TPT-TRAFFIC-MIB

All MIBs › TPT-TRAFFIC-MIB

Organization: Trend Micro, Inc.

Last Updated: 2016-05-25

Category: Firewall and Intrusion Prevention, Network Monitoring and Statistics

Description: Monitors TippingPoint IPS inspected traffic statistics including packet counts and throughput by segment.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is TPT-TRAFFIC-MIB?

TPT-TRAFFIC-MIB is a Trend Micro TippingPoint MIB for monitoring inspected traffic performance on IPS appliances, focused on configured rate limiters and their real-time and historical statistics. It exposes per-rate-limiter tables covering requested versus actual rate, and packet sent/dropped/queued counters, plus historical rollups at second, minute, and hour granularity. Its monitoring emphasis is performance/software status: comparing rateLimitActualRate to rateLimitRequestedRate confirms whether a rate-limiting policy is being enforced as configured, while rising rateLimitPacketsDropped or rateLimitPacketsQueued counters reveal congestion, possibly from an attack or a misconfigured limit, causing the appliance to shape or drop traffic. It complements TPT-HEALTH-MIB (hardware) and standard interface counters (IF-MIB) by providing IPS-specific traffic-shaping visibility. It's deployed on TippingPoint IPS appliances inspecting inline traffic, where TPT-TRAFFIC-MIB SNMP monitoring is operationally important for detecting a DoS condition or a rate-limit misconfiguration causing legitimate drops.

IPNetwork Monitor allows you to monitor SNMP objects defined in TPT-TRAFFIC-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

TippingPoint (Trend Micro) IPS appliances

Monitoring Examples

An administrator polls rateLimitTable, indexed by rateLimitGlobalID, comparing rateLimitRequestedRate to rateLimitActualRate to confirm the configured limit is being honored on a given segment. A rising rateLimitPacketsDropped or rateLimitPacketsQueued counter signals the device is actively shaping or dropping excess traffic, possibly during a DoS event. rateLimitHistSecondsTable is pulled for short-interval historical samples to graph the trend leading up to the anomaly.

What Can Be Monitored

requested vs actual rate-limit throughput
packets sent/dropped/queued per rate limiter
historical rate-limit statistics (seconds/minutes/hours)
per-segment traffic rate limiter identity

Imported Objects

From IF-MIB

InterfaceIndex

From SNMPv2-SMI

Counter64
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

TEXTUAL-CONVENTION

From TPT-TPAMIBS-MIB

tpt-tpa-eventsV2
tpt-tpa-objs
tpt-tpa-unkparams

How to Use in IPNetwork Monitor

Example using rateLimitPacketsSent OID:

Select a TippingPoint IPS appliance as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type rateLimitPacketsSent into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. The number of packets sent via this rate limiter since last cleared. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter64-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
tpt_traffic	1.3.6.1.4.1.10734.3.3.2.8			Traffic management (rate limiters and traffic thresholds). Copyright (C) 2016 Trend Micro Incorporated. All Rights Reserved. Trend Micro makes no warranty of any kind with regard to this material, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose. Trend Micro shall not be liable for errors contained herein or for incidental or consequential damages in connection with the furnishing, performance, or use of this material. This document contains proprietary information, which is protected by copyright. No part of this document may be photocopied, reproduced, or translated into another language without the prior written consent of Trend Micro. The information is provided 'as is' without warranty of any kind and is subject to change without notice. The only warranties for Trend Micro products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. Trend Micro shall not be liable for technical or editorial errors or omissions contained herein. TippingPoint(R), the TippingPoint logo, and Digital Vaccine(R) are registered trademarks of Trend Micro. All other company and product names may be trademarks of their respective holders. All rights reserved. This document contains confidential information, trade secrets or both, which are the property of Trend Micro. No part of this documentation may be reproduced in any form or by any means or used to make any derivative work (such as translation, transformation, or adaptation) without written permission from Trend Micro or one of its subsidiaries. All other company and product names may be trademarks of their respective holders.
rateLimitTable	1.3.6.1.4.1.10734.3.3.2.8.1		not-accessible	High-level (non-sampled) data about an action set with a rate limit.
rateLimitEntry	1.3.6.1.4.1.10734.3.3.2.8.1.1		not-accessible	An entry in the rate limit list. Rows cannot be created or deleted.
OCT rateLimitGlobalID	1.3.6.1.4.1.10734.3.3.2.8.1.1.1	OCTET STRING	not-accessible	The global identifier of an action set with a rate limit.
U32 rateLimitRequestedRate	1.3.6.1.4.1.10734.3.3.2.8.1.1.2	Unsigned32	read-only	The bit rate (in Kbps) set requested by the action set creator.
U32 rateLimitActualRate	1.3.6.1.4.1.10734.3.3.2.8.1.1.3	Unsigned32	read-only	The bit rate (in Kbps) set up at the hardware level.
C64 rateLimitPacketsSentEx	1.3.6.1.4.1.10734.3.3.2.8.1.1.4	Counter64	read-only	The number of packets sent via this rate limiter since last cleared.
C64 rateLimitPacketsDropped	1.3.6.1.4.1.10734.3.3.2.8.1.1.5	Counter64	read-only	The number of packets dropped by this rate limiter since last cleared.
C64 rateLimitPacketsQueued	1.3.6.1.4.1.10734.3.3.2.8.1.1.6	Counter64	read-only	The number of packets queued up to be sent via this rate limiter.
U32 rateLimitHistNumSeconds	1.3.6.1.4.1.10734.3.3.2.8.1.1.7	Unsigned32	read-only	The number of seconds of valid historical (sampled) data available.
U32 rateLimitHistNumMinutes	1.3.6.1.4.1.10734.3.3.2.8.1.1.8	Unsigned32	read-only	The number of minutes of valid historical (sampled) data available.
U32 rateLimitHistNumHours	1.3.6.1.4.1.10734.3.3.2.8.1.1.9	Unsigned32	read-only	The number of hours of valid historical (sampled) data available.
rateLimitHistSecondsTable	1.3.6.1.4.1.10734.3.3.2.8.2		not-accessible	Historical (sampled) data every second for a minute.
rateLimitHistSecondsEntry	1.3.6.1.4.1.10734.3.3.2.8.2.1		not-accessible	An entry in the rate limit history seconds table. Rows cannot be created or deleted.
OCT rateLimitHistSecondsGlobalID	1.3.6.1.4.1.10734.3.3.2.8.2.1.1	OCTET STRING	not-accessible	The global identifier of an action set with a rate limit.
U32 rateLimitHistSecondsIndex	1.3.6.1.4.1.10734.3.3.2.8.2.1.2	Unsigned32	not-accessible	The index (0-59) of the second.
C64 rateLimitHistSecondsBytesSent	1.3.6.1.4.1.10734.3.3.2.8.2.1.3	Counter64	read-only	The number of bytes sent via this rate limiter in the specified second.
U32 rateLimitHistSecondsTimestamp	1.3.6.1.4.1.10734.3.3.2.8.2.1.4	Unsigned32	read-only	The time SecondsBytesSent was updated (in seconds since January 1, 1970).
rateLimitHistMinutesTable	1.3.6.1.4.1.10734.3.3.2.8.3		not-accessible	Historical (sampled) data every minute for an hour.
rateLimitHistMinutesEntry	1.3.6.1.4.1.10734.3.3.2.8.3.1		not-accessible	An entry in the rate limit history minutes table. Rows cannot be created or deleted.
OCT rateLimitHistMinutesGlobalID	1.3.6.1.4.1.10734.3.3.2.8.3.1.1	OCTET STRING	not-accessible	The global identifier of an action set with a rate limit.
U32 rateLimitHistMinutesIndex	1.3.6.1.4.1.10734.3.3.2.8.3.1.2	Unsigned32	not-accessible	The index (0-59) of the minute.
C64 rateLimitHistMinutesBytesSent	1.3.6.1.4.1.10734.3.3.2.8.3.1.3	Counter64	read-only	The number of bytes sent via this rate limiter in the specified minute.
U32 rateLimitHistMinutesTimestamp	1.3.6.1.4.1.10734.3.3.2.8.3.1.4	Unsigned32	read-only	The time MinutesBytesSent was updated (in seconds since January 1, 1970).
rateLimitHistHoursTable	1.3.6.1.4.1.10734.3.3.2.8.4		not-accessible	Historical (sampled) data every hour for a day.
rateLimitHistHoursEntry	1.3.6.1.4.1.10734.3.3.2.8.4.1		not-accessible	An entry in the rate limit history hours table. Rows cannot be created or deleted.
OCT rateLimitHistHoursGlobalID	1.3.6.1.4.1.10734.3.3.2.8.4.1.1	OCTET STRING	not-accessible	The global identifier of an action set with a rate limit.
U32 rateLimitHistHoursIndex	1.3.6.1.4.1.10734.3.3.2.8.4.1.2	Unsigned32	not-accessible	The index (0-23) of the hour.
C64 rateLimitHistHoursBytesSent	1.3.6.1.4.1.10734.3.3.2.8.4.1.3	Counter64	read-only	The number of bytes sent via this rate limiter in the specified hour.
U32 rateLimitHistHoursTimestamp	1.3.6.1.4.1.10734.3.3.2.8.4.1.4	Unsigned32	read-only	The time HoursBytesSent was updated (in seconds since January 1, 1970).
thresholdHistSecondsTable	1.3.6.1.4.1.10734.3.3.2.8.5		not-accessible	Historical (sampled) data every second for a minute.
thresholdHistSecondsEntry	1.3.6.1.4.1.10734.3.3.2.8.5.1		not-accessible	An entry in the traffic threshold history seconds table. Rows cannot be created or deleted.
OCT thresholdHistSecondsGlobalID	1.3.6.1.4.1.10734.3.3.2.8.5.1.1	OCTET STRING	not-accessible	The global identifier of a traffic threshold filter.
U32 thresholdHistSecondsIndex	1.3.6.1.4.1.10734.3.3.2.8.5.1.2	Unsigned32	not-accessible	The index (0-59) of the second.
C64 thresholdHistSecondsUnitCount	1.3.6.1.4.1.10734.3.3.2.8.5.1.3	Counter64	read-only	The count of filter-specific units matching the traffic criteria for this filter in the specified second.
U32 thresholdHistSecondsTimestamp	1.3.6.1.4.1.10734.3.3.2.8.5.1.4	Unsigned32	read-only	The time SecondsUnitCount was updated (in seconds since January 1, 1970).
thresholdHistMinutesTable	1.3.6.1.4.1.10734.3.3.2.8.6		not-accessible	Historical (sampled) data every minute for an hour.
thresholdHistMinutesEntry	1.3.6.1.4.1.10734.3.3.2.8.6.1		not-accessible	An entry in the traffic threshold history minutes table. Rows cannot be created or deleted.
OCT thresholdHistMinutesGlobalID	1.3.6.1.4.1.10734.3.3.2.8.6.1.1	OCTET STRING	not-accessible	The global identifier of a traffic threshold filter.
U32 thresholdHistMinutesIndex	1.3.6.1.4.1.10734.3.3.2.8.6.1.2	Unsigned32	not-accessible	The index (0-59) of the minute.
C64 thresholdHistMinutesUnitCount	1.3.6.1.4.1.10734.3.3.2.8.6.1.3	Counter64	read-only	The average of the SecondsUnitCount values corresponding to this minute.
U32 thresholdHistMinutesTimestamp	1.3.6.1.4.1.10734.3.3.2.8.6.1.4	Unsigned32	read-only	The time MinutesUnitCount was updated (in seconds since January 1, 1970).
thresholdHistHoursTable	1.3.6.1.4.1.10734.3.3.2.8.7		not-accessible	Historical (sampled) data every hour for a day.
thresholdHistHoursEntry	1.3.6.1.4.1.10734.3.3.2.8.7.1		not-accessible	An entry in the traffic threshold history hours table. Rows cannot be created or deleted.
OCT thresholdHistHoursGlobalID	1.3.6.1.4.1.10734.3.3.2.8.7.1.1	OCTET STRING	not-accessible	The global identifier of a traffic threshold filter.
U32 thresholdHistHoursIndex	1.3.6.1.4.1.10734.3.3.2.8.7.1.2	Unsigned32	not-accessible	The index (0-23) of the hour.
C64 thresholdHistHoursUnitCount	1.3.6.1.4.1.10734.3.3.2.8.7.1.3	Counter64	read-only	The average of the MinutesUnitCount values corresponding to this hour.
U32 thresholdHistHoursTimestamp	1.3.6.1.4.1.10734.3.3.2.8.7.1.4	Unsigned32	read-only	The time HoursUnitCount was updated (in seconds since January 1, 1970).
thresholdHistDaysTable	1.3.6.1.4.1.10734.3.3.2.8.8		not-accessible	Historical (sampled) data every hour for a day.
thresholdHistDaysEntry	1.3.6.1.4.1.10734.3.3.2.8.8.1		not-accessible	An entry in the traffic threshold history hours table. Rows cannot be created or deleted.
OCT thresholdHistDaysGlobalID	1.3.6.1.4.1.10734.3.3.2.8.8.1.1	OCTET STRING	not-accessible	The global identifier of a traffic threshold filter.
U32 thresholdHistDaysIndex	1.3.6.1.4.1.10734.3.3.2.8.8.1.2	Unsigned32	not-accessible	The index (0-34) of the day.
C64 thresholdHistDaysUnitCount	1.3.6.1.4.1.10734.3.3.2.8.8.1.3	Counter64	read-only	The average of the HoursUnitCount values corresponding to this day.
U32 thresholdHistDaysTimestamp	1.3.6.1.4.1.10734.3.3.2.8.8.1.4	Unsigned32	read-only	The time DaysUnitCount was updated (in seconds since January 1, 1970).
thresholdTable	1.3.6.1.4.1.10734.3.3.2.8.9		not-accessible	High-level (non-sampled) data about a traffic threshold filter.
thresholdEntry	1.3.6.1.4.1.10734.3.3.2.8.9.1		not-accessible	An entry in the traffic threshold filter list. Rows cannot be created or deleted.
OCT thresholdGlobalID	1.3.6.1.4.1.10734.3.3.2.8.9.1.1	OCTET STRING	not-accessible	The global identifier of a traffic threshold filter policy group.
THR thresholdState	1.3.6.1.4.1.10734.3.3.2.8.9.1.2	ThresholdFilterState	read-only	The state (green, yellow, red) of this traffic threshold filter.
OCT thresholdUnits	1.3.6.1.4.1.10734.3.3.2.8.9.1.3	OCTET STRING	read-only	The units value (e.g., packets/sec) monitored by this threshold filter.
interfaceHistSecondsTable	1.3.6.1.4.1.10734.3.3.2.8.10		not-accessible	Historical (sampled) data every second for a minute.
interfaceHistSecondsEntry	1.3.6.1.4.1.10734.3.3.2.8.10.1		not-accessible	An entry in the traffic interface history seconds table. Rows cannot be created or deleted.
NUM interfaceHistSecondsIfIndex	1.3.6.1.4.1.10734.3.3.2.8.10.1.1	InterfaceIndex	not-accessible	The ifIndex of the interface for this historic data.
U32 interfaceHistSecondsIndex	1.3.6.1.4.1.10734.3.3.2.8.10.1.2	Unsigned32	not-accessible	The index (0-59) of the second.
C64 interfaceHistSecondsUnitCountIn	1.3.6.1.4.1.10734.3.3.2.8.10.1.3	Counter64	read-only	The entering the interface port in octets in the specified second.
C64 interfaceHistSecondsUnitCountOut	1.3.6.1.4.1.10734.3.3.2.8.10.1.4	Counter64	read-only	The leaving the interface port in octets in the specified second.
U32 interfaceHistSecondsTimestamp	1.3.6.1.4.1.10734.3.3.2.8.10.1.5	Unsigned32	read-only	The time SecondsUnitCount was updated (in seconds since January 1, 1970).
interfaceHistMinutesTable	1.3.6.1.4.1.10734.3.3.2.8.11		not-accessible	Historical (sampled) data every minute for an hour.
interfaceHistMinutesEntry	1.3.6.1.4.1.10734.3.3.2.8.11.1		not-accessible	An entry in the traffic interface history minutes table. Rows cannot be created or deleted.
NUM interfaceHistMinutesIfIndex	1.3.6.1.4.1.10734.3.3.2.8.11.1.1	InterfaceIndex	not-accessible	The ifIndex of the interface for this historic data.
U32 interfaceHistMinutesIndex	1.3.6.1.4.1.10734.3.3.2.8.11.1.2	Unsigned32	not-accessible	The index (0-59) of the minute.
C64 interfaceHistMinutesUnitCountIn	1.3.6.1.4.1.10734.3.3.2.8.11.1.3	Counter64	read-only	The average of the SecondsUnitCountIn values corresponding to this minute.
C64 interfaceHistMinutesUnitCountOut	1.3.6.1.4.1.10734.3.3.2.8.11.1.4	Counter64	read-only	The average of the SecondsUnitCountOut values corresponding to this minute.
U32 interfaceHistMinutesTimestamp	1.3.6.1.4.1.10734.3.3.2.8.11.1.5	Unsigned32	read-only	The time MinutesUnitCount was updated (in seconds since January 1, 1970).
interfaceHistHoursTable	1.3.6.1.4.1.10734.3.3.2.8.12		not-accessible	Historical (sampled) data every hour for a day.
interfaceHistHoursEntry	1.3.6.1.4.1.10734.3.3.2.8.12.1		not-accessible	An entry in the traffic interface history hours table. Rows cannot be created or deleted.
NUM interfaceHistHoursIfIndex	1.3.6.1.4.1.10734.3.3.2.8.12.1.1	InterfaceIndex	not-accessible	The ifIndex of the interface for this historic data.
U32 interfaceHistHoursIndex	1.3.6.1.4.1.10734.3.3.2.8.12.1.2	Unsigned32	not-accessible	The index (0-23) of the hour.
C64 interfaceHistHoursUnitCountIn	1.3.6.1.4.1.10734.3.3.2.8.12.1.3	Counter64	read-only	The average of the MinutesUnitCountIn values corresponding to this hour.
C64 interfaceHistHoursUnitCountOut	1.3.6.1.4.1.10734.3.3.2.8.12.1.4	Counter64	read-only	The average of the MinutesUnitCountOut values corresponding to this hour.
U32 interfaceHistHoursTimestamp	1.3.6.1.4.1.10734.3.3.2.8.12.1.5	Unsigned32	read-only	The time HoursUnitCount was updated (in seconds since January 1, 1970).
interfaceHistDaysTable	1.3.6.1.4.1.10734.3.3.2.8.13		not-accessible	Historical (sampled) data every hour for a day.
interfaceHistDaysEntry	1.3.6.1.4.1.10734.3.3.2.8.13.1		not-accessible	An entry in the traffic interface history hours table. Rows cannot be created or deleted.
NUM interfaceHistDaysIfIndex	1.3.6.1.4.1.10734.3.3.2.8.13.1.1	InterfaceIndex	not-accessible	The ifIndex of the interface for this historic data.
U32 interfaceHistDaysIndex	1.3.6.1.4.1.10734.3.3.2.8.13.1.2	Unsigned32	not-accessible	The index (0-34) of the day.
C64 interfaceHistDaysUnitCountIn	1.3.6.1.4.1.10734.3.3.2.8.13.1.3	Counter64	read-only	The average of the HoursUnitCountIn values corresponding to this day.
C64 interfaceHistDaysUnitCountOut	1.3.6.1.4.1.10734.3.3.2.8.13.1.4	Counter64	read-only	The average of the HoursUnitCountOut values corresponding to this day.
U32 interfaceHistDaysTimestamp	1.3.6.1.4.1.10734.3.3.2.8.13.1.5	Unsigned32	read-only	The time DaysUnitCount was updated (in seconds since January 1, 1970).
NTF tptThresholdFilterNotify	1.3.6.1.4.1.10734.3.3.3.0.17			Notification: Used to inform the management station that a threshold filter threshold crossing has been logged.
OCT tptThresholdNotifyDeviceID	1.3.6.1.4.1.10734.3.3.3.1.111	OCTET STRING	read-only	The unique identifier of the device sending this notification.
OCT tptThresholdNotifyPolicyID	1.3.6.1.4.1.10734.3.3.3.1.112	OCTET STRING	read-only	The unique identifier of the policy causing this notification.
OCT tptThresholdNotifySignatureID	1.3.6.1.4.1.10734.3.3.3.1.113	OCTET STRING	read-only	The unique identifier of the signature associated with the policy.
OCT tptThresholdNotifySegmentName	1.3.6.1.4.1.10734.3.3.3.1.114	OCTET STRING	read-only	A string of the format : that uniquely identifies the segment pertaining to this notification.
OCT tptThresholdNotifyZonePair	1.3.6.1.4.1.10734.3.3.3.1.115	OCTET STRING	read-only	A string of the format : that identifies the zone pertaining to this notification.

RFC description

Manages traffic control functions including rate limiters and traffic thresholds for network devices.

Start monitoring TippingPoint IPS appliances with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download TPT-TRAFFIC-MIB