UCD-IPFWACC-MIB

All MIBs › UCD-IPFWACC-MIB

Organization: University of California, Davis

Last Updated: 1999-12-16

Category: Net-SNMP and Linux, VPN and Security

Description: Defines managed objects for monitoring Linux IP firewall accounting statistics via the Net-SNMP agent.

IPNetwork Monitor uses several OIDs from this MIB in network discovery and polling the applicable devices. Start monitoring UCD-IPFWACC-MIB with a free 30-day trial of IPNetwork Monitor.

What Is UCD-IPFWACC-MIB?

UCD-IPFWACC-MIB is a Net-SNMP community MIB that exposes Linux IP firewall accounting rule statistics, letting SNMP tools read the rules and packet/byte counters maintained by the kernel's IP firewall accounting facility. It is read-oriented, deliberately omitting fields the author considered irrelevant and offering no write access for rule modification. Its monitoring role is purely software/network-traffic status: tracking per-rule accounting counters (matched traffic between source/destination address and netmask pairs, via specific interfaces) to detect traffic anomalies, policy violations, or unexpected volume on a given accounting rule. It is tied specifically to the Linux kernel's ipfwadm/ipchains-era firewall accounting subsystem and the Net-SNMP agent framework rather than any IETF standard. It is deployed on Linux hosts or routers using IP firewall accounting rules, monitored centrally via Net-SNMP for traffic and security auditing. Engineers can download the UCD-IPFWACC-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in UCD-IPFWACC-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Linux hosts/routers running Net-SNMP with IP firewall accounting enabled

Monitoring Examples

An administrator would poll ipFwAccTable/ipFwAccEntry indexed by ipFwAccIndex, examining ipFwAccSrcAddr/ipFwAccSrcNetMask and ipFwAccDstAddr/ipFwAccDstNetMask alongside ipFwAccViaName/ipFwAccViaAddr to see which interface and address pair a given accounting rule covers. A sudden spike in traffic counted against a rule with ipFwAccBidir set would indicate unexpected bidirectional flow between two hosts, useful for spotting a misbehaving service or a security incident. ipFwAccProto identifies which protocol the matched traffic belongs to, helping narrow down the cause.

What Can Be Monitored

firewall accounting rule definitions
per-rule traffic counters
source/destination address and netmask matches
protocol and interface association
bidirectional traffic flag

Imported Objects

From SNMPv2-SMI

Counter32
Integer32
IpAddress
MODULE-IDENTITY
OBJECT-TYPE

From SNMPv2-TC

DisplayString

From UCD-SNMP-MIB

ucdExperimental

OBJECT-IDENTITY

How to Use in IPNetwork Monitor

Example using ipFwAccBytes OID:

Select a Linux hosts/routers running Net-SNMP with IP firewall accounting enabled (per-rule packet/byte counter status) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type ipFwAccBytes into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. The number of bytes that matched this rule since the last reset of the counters. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
ucdIpFwAccMIB	1.3.6.1.4.1.2021.13.1			This module defines MIB components for reading information from the accounting rules IP Firewall. This would typically let you read the rules and the counters. I did not include some flags and fields that I considered irrelevant for the accounting rules. Resetting the counters of the rules by SNMP would be simple, but I don't consider it so useful. I gave no consideration to implementing write access for allowing modification of the accounting rules. Cristian.Estan@net.utcluj.ro
ipFwAccTable	1.3.6.1.4.1.2021.13.1.1		not-accessible	A table with the accounting rules of the IP firewall
ipFwAccEntry	1.3.6.1.4.1.2021.13.1.1.1		not-accessible	An accounting rule of the IP firewall
I32 ipFwAccIndex	1.3.6.1.4.1.2021.13.1.1.1.1	Integer32	read-only	Reference index for each firewall rule.
IP ipFwAccSrcAddr	1.3.6.1.4.1.2021.13.1.1.1.2	IpAddress	read-only	The source address in the firewall rule.
IP ipFwAccSrcNetMask	1.3.6.1.4.1.2021.13.1.1.1.3	IpAddress	read-only	The netmask of the source address in the firewall rule.
IP ipFwAccDstAddr	1.3.6.1.4.1.2021.13.1.1.1.4	IpAddress	read-only	The destination address in the firewall rule.
IP ipFwAccDstNetMask	1.3.6.1.4.1.2021.13.1.1.1.5	IpAddress	read-only	The netmask of the destination address in the firewall rule.
STR ipFwAccViaName	1.3.6.1.4.1.2021.13.1.1.1.6	DisplayString	read-only	The name of the interface to which the rule applies. If no interface is associated with the present rule, this should contain a dash (-).
IP ipFwAccViaAddr	1.3.6.1.4.1.2021.13.1.1.1.7	IpAddress	read-only	The address of the interface to which the rule applies. Using this parameter makes sense when multiple addresses are associated to the same physical interface. If not defined for the current rule this should be set to 0.
INT ipFwAccProto	1.3.6.1.4.1.2021.13.1.1.1.8	INTEGER	read-only	The protocol(s) to which the rule applies.
INT ipFwAccBidir	1.3.6.1.4.1.2021.13.1.1.1.9	INTEGER	read-only	Whether the rule works in both directions (i.e. with the source and destination parts swapped) or not.
INT ipFwAccDir	1.3.6.1.4.1.2021.13.1.1.1.10	INTEGER	read-only	Whether the rule applies to packets entering or exiting the kernel.
C32 ipFwAccBytesEx	1.3.6.1.4.1.2021.13.1.1.1.11	Counter32	read-only	The number of bytes that matched this rule since the last reset of the counters.
C32 ipFwAccPackets	1.3.6.1.4.1.2021.13.1.1.1.12	Counter32	read-only	The number of packets that matched this rule since the last reset of the counters.
I32 ipFwAccNrSrcPorts	1.3.6.1.4.1.2021.13.1.1.1.13	Integer32	read-only	The number of ports that refer to the source address.
I32 ipFwAccNrDstPorts	1.3.6.1.4.1.2021.13.1.1.1.14	Integer32	read-only	The number of ports that refer to the destination address.
INT ipFwAccSrcIsRange	1.3.6.1.4.1.2021.13.1.1.1.15	INTEGER	read-only	Interpret the first two ports of the source part as the upper and lower limit of an interval or not.
INT ipFwAccDstIsRange	1.3.6.1.4.1.2021.13.1.1.1.16	INTEGER	read-only	Interpret the first two ports of the destination part as the upper and lower limit of an interval or not.
I32 ipFwAccPort1	1.3.6.1.4.1.2021.13.1.1.1.17	Integer32	read-only	Port number 1.
I32 ipFwAccPort2	1.3.6.1.4.1.2021.13.1.1.1.18	Integer32	read-only	Port number 2.
I32 ipFwAccPort3	1.3.6.1.4.1.2021.13.1.1.1.19	Integer32	read-only	Port number 3.
I32 ipFwAccPort4	1.3.6.1.4.1.2021.13.1.1.1.20	Integer32	read-only	Port number 4.
I32 ipFwAccPort5	1.3.6.1.4.1.2021.13.1.1.1.21	Integer32	read-only	Port number 5.
I32 ipFwAccPort6	1.3.6.1.4.1.2021.13.1.1.1.22	Integer32	read-only	Port number 6.
I32 ipFwAccPort7	1.3.6.1.4.1.2021.13.1.1.1.23	Integer32	read-only	Port number 7.
I32 ipFwAccPort8	1.3.6.1.4.1.2021.13.1.1.1.24	Integer32	read-only	Port number 8.
I32 ipFwAccPort9	1.3.6.1.4.1.2021.13.1.1.1.25	Integer32	read-only	Port number 9.
I32 ipFwAccPort10	1.3.6.1.4.1.2021.13.1.1.1.26	Integer32	read-only	Port number 10.

RFC description

Reads and monitors IP firewall accounting rules and their traffic counters including bytes and packets.

Start monitoring Linux hosts/routers running Net-SNMP with IP firewall accounting enabled (per-rule packet/byte counter status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download UCD-IPFWACC-MIB