ZYXEL-ARP-INSPECTION-MIB

All MIBs › ZYXEL-ARP-INSPECTION-MIB

Organization: Enterprise Solution ZyXEL

Last Updated: 2012-07-01

Category: ZyXEL Security and Access Control

Description: Manages ZyXEL dynamic ARP inspection to validate ARP packets and prevent ARP spoofing attacks.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is ZYXEL-ARP-INSPECTION-MIB?

ZYXEL-ARP-INSPECTION-MIB is a ZyXEL private module implementing Dynamic ARP Inspection (DAI), a security feature that validates ARP packets against a trusted binding table to prevent ARP spoofing/man-in-the-middle attacks on ZyXEL switches. It exposes configuration objects for enabling inspection per VLAN/port and defining trusted ports, along with statistics/status for ARP packets validated, dropped, or logged. Its monitoring value is significant from a security-fault perspective: administrators track dropped/invalid ARP packet counts and per-port trust/inspection status to detect an active ARP-spoofing attempt or a misconfigured trusted port that could bypass protection. It typically works together with DHCP snooping MIBs, since DAI relies on the DHCP snooping binding table to validate ARP entries. It is deployed on ZyXEL access-layer switches in networks where protection against ARP spoofing is required, such as enterprise or campus edge networks, and administrators can download the ZYXEL-ARP-INSPECTION-MIB file to load it into their MIB browser for security monitoring.

IPNetwork Monitor allows you to monitor SNMP objects defined in ZYXEL-ARP-INSPECTION-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

ZyXEL managed switch

Monitoring Examples

No sample objects were provided for this module, so specific object names cannot be cited; conceptually, an administrator would poll per-VLAN/port ARP inspection enable status and dropped-packet counters to confirm the feature is active and functioning. A rising count of dropped ARP packets on a given port would indicate an active spoofing attempt or a misbehaving host on that port.

What Can Be Monitored

ARP inspection enable status per VLAN/port
trusted port configuration
dropped/invalid ARP packet count

Imported Objects

From BRIDGE-MIB

dot1dBasePort

OBJECT-TYPE

From P-BRIDGE-MIB

EnabledStatus

From SNMPv2-SMI

Counter32
IpAddress
MODULE-IDENTITY
OBJECT-TYPE

From SNMPv2-TC

DateAndTime
MacAddress

From ZYXEL-ES-SMI

esMgmt

OBJECT-IDENTITY

How to Use in IPNetwork Monitor

Example using zyArpInspectStatisticsReceived OID:

Select a ZyXEL managed switch (Dynamic ARP Inspection trusted-port/dropped-packet-count status) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type zyArpInspectStatisticsReceived into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. This field displays the total number of ARP packets received from the VLAN since the switch last restarted. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
zyxelArpInspection	1.3.6.1.4.1.890.1.15.3.12			The subtree for arp inspection
zyxelArpInspectSetup	1.3.6.1.4.1.890.1.15.3.12.1
ENA zyArpInspectState	1.3.6.1.4.1.890.1.15.3.12.1.1	EnabledStatus	read-write	Enable/Disable ARP inspection on the switch.
INT zyArpInspectFilterAgingTime	1.3.6.1.4.1.890.1.15.3.12.1.2	INTEGER	read-write	Enter how long (1-2147483647 seconds) the MAC address filter remains in the switch after the switch identifies an unauthorized ARP packet. The switch automatically deletes the MAC address filter afterwards. Type 0 if you want the MAC address filter to be permanent.
zyxelArpInspectLog	1.3.6.1.4.1.890.1.15.3.12.1.3
INT zyArpInspectLogEntries	1.3.6.1.4.1.890.1.15.3.12.1.3.1	INTEGER	read-write	Enter the maximum number (1-1024) of log messages that were generated by ARP packets and have not been sent to the syslog server yet. Make sure this number is appropriate for the specified syslog rate and Log interval. If the number of log messages in the switch exceeds this number, the switch stops recording log messages and simply starts counting the number of entries that were dropped due to unavailable buffer.
INT zyArpInspectLogRate	1.3.6.1.4.1.890.1.15.3.12.1.3.2	INTEGER	read-write	Enter the maximum number of syslog messages the switch can send to the syslog server in one batch. This number is expressed as a rate because the batch frequency is determined by the Log Interval. You must configure the syslog server to use this. Enter 0 if you do not want the switch to send log messages generated by ARP packets to the syslog server.
INT zyArpInspectLogInterval	1.3.6.1.4.1.890.1.15.3.12.1.3.3	INTEGER	read-write	Enter how often (1-86400 seconds) the switch sends a batch of syslog messages to the syslog server. Enter 0 if you want the switch to send syslog messages immediately.
zyxelArpInspectVlanTable	1.3.6.1.4.1.890.1.15.3.12.1.4		not-accessible	The table contains ARP inspection VLAN configuration.
zyxelArpInspectVlanEntry	1.3.6.1.4.1.890.1.15.3.12.1.4.1		not-accessible	An entry contains ARP inspection VLAN configuration.
INT zyArpInspectVlanVid	1.3.6.1.4.1.890.1.15.3.12.1.4.1.1	INTEGER	not-accessible	The VLAN ID of each VLAN.
ENA zyArpInspectVlanState	1.3.6.1.4.1.890.1.15.3.12.1.4.1.2	EnabledStatus	read-write	Enable/Disable ARP inspection on the VLAN.
INT zyArpInspectVlanLog	1.3.6.1.4.1.890.1.15.3.12.1.4.1.3	INTEGER	read-write	Specify when the switch generates log messages for receiving ARP packets from the VLAN. None: The switch does not generate any log messages when it receives an ARP packet from the VLAN. Deny: The switch generates log messages when it discards an ARP packet from the VLAN. Permit: The switch generates log messages when it forwards an ARP packet from the VLAN. All: The switch generates log messages every time it receives an ARP packet from the VLAN.
zyxelArpInspectPortTable	1.3.6.1.4.1.890.1.15.3.12.1.5		not-accessible	The table contains ARP inspection port configuration.
zyxelArpInspectPortEntry	1.3.6.1.4.1.890.1.15.3.12.1.5.1		not-accessible	An entry contains ARP inspection port configuration.
ENA zyArpInspectPortTrustState	1.3.6.1.4.1.890.1.15.3.12.1.5.1.1	EnabledStatus	read-write	Enable/Disable this port to be a trusted port (enable) or an untrusted port (disable). The switch does not discard ARP packets on trusted ports for any reason.
INT zyArpInspectPortRate	1.3.6.1.4.1.890.1.15.3.12.1.5.1.2	INTEGER	read-write	Specify the maximum rate (1-2048 packets per second) at which the switch receives ARP packets from each port. The switch discards any additional ARP packets. Enter 0 to disable this limit.
INT zyArpInspectPortInterval	1.3.6.1.4.1.890.1.15.3.12.1.5.1.3	INTEGER	read-write	Enter the length (1-15 seconds) of the burst interval. The burst interval is the length of time over which the rate of ARP packets is monitored for each port. For example, if the Rate is 15 pps and the burst interval is 1 second, then the switch accepts a maximum of 15 ARP packets in every one-second interval. If the burst interval is 5 seconds, then the switch accepts a maximum of 75 ARP packets in every five-second interval.
zyxelArpInspectStatus	1.3.6.1.4.1.890.1.15.3.12.2
ENA zyArpInspectFilterClearAll	1.3.6.1.4.1.890.1.15.3.12.2.1	EnabledStatus	read-write	Delete all ARP inspection filters from the switch.
ENA zyArpInspectLogClear	1.3.6.1.4.1.890.1.15.3.12.2.2	EnabledStatus	read-write	Delete all ARP inspection log from the switch.
zyxelArpInspectFilterTable	1.3.6.1.4.1.890.1.15.3.12.2.3		not-accessible	The table contains ARP inspection filter information.
zyxelArpInspectFilterEntry	1.3.6.1.4.1.890.1.15.3.12.2.3.1		not-accessible	An entry contains ARP inspection filter information.
MAC zyArpInspectFilterMacAddress	1.3.6.1.4.1.890.1.15.3.12.2.3.1.1	MacAddress	not-accessible	This field displays the source MAC address in ARP inspection filter.
INT zyArpInspectFilterVid	1.3.6.1.4.1.890.1.15.3.12.2.3.1.2	INTEGER	not-accessible	This field displays the source VLAN ID in ARP inspection filter.
INT zyArpInspectFilterPort	1.3.6.1.4.1.890.1.15.3.12.2.3.1.3	INTEGER	read-only	This field displays the source port of the discarded ARP packet.
INT zyArpInspectFilterExpiry	1.3.6.1.4.1.890.1.15.3.12.2.3.1.4	INTEGER	read-only	This field displays how long (in seconds) the ARP inspection filter remains in the switch.
INT zyArpInspectFilterReasonType	1.3.6.1.4.1.890.1.15.3.12.2.3.1.5	INTEGER	read-only	This field displays the reason the ARP packet was discarded. MAC+VLAN: The MAC address and VLAN ID were not in the binding table. IP: The MAC address and VLAN ID were in the binding table, but the IP address was not valid. Port: The MAC address, VLAN ID, and IP address were in the binding table, but the port number was not valid.
ENA zyArpInspectFilterClear	1.3.6.1.4.1.890.1.15.3.12.2.3.1.6	EnabledStatus	read-create	This object allow entry to be deleted an ARP inspect filter entry.
zyxelArpInspectLogTable	1.3.6.1.4.1.890.1.15.3.12.2.4		not-accessible	The table contains ARP inspection log information.
zyxelArpInspectLogEntry	1.3.6.1.4.1.890.1.15.3.12.2.4.1		not-accessible	An entry contains ARP inspection log information.
MAC zyArpInspectLogMacAdderss	1.3.6.1.4.1.890.1.15.3.12.2.4.1.1	MacAddress	not-accessible	This field displays the source MAC address of the ARP packet.
INT zyArpInspectLogVid	1.3.6.1.4.1.890.1.15.3.12.2.4.1.2	INTEGER	not-accessible	This field displays the source VLAN ID of the ARP packet.
INT zyArpInspectLogPort	1.3.6.1.4.1.890.1.15.3.12.2.4.1.3	INTEGER	not-accessible	This field displays the source port of the ARP packet.
IP zyArpInspectLogIpAddress	1.3.6.1.4.1.890.1.15.3.12.2.4.1.4	IpAddress	not-accessible	This field displays the source IP address of the ARP packet.
INT zyArpInspectLogNumberPacket	1.3.6.1.4.1.890.1.15.3.12.2.4.1.5	INTEGER	read-only	This field displays the number of ARP packets that were consolidated into this log message. The switch consolidates identical log messages generated by ARP packets in the log consolidation interval into one log message.
INT zyArpInspectLogReasonType	1.3.6.1.4.1.890.1.15.3.12.2.4.1.6	INTEGER	not-accessible	This field displays the reason the log message was generated. dhcp deny: An ARP packet was discarded because it violated a dynamic binding with the same MAC address and VLAN ID. static deny: An ARP packet was discarded because it violated a static binding with the same MAC address and VLAN ID. deny: An ARP packet was discarded because there were no bindings with the same MAC address and VLAN ID. dhcp permit: An ARP packet was forwarded because it matched a dynamic binding. static permit: An ARP packet was forwarded because it matched a static binding.
DAT zyArpInspectLogTime	1.3.6.1.4.1.890.1.15.3.12.2.4.1.7	DateAndTime	read-only	This field displays when the log message was generated.
zyxelArpInspectStatisticsTable	1.3.6.1.4.1.890.1.15.3.12.2.5		not-accessible	The table contains ARP inspection statistics information.
zyxelArpInspectStatisticsEntry	1.3.6.1.4.1.890.1.15.3.12.2.5.1		not-accessible	An entry contains ARP inspection statistics information.
INT zyArpInspectStatisticsVid	1.3.6.1.4.1.890.1.15.3.12.2.5.1.1	INTEGER	not-accessible	The VLAN ID of each VLAN.
C32 zyArpInspectStatisticsReceivedEx	1.3.6.1.4.1.890.1.15.3.12.2.5.1.2	Counter32	read-only	This field displays the total number of ARP packets received from the VLAN since the switch last restarted.
C32 zyArpInspectStatisticsRequest	1.3.6.1.4.1.890.1.15.3.12.2.5.1.3	Counter32	read-only	This field displays the total number of ARP Request packets received from the VLAN since the switch last restarted.
C32 zyArpInspectStatisticsReply	1.3.6.1.4.1.890.1.15.3.12.2.5.1.4	Counter32	read-only	This field displays the total number of ARP Reply packets received from the VLAN since the switch last restarted.
C32 zyArpInspectStatisticsForward	1.3.6.1.4.1.890.1.15.3.12.2.5.1.5	Counter32	read-only	This field displays the total number of ARP packets the switch forwarded for the VLAN since the switch last restarted.
C32 zyArpInspectStatisticsDrop	1.3.6.1.4.1.890.1.15.3.12.2.5.1.6	Counter32	read-only	This field displays the total number of ARP packets the switch discarded for the VLAN since the switch last restarted.
ENA zyArpInspectStatisticsClear	1.3.6.1.4.1.890.1.15.3.12.2.5.1.7	EnabledStatus	read-write	Removes ARP inspection statistics for the specified VLAN.

RFC description

Monitors and manages ARP inspection to detect unauthorized ARP packets on ZyXEL switches.

Start monitoring ZyXEL managed switch (Dynamic ARP Inspection trusted-port/dropped-packet-count status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download ZYXEL-ARP-INSPECTION-MIB