ZYXEL-DHCP-SNOOPING-MIB

All MIBs › ZYXEL-DHCP-SNOOPING-MIB

Organization: Enterprise Solution ZyXEL

Last Updated: 2012-07-01

Category: ZyXEL Security and Access Control

Description: Manages ZyXEL DHCP snooping to validate DHCP messages and build a trusted binding table per port.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is ZYXEL-DHCP-SNOOPING-MIB?

ZYXEL-DHCP-SNOOPING-MIB is a ZyXEL enterprise MIB module that manages the DHCP Snooping security feature on ZyXEL switches, a Layer 2 access-layer networking technology. It exposes configuration data for enabling/disabling DHCP snooping globally and per-VLAN/port, along with trusted/untrusted port classification and the DHCP binding table that records validated client IP-to-MAC-to-port bindings. In monitoring terms it is used mainly to confirm the software configuration/state of the anti-spoofing feature (whether snooping is enabled, which ports are trusted) and to inspect the live binding table for anomalies, rather than hardware sensor data. It commonly depends on or complements standard bridge/VLAN MIBs (BRIDGE-MIB, Q-BRIDGE-MIB) since bindings are tied to VLAN and port identifiers. It is deployed on ZyXEL managed switches in enterprise or SMB access networks to protect against rogue DHCP servers and IP/MAC spoofing. Engineers can download the ZYXEL-DHCP-SNOOPING-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in ZYXEL-DHCP-SNOOPING-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

ZyXEL managed switch

Monitoring Examples

An administrator would poll the per-port trusted/untrusted status and the DHCP binding table (recording IP address, MAC address, VLAN, and port for each DHCP-assigned client) to verify that only legitimate DHCP-assigned addresses are present on untrusted ports. An unexpected or missing binding entry, or an entry appearing on a port that should be trust-disabled, can reveal a rogue DHCP server or an IP-spoofing attempt on the network. Since no object names were captured in sample_objects, this example is grounded in the module's stated purpose (the dhcp snooping subtree) rather than confirmed object names.

What Can Be Monitored

DHCP snooping enable/disable state
per-port trusted/untrusted status
DHCP binding table (IP/MAC/VLAN/port)

Imported Objects

From BRIDGE-MIB

dot1dBasePort

OBJECT-TYPE

From P-BRIDGE-MIB

EnabledStatus

From SNMPv2-SMI

MODULE-IDENTITY
OBJECT-TYPE

From SNMPv2-TC

DisplayString

From ZYXEL-ES-SMI

esMgmt

OBJECT-IDENTITY

OIDs

OID symbolic	OID numeric	Type	Access	Description
zyxelDhcpSnooping	1.3.6.1.4.1.890.1.15.3.20			The subtree for dhcp snooping
zyxelDhcpSnoopingSetup	1.3.6.1.4.1.890.1.15.3.20.1
ENA zyDhcpSnoopingState	1.3.6.1.4.1.890.1.15.3.20.1.1	EnabledStatus	read-write	Enable/Disable DHCP snooping on this switch.
zyxelDhcpSnoopingVlanTable	1.3.6.1.4.1.890.1.15.3.20.1.2		not-accessible	The table contains DHCP snooping VLAN configuration.
zyxelDhcpSnoopingVlanEntry	1.3.6.1.4.1.890.1.15.3.20.1.2.1		not-accessible	An entry contains DHCP snooping VLAN configuration.
INT zyDhcpSnoopingVlanVid	1.3.6.1.4.1.890.1.15.3.20.1.2.1.1	INTEGER	not-accessible	The VLAN ID of each VLAN.
ENA zyDhcpSnoopingVlanState	1.3.6.1.4.1.890.1.15.3.20.1.2.1.2	EnabledStatus	read-write	Enable/Disable DHCP snooping on the VLAN.
STR zyDhcpSnoopingVlanOption82Profile	1.3.6.1.4.1.890.1.15.3.20.1.2.1.3	DisplayString	read-write	The name of DHCP option 82 Profile.
zyxelDhcpSnoopingPortTable	1.3.6.1.4.1.890.1.15.3.20.1.3		not-accessible	The table contains DHCP snooping port configuration.
zyxelDhcpSnoopingPortEntry	1.3.6.1.4.1.890.1.15.3.20.1.3.1		not-accessible	An entry contains DHCP snooping port configuration.
ENA zyDhcpSnoopingPortTrustState	1.3.6.1.4.1.890.1.15.3.20.1.3.1.1	EnabledStatus	read-write	Enable/Disable this port to be a trusted port (enable) or an un-trusted port (disable).
INT zyDhcpSnoopingPortRate	1.3.6.1.4.1.890.1.15.3.20.1.3.1.2	INTEGER	read-write	Enter the maximum number for DHCP packets (1-2048) that the switch receives from each port each second. The switch discards any additional DHCP packets. Enter 0 to disable this limit, which is recommended for trusted ports.
zyxelDhcpSnoopingDb	1.3.6.1.4.1.890.1.15.3.20.1.4
INT zyDhcpSnoopingDbAbort	1.3.6.1.4.1.890.1.15.3.20.1.4.1	INTEGER	read-write	Enter how long (10-65535 seconds) the switch tries to complete a specific update in the DHCP snooping database before it gives up.
INT zyDhcpSnoopingDbWriteDelay	1.3.6.1.4.1.890.1.15.3.20.1.4.2	INTEGER	read-write	Enter how long (10-65535 seconds) the switch waits to update the DHCP snooping database the first time the current bindings change after an update. Once the next update is scheduled, additional changes in current bindings are automatically included in the next update.
STR zyDhcpSnoopingDbUrl	1.3.6.1.4.1.890.1.15.3.20.1.4.3	DisplayString	read-write	Enter the location of the DHCP snooping database. The location should be expressed like this: tftp://{domain name or IP address}/directory, if applicable/file name; for example, tftp://192.168.10.1/database.txt.
STR zyDhcpSnoopingDbUrlRenew	1.3.6.1.4.1.890.1.15.3.20.1.4.4	DisplayString	read-write	Enter the location of a DHCP snooping database. You can use this to load dynamic bindings from a different DHCP snooping database than the one specified in Agent URL.
zyxelDhcpSnoopingDhcpVlan	1.3.6.1.4.1.890.1.15.3.20.1.5
INT zyDhcpSnoopingDhcpVlanVid	1.3.6.1.4.1.890.1.15.3.20.1.5.1	INTEGER	read-write	Enter a VLAN ID if you want the switch to forward DHCP packets to DHCP servers on a specific VLAN. Value 0 means to disable DHCP VLAN, if you do not want the switch to forward DHCP packets to a specific VLAN.
INT zyDhcpSnoopingMaxNumberOfOption82VlanPort	1.3.6.1.4.1.890.1.15.3.20.1.6	INTEGER	read-only	The maximum number of DHCP snooping Option82 VLAN port entries that can be created.
zyxelDhcpSnoopingOption82VlanPortTable	1.3.6.1.4.1.890.1.15.3.20.1.7		not-accessible	The table contains DHCP snooping Option82 VLAN port configuration.
zyxelDhcpSnoopingOption82VlanPortEntry	1.3.6.1.4.1.890.1.15.3.20.1.7.1		not-accessible	An entry contains DHCP snooping Option82 VLAN port configuration.
STR zyDhcpSnoopingOption82VlanPortProfile	1.3.6.1.4.1.890.1.15.3.20.1.7.1.1	DisplayString	read-create	DHCP option 82 profile in specified VLAN and port.
zyxelDhcpSnoopingStatus	1.3.6.1.4.1.890.1.15.3.20.2
ENA zyDhcpSnoopingDbStatisticsClear	1.3.6.1.4.1.890.1.15.3.20.2.1	EnabledStatus	read-write	This entry can clear these counters of DHCP snooping statistics status.
zyxelDhcpSnoopingDbStatistics	1.3.6.1.4.1.890.1.15.3.20.2.2
INT zyDhcpSnoopingDbStatisticsAgentRunning	1.3.6.1.4.1.890.1.15.3.20.2.2.1	INTEGER	read-only	This entry displays the status of the current update or access of the DHCP snooping database. none: The switch is not accessing the DHCP snooping database. read: The switch is loading dynamic bindings from the DHCP snooping database. write: The switch is updating the DHCP snooping database.
INT zyDhcpSnoopingDbStatisticsDelayExpiry	1.3.6.1.4.1.890.1.15.3.20.2.2.2	INTEGER	read-only	This entry displays how much longer (in seconds) the switch tries to complete the current update before it gives up.
INT zyDhcpSnoopingDbStatisticsAbortExpiry	1.3.6.1.4.1.890.1.15.3.20.2.2.3	INTEGER	read-only	This entry displays when (in seconds) the switch is going to update the DHCP snooping database again.
STR zyDhcpSnoopingDbStatisticsLastSuccessTime	1.3.6.1.4.1.890.1.15.3.20.2.2.4	DisplayString	read-only	This entry displays the last time the switch updated the DHCP snooping database successfully.
STR zyDhcpSnoopingDbStatisticsLastFailTime	1.3.6.1.4.1.890.1.15.3.20.2.2.5	DisplayString	read-only	This entry displays the last time the switch updated the DHCP snooping database unsuccessfully.
STR zyDhcpSnoopingDbStatisticsLastFailReasonType	1.3.6.1.4.1.890.1.15.3.20.2.2.6	DisplayString	read-only	This entry displays the reason the switch updated the DHCP snooping database unsuccessfully.
INT zyDhcpSnoopingDbStatisticsTotalAttempt	1.3.6.1.4.1.890.1.15.3.20.2.2.7	INTEGER	read-only	This entry displays the number of times the switch has tried to access the DHCP snooping database for any reason.
INT zyDhcpSnoopingDbStatisticsStartupFail	1.3.6.1.4.1.890.1.15.3.20.2.2.8	INTEGER	read-only	This entry displays the number of times the switch could not create or read the DHCP snooping database when the switch started up or a new URL is configured for the DHCP snooping database.
INT zyDhcpSnoopingDbStatisticsSuccessTrans	1.3.6.1.4.1.890.1.15.3.20.2.2.9	INTEGER	read-only	This entry displays the number of times the switch read bindings from or updated the bindings in the DHCP snooping database successfully.
INT zyDhcpSnoopingDbStatisticsFailTrans	1.3.6.1.4.1.890.1.15.3.20.2.2.10	INTEGER	read-only	This entry displays the number of times the switch was unable to read bindings from or update the bindings in the DHCP snooping database.
INT zyDhcpSnoopingDbStatisticsSuccessRead	1.3.6.1.4.1.890.1.15.3.20.2.2.11	INTEGER	read-only	This entry displays the number of times the switch read bindings from the DHCP snooping database successfully.
INT zyDhcpSnoopingDbStatisticsFailRead	1.3.6.1.4.1.890.1.15.3.20.2.2.12	INTEGER	read-only	This entry displays the number of times the switch was unable to read bindings from the DHCP snooping database.
INT zyDhcpSnoopingDbStatisticsSuccessWrite	1.3.6.1.4.1.890.1.15.3.20.2.2.13	INTEGER	read-only	This entry displays the number of times the switch updated the bindings in the DHCP snooping database successfully.
INT zyDhcpSnoopingDbStatisticsFailWrite	1.3.6.1.4.1.890.1.15.3.20.2.2.14	INTEGER	read-only	This entry displays the number of times the switch was unable to update the bindings in the DHCP snooping database.
INT zyDhcpSnoopingDbStatisticsFirstSuccessAccess	1.3.6.1.4.1.890.1.15.3.20.2.2.15	INTEGER	read-only	This entry displays the first time the switch accessed the DHCP snooping database for any reason.
INT zyDhcpSnoopingDbStatisticsLastIgnoreBindCollision	1.3.6.1.4.1.890.1.15.3.20.2.2.16	INTEGER	read-only	This entry displays the number of bindings the switch ignored because the switch already had a binding with the same MAC address and VLAN ID.
INT zyDhcpSnoopingDbStatisticsLastIgnoreExpireLease	1.3.6.1.4.1.890.1.15.3.20.2.2.17	INTEGER	read-only	This entry displays the number of bindings the switch ignored because the lease time had already expired.
INT zyDhcpSnoopingDbStatisticsLastIgnoreInvalidInterface	1.3.6.1.4.1.890.1.15.3.20.2.2.18	INTEGER	read-only	This entry displays the number of bindings the switch ignored because the port number was a trusted interface or does not exist anymore.
INT zyDhcpSnoopingDbStatisticsLastIgnoreUnsupportedVlan	1.3.6.1.4.1.890.1.15.3.20.2.2.19	INTEGER	read-only	This entry displays the number of bindings the switch ignored because the VLAN ID does not exist anymore.
INT zyDhcpSnoopingDbStatisticsLastIgnoreParse	1.3.6.1.4.1.890.1.15.3.20.2.2.20	INTEGER	read-only	This entry displays the number of bindings the switch ignored because the switch was unable to understand the binding in the DHCP binding database.
INT zyDhcpSnoopingDbStatisticsTotalIgnoreBindCollision	1.3.6.1.4.1.890.1.15.3.20.2.2.21	INTEGER	read-only	This entry displays the total number of bindings the switch has ignored because the switch already had a binding with the same MAC address and VLAN ID.
INT zyDhcpSnoopingDbStatisticsTotalIgnoreExpireLease	1.3.6.1.4.1.890.1.15.3.20.2.2.22	INTEGER	read-only	This entry displays the total number of bindings the switch has ignored because the lease time had already expired.
INT zyDhcpSnoopingDbStatisticsTotalIgnoreInvalidInterface	1.3.6.1.4.1.890.1.15.3.20.2.2.23	INTEGER	read-only	This entry displays the total number of bindings the switch has ignored because the port number was a trusted interface or does not exist anymore.
INT zyDhcpSnoopingDbStatisticsTotalIgnoreUnsupportedVlan	1.3.6.1.4.1.890.1.15.3.20.2.2.24	INTEGER	read-only	This entry displays the total number of bindings the switch has ignored because the VLAN id does not exist anymore.
INT zyDhcpSnoopingDbStatisticsTotalIgnoreParse	1.3.6.1.4.1.890.1.15.3.20.2.2.25	INTEGER	read-only	This entry displays the total number of bindings the switch has ignored because the switch was unable to understand the binding in the DHCP binding database.

RFC description

ZyXEL DHCP snooping management with per-VLAN and per-port option 82 support.

Start monitoring ZyXEL managed switch (DHCP-snooping trusted-port/binding-table status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download ZYXEL-DHCP-SNOOPING-MIB

What Is ZYXEL-DHCP-SNOOPING-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description