All MIBs › WS-SW-FIREWALL-MIB
Organization: Symbol Technologies, Inc.
Last Updated: 2009-01-16
Category: Symbol Technologies Wireless
Description: Manages Symbol Technologies wireless switch stateful firewall rules, NAT policies, and connection tracking.
Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.
What Is WS-SW-FIREWALL-MIB?
WS-SW-FIREWALL-MIB is a Symbol Technologies (later Motorola/Zebra) proprietary MIB implementing DoS-attack detection and Layer 2/3 firewall configuration for bridge-level attack detection/mitigation on Symbol wireless switches. Its objects cover TCP max-incomplete-connection high/low watermarks, global DoS-check enable/disable-all and clear-stats actions, a per-check-type table (enable, log level), a statistics table (attack type, count, last-occurrence time), and an L2 firewall table per interface recording ARP rate limit, DHCP/ARP trust enable, and broadcast/multicast/unicast storm-control ingress rate limits. As a configuration/security-status MIB it lets an administrator confirm storm-control and DoS-check thresholds are tuned correctly and review recent attack statistics. It is deployed on Symbol Technologies (Zebra) wireless switches. Engineers can download the WS-SW-FIREWALL-MIB file directly to load it into their MIB browser.
IPNetwork Monitor allows you to monitor SNMP objects defined in WS-SW-FIREWALL-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.
Supported Devices
- Symbol Technologies (Zebra) wireless switches
Monitoring Examples
An administrator checks wsSwFirewallDosStatsAttackCount and wsSwFirewallDosStatsLastOccurrence to determine how recently and how often a specific DoS attack type has been detected on a Symbol wireless switch.
What Can Be Monitored
- DoS attack statistics
- L2/L3 firewall and storm-control configuration
This MIB depends on
Related MIBs
Imported Objects
From SNMPv2-CONF
| MODULE-COMPLIANCE | |
| OBJECT-GROUP |
From SNMPv2-SMI
| Counter32 | |
| Integer32 | |
| IpAddress | |
| MODULE-IDENTITY | |
| OBJECT-TYPE | |
| TimeTicks | |
| Unsigned32 |
From SNMPv2-TC
| PhysAddress | |
| TruthValue |
From WS-SMI
| wsSw | OBJECT-IDENTITY |
From WS-TYPE-MIB
| AbbrevRowStatus | |
| DoActionNow |
OIDs
| OID symbolic | OID numeric | Type | Access | Description |
|---|---|---|---|---|
| wsSwFirewall | 1.3.6.1.4.1.388.14.2.16 | |||
| wsSwFirewallMibModule | 1.3.6.1.4.1.388.14.2.16.1 | MIB for DoS Attacks configuration and L2/L3 firewall configurations and firewall config for WLAN implemented for bridge level attack detection/mitigation feature and statistics related to it. | ||
| wsSwFirewallMIB | 1.3.6.1.4.1.388.14.2.16.1.1 | |||
| wsSwFirewallDos | 1.3.6.1.4.1.388.14.2.16.1.1.1 | |||
| wsSwFirewallDosScalars | 1.3.6.1.4.1.388.14.2.16.1.1.1.1 | |||
| I32 wsSwFirewallDosTcpMaxIncompleteCnHigh | 1.3.6.1.4.1.388.14.2.16.1.1.1.1.1 | Integer32 | read-write | Maximum number of half-open TCP connections in the system after which firewall will start intercepting TCP connections. The configured value will be used by TCP Intercept DoS Attack check to handle SYN Flood Attack. |
| I32 wsSwFirewallDosTcpMaxIncompleteCnLow | 1.3.6.1.4.1.388.14.2.16.1.1.1.1.2 | Integer32 | read-write | Maximum number of half-open TCP connections in the system after which firewall will stop intercepting TCP connections. The configured value will be used by TCP Intercept DoS Attack check to handle SYN Flood Attack. |
| DOA wsSwFirewallDosCheckEnableAll | 1.3.6.1.4.1.388.14.2.16.1.1.1.1.3 | DoActionNow | read-write | Enable all DOS checks. |
| DOA wsSwFirewallDosCheckDisableAll | 1.3.6.1.4.1.388.14.2.16.1.1.1.1.4 | DoActionNow | read-write | Disable all DOS checks. |
| DOA wsSwFirewallDosClearStats | 1.3.6.1.4.1.388.14.2.16.1.1.1.1.5 | DoActionNow | read-write | Re-set all the DOS stats in the wsSwFirewallDosStatsTable. |
| wsSwFirewallDosChecksTable | 1.3.6.1.4.1.388.14.2.16.1.1.1.2 | not-accessible | Currently wsSwFirewallDoSChecksTable is handling the following configurable DoS Attacks: 1. Smurf DoS Attack: Enable this check in the firewall to drop ICMP echo packets destined to a broadcast IP address. Attackers use this type of packet to bring down a target host by spoofing its IP address and flooding it with ICMP echo responses. 2. Twinge DoS Attack: Enable this check in the firewall to drop false ICMP control packets going through the wirless switch. 3. Invalid IP Protocol DoS Attack: Enable this check in firewall to deny packets with invalid IP protocol value in the IP header. Some applications can use non-assigned IP protocol numbers to send malicious packets. 4. Ascend DoS Attack: Protocol is UDP, destination port is 9, UDP packet is mal-formed. 5. Chargen DoS Attack: The attack consists of a flood of UDP datagram's sent to the subnet broadcast address with the destination port set to 19 (chargen) and a spoofed source IP address. 6. Fraggle DoS Attack: When a perpetrator sends a large number of UDP echo (ping) traffic at IP broadcast addresses, all of it having a fake source address 7. ICMP Router Solicit DoS Attack: If the packet received from the network is an ICMP packet type 10 then it's an ICMP router discovery messages called Router Solicitations. 8. ICMP Router Advertisement DoS Attack: Enable this check in firewall to drop route advertisement packets. Route advertisements are used by neighboring hosts to configure their route table. These messages can be used by attackers to configure routes on hosts to re-direct traffic. 9. IP Source Route Option DoS Attack: Enable this check in firewall to drop packets with source route option set in IP header. 10. Snork DoS Attack: Enable this check in firewall to deny UDP or TCP packets with destination port set to 135 and source port set to either 7,19 or 135. This can cause packets to be exchanged indefinitely between the two hosts causing them to slow down. 11. FTP Bounce DoS Attack: Enable this check in firewall to drop FTP packets if the IP address encoded in the PORT command does not match the IP address of the FTP client. 12.TCP Intercept DoS Attack: Enable / disable TCP packet interception. This should be enabled for protection against TCP SYN flood attacks. 13. Bcast/Mcast Icmp DoS: By default we consider bcast-mcast ICMP as DoS and drop the packets. | |
| wsSwFirewallDosChecksEntry | 1.3.6.1.4.1.388.14.2.16.1.1.1.2.1 | not-accessible | An entry in the wsSwFirewallDoSChecksTable. | |
| INT wsSwFirewallDosCheckType | 1.3.6.1.4.1.388.14.2.16.1.1.1.2.1.1 | INTEGER | read-only | The Check type for handling the respective DoS Attack. |
| T/F wsSwFirewallDosCheckEnable | 1.3.6.1.4.1.388.14.2.16.1.1.1.2.1.2 | TruthValue | read-write | Status of respective DoS Attack check, True for being enabled and False for being disabled. |
| INT wsSwFirewallDosCheckLogLevel | 1.3.6.1.4.1.388.14.2.16.1.1.1.2.1.3 | INTEGER | read-write | The Current log level for the respective DoS Attack check. The Default is warning(5) and user can modify as per his requirement. Changing the log level will allow the user to enable logging for the respective DoS check to happen at desried level of system logging. Note: setting log level to none(9) will disable the logging even though the check is enabled. |
| wsSwFirewallDosStatsTable | 1.3.6.1.4.1.388.14.2.16.1.1.1.3 | not-accessible | This Table shows the stats related to each kind of DoS attacks supported by the switch, few of them can be configured in the wsSwFirewallDoSChecksTable. 1. Smurf DoS Attack: ICMP echo packets destined to a broadcast IP address. Attackers use this type of packet to bring down a target host by spoofing its IP address and flooding it with ICMP echo responses. 2. Twinge DoS Attack: False ICMP control packets going through the wireless switch. 3. Invalid IP Protocol DoS Attack: Packets with invalid IP protocol value in the IP header. Some applications can use non-assigned IP protocol numbers to send malicious packets. 4. Ascend DoS Attack: Protocol is UDP, destination port is 9, UDP packet is mal-formed. 5. Chargen DoS Attack: The attack consists of a flood of UDP datagram's sent to the subnet broadcast address with the destination port set to 19 (chargen) and a spoofed source IP address. 6. Fraggle DoS Attack: When a perpetrator sends a large number of UDP echo (ping) traffic at IP broadcast addresses, all of it having a fake source address 7. ICMP Router Solicit DoS Attack: If the packet received from the network is an ICMP packet type 10 then it's an ICMP router discovery messages called Router Solicitations. 8. ICMP Router Advertisement DoS Attack: Route advertisements are used by neighboring hosts to configure their route table. These messages can be used by attackers to configure routes on hosts to re-direct traffic. 9. IP Source Route Option DoS Attack: Packets with source route option set in IP header. 10. Snork DoS Attack: UDP or TCP packets with destination port set to 135 and source port set to either 7,19 or 135. This can cause packets to be exchanged indefinitely between the two hosts causing them to slow down. 11. FTP Bounce DoS Attack: FTP packets if the IP address encoded in the PORT command does not match the IP address of the FTP client. 12. TCP Intercept DoS Attack: TCP SYN flood attacks. 13. Bcast/Mcast Icmp DoS: By default we consider bcast-mcast ICMP as DoS and drop the packets. 14. TCP Header Fragmented DoS Attack: TCP packets if the TCP header spans across IP fragments. 15. WINNUKE DoS Attack: Out of band data to the target computer on TCP port 139 (NetBIOS), 16. LAND DoS Attack: The attack involves sending a spoofed TCP SYN packet (connection initiation) with the target host's IP address and an open port as both source and destination. 17. UDP Short Header DoS Attack: A UDP header is a minimum of 8-bytes long. However, some systems (like BeOS) will crash when they receive UDP traffic with header length less than eight 18. TCP Bad Sequence DoS Attack: These types of attack are usually man-in-the-middle attacks where the attacker injects a packet with invalid sequence number to terminate the connection. 19. TCP FIN Scan DoS Attack: It attempts to close a non-existent connection on the server. Either way, it is an error, but systems sometimes give back different error results depending upon whether the desired service is available or not. As a result, the attacker doesn't trigger the normal logging of the system. However, this type of scan does result in weird network traffic. 20. TCP NULL Scan DoS Attack: A TCP frame with a sequence number of zero and all control bits are set to zero. 21. TCP XMAS Scan DoS Attack: A TCP frame with a sequence number of zero and the FIN, URG, and PUSH bits are all set. 22. TCP Post SYN Scan DoS Attack: This attack is caused when an attacker tries to send TCP packet with SYN flag set after the connection is established. 23. IP TTL zero DoS Attack: An IP packet set with ttl zero leading the packet to be dropped before reaching it's destination. 24. IP Spoof DoS Attack: IP datagram is treated as spoofed if the source IP address does not belong to the subnet from where the packet arrived. Most of the DoS attacks use spoofed IP addresses so that it is difficult to trace the origin of the attack. | |
| wsSwFirewallDosStatsEntry | 1.3.6.1.4.1.388.14.2.16.1.1.1.3.1 | not-accessible | An entry in the wsSwFirewallDoSStatsTable. | |
| INT wsSwFirewallDosStatsAttackType | 1.3.6.1.4.1.388.14.2.16.1.1.1.3.1.1 | INTEGER | read-only | The Check type for handling the respective DoS Attack. |
| C32 wsSwFirewallDosStatsAttackCount | 1.3.6.1.4.1.388.14.2.16.1.1.1.3.1.2 | Counter32 | read-only | The count of the number of attacks seen. |
| TIK wsSwFirewallDosStatsLastOccurrence | 1.3.6.1.4.1.388.14.2.16.1.1.1.3.1.3 | TimeTicks | read-only | The last occurrence of the attack. |
| wsSwFirewallL2If | 1.3.6.1.4.1.388.14.2.16.1.1.2 | |||
| wsSwFirewallL2Table | 1.3.6.1.4.1.388.14.2.16.1.1.2.1 | not-accessible | Physical/aggregate port interface configuration for ARP rate-limiting/ARP Spoof Detection and bcast/mcast/ucast storm suppression. Maximum permissible rate of ARP packets per interface is configured in terms of ARP packets/s. When the configured threshold is crossed, a warning is posted to the console through syslog. Interfaces are configured to be DHCP trusted or ARP trusted. DHCP responses coming from DHCP trusted interfaces are used for building the trusted IP-MAC binding table. ARP messages coming through ARP trusted interfaces are not subjected to ARP spoof checking. | |
| wsSwFirewallL2Entry | 1.3.6.1.4.1.388.14.2.16.1.1.2.1.1 | not-accessible | L2 Fw interface level configuration table for ARP spoof detection and ARP rate limiting | |
| OCT wsSwFirewallIfName | 1.3.6.1.4.1.388.14.2.16.1.1.2.1.1.1 | OCTET STRING | read-only | layer2 interface name on which ARP Limit/DHCP trust/ARP trust is configured. For eg names like ge1-ge4 and sa1-sa4 |
| U32 wsSwFirewallARPRate | 1.3.6.1.4.1.388.14.2.16.1.1.2.1.1.2 | Unsigned32 | read-create | ARP Rate Limit set in packets/second through this interface. Interface refers to physical/aggregate port interfaces. |
| T/F wsSwFirewallDHCPTrustEnable | 1.3.6.1.4.1.388.14.2.16.1.1.2.1.1.3 | TruthValue | read-create | State of DHCP trust on this interface. |
| T/F wsSwFirewallARPTrustEnable | 1.3.6.1.4.1.388.14.2.16.1.1.2.1.1.4 | TruthValue | read-create | State of ARP trust on this interface. |
| U32 wsSwFirewallBcastStormCtrlInRate | 1.3.6.1.4.1.388.14.2.16.1.1.2.1.1.5 | Unsigned32 | read-create | High threshold for broadcast packets coming in from this physical/aggregate interface |
| U32 wsSwFirewallMcastStormCtrlInRate | 1.3.6.1.4.1.388.14.2.16.1.1.2.1.1.6 | Unsigned32 | read-create | High threshold for multicast packets coming in from this physical/aggregate interface |
| U32 wsSwFirewallUcastStormCtrlInRate | 1.3.6.1.4.1.388.14.2.16.1.1.2.1.1.7 | Unsigned32 | read-create | High threshold for unicast packets coming in from this physical/aggregate interface |
| ABB wsSwFirewallL2RowStatus | 1.3.6.1.4.1.388.14.2.16.1.1.2.1.1.8 | AbbrevRowStatus | read-create | Description. |
| wsSwFirewallWlan | 1.3.6.1.4.1.388.14.2.16.1.1.3 | |||
| wsSwFirewallWlanTable | 1.3.6.1.4.1.388.14.2.16.1.1.3.1 | not-accessible | Per wlan configuration table for b/m/u cast storm suppression,ARP spoof detection and rogue MU detection Bcast/Mcast/Ucast Storm Suppression. A high threshold and a low threshold is configured per wlan, in IN direction.When the rate of b/m/u cast packets exceeds the high threshold configured for a wlan, all packets are throttled till the rate falls below the configured rate. When the rate of b/m/u cast packets exceeds the configured threshold, a warning is posted to the console if logging is enabled. Thresholds are configured in terms of packets/second. ARP spoof Detection Marking DHCP and ARP trust on wlan indices for ARP spoof detection Rogue MU Detection MUs pumping denied traffic are either de-authentiacted or a warning posted through syslog based on a user configurable per wlan threshold of allowed MU denies per second. It's not necessary that the MU hit the same deny rule for triggering the action. It's the cumulative number of denials within the specified period that leads to the action. Logging of the event is a must, though deauthentication is optional. | |
| wsSwFirewallWlanEntry | 1.3.6.1.4.1.388.14.2.16.1.1.3.1.1 | not-accessible | Wlan level configuration table for ARP spoof detection,ARP rate limiting Bcast storm suppression and Rogue MU traffic detection | |
| INT wsSwFirewallWlanIndex | 1.3.6.1.4.1.388.14.2.16.1.1.3.1.1.1 | INTEGER | read-only | Wlan index on which to set l2fw configurations. |
| U32 wsSwFirewallWlanBcastStormCtrlInRate | 1.3.6.1.4.1.388.14.2.16.1.1.3.1.1.2 | Unsigned32 | read-create | High Level threshold for broadcast packets coming from a WLAN |
| U32 wsSwFirewallWlanMcastStormCtrlInRate | 1.3.6.1.4.1.388.14.2.16.1.1.3.1.1.3 | Unsigned32 | read-create | High Level threshold for multicast packets coming from a WLAN |
| U32 wsSwFirewallWlanUcastStormCtrlInRate | 1.3.6.1.4.1.388.14.2.16.1.1.3.1.1.4 | Unsigned32 | read-create | High Level threshold for packets having unknown unicast address as destination coming from a WLAN |
| U32 wsSwFirewallWlanAllowedMUDeniesPerSecond | 1.3.6.1.4.1.388.14.2.16.1.1.3.1.1.5 | Unsigned32 | read-create | Permissble rate of denies for a mobile-unit in the wlan This is counted in terms of denied/packets/second from that MU |
| T/F wsSwFirewallWlanMUDeauthenticate | 1.3.6.1.4.1.388.14.2.16.1.1.3.1.1.6 | TruthValue | read-create | Option to de-authenthenticate the MU on hitting the threshold value configured. |
| T/F wsSwFirewallWlanDHCPTrustEnable | 1.3.6.1.4.1.388.14.2.16.1.1.3.1.1.7 | TruthValue | read-create | DHCP trust state on this wlan. |
| T/F wsSwFirewallWlanARPTrustEnable | 1.3.6.1.4.1.388.14.2.16.1.1.3.1.1.8 | TruthValue | read-create | ARP trust state on this wlan. |
| U32 wsSwFirewallWlanARPRate | 1.3.6.1.4.1.388.14.2.16.1.1.3.1.1.9 | Unsigned32 | read-create | ARP rate-limit threshold specified in ARPpackets/second unit. |
| ABB wsSwFirewallWlanRowStatus | 1.3.6.1.4.1.388.14.2.16.1.1.3.1.1.10 | AbbrevRowStatus | read-create | Description. |
| wsSwFirewallDhcpSnoop | 1.3.6.1.4.1.388.14.2.16.1.1.4 | |||
| wsSwFirewallDhcpSnoopTable | 1.3.6.1.4.1.388.14.2.16.1.1.4.1 | not-accessible | Dynamic IP-MAC binding table built up on the basis of DHCP Server responses | |
| wsSwFirewallDhcpSnoopEntry | 1.3.6.1.4.1.388.14.2.16.1.1.4.1.1 | not-accessible | IP-MAC Binding Table Entry | |
| I32 wsSwFirewallDhcpSnoopIndex | 1.3.6.1.4.1.388.14.2.16.1.1.4.1.1.1 | Integer32 | read-only | Simple index number of snoop entries |
| IP wsSwFirewallDhcpSnoopIpAddr | 1.3.6.1.4.1.388.14.2.16.1.1.4.1.1.2 | IpAddress | read-only | Description. IP address of the client |
| INT wsSwFirewallDhcpSnoopVlanId | 1.3.6.1.4.1.388.14.2.16.1.1.4.1.1.3 | INTEGER | read-only | Vlan id of the client |
| PHY wsSwFirewallDhcpSnoopMACAddr | 1.3.6.1.4.1.388.14.2.16.1.1.4.1.1.4 | PhysAddress | read-only | MAC address of the client |
| BIT wsSwFirewallDhcpSnoopType | 1.3.6.1.4.1.388.14.2.16.1.1.4.1.1.5 | Bits | read-only | The snoop entry can be a combination of the following bits.Valid combinations are client-router, server-router, client-router-vrrp, client-router-hsrp, server-router-vrrp, server-router-hsrp, client, router, server, vrrp-router, hsrp-router. If none of the bits are set, it's the switch svi |
| I32 wsSwFirewallDhcpSnoopLeaseTime | 1.3.6.1.4.1.388.14.2.16.1.1.4.1.1.6 | Integer32 | read-only | Lease time for the binding entry |
| OCT wsSwFirewallDhcpSnoopIngressPort | 1.3.6.1.4.1.388.14.2.16.1.1.4.1.1.7 | OCTET STRING | read-only | Name of Port/Wlan through which packet from this entity ingresses.(eg: ge1, wlan1) |
| wsSwFirewallLogging | 1.3.6.1.4.1.388.14.2.16.1.1.5 | |||
| INT wsSwFirewallArpLogLvl | 1.3.6.1.4.1.388.14.2.16.1.1.5.1 | INTEGER | read-write | Enable Logging when ARP ratelimit is exceeded |
| INT wsSwFirewallBcastLogLvl | 1.3.6.1.4.1.388.14.2.16.1.1.5.2 | INTEGER | read-write | Enable logging when broadcast rate-limit is exceeded |
| INT wsSwFirewallMcastLogLvl | 1.3.6.1.4.1.388.14.2.16.1.1.5.3 | INTEGER | read-write | Enable logging when multicast ratelimit is exceeded |
| INT wsSwFirewallUcastLogLvl | 1.3.6.1.4.1.388.14.2.16.1.1.5.4 | INTEGER | read-write | Enable logging when unicast ratelimit is exceeded |
| wsSwFirewallConf | 1.3.6.1.4.1.388.14.2.16.1.1.100 | |||
| wsSwFirewallCompliances | 1.3.6.1.4.1.388.14.2.16.1.1.100.1 | |||
| wsSwFirewallCompliance | 1.3.6.1.4.1.388.14.2.16.1.1.100.1.1 | Description. | ||
| wsSwFirewallGroups | 1.3.6.1.4.1.388.14.2.16.1.1.100.2 | |||
| wsSwFirewallObjectGroup | 1.3.6.1.4.1.388.14.2.16.1.1.100.2.1 | Description. |
RFC description
Symbol Wireless Switch Firewall MIB for DoS attack mitigation and L2/L3 firewall configuration.
Start monitoring Symbol Technologies (Zebra) wireless switches (DoS-check/storm-control threshold and attack-statistics status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.