Standard view Table view

CISCO-IP-URPF-MIB

        Unicast Reverse Path Forwarding (URPF) is a function that
checks the validity of the source address of IP packets
received on an interface. This in an attempt to prevent
Denial of Service attacks based on IP address spoofing.
        
URPF checks validity of a source address by determining
whether the packet would be successfully routed as a
destination address. 
Based on configuration, the check made
can be for existence of any route for the address, or more
strictly for a route out the interface on which the packet
was received by the device. When a violating packet is
detected, it can be dropped. 
This MIB allows detection of
spoofingevents.
Source file
CISCO-IP-URPF-MIB
Last revised
Identity
ciscoIpUrpfMIB
Base OID
1.3.6.1.4.1.9.9.451
Imported Objects
CISCO-SMI ciscoMgmt
IF-MIB ifIndex
SNMP-FRAMEWORK-MIB SnmpAdminString
SNMPv2-CONF MODULE-COMPLIANCE NOTIFICATION-GROUP OBJECT-GROUP
SNMPv2-SMI Counter32 Gauge32 Integer32 MODULE-IDENTITY NOTIFICATION-TYPE OBJECT-TYPE Unsigned32
SNMPv2-TC TEXTUAL-CONVENTION TimeStamp TruthValue
Net-SNMP examples using the cisco MIB directory Show commands

These commands use the standard Observium installation path and load the selected MIB variant before the RFC and Net-SNMP directories.

Translate the module identity
/usr/bin/snmptranslate -Pud -Ir -On -m 'CISCO-IP-URPF-MIB' -M '/opt/observium/mibs/cisco:/opt/observium/mibs/rfc:/opt/observium/mibs/net-snmp' 'CISCO-IP-URPF-MIB::ciscoIpUrpfMIB'
Walk the MIB subtree
/usr/bin/snmpbulkwalk -v2c -c '<community>' -Pud -Ir -OQUs -m 'CISCO-IP-URPF-MIB' -M '/opt/observium/mibs/cisco:/opt/observium/mibs/rfc:/opt/observium/mibs/net-snmp' 'udp:<hostname>:161' 'CISCO-IP-URPF-MIB::ciscoIpUrpfMIB'
How SNMP, Net-SNMP, MIB paths, and variants work
Objects (40)
ciscoIpUrpfMIB
.1.3.6.1.4.1.9.9.451
ciscoIpUrpfMIBNotifs
.1.3.6.1.4.1.9.9.451.0
ciscoIpUrpfMIBObjects
.1.3.6.1.4.1.9.9.451.1
cipUrpfScalar
.1.3.6.1.4.1.9.9.451.1.1
cipUrpfDropRateWindow r/w
secondsInteger32
 .1.3.6.1.4.1.9.9.451.1.1.1
cipUrpfComputeInterval r/w
secondsInteger32
 .1.3.6.1.4.1.9.9.451.1.1.2
cipUrpfDropNotifyHoldDownTime r/w
secondsInteger32
 .1.3.6.1.4.1.9.9.451.1.1.3
cipUrpfStatistics
.1.3.6.1.4.1.9.9.451.1.2
cipUrpfTable
.1.3.6.1.4.1.9.9.451.1.2.1
cipUrpfEntry
cipUrpfIpVersion
 .1.3.6.1.4.1.9.9.451.1.2.1.1
cipUrpfIpVersion
Enumeration
 .1.3.6.1.4.1.9.9.451.1.2.1.1.1
cipUrpfDrops
packetsSNMPv2-SMICounter32
 .1.3.6.1.4.1.9.9.451.1.2.1.1.2
cipUrpfDropRate
packets per secondSNMPv2-SMIGauge32
 .1.3.6.1.4.1.9.9.451.1.2.1.1.3
cipUrpfIfMonTable
.1.3.6.1.4.1.9.9.451.1.2.2
cipUrpfIfMonEntry
IF-MIBifIndexcipUrpfIfIpVersion
 .1.3.6.1.4.1.9.9.451.1.2.2.1
cipUrpfIfIpVersion
Enumeration
 .1.3.6.1.4.1.9.9.451.1.2.2.1.1
cipUrpfIfDrops
packetsSNMPv2-SMICounter32
 .1.3.6.1.4.1.9.9.451.1.2.2.1.2
cipUrpfIfSuppressedDrops
packetsSNMPv2-SMICounter32
 .1.3.6.1.4.1.9.9.451.1.2.2.1.3
cipUrpfIfDropRate
packets/secondSNMPv2-SMIGauge32
 .1.3.6.1.4.1.9.9.451.1.2.2.1.4
cipUrpfIfDiscontinuityTime
SNMPv2-TCTimeStamp
 .1.3.6.1.4.1.9.9.451.1.2.2.1.5
cipUrpfVrfIfTable
.1.3.6.1.4.1.9.9.451.1.2.3
cipUrpfVrfIfEntry
cipUrpfVrfNameIF-MIBifIndex
 .1.3.6.1.4.1.9.9.451.1.2.3.1
cipUrpfVrfIfDrops
packetsSNMPv2-SMICounter32
 .1.3.6.1.4.1.9.9.451.1.2.3.1.2
cipUrpfVrfIfDiscontinuityTime
SNMPv2-TCTimeStamp
 .1.3.6.1.4.1.9.9.451.1.2.3.1.3
cipUrpfInterfaceConfig
.1.3.6.1.4.1.9.9.451.1.3
cipUrpfIfConfTable
.1.3.6.1.4.1.9.9.451.1.3.1
cipUrpfIfConfEntry
.1.3.6.1.4.1.9.9.451.1.3.1.1
cipUrpfIfDropRateNotifyEnable r/w
SNMPv2-TCTruthValue
 .1.3.6.1.4.1.9.9.451.1.3.1.1.1
cipUrpfIfNotifyDropRateThreshold r/w
packets/secondSNMPv2-SMIUnsigned32
 .1.3.6.1.4.1.9.9.451.1.3.1.1.2
cipUrpfIfNotifyDrHoldDownReset r/w
SNMPv2-TCTruthValue
 .1.3.6.1.4.1.9.9.451.1.3.1.1.3
cipUrpfIfCheckStrict
Enumeration
 .1.3.6.1.4.1.9.9.451.1.3.1.1.4
cipUrpfIfWhichRouteTableID
Enumeration
 .1.3.6.1.4.1.9.9.451.1.3.1.1.5
cipUrpfIfVrfName
OctetString
 .1.3.6.1.4.1.9.9.451.1.3.1.1.6
cipUrpfVrf
.1.3.6.1.4.1.9.9.451.1.4
cipUrpfVrfTable
.1.3.6.1.4.1.9.9.451.1.4.1
cipUrpfVrfEntry
cipUrpfVrfName
 .1.3.6.1.4.1.9.9.451.1.4.1.1
cipUrpfVrfName
OctetString
 .1.3.6.1.4.1.9.9.451.1.4.1.1.1
ciscoIpUrpfMIBConformance
.1.3.6.1.4.1.9.9.451.2
ciscoIpUrpfMIBCompliances
.1.3.6.1.4.1.9.9.451.2.1
ciscoIpUrpfMIBGroups
.1.3.6.1.4.1.9.9.451.2.2
Dependencies (8) 6 direct · 2 transitive Show tree and compile order Hide dependency details

Each imported module is resolved in the importing module's source directory first, then through the normal default-variant rules.

Dependency tree
Dependency-first compile order
  1. SNMPv2-SMIrfc
  2. CISCO-SMIcisco
  3. SNMPv2-TCrfc
  4. IANAifType-MIBrfc
  5. SNMPv2-CONFrfc
  6. SNMPv2-MIBrfc
  7. IF-MIBrfc
  8. SNMP-FRAMEWORK-MIBrfc
  9. CISCO-IP-URPF-MIBciscoselected
Type Definitions (2)
UnicastRpfOptions
Bits
allowDefault(0)
allowSelfPing(1)
UnicastRpfType
Enumeration
strict(1)
loose(2)
disabled(3)
Conformance Groups (3)
ciscoIpUrpfMIBMainObjectGroup
cipUrpfDropRateWindow cipUrpfComputeInterval cipUrpfDropNotifyHoldDownTime cipUrpfDrops cipUrpfDropRate cipUrpfIfDrops cipUrpfIfSuppressedDrops cipUrpfIfDropRate cipUrpfIfDropRateNotifyEnable cipUrpfIfNotifyDropRateThreshold cipUrpfIfNotifyDrHoldDownReset cipUrpfIfCheckStrict cipUrpfIfDiscontinuityTime
The collection of common counter objects, those
needed by other objects, and the common interface
table.
 .1.3.6.1.4.1.9.9.451.2.2.1
ciscoIpUrpfMIBVrfObjectGroup
cipUrpfVrfName cipUrpfIfWhichRouteTableID cipUrpfIfVrfName cipUrpfVrfIfDrops cipUrpfVrfIfDiscontinuityTime
The collection of objects needed to index by
VRF.
 .1.3.6.1.4.1.9.9.451.2.2.2
ciscoIpUrpfMIBNotifyGroup
cipUrpfIfDropRateNotify
The collection of objects which are used to specify
notifications for URPF.
 .1.3.6.1.4.1.9.9.451.2.2.6
Compliance Statements (1)

OID .1.3.6.1.4.1.9.9.451.2.1.1
An SNMP entity can implement this module to
provide URPF problem diagnosis information.
Required groups
mandatory ciscoIpUrpfMIBMainObjectGroup
mandatory ciscoIpUrpfMIBNotifyGroup
optional ciscoIpUrpfMIBVrfObjectGroup This group is mandatory for all implementations
that need to index URPF statistics by VRF interfaces.
Notifications / Traps (1)
NameOIDDescription
cipUrpfIfDropRateNotify
cipUrpfIfDropRate
.1.3.6.1.4.1.9.9.451.0.1
This notification is generated when
cipUrpfIfDropRateNotifyEnable is set to true and
the calculated URPF drop rate (cipUrpfIfDropRate)
exceeds the notification threshold drop rate
(cipUrpfIfNotifyDropRateThreshold). Note the
exceptional value of 0 for threshold allows notification
generation if any drop events occur in an interval.

After generating this notification, another such
notification will not be sent out for a minimum of five
minutes (note the exception to this provided by
cipUrpfIfNotifyDrHoldDownReset).

The object value present in the notification is the
the drop rate that exceeded the threshold.