TUBS-IBR-LINUX-NETFILTER-MIB

All MIBs › TUBS-IBR-LINUX-NETFILTER-MIB

Organization: TU Braunschweig

Last Updated: 2002-07-23

Category: Linux and System Monitoring, TU Braunschweig Research MIBs

Description: Monitors Linux netfilter/iptables packet filtering rules, counters, and connection tracking statistics.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is TUBS-IBR-LINUX-NETFILTER-MIB?

TUBS-IBR-LINUX-NETFILTER-MIB is an experimental MIB from TU Braunschweig's Institute of Operating Systems and Computer Networks (IBR) for monitoring the Linux 2.4 kernel's netfilter/iptables packet-filtering subsystem. It exposes the set of netfilter tables and chains configured on a host, along with per-chain packet and byte counters and the chain's default target, plus a last-change timestamp. Its monitoring focus is software/firewall status: administrators use it to watch traffic volumes hitting specific firewall chains and to detect when the ruleset has been modified, which can reveal both normal traffic shifts and potential security events like a spike in dropped/rejected packets. As a research-oriented MIB tied specifically to Linux netfilter, it is part of the same TUBS-IBR experimental series as TUBS-NFS-MIB and TUBS-PROC-MIB, sharing similar Unix-host-monitoring conventions. It is deployed on Linux servers or routers running iptables-based firewalls, typically in academic or Linux-centric network operations settings. Engineers can download the TUBS-IBR-LINUX-NETFILTER-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in TUBS-IBR-LINUX-NETFILTER-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Linux server/router running netfilter/iptables (kernel 2.4)

Monitoring Examples

The lnfTableTable/lnfTableEntry rows list each netfilter table by lnfTableName (e.g., filter or nat), while lnfChainTable/lnfChainEntry breaks each table down by lnfChainName along with lnfChainPackets, lnfChainOctets, and the chain's lnfChainTarget. Polling lnfChainPackets over time lets an admin see a sudden spike in traffic hitting a DROP or REJECT chain, which could indicate a scan or attack, and lnfLastChange flags exactly when the ruleset was last modified, useful for correlating a policy change with a traffic shift.

What Can Be Monitored

netfilter table and chain list
chain packet/byte counters
chain target (ACCEPT/DROP/REJECT)
ruleset last-change time

Imported Objects

From INET-ADDRESS-MIB

InetAddress
InetAddressPrefixLength
InetAddressType

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Counter64
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

RowStatus
StorageType
TEXTUAL-CONVENTION
TimeStamp
TruthValue

From TUBS-SMI

ibr	OBJECT-IDENTITY

How to Use in IPNetwork Monitor

Example using lnfChainPackets OID:

Select a Linux server/router running netfilter/iptables, kernel 2.4 (per-chain packet/byte counter status) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type lnfChainPackets into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. The number of packets that passed this chain since the rule was installed or reset. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter64-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
lnfMIB	1.3.6.1.4.1.1575.1.13			Experimental MIB module for the Linux 2.4 netfilter subsystem.
lnfObjects	1.3.6.1.4.1.1575.1.13.1
TIM lnfLastChange	1.3.6.1.4.1.1575.1.13.1.1	TimeStamp	read-only	The time of the last netfilter configuration change of any kind, including any creation, deletion or modification of any table of this MIB.
lnfTableTable	1.3.6.1.4.1.1575.1.13.1.2		not-accessible	A list of all tables installed on the netfilter subsystem.
lnfTableEntry	1.3.6.1.4.1.1575.1.13.1.2.1		not-accessible	An entry describing a particular netfilter table.
IPt lnfTableAddressType	1.3.6.1.4.1.1575.1.13.1.2.1.1	InetAddressType	not-accessible	The address type for which the netfilter table works.
STR lnfTableName	1.3.6.1.4.1.1575.1.13.1.2.1.2	SnmpAdminString	not-accessible	The name of the netfilter table.
TIM lnfTableLastChange	1.3.6.1.4.1.1575.1.13.1.2.1.3	TimeStamp	read-only	The time of the last modification of this netfilter table, including the creation or deletion of a netfilter chain that belongs to this table.
lnfChainTable	1.3.6.1.4.1.1575.1.13.1.3		not-accessible	A list of all chains installed on the netfilter subsystem.
lnfChainEntry	1.3.6.1.4.1.1575.1.13.1.3.1		not-accessible	An entry describing a particular netfilter chain.
STR lnfChainName	1.3.6.1.4.1.1575.1.13.1.3.1.1	SnmpAdminString	not-accessible	The netfilter chain to which the rule belongs.
C64 lnfChainPacketsEx	1.3.6.1.4.1.1575.1.13.1.3.1.2	Counter64	read-only	The number of packets that passed this chain since the rule was installed or reset.
C64 lnfChainOctets	1.3.6.1.4.1.1575.1.13.1.3.1.3	Counter64	read-only	The number of octets that passed this chain since the chain was installed or reset.
LNF lnfChainTarget	1.3.6.1.4.1.1575.1.13.1.3.1.4	LnfTarget	read-create	The action that shall be applied to a packet if no rule within the chain matches. Note that user-defined chains only allow return(6).
TIM lnfChainLastChange	1.3.6.1.4.1.1575.1.13.1.3.1.5	TimeStamp	read-only	The time of the last modification of this netfilter chain, including the creation or deletion of a netfilter rule that belongs to this chain.
STO lnfChainStorage	1.3.6.1.4.1.1575.1.13.1.3.1.6	StorageType	read-create	This object defines whether this row is kept in volatile storage and lost upon reboot or whether it is backed up by stable storage or builtin.
ROW lnfChainStatus	1.3.6.1.4.1.1575.1.13.1.3.1.7	RowStatus	read-create	This object is used to create and delete rows in the lnfChainTable.
lnfRuleTable	1.3.6.1.4.1.1575.1.13.1.4		not-accessible	A list of all rules installed on the netfilter subsystem.
lnfRuleEntry	1.3.6.1.4.1.1575.1.13.1.4.1		not-accessible	An entry describing a particular netfilter rule. Rules of different netfilter tables and chains are distinguished by the corresponding index objects.
U32 lnfRuleIndex	1.3.6.1.4.1.1575.1.13.1.4.1.1	Unsigned32	not-accessible	A unique number identifying the rule within a netfilter chain.
U32 lnfRuleProtocol	1.3.6.1.4.1.1575.1.13.1.4.1.2	Unsigned32	read-create	The protocol of the rule. The number zero matches all protocols.
T/F lnfRuleProtocolInv	1.3.6.1.4.1.1575.1.13.1.4.1.3	TruthValue	read-create	This flag specifies whether the lnfRuleProtocol test has to be inverted.
IP lnfRuleSourceAddress	1.3.6.1.4.1.1575.1.13.1.4.1.4	InetAddress	read-create	The source address of a packet. The exact format depends on the address type specified by lnfRuleAddressType. This test is applied for an address prefix whose length is specified by lnfRuleSourceAddressPrefixLength. If a new row is created this object should default to an all-zeros value with a length approrpiate for the corresponding lnfRuleAddressType object value.
ADR lnfRuleSourceAddressPrefixLength	1.3.6.1.4.1.1575.1.13.1.4.1.5	InetAddressPrefixLength	read-create	The network prefix length associated with lnfRuleSourceAddress.
T/F lnfRuleSourceAddressInv	1.3.6.1.4.1.1575.1.13.1.4.1.6	TruthValue	read-create	This flag specifies whether the lnfRuleSourceAddress and lnfRuleSourceAddressPrefixLength test has to be inverted.
IP lnfRuleDestinationAddress	1.3.6.1.4.1.1575.1.13.1.4.1.7	InetAddress	read-create	The destination address of a packet. The exact format depends on the address type specified by lnfRuleAddressType. This test is applied for an address prefix whose length is specified by lnfRuleDestinationAddressPrefixLength. If a new row is created this object should default to an all-zeros value with a length approrpiate for the corresponding lnfRuleAddressType object value.
ADR lnfRuleDestinationAddressPrefixLength	1.3.6.1.4.1.1575.1.13.1.4.1.8	InetAddressPrefixLength	read-create	The network prefix length associated with lnfRuleDestinationAddress.
T/F lnfRuleDestinationAddressInv	1.3.6.1.4.1.1575.1.13.1.4.1.9	TruthValue	read-create	This flag specifies whether the lnfRuleDestinationAddress and lnfRuleDestinationAddressPrefixLength test has to be inverted.
STR lnfRuleInInterface	1.3.6.1.4.1.1575.1.13.1.4.1.10	SnmpAdminString	read-create	Name of an interface via which a packet is going to be received (only for packets entering the INPUT, FORWARD and PREROUTING chains). If the interface name ends in a '+', then any interface which begins with this name will match. If this is an empty string, any interface name will match.
T/F lnfRuleInInterfaceInv	1.3.6.1.4.1.1575.1.13.1.4.1.11	TruthValue	read-create	This flag specifies whether the lnfRuleInInterface test has to be inverted.
STR lnfRuleOutInterface	1.3.6.1.4.1.1575.1.13.1.4.1.12	SnmpAdminString	read-create	Name of an interface via which a packet is going to be sent (for packets entering the FORWARD, OUTPUT and POSTROUTING chains). If the interface name ends in a '+', then any interface which begins with this name will match. If this is an empty string, any interface name will match.
T/F lnfRuleOutInterfaceInv	1.3.6.1.4.1.1575.1.13.1.4.1.13	TruthValue	read-create	This flag specifies whether the lnfRuleOutInterface test has to be inverted.
T/F lnfRuleFragment	1.3.6.1.4.1.1575.1.13.1.4.1.14	TruthValue	read-create	If this flag is true, the rule only refers to second and further fragments of fragmented packets. Since there is no way to tell the source or destination ports of such a packet (or ICMP type), such a packet will not match any rules which specify them.
T/F lnfRuleFragmentInv	1.3.6.1.4.1.1575.1.13.1.4.1.15	TruthValue	read-create	This flag specifies whether the lnfRuleFragmentInv test, if true, has to be inverted. An inverted rule will only match head fragments, or unfragmented packets.
C64 lnfRulePackets	1.3.6.1.4.1.1575.1.13.1.4.1.16	Counter64	read-only	The number of packets that matched this rule since the rule was installed or reset.
C64 lnfRuleOctets	1.3.6.1.4.1.1575.1.13.1.4.1.17	Counter64	read-only	The number of octets that matched this rule since the rule was installed or reset.
LNF lnfRuleTarget	1.3.6.1.4.1.1575.1.13.1.4.1.18	LnfTarget	read-create	The action that shall be applied to a packet if the rule matches. If the value is chain(7), then jump to the user chain specified by lnfRuleTargetChain.
STR lnfRuleTargetChain	1.3.6.1.4.1.1575.1.13.1.4.1.19	SnmpAdminString	read-create	The name of the target chain if the value of lnfRuleTarget is chain(7).
T/F lnfRuleTrapEnable	1.3.6.1.4.1.1575.1.13.1.4.1.20	TruthValue	read-write	Indicates whether lnfRuleMatch traps should be generated for packets matching this rule. Note that it's up to the implementation to delay and accumulate mutliple traps in order to reduce the number of emitted traps.
TIM lnfRuleLastChange	1.3.6.1.4.1.1575.1.13.1.4.1.21	TimeStamp	read-only	The time of the last modification of this netfilter rule. If it has been unchanged since the last re-initialization of the local network management subsystem, then this object contains a zero value.
STO lnfRuleStorage	1.3.6.1.4.1.1575.1.13.1.4.1.22	StorageType	read-create	This object defines whether this row is kept in volatile storage and lost upon reboot or whether it is backed up by stable storage or builtin.
ROW lnfRuleStatus	1.3.6.1.4.1.1575.1.13.1.4.1.23	RowStatus	read-create	This object is used to create and delete rows in the lnfRuleTable.
lnfTraps	1.3.6.1.4.1.1575.1.13.2
lnfNotifications	1.3.6.1.4.1.1575.1.13.2.0
NTF lnfRuleMatch	1.3.6.1.4.1.1575.1.13.2.0.1			A lnfRuleMatch trap signifies that the rule to which the lnfRulePackets and lnfRuleOctets objects belong was matched by at least one packets since the last trap for the same rule was emitted. The agent may delay and accumulate mutliple traps in order to reduce the number of emitted traps, but the time for accumulation should be no more than 60 seconds. Note that detailed information on the packet(s) that triggered a trap is not available from the trap's objects. This would cause problems with the accumulation of matches and/or increased trap traffic.
lnfConformance	1.3.6.1.4.1.1575.1.13.3
lnfCompliances	1.3.6.1.4.1.1575.1.13.3.1
lnfCompliance	1.3.6.1.4.1.1575.1.13.3.1.1			The compliance statement for an SNMP entity which implements the Linux Netfilter MIB.
lnfGroups	1.3.6.1.4.1.1575.1.13.3.2
lnfGeneralGroup	1.3.6.1.4.1.1575.1.13.3.2.1			A collection of all Linux Netfilter objects of the core table.
lnfNotificationGroup	1.3.6.1.4.1.1575.1.13.3.2.2			A collection of all Linux Netfilter notifications.

RFC description

Experimental MIB module for the Linux 2.4 netfilter subsystem firewall and packet filtering management.

Start monitoring Linux server/router running netfilter/iptables, kernel 2.4 (per-chain packet/byte counter status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download TUBS-IBR-LINUX-NETFILTER-MIB