1MaxPktsPerSecC	1.3.6.1.4.1.10734.3.3.2.10.3.10	Unsigned32	read-only	The maximum processor C receive rate in packets per second.
U32 npstatsTier1MaxTxPktsPerSec	1.3.6.1.4.1.10734.3.3.2.10.3.9	Unsigned32	read-only	The maximum transmit rate in packets per second.
U32 npstatsTier1MaxVlanTransPktsPerSec	1.3.6.1.4.1.10734.3.3.2.10.3.19	Unsigned32	read-only	The maximum VLAN translation rate in packets per second.
U32 npstatsTier1PatternMatchToRxPktsPerSecRatio	1.3.6.1.4.1.10734.3.3.2.10.3.21	Unsigned32	read-only	The ratio of pattern match packets per second to Rx packets per second.
U32 npstatsTier1TxPktsPerSec	1.3.6.1.4.1.10734.3.3.2.10.3.8	Unsigned32	read-only	The transmit rate in packets per second.
U32 npstatsTier1VlanTransPktsPerSec	1.3.6.1.4.1.10734.3.3.2.10.3.18	Unsigned32	read-only	The VLAN translation rate in packets per second.
U32 npstatsTier1VlanTransToRxPktsPerSecRatio	1.3.6.1.4.1.10734.3.3.2.10.3.20	Unsigned32	read-only	The ratio of VLAN translation packets per second to Rx packets per second.
U32 npstatsTier2MaxTxTrustedPktsPerSec	1.3.6.1.4.1.10734.3.3.2.10.3.23	Unsigned32	read-only	The maximum Tier 2 Trusted packets transmit rate in packets per second.
U32 npstatsTier2TxTrustedPktsPerSec	1.3.6.1.4.1.10734.3.3.2.10.3.12	Unsigned32	read-only	The Tier 2 Trusted packets transmit rate in packets per second.
U32 npstatsTier3MaxTxTrustedPktsPerSec	1.3.6.1.4.1.10734.3.3.2.10.3.24	Unsigned32	read-only	The maximum Tier 3 Trusted packets transmit rate in packets per second.
U32 npstatsTier3TxTrustedPktsPerSec	1.3.6.1.4.1.10734.3.3.2.10.3.13	Unsigned32	read-only	The Tier 3 Trusted packets transmit rate in packets per second.
U32 npstatsTier4MaxProtoDcdPer1000	1.3.6.1.4.1.10734.3.3.2.10.3.29	Unsigned32	read-only	Maximum proportion of reroute traffic inspected because of protocol decode (percent * 10).
U32 npstatsTier4MaxReroutePer1000	1.3.6.1.4.1.10734.3.3.2.10.3.27	Unsigned32	read-only	Maximum proportion of traffic inspected because of reroute (percent * 10).
U32 npstatsTier4MaxTcpSequencePer1000	1.3.6.1.4.1.10734.3.3.2.10.3.28	Unsigned32	read-only	Maximum proportion of traffic inspected because of TCP sequence (percent * 10).
U32 npstatsTier4MaxTriggerMatchPer1000	1.3.6.1.4.1.10734.3.3.2.10.3.26	Unsigned32	read-only	Maximum proportion of traffic inspected because of trigger match (percent * 10).
U32 npstatsTier4MaxTxTrustedPktsPerSec	1.3.6.1.4.1.10734.3.3.2.10.3.25	Unsigned32	read-only	The maximum Tier 4 Trusted packets transmit rate in packets per second.
U32 npstatsTier4ProtoDcdPer1000	1.3.6.1.4.1.10734.3.3.2.10.3.11	Unsigned32	read-only	Proportion of reroute traffic inspected because of protocol decode (percent * 10).
U32 npstatsTier4ReroutePer1000	1.3.6.1.4.1.10734.3.3.2.10.3.6	Unsigned32	read-only	Proportion of traffic inspected because of reroute (percent * 10).
U32 npstatsTier4TcpSequencePer1000	1.3.6.1.4.1.10734.3.3.2.10.3.7	Unsigned32	read-only	Proportion of traffic inspected because of TCP sequence (percent * 10).
U32 npstatsTier4TriggerMatchPer1000	1.3.6.1.4.1.10734.3.3.2.10.3.5	Unsigned32	read-only	Proportion of traffic inspected because of trigger match (percent * 10).
U32 npstatsTier4TxTrustedPktsPerSec	1.3.6.1.4.1.10734.3.3.2.10.3.14	Unsigned32	read-only	The Tier 4 Trusted packets transmit rate in packets per second.
U32 npstatsTierNumber	1.3.6.1.4.1.10734.3.3.2.10.2.1.1	Unsigned32	not-accessible	The network processor statistics tier number.
U32 npstatsTiersAvgBytesPerPkt	1.3.6.1.4.1.10734.3.3.2.10.2.1.6	Unsigned32	read-only	The average packet size in bytes.
npstatsTiersEntry	1.3.6.1.4.1.10734.3.3.2.10.2.1		not-accessible	An entry in the network processor statistics tiers table. Rows cannot be created or deleted.
npstatsTiersExtra	1.3.6.1.4.1.10734.3.3.2.10.3			Additional statistical information pertaining to network processor tiers.
U32 npstatsTiersMaxPktsPerSec	1.3.6.1.4.1.10734.3.3.2.10.2.1.5	Unsigned32	read-only	The maximum receive rate in packets per sec.
U32 npstatsTiersMaxRatioToNextPer10K	1.3.6.1.4.1.10734.3.3.2.10.2.1.12	Unsigned32	read-only	The maximum ratio of this tier's throughput to the next per 10K (percent * 100).
U32 npstatsTiersMaxReceiveMbps	1.3.6.1.4.1.10734.3.3.2.10.2.1.9	Unsigned32	read-only	The maximum receive rate in Mbps.
U32 npstatsTiersMaxTransmitMbps	1.3.6.1.4.1.10734.3.3.2.10.2.1.10	Unsigned32	read-only	The maximum transmit rate in Mbps.
I32 npstatsTiersMaxUtilizationPercent	1.3.6.1.4.1.10734.3.3.2.10.2.1.11	Integer32	read-only	The maximum percent utilization of this tier.
U32 npstatsTiersRatioToNextPer10K	1.3.6.1.4.1.10734.3.3.2.10.2.1.8	Unsigned32	read-only	The ratio of this tier's throughput to the next per 10K (percent * 100).
U32 npstatsTiersReceiveMbps	1.3.6.1.4.1.10734.3.3.2.10.2.1.2	Unsigned32	read-only	The current receive rate in Mbps.
U32 npstatsTiersRxPktsPerSec	1.3.6.1.4.1.10734.3.3.2.10.2.1.4	Unsigned32	read-only	The current receive rate in packets per sec.
npstatsTiersTable	1.3.6.1.4.1.10734.3.3.2.10.2		not-accessible	Statistical information pertaining to network processor tiers.
U32 npstatsTiersTransmitMbps	1.3.6.1.4.1.10734.3.3.2.10.2.1.3	Unsigned32	read-only	The current transmit rate in Mbps.
I32 npstatsTiersUtilizationPercent	1.3.6.1.4.1.10734.3.3.2.10.2.1.7	Integer32	read-only	The percent utilization of this tier.
tpt_npstats	1.3.6.1.4.1.10734.3.3.2.10			Network processor statistics. Copyright (C) 2016 Trend Micro Incorporated. All Rights Reserved. Trend Micro makes no warranty of any kind with regard to this material, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose. Trend Micro shall not be liable for errors contained herein or for incidental or consequential damages in connection with the furnishing, performance, or use of this material. This document contains proprietary information, which is protected by copyright. No part of this document may be photocopied, reproduced, or translated into another language without the prior written consent of Trend Micro. The information is provided 'as is' without warranty of any kind and is subject to change without notice. The only warranties for Trend Micro products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. Trend Micro shall not be liable for technical or editorial errors or omissions contained herein. TippingPoint(R), the TippingPoint logo, and Digital Vaccine(R) are registered trademarks of Trend Micro. All other company and product names may be trademarks of their respective holders. All rights reserved. This document contains confidential information, trade secrets or both, which are the property of Trend Micro. No part of this documentation may be reproduced in any form or by any means or used to make any derivative work (such as translation, transformation, or adaptation) without written permission from Trend Micro or one of its subsidiaries. All other company and product names may be trademarks of their respective holders.

RFC description

Topaz Platform Technologies network performance statistics MIB providing monitoring of network performance metrics and traffic statistics on TPT appliances (vendor product-specific).

Start monitoring TippingPoint (Trend Micro) IPS appliance (network-processor rule/tier throughput status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download TPT-NPSTATS-MIB