TPT-SFLOW-MIB

All MIBs › TPT-SFLOW-MIB

Organization: Trend Micro, Inc.

Last Updated: 2016-05-25

Category: Firewall and Intrusion Prevention

Description: Manages TippingPoint IPS sFlow traffic sampling configuration, collector addresses, and sampling rates.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is TPT-SFLOW-MIB?

TPT-SFLOW-MIB is a TippingPoint (Trend Micro) private MIB for the TippingPoint Intrusion Prevention System (IPS), managing sFlow traffic sampling configuration including collector addresses, UDP ports, and global sFlow status. It exposes a collector table defining one or more sFlow collector destinations (IPv4 and IPv6 addresses) and ports, plus a global sFlowStatus object to enable or disable sampling on the device. This MIB is used to monitor and confirm the software-level configuration of the device's traffic-sampling/export feature rather than exposing hardware sensors: verifying sFlowStatus is enabled and that collector entries point to the correct monitoring server confirms flow data is being exported for network visibility and security analytics. It depends conceptually on the sFlow protocol standard (maintained by the sFlow.org consortium) for the sampled-data format sent to collectors, though the MIB itself is TippingPoint-proprietary for configuration. It is deployed on TippingPoint IPS appliances in enterprise/service-provider security infrastructure where flow-based traffic visibility feeds into an sFlow analyzer, and administrators typically start with a TPT-SFLOW-MIB download to load into their MIB browser before configuring collectors.

IPNetwork Monitor allows you to monitor SNMP objects defined in TPT-SFLOW-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

TippingPoint (Trend Micro) Intrusion Prevention System appliance

Monitoring Examples

An administrator can check sFlowStatus to confirm sFlow sampling is enabled on the IPS, then walk sFlowCollectorTable/sFlowCollectorEntry to verify collectorAddr (or collectorAddrV6) and udpPort match the intended sFlow collector, such as a NetFlow/sFlow analytics server. If a configured collectorIndex entry is present but sFlowStatus is disabled or the address is wrong, the analytics platform would receive no flow data despite appearing configured, indicating a mismatch to fix.

What Can Be Monitored

global sFlow enable status
configured sFlow collector IPv4/IPv6 address
collector UDP port
number of configured collectors

Imported Objects

From SNMPv2-SMI

MODULE-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

TEXTUAL-CONVENTION

From TPT-TPAMIBS-MIB

tpt-tpa-objs

OIDs

OID symbolic	OID numeric	Type	Access	Description
tpt_sflow_objs	1.3.6.1.4.1.10734.3.3.2.18			Global sFlow status and collector address/udp port on the device. Copyright (C) 2016 Trend Micro Incorporated. All Rights Reserved. Trend Micro makes no warranty of any kind with regard to this material, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose. Trend Micro shall not be liable for errors contained herein or for incidental or consequential damages in connection with the furnishing, performance, or use of this material. This document contains proprietary information, which is protected by copyright. No part of this document may be photocopied, reproduced, or translated into another language without the prior written consent of Trend Micro. The information is provided 'as is' without warranty of any kind and is subject to change without notice. The only warranties for Trend Micro products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. Trend Micro shall not be liable for technical or editorial errors or omissions contained herein. TippingPoint(R), the TippingPoint logo, and Digital Vaccine(R) are registered trademarks of Trend Micro. All other company and product names may be trademarks of their respective holders. All rights reserved. This document contains confidential information, trade secrets or both, which are the property of Trend Micro. No part of this documentation may be reproduced in any form or by any means or used to make any derivative work (such as translation, transformation, or adaptation) without written permission from Trend Micro or one of its subsidiaries. All other company and product names may be trademarks of their respective holders.
sFlowCollectorTable	1.3.6.1.4.1.10734.3.3.2.18.1		not-accessible	Table of sFlow collectors. It supports up to 2 collectors.
sFlowCollectorEntry	1.3.6.1.4.1.10734.3.3.2.18.1.1		not-accessible	A collector address and port in the sFlowCollectorTable. Rows cannot be created or deleted.
U32 collectorIndex	1.3.6.1.4.1.10734.3.3.2.18.1.1.1	Unsigned32	not-accessible	Index into the sFlow collector table, starting with 1.
OCT collectorAddr	1.3.6.1.4.1.10734.3.3.2.18.1.1.2	OCTET STRING	read-only	The IPv4 address of the collector. If the address is not set, the value will be an empty string. It is not applicable on platforms (10/110/330). For those platforms, the value will be set to an empty string.
U32 udpPort	1.3.6.1.4.1.10734.3.3.2.18.1.1.3	Unsigned32	read-only	The udp port of the collector. It is not applicable on Lowball platforms (10/110/330). For those platforms, the value will be set to 0.
OCT collectorAddrV6	1.3.6.1.4.1.10734.3.3.2.18.1.1.4	OCTET STRING	read-only	The IPv6 address of the collector. If the address is not set, the value will be an empty string. It is not applicable on Lowball platforms (10/110/330). For those platforms, the value will be set to an empty string
SFL sFlowStatus	1.3.6.1.4.1.10734.3.3.2.18.2	SflowStatus	read-only	A Device-wide sFlow status.

RFC description

Trend Micro sFlow MIB monitoring global sFlow collector status and UDP port configuration on network devices.

Start monitoring TippingPoint (Trend Micro) Intrusion Prevention System appliance (global sFlow collector config status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download TPT-SFLOW-MIB

What Is TPT-SFLOW-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description