CABH-SEC-MIB Table View

This table controls the reporting of the
Firewall Attacks events

cabhSec2FwEventControlEntry row .1.3.6.1.4.1.4491.2.4.2.5.4.2.1.1

Allows configuration of the reporting mechanisms
for a particular type of attack.

Indexes

cabhSec2FwEventType

Column	Syntax	OID
cabhSec2FwEventType Classification of the different types of attacks. Type 1 logs all attempts from both LAN and WAN clients to traverse the Firewall that violate the Security Policy. Type 2 logs identified Denial of Service attack atte…	Enumeration Enumerated Values: 1 type1 2 type2 3 type3 4 type4 5 type5 6 type6	.1.3.6.1.4.1.4491.2.4.2.5.4.2.1.1.1
cabhSec2FwEventEnable Enables or disables counting and logging of firewall events by type as assigned by cabhSec2FwEventType.	Enumerationr/w Enumerated Values: 1 enabled 2 disabled	.1.3.6.1.4.1.4491.2.4.2.5.4.2.1.1.2
cabhSec2FwEventThreshold Number of attacks to count before sending the appropriate event by type as assigned by cabhSec2FwEventType.	Unsigned32r/w Constraints: range: 0-65535	.1.3.6.1.4.1.4491.2.4.2.5.4.2.1.1.3
cabhSec2FwEventInterval Indicates the time interval in hours to count and log occurrences of a firewall event type as assigned in cabhSec2FwEventType. If this MIB has a value of zero then there is no interval assigned and the PS will not cou…	hoursUnsigned32r/w Constraints: range: 0-744	.1.3.6.1.4.1.4491.2.4.2.5.4.2.1.1.4
cabhSec2FwEventCount Indicates the current count up to the cabhSec2FwEventThreshold value by type as assigned by cabhSec2FwEventType.	RMON2-MIBZeroBasedCounter32	.1.3.6.1.4.1.4491.2.4.2.5.4.2.1.1.5
cabhSec2FwEventLogReset Setting this object to true clears the log table for the specified event type. Reading this object always returns false.	SNMPv2-TCTruthValuer/w Type Values: 1 true 2 false Description: Represents a boolean value.	.1.3.6.1.4.1.4491.2.4.2.5.4.2.1.1.6
cabhSec2FwEventLogLastReset The value of sysUpTime when cabhSec2FwEventLogReset was last set to true. Zero if never reset.	SNMPv2-TCTimeStamp Based On: SNMPv2-SMITimeTicks Description: The value of the sysUpTime object at which a specific occurrence happened. The specific occurrence must be defined in the description of any object defined using this type. If sysUpTime is reset t…	.1.3.6.1.4.1.4491.2.4.2.5.4.2.1.1.7

Contains a log of packet information as related
to events enabled by the cable operator. The types
are defined in the CableHome 1.1 specification and
require various objects to be included in the log.
The following is a description for what is
expected in the log for each type Type 1, Type 2,
Type 5 and Type 6 table MUST include
cabhSec2FwEventType, cabhSec2FwEventPriority,
cabhSec2FwEventId, cabhSec2FwLogTime,
cabhSec2FwIpProtocol, cabhSec2FwIpSourceAddr,
cabhSec2FwIpDestAddr, cabhSec2FwIpSourcePort,
cabhSec2FwIpDestPort, cabhSec2Fw,
cabhSec2FwReplayCount.  The other values not used
by Types 1, 2, 5 and 6 are default values. Type 3 
and Type 4 MUST include cabhSec2FwEventType,
cabhSec2FwEventPriority, cabhSec2FwEventId,
cabhSec2FwLogTime, cabhSec2FwIpSourceAddr,
cabhSec2FwLogMIBPointer.  The other values not used
by type 3 and 4 are default values. When applicable, 
Type 1, Type 5,and Type 6 MUST also include 
cabhSec2FwLogMatchingFilterTableName,
cabhSec2FwLogMatchingFilterTableIndex,
cabhSec2FwLogMatchingFilterDescr.

cabhSec2FwLogEntry row .1.3.6.1.4.1.4491.2.4.2.5.4.3.1.1

Each entry contains the log of firewall events

Indexes

cabhSec2FwLogIndex

Column	Syntax	OID
cabhSec2FwLogIndex A sequence number for the specific events under a cabhSec2FwEventType.	Unsigned32 Constraints: range: 1-2147483647	.1.3.6.1.4.1.4491.2.4.2.5.4.3.1.1.1
cabhSec2FwLogEventType Classification of the different types of attacks. Type 1 logs all attempts from both LAN and WAN clients to traverse the Firewall that violate the Security Policy. Type 2 logs identified Denial of Service attack attempt…	Enumeration Enumerated Values: 1 type1 2 type2 3 type3 4 type4 5 type5 6 type6	.1.3.6.1.4.1.4491.2.4.2.5.4.3.1.1.2
cabhSec2FwLogEventPriority The priority level of this event as defined by CableHome Specification. If a priority is not assigned in the CableHome specification for a particular event then the vendor or cable operator may assign priorities. These …	Enumeration Enumerated Values: 1 emergency 2 alert 3 critical 4 error 5 warning 6 notice 7 information 8 debug	.1.3.6.1.4.1.4491.2.4.2.5.4.3.1.1.3
cabhSec2FwLogEventId The assigned event ID.	SNMPv2-SMIUnsigned32 Type Constraints: range: 0..4294967295	.1.3.6.1.4.1.4491.2.4.2.5.4.3.1.1.4
cabhSec2FwLogTime The time that this entry was created by the PS.	SNMPv2-TCDateAndTime Type Constraints: range: 8 range: 11 Description: A date-time specification. field octets contents range ----- ------ -------- ----- 1 1-2 year* 0..65536 2 3 month …	.1.3.6.1.4.1.4491.2.4.2.5.4.3.1.1.5
cabhSec2FwLogIpProtocol The IP Protocol.	Unsigned32 Constraints: range: 0-256	.1.3.6.1.4.1.4491.2.4.2.5.4.3.1.1.6
cabhSec2FwLogIpSourceAddr The Source IP Address of the packet logged.	INET-ADDRESS-MIBInetAddress Type Constraints: range: 0..255	.1.3.6.1.4.1.4491.2.4.2.5.4.3.1.1.7
cabhSec2FwLogIpDestAddr The Destination IP Address of the packet logged.	INET-ADDRESS-MIBInetAddress Type Constraints: range: 0..255	.1.3.6.1.4.1.4491.2.4.2.5.4.3.1.1.8
cabhSec2FwLogIpSourcePort The Source IP Port of the packet logged.	INET-ADDRESS-MIBInetPortNumber Type Constraints: range: 0..65535	.1.3.6.1.4.1.4491.2.4.2.5.4.3.1.1.9
cabhSec2FwLogIpDestPort The Source IP Port of the packet logged.	INET-ADDRESS-MIBInetPortNumber Type Constraints: range: 0..65535	.1.3.6.1.4.1.4491.2.4.2.5.4.3.1.1.10
cabhSec2FwLogMessageType The ICMP defined types.	SNMPv2-SMIUnsigned32 Type Constraints: range: 0..4294967295	.1.3.6.1.4.1.4491.2.4.2.5.4.3.1.1.11
cabhSec2FwLogReplayCount The number of identical attack packets that were seen by the firewall based on cabhSec2FwLogIpProtocol, cabhSec2FwLogIpSourceAddr, cabhSec2FwLogIpDestAddr, cabhSec2FwLogIpSourcePort, cabhSec2FwLogIpDestPort and cabhSec2…	SNMPv2-SMIUnsigned32 Type Constraints: range: 0..4294967295	.1.3.6.1.4.1.4491.2.4.2.5.4.3.1.1.12
cabhSec2FwLogMIBPointer Identifies if the cabhSec2FwPolicyFileURL or the cabhSec2FwEnable MIB object changed or an attempt was made to change it.	SNMPv2-TCVariablePointer Description: A pointer to a specific object instance. For example, sysContact.0 or ifInOctets.3.	.1.3.6.1.4.1.4491.2.4.2.5.4.3.1.1.13
cabhSec2FwLogMatchingFilterTableName When applicable, cabhSec2FwLogMatchingFilterTableName indicates the filter table name containing the last filter rule matched that caused the event to be generated.	Enumeration Enumerated Values: 1 cabhSec2FwFactoryDefaultFilterTable 2 docsDevFilterIpTable 3 cabhSec2FwLocalFilterIpTable 4 none	.1.3.6.1.4.1.4491.2.4.2.5.4.3.1.1.14
cabhSec2FwLogMatchingFilterTableIndex When applicable, cabhSec2FwLogMatchingFilterTableIndex indicates the filter table index if the last filter rule matched that caused the event to be generated. If the value is 0, the event was not caused by a filter r…	Unsigned32 Constraints: range: 0-2147483647	.1.3.6.1.4.1.4491.2.4.2.5.4.3.1.1.15
cabhSec2FwLogMatchingFilterDescr When applicable, cabhSec2FwLogMatchingFilterDesc contains the description value found in the cabhSec2FwFilterScheduleDesc MIB object or the cabhSec2FwLocalFilterIpDesc MIB object of the last filter rule matched that…	SNMP-FRAMEWORK-MIBSnmpAdminString Constraints: range: 0-32	.1.3.6.1.4.1.4491.2.4.2.5.4.3.1.1.16

Extends the filtering matching parameters of 
docsDevFilterIpTable defined in RFC 2669 for CableHome 
Residential Gateways to include time day intervals and days
of the week.

cabhSec2FwFilterScheduleEntry row .1.3.6.1.4.1.4491.2.4.2.5.4.4.1.1

Extended values for entries of docsDevFilterIpTable.
If the PS has not aqcuire ToD the entire
docsDevFilterIpEntry rule set is ignored.
Note: A filter time period may include two days
(e.g from 10 PM to 4 AM). A filter…

Indexes

No indexes recorded

Column	Syntax	OID
cabhSec2FwFilterScheduleStartTime The start time for matching the filter ruleset in the specified days indicated in cabhSec2FwFilterScheduleDOW. Time is represented in Military Time, e.g., 8:30 AM is represented as 830 and 11:45 PM as 2345. An attempt …	Unsigned32r/w Constraints: range: 0-2359	.1.3.6.1.4.1.4491.2.4.2.5.4.4.1.1.1
cabhSec2FwFilterScheduleEndTime The end time for matching the filter rule for the days indicated in cabhSec2FwFilterScheduleDOW. The filter rule associated with this end time MUST not be disabled until the minute following the time indicated by this M…	Unsigned32r/w Constraints: range: 0-2359	.1.3.6.1.4.1.4491.2.4.2.5.4.4.1.1.2
cabhSec2FwFilterScheduleDOW If the day of week bit associated with the PS given day is '1', this object criteria matches.	Bitsr/w Enumerated Values: 0 sunday 1 monday 2 tuesday 3 wednesday 4 thursday 5 friday 6 saturday	.1.3.6.1.4.1.4491.2.4.2.5.4.4.1.1.3
cabhSec2FwFilterScheduleDescr A filter rule description configured by the cable operator or subscriber.	SNMP-FRAMEWORK-MIBSnmpAdminStringr/w Constraints: range: 0-32	.1.3.6.1.4.1.4491.2.4.2.5.4.4.1.1.4

Contains the firewall factory default ruleset as 
defined by the CableLabs CableHome 1.1 Specification.

cabhSec2FwFactoryDefaultFilterEntry row .1.3.6.1.4.1.4491.2.4.2.5.4.4.2.1

Contains the firewall factory default ruleset.

Indexes

cabhSec2FwFactoryDefaultFilterIndex

Column	Syntax	OID
cabhSec2FwFactoryDefaultFilterIndex Index used to order the application of filters. The filter with the lowest index is always applied first.	Unsigned32 Constraints: range: 1-2147483647	.1.3.6.1.4.1.4491.2.4.2.5.4.4.2.1.1
cabhSec2FwFactoryDefaultFilterControl If set to deny(1), all packets matching this filter will be discarded. If set to allow(2), all packets matching this filter will be accepted. The cabhSec2FwFactoryDefaultFilterContinue object is Set to true, and there…	Enumeration Enumerated Values: 1 deny 2 allow	.1.3.6.1.4.1.4491.2.4.2.5.4.4.2.1.2
cabhSec2FwFactoryDefaultFilterIfIndex The index number assigned to this object MUST match to the IfIndex numbering assigned in the ifTable from the Interfaces Group MIB [RFC 2863], and as specified in CH 1.1 Spec, Table 6-16 Numbering Interfaces in the i…	IF-MIBInterfaceIndexOrZero Type Constraints: range: 0..2147483647 Description: This textual convention is an extension of the InterfaceIndex convention. The latter defines a greater than zero value used to identify an interface or interface sub-layer in the managed system. This extension permits…	.1.3.6.1.4.1.4491.2.4.2.5.4.4.2.1.3
cabhSec2FwFactoryDefaultFilterDirection This value represents direction in relationship to the assigned cabhSec2FwFactoryDefaultFilterIfIndex in this particular rule, meaning that the PS MUST represent traffic direction as follows: inbound(1)traffic, outbo…	Enumeration Enumerated Values: 1 inbound 2 outbound 3 both	.1.3.6.1.4.1.4491.2.4.2.5.4.4.2.1.4
cabhSec2FwFactoryDefaultFilterSaddr The source IP address, or portion thereof, that is to be matched for this filter. The source address is first masked (and'ed) against cabhSec2FwFactoryDefaultFilterSmask before being compared to this value. A value of…	INET-ADDRESS-MIBInetAddress Type Constraints: range: 0..255	.1.3.6.1.4.1.4491.2.4.2.5.4.4.2.1.5
cabhSec2FwFactoryDefaultFilterSmask A bit mask that is to be applied to the source address prior to matching. This mask is not necessarily the same as a subnet mask, but 1's bits must be leftmost and contiguous.	INET-ADDRESS-MIBInetAddress Type Constraints: range: 0..255	.1.3.6.1.4.1.4491.2.4.2.5.4.4.2.1.6
cabhSec2FwFactoryDefaultFilterDaddr The destination IP address, or portion thereof, that is to be matched for this filter. The destination address is first masked (and'ed) against cabhSec2FwFactoryDefaultFilterDmask before being compared to this value.…	INET-ADDRESS-MIBInetAddress Type Constraints: range: 0..255	.1.3.6.1.4.1.4491.2.4.2.5.4.4.2.1.7
cabhSec2FwFactoryDefaultFilterDmask A bit mask that is to be applied to the destination address prior to matching. This mask is not necessarily the same as a subnet mask, but 1's bits must be leftmost and contiguous.	INET-ADDRESS-MIBInetAddress Type Constraints: range: 0..255	.1.3.6.1.4.1.4491.2.4.2.5.4.4.2.1.8
cabhSec2FwFactoryDefaultFilterProtocol The protocol value that is to be matched. For example: icmp is 1, tcp is 6, udp is 17. A value of 65535 matches ANY protocol.	Unsigned32 Constraints: range: 0-65535	.1.3.6.1.4.1.4491.2.4.2.5.4.4.2.1.9
cabhSec2FwFactoryDefaultFilterSourcePortLow If cabhSec2FwFactoryDefaultFilterProtocol is udp or tcp, this is the inclusive lower bound of the transport-layer source port range that is to be matched, otherwise it is ignored during matching.	Unsigned32 Constraints: range: 0-65535	.1.3.6.1.4.1.4491.2.4.2.5.4.4.2.1.10
cabhSec2FwFactoryDefaultFilterSourcePortHigh If cabhSec2FwFactoryDefaultFilterProtocol is udp or tcp, this is the inclusive upper bound of the transport-layer source port range that is to be matched, otherwise it is ignored during matching.	Unsigned32 Constraints: range: 0-65535	.1.3.6.1.4.1.4491.2.4.2.5.4.4.2.1.11
cabhSec2FwFactoryDefaultFilterDestPortLow If cabhSec2FwFactoryDefaultFilterProtocol is udp or tcp, this is the inclusive lower bound of the transport-layer destination port range that is to be matched, otherwise it is ignored during matching.	Unsigned32 Constraints: range: 0-65535	.1.3.6.1.4.1.4491.2.4.2.5.4.4.2.1.12
cabhSec2FwFactoryDefaultFilterDestPortHigh If cabhSec2FwFactoryDefaultFilterProtocol is udp or tcp, this is the inclusive upper bound of the transport-layer destination port range that is to be matched, otherwise it is ignored during matching.	Unsigned32 Constraints: range: 0-65535	.1.3.6.1.4.1.4491.2.4.2.5.4.4.2.1.13
cabhSec2FwFactoryDefaultFilterContinue This value is always set to true so the PS MUST continue scanning and applying rules.	SNMPv2-TCTruthValue Type Values: 1 true 2 false Description: Represents a boolean value.	.1.3.6.1.4.1.4491.2.4.2.5.4.4.2.1.14

Contains a configured filtering Ruleset for the 
PS firewall.

cabhSec2FwLocalFilterIpEntry row .1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1

Contains a configured filter rule for the PS
firewall.

If the PS has not aqcuired ToD, entries that do not have
default time settings are ignored.

Note, that a filter time period may include …

Indexes

cabhSec2FwLocalFilterIpIndex

Column	Syntax	OID
cabhSec2FwLocalFilterIpIndex Index used to order the application of filters. The filter with the lowest index is always applied first.	Unsigned32 Constraints: range: 1-2147483647	.1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.1
cabhSec2FwLocalFilterIpStatus Controls and reflects the status of rows in this table. Creation of the rows may be done via either create-and-wait or create-and-go, but the filter is not applied until this object is set to (or changes to) active. Th…	SNMPv2-TCRowStatusr/w Type Values: 1 active 2 notInService 3 notReady 4 createAndGo 5 createAndWait 6 destroy Description: The RowStatus textual convention is used to manage the creation and deletion of conceptual rows, and is used as the value of the SYNTAX clause for the status column of a conceptual row (as described in Section 7.7.1 of …	.1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.2
cabhSec2FwLocalFilterIpControl If set to deny(1), all packets matching this filter will be discarded. If set to allow(2), all packets matching this filter will be accepted. The cabhSec2FwLocalFilterIpContinue object is Set to true, and therefore th…	Enumerationr/w Enumerated Values: 1 deny 2 allow	.1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.3
cabhSec2FwLocalFilterIpIfIndex The index number assigned to this object MUST match to the IfIndex numbering assigned in the ifTable from the Interfaces Group MIB [RFC 2863], and as specified in CH 1.1 Spec, Table 6-16 Numbering Interfaces in the i…	IF-MIBInterfaceIndexOrZeror/w Type Constraints: range: 0..2147483647 Description: This textual convention is an extension of the InterfaceIndex convention. The latter defines a greater than zero value used to identify an interface or interface sub-layer in the managed system. This extension permits…	.1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.4
cabhSec2FwLocalFilterIpDirection This value represents direction in relationship to the assigned cabhSec2FwLocalFilterIpIfIndex in this particular rule, meaning that the PS MUST represent traffic direction as follows: inbound(1)traffic, outbound(2) t…	Enumerationr/w Enumerated Values: 1 inbound 2 outbound 3 both	.1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.5
cabhSec2FwLocalFilterIpSaddr The source IP address, or portion thereof, that is to be matched for this filter. The source address is first masked (and'ed) against cabhSec2FwLocalFilterIpSmask before being compared to this value. A value of 0 for th…	INET-ADDRESS-MIBInetAddressr/w Type Constraints: range: 0..255	.1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.6
cabhSec2FwLocalFilterIpSmask A bit mask that is to be applied to the source address prior to matching. This mask is not necessarily the same as a subnet mask, but 1's bits must be leftmost and contiguous.	INET-ADDRESS-MIBInetAddressr/w Type Constraints: range: 0..255	.1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.7
cabhSec2FwLocalFilterIpDaddr The destination IP address, or portion thereof, that is to be matched for this filter. The destination address is first masked (and'ed) against cabhSec2FwLocalFilterIpDmask before being compared to this value. A valu…	INET-ADDRESS-MIBInetAddressr/w Type Constraints: range: 0..255	.1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.8
cabhSec2FwLocalFilterIpDmask A bit mask that is to be applied to the destination address prior to matching. This mask is not necessarily the same as a subnet mask, but 1's bits must be leftmost and contiguous.	INET-ADDRESS-MIBInetAddressr/w Type Constraints: range: 0..255	.1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.9
cabhSec2FwLocalFilterIpProtocol The protocol value that is to be matched. For example: icmp is 1, tcp is 6, udp is 17. A value of 65535 matches ANY protocol.	Unsigned32r/w Constraints: range: 0-65535	.1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.10
cabhSec2FwLocalFilterIpSourcePortLow If cabhSec2FwLocalFilterIpProtocol is udp or tcp, this is the inclusive lower bound of the transport-layer source port range that is to be matched, otherwise it is ignored during matching.	Unsigned32r/w Constraints: range: 0-65535	.1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.11
cabhSec2FwLocalFilterIpSourcePortHigh If cabhSec2FwLocalFilterIpProtocol is udp or tcp, this is the inclusive upper bound of the transport-layer source port range that is to be matched, otherwise it is ignored during matching.	Unsigned32r/w Constraints: range: 0-65535	.1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.12
cabhSec2FwLocalFilterIpDestPortLow If cabhSec2FwLocalFilterIpProtocol is udp or tcp, this is the inclusive lower bound of the transport-layer destination port range that is to be matched, otherwise it is ignored during matching.	Unsigned32r/w Constraints: range: 0-65535	.1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.13
cabhSec2FwLocalFilterIpDestPortHigh If cabhSec2FwLocalFilterIpProtocol is udp or tcp, this is the inclusive upper bound of the transport-layer destination port range that is to be matched, otherwise it is ignored during matching.	Unsigned32r/w Constraints: range: 0-65535	.1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.14
cabhSec2FwLocalFilterIpMatches Counts the number of times this filter was matched. This object is initialized to 0 at boot, or at row creation, and is reset only upon reboot.	SNMPv2-SMICounter32 Type Constraints: range: 0..4294967295	.1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.15
cabhSec2FwLocalFilterIpContinue This value is always set to true so the PS MUST continue scanning and applying rules.	SNMPv2-TCTruthValue Type Values: 1 true 2 false Description: Represents a boolean value.	.1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.16
cabhSec2FwLocalFilterIpStartTime The start time for matching the filter ruleset in the specified days indicated in cabhSec2FwLocalFilterIpDOW. Time is represented in Military Time, e.g., 8:30 AM is represented as 830 and 11:45 PM as 2345. An attempt t…	Unsigned32r/w Constraints: range: 0-2359	.1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.17
cabhSec2FwLocalFilterIpEndTime The end time for matching the filter ruleset for the days indicated in cabhSec2FwLocalFilterIpDOW. The filter rule associated with this end time MUST not be disabled until the minute following the time indicated by thi…	Unsigned32r/w Constraints: range: 0-2359	.1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.18
cabhSec2FwLocalFilterIpDOW If the day of week bit associated with the PS given day is '1', this object criteria matches.	Bitsr/w Enumerated Values: 0 sunday 1 monday 2 tuesday 3 wednesday 4 thursday 5 friday 6 saturday	.1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.19
cabhSec2FwLocalFilterIpDescr A filter rule description configured by the cable operator or subscriber.	SNMP-FRAMEWORK-MIBSnmpAdminStringr/w Constraints: range: 0-32	.1.3.6.1.4.1.4491.2.4.2.5.4.4.3.1.20