Login
- Table of Contents
- Related Documents
-
| Title | Size | Download |
|---|---|---|
| 03-HH3C-IPSG-MIB | 121.40 KB |
Contents
HH3C-IPSG-MIB
About this MIB
Use this MIB to configure report of notifications for the IP Source Guard (IPSG) module.
MIB file name
hh3c-ipsg.mib
Root object
iso(1).org(3).dod(6).internet(1).private(4).enterprises(1).hh3c(25506).hh3cCommon(2).hh3cIpsg(246)
Scalar objects
hh3cIpsgDropFamily
|
Object (OID) |
Access |
Syntax |
Value range |
Description |
Implementation |
|
hh3cIpsgDropFamily (1.3.6.1.4.1.25506.2.246.1.1.1) |
accessible-for-notify |
InetAddressType |
ipv4(1), ipv6(2) |
IP protocol family. |
As per the MIB. |
hh3cIpsgDropIfName
|
Object (OID) |
Access |
Syntax |
Value range |
Description |
Implementation |
|
hh3cIpsgDropIfName (1.3.6.1.4.1.25506.2.246.1.1.2) |
accessible-for-notify |
OCTET STRING |
OCTET STRING (0..255) |
Interface on which packets are dropped. |
As per the MIB. |
hh3cIpsgDropThreshold
|
Object (OID) |
Access |
Syntax |
Value range |
Description |
Implementation |
|
hh3cIpsgDropThreshold (1.3.6.1.4.1.25506.2.246.1.1.3) |
accessible-for-notify |
Unsigned32 |
Unsigned32(1..1000) |
Packet dropping rate threshold. |
As per the MIB. |
hh3cIpsgDropVlan
|
Object (OID) |
Access |
Syntax |
Value range |
Description |
Implementation |
|
hh3cIpsgDropVlan (1.3.6.1.4.1.25506.2.246.1.1.4) |
accessible-for-notify |
Unsigned32 |
Unsigned32(1..4094) |
ID of the VLAN in which the dropped packets reside. |
As per the MIB. |
hh3cIpsgChassis
|
Object (OID) |
Access |
Syntax |
Value range |
Description |
Implementation |
|
hh3cIpsgChassis (1.3.6.1.4.1.25506.2.246.1.1.5) |
accessible-for-notify |
Unsigned32 |
Standard MIB values. |
ID of the chassis that generated the alarm notification. |
As per the MIB. |
hh3cIpsgSlot
|
Object (OID) |
Access |
Syntax |
Value range |
Description |
Implementation |
|
hh3cIpsgSlot (1.3.6.1.4.1.25506.2.246.1.1.6) |
accessible-for-notify |
Unsigned32 |
Standard MIB values. |
ID of the slot that generated the alarm notification. |
As per the MIB. |
Notifications
hh3cIpsgDropAlarm
Basic information
|
OID |
Event |
Type |
Severity |
Recovery notification |
Default status |
|
1.3.6.1.4.1.25506.2.246.1.0.1 |
The number of packets dropped on an interface reached the threshold. |
Error |
Warning |
1.3.6.1.4.1.25506.2.246.1.0.2 (hh3cIpsgDropAlarmResume) |
ON |
Notification triggers
This notification is generated when the number of packets dropped due to IPSG binding entry mismatching on an interface reaches or exceeds the threshold.
System impact
When this alarm is generated, the device may have been attacked by illegal messages. If the attack traffic is too large, it will consume too many system resources, which may cause interruptions in legitimate user services.
Status control
ON
CLI: Use the snmp-agent trap enable ipsg [ drop-threshold ] command.
OFF
CLI: Use the undo snmp-agent trap enable ipsg [ drop-threshold ] command.
Objects
|
OID (object name) |
Description |
Index nodes |
Type |
Value range |
|
1.3.6.1.4.1.25506.2.246.1.1.1 (hh3cIpsgDropFamily) |
Protocol family. |
N/A |
InetAddressType |
ipv4(1), ipv6(2) |
|
1.3.6.1.4.1.25506.2.246.1.1.2 (hh3cIpsgDropIfName) |
Interface name. |
N/A |
OCTET STRING |
OCTET STRING (0..255) |
|
1.3.6.1.4.1.25506.2.246.1.1.3 (hh3cIpsgDropThreshold) |
Packet dropping rate threshold. |
N/A |
Unsigned32 |
Unsigned32(1..1000) |
|
1.3.6.1.4.1.25506.2.246.1.1.5 (hh3cIpsgChassis) |
ID of the chassis that generated the notification. |
N/A |
Unsigned32 |
Unsigned32(1..2147483647) |
|
1.3.6.1.4.1.25506.2.246.1.1.6 (hh3cIpsgSlot) |
ID of the slot that generated the notification. |
N/A |
Unsigned32 |
Unsigned32(1..2147483647) |
Recommended action
1. In any view, use the display ip source binding/display ipv6 source binding command to view the IPSG binding entries and use port mirroring to capture packets received on the interface.
¡ If a large number of mismatching packets are received, it can be determined that the interface is under attack. Locate the attack source. If the source is legal, configure a static IPSG entry to allow packets from the source to pass through.
¡ If the interface does not receive a large number of mismatching packets, it can be determined that the interface is not under attack. Use the ip verify source alarm/ipv6 verify source alarm command to adjust the alarm threshold.
2. If the issue persists, collect alarm, log, and configuration information, and contact H3C Support.
hh3cIpsgDropAlarmResume
Basic information
|
OID |
Event |
Type |
Severity |
Recovery notification |
Default status |
|
1.3.6.1.4.1.25506.2.246.1.0.2 |
The number of packets dropped on an interface dropped below the threshold. |
Recovery |
Warning |
N/A |
ON |
Notification triggers
This notification is generated when the number of packets dropped due to IPSG binding entry mismatching on an interface drops below the threshold.
System impact
No negative impact on the services.
Status control
ON
CLI: Use the snmp-agent trap enable ipsg [ drop-threshold ] command.
OFF
CLI: Use the undo snmp-agent trap enable ipsg [ drop-threshold ] command.
Objects
|
OID (object name) |
Description |
Index nodes |
Type |
Value range |
|
1.3.6.1.4.1.25506.2.246.1.1.1 (hh3cIpsgDropFamily) |
Protocol family. |
N/A |
InetAddressType |
ipv4(1), ipv6(2) |
|
1.3.6.1.4.1.25506.2.246.1.1.2 (hh3cIpsgDropIfName) |
Interface name. |
N/A |
OCTET STRING |
OCTET STRING (0..255) |
|
1.3.6.1.4.1.25506.2.246.1.1.3 (hh3cIpsgDropThreshold) |
Packet dropping rate threshold. |
N/A |
Unsigned32 |
Unsigned32(1..1000) |
|
1.3.6.1.4.1.25506.2.246.1.1.5 (hh3cIpsgChassis) |
ID of the chassis that generated the notification. |
N/A |
Unsigned32 |
Unsigned32(1..2147483647) |
|
1.3.6.1.4.1.25506.2.246.1.1.6 (hh3cIpsgSlot) |
ID of the slot that generated the notification. |
N/A |
Unsigned32 |
Unsigned32(1..2147483647) |
Recommended action
No action is required.
hh3cIpsgVlanDropAlarm
Basic information
|
OID |
Event |
Type |
Severity |
Recovery notification |
Default status |
|
1.3.6.1.4.1.25506.2.246.1.0.3 |
Number of packets dropped in the VLAN reached the threshold. |
Error |
Warning |
1.3.6.1.4.1.25506.2.246.1.0.4 (hh3cIpsgVlanDropAlarmResume) |
ON |
Notification triggers
This notification is generated when the number of packets dropped due to IPSG binding entry mismatching in a VLAN reaches or exceeds the threshold.
System impact
When this alarm is generated, the device may have been attacked by illegal messages. If the attack traffic is too large, it will consume too many system resources, which may cause interruptions in user services.
Status control
ON
CLI: Use the snmp-agent trap enable ipsg [ drop-threshold ] command.
OFF
CLI: Use the undo snmp-agent trap enable ipsg [ drop-threshold ] command.
Objects
|
OID (object name) |
Description |
Index nodes |
Type |
Value range |
|
1.3.6.1.4.1.25506.2.246.1.1.1 (hh3cIpsgDropFamily) |
Protocol family. |
N/A |
InetAddressType |
ipv4(1), ipv6(2) |
|
1.3.6.1.4.1.25506.2.246.1.1.4 (hh3cIpsgDropVlan) |
ID of the VLAN in which the dropped packets reside. |
N/A |
Unsigned32 |
Unsigned32(1..4094) |
|
1.3.6.1.4.1.25506.2.246.1.1.3 (hh3cIpsgDropThreshold) |
Packet dropping rate threshold. |
N/A |
Unsigned32 |
Unsigned32(1..1000) |
|
1.3.6.1.4.1.25506.2.246.1.1.5 (hh3cIpsgChassis) |
ID of the chassis that generated the notification. |
N/A |
Unsigned32 |
Unsigned32(1..2147483647) |
|
1.3.6.1.4.1.25506.2.246.1.1.6 (hh3cIpsgSlot) |
ID of the slot that generated the notification. |
N/A |
Unsigned32 |
Unsigned32(1..2147483647) |
Recommended action
1. Use the display ip source binding/display ipv6 source binding command in any view to view the IPSG binding entries and use port mirroring to capture packets received in the VLAN.
¡ If a large number of mismatching packets are received, it can be determined that the VLAN is under attack. Locate the attack source. If the source is legal, configure a static IPSG entry to allow packets from the source to pass through.
¡ If the VLAN does not receive a large number of mismatching packets, it can be determined that the VLAN is not under attack. Use the ip verify source alarm/ipv6 verify source alarm command to adjust the alarm threshold.
2. If the issue persists, collect alarm, log, and configuration information, and contact H3C Support.
hh3cIpsgVlanDropAlarmResume
Basic information
|
OID |
Event |
Type |
Severity |
Recovery notification |
Default status |
|
1.3.6.1.4.1.25506.2.246.1.0.4 |
The number of packets dropped in a VLAN dropped below the threshold. |
Recovery |
Warning |
N/A |
ON |
Notification triggers
This notification is generated when the number of packets dropped due to IPSG binding entry mismatching in a VLAN drops below the threshold.
System impact
No negative impact on the services.
Status control
ON
CLI: Use the snmp-agent trap enable ipsg [ drop-threshold ] command.
OFF
CLI: Use the undo snmp-agent trap enable ipsg [ drop-threshold ] command.
Objects
|
OID (object name) |
Description |
Index nodes |
Type |
Value range |
|
1.3.6.1.4.1.25506.2.246.1.1.1 (hh3cIpsgDropFamily) |
Protocol family. |
N/A |
InetAddressType |
ipv4(1), ipv6(2) |
|
1.3.6.1.4.1.25506.2.246.1.1.4 (hh3cIpsgDropVlan) |
ID of the VLAN in which the dropped packets reside. |
N/A |
Unsigned32 |
Unsigned32(1..4094) |
|
1.3.6.1.4.1.25506.2.246.1.1.3 (hh3cIpsgDropThreshold) |
Packet dropping rate threshold. |
N/A |
Unsigned32 |
Unsigned32(1..1000) |
|
1.3.6.1.4.1.25506.2.246.1.1.5 (hh3cIpsgChassis) |
ID of the chassis that generated the notification. |
N/A |
Unsigned32 |
Unsigned32(1..2147483647) |
|
1.3.6.1.4.1.25506.2.246.1.1.6 (hh3cIpsgSlot) |
ID of the slot that generated the notification. |
N/A |
Unsigned32 |
Unsigned32(1..2147483647) |
Recommended action
No action is required.