UCD-IPFILTER-MIB

All MIBs › UCD-IPFILTER-MIB

Organization: University of California, Davis

Last Updated: 2000-01-26

Category: Net-SNMP and Linux

Description: Defines managed objects for monitoring IP packet filtering statistics on systems running the Net-SNMP agent.

IPNetwork Monitor uses several OIDs from this MIB in network discovery and polling the applicable devices. Start monitoring UCD-IPFILTER-MIB with a free 30-day trial of IPNetwork Monitor.

What Is UCD-IPFILTER-MIB?

UCD-IPFILTER-MIB is a Net-SNMP (formerly UCD-SNMP) community MIB that exposes statistics from Darren Reed's IP Filter (ipf) packet-filtering subsystem on Unix-like hosts. It provides read-only access to inbound and outbound filter rule tables along with per-rule hit counters, giving visibility into which firewall rules are matching traffic. Rather than hardware health, this MIB monitors software/security state: it lets an operator confirm that firewall rules are active and see how frequently each rule is being triggered, which can reveal a misconfigured rule, an attack pattern, or a rule that is unexpectedly blocking legitimate traffic. It depends on the underlying IP Filter (ipf) kernel/userland module being present on the host and is specific to the Net-SNMP agent's extension modules rather than being a general IETF standard. It is deployed on Unix/BSD/Linux hosts running IP Filter as a firewall, monitored via the Net-SNMP agent for security and traffic-filtering visibility, with the UCD-IPFILTER-MIB MIB providing the object definitions the Net-SNMP agent exposes for this purpose.

IPNetwork Monitor allows you to monitor SNMP objects defined in UCD-IPFILTER-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Unix/Linux/BSD hosts running Net-SNMP with IP Filter (ipf) firewall

Monitoring Examples

An administrator would poll ipfInTable/ipfInEntry (indexed by ipfInIndex) for each inbound rule's ipfInRule text and its ipfInHits counter, and similarly ipfOutTable/ipfOutEntry for outbound rules, to see which filter rules are actively matching traffic. A rule whose ipfInHits counter climbs unexpectedly fast could indicate a scan or attack being blocked, while a rule with zero hits over a long period might mean an outdated or never-triggered ACL entry. ipfAccInTable extends this with accounting-style rule statistics for deeper traffic analysis.

What Can Be Monitored

inbound filter rule hit counts
outbound filter rule hit counts
active filter rule definitions
per-rule packet accounting

Imported Objects

From SNMPv2-SMI

Counter32
Integer32
MODULE-IDENTITY
OBJECT-TYPE

From UCD-SNMP-MIB

ucdExperimental

OBJECT-IDENTITY

How to Use in IPNetwork Monitor

Example using ipfInHits OID:

Select an Unix/Linux/BSD hosts running Net-SNMP with IP Filter (ipf) firewall (rule/hit-counter status) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type ipfInHits into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. Hits of the incoming IP Filter rule. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
ucdIpFilter	1.3.6.1.4.1.2021.13.2			This module defines MIB components for reading information from the IP Filter. This would let you only read its rules and counters. IP Filter by Darren Reed IP Filter web page URL http://coombs.anu.edu.au/~avalon/ ipf-mod.pl module by Yaroslav Terletsky IP Filter UCD-SNMP module URL ftp://ftp.polynet.lviv.ua/pub/UNIX/security/ipf/ucd-snmp-ipf-mod.tgz Yaroslav Terletsky
ipfInTable	1.3.6.1.4.1.2021.13.2.1		not-accessible	A table with IP Filter incoming rules and statistics.
ipfInEntry	1.3.6.1.4.1.2021.13.2.1.1		not-accessible	IP Filter incoming rules table entry.
I32 ipfInIndex	1.3.6.1.4.1.2021.13.2.1.1.1	Integer32	read-only	Reference index for each incoming IP Filter rule.
OCT ipfInRule	1.3.6.1.4.1.2021.13.2.1.1.2	OCTET STRING	read-only	Textual representation of the incoming IP Filter rule.
C32 ipfInHitsEx	1.3.6.1.4.1.2021.13.2.1.1.3	Counter32	read-only	Hits of the incoming IP Filter rule.
ipfOutTable	1.3.6.1.4.1.2021.13.2.2		not-accessible	A table with IP Filter outgoing rules and statistic.
ipfOutEntry	1.3.6.1.4.1.2021.13.2.2.1		not-accessible	IP Filter outgoing rules table entry.
I32 ipfOutIndex	1.3.6.1.4.1.2021.13.2.2.1.1	Integer32	read-only	Reference index for each outgoing IP Filter rule.
OCT ipfOutRule	1.3.6.1.4.1.2021.13.2.2.1.2	OCTET STRING	read-only	Textual representation of the outgoing IP Filter rule.
C32 ipfOutHits	1.3.6.1.4.1.2021.13.2.2.1.3	Counter32	read-only	Hits of the outgoing IP Filter rule.
ipfAccInTable	1.3.6.1.4.1.2021.13.2.3		not-accessible	A table with IP Filter incoming accounting rules and statistics.
ipfAccInEntry	1.3.6.1.4.1.2021.13.2.3.1		not-accessible	IP FIlter incoming accounting rules table entry.
I32 ipfAccInIndex	1.3.6.1.4.1.2021.13.2.3.1.1	Integer32	read-only	Reference index for each incoming accounting IP Filter rule.
OCT ipfAccInRule	1.3.6.1.4.1.2021.13.2.3.1.2	OCTET STRING	read-only	Textual representation of the incoming accounting IP Filter rule.
C32 ipfAccInHits	1.3.6.1.4.1.2021.13.2.3.1.3	Counter32	read-only	Hits of the incoming accounting IP Filter rule.
C32 ipfAccInBytes	1.3.6.1.4.1.2021.13.2.3.1.4	Counter32	read-only	Bytes passed thru the incoming accounting IP Filter rule.
ipfAccOutTable	1.3.6.1.4.1.2021.13.2.4		not-accessible	A table with IP Filter outgoing accounting rules and statistic.
ipfAccOutEntry	1.3.6.1.4.1.2021.13.2.4.1		not-accessible	IP Filter outgoing accounting rules table entry.
I32 ipfAccOutIndex	1.3.6.1.4.1.2021.13.2.4.1.1	Integer32	read-only	Reference index for each outgoing accounting IP Filter rule.
OCT ipfAccOutRule	1.3.6.1.4.1.2021.13.2.4.1.2	OCTET STRING	read-only	Textual representation of the outgoing accounting IP Filter rule.
C32 ipfAccOutHits	1.3.6.1.4.1.2021.13.2.4.1.3	Counter32	read-only	Hits of the outgoing accounting IP Filter rule.
C32 ipfAccOutBytes	1.3.6.1.4.1.2021.13.2.4.1.4	Counter32	read-only	Bytes passed thru the outgoing accounting IP Filter rule.

RFC description

Provides read-only access to IP Filter rules and counters for monitoring firewall filter statistics.

Start monitoring Unix/Linux/BSD hosts running Net-SNMP with IP Filter (ipf) firewall (rule/hit-counter status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download UCD-IPFILTER-MIB