ZHONE-COM-IP-FILTER-MIB
Zhone IP Filter MIB Module. IP Software Minneapolis, MN
Main OID:
comIpFilter.1.3.6.1.4.1.5504.6.58
67
Objects
Active
Status
5
Dependencies
Imported Objects
Objects
67 total| Object Name |
|---|
filterThe MIB module representing IP filter specifications in Zhone Technologies products. IP filtering is typically performed to enhance network security by limiting what access is allowed between two networks. Filtering is also effective in eliminating certain denial-of-service attacks. Packet filtering also provides a framework for sanity checking packet headers, and rejecting packets that are unlikely (or that should be impossible). In this way, packet filtering can prevent certain unfortunate mistakes from shutting a network down. OBJECT IDENTIFIER .1.3.6.1.4.1.5504.4.1.8 |
filterGlobalGlobal filter provisioning information. OBJECT IDENTIFIER .1.3.6.1.4.1.5504.4.1.8.1 |
fltGlobalIndexNextThe next available filter spec table index (filterSpecIndex). A GET on this object increments the value by one. A GETNEXT on this object will always return zero.ro Integer32 .1.3.6.1.4.1.5504.4.1.8.1.1 |
fltGlobalTimeoutFilter inconsistency timeout in seconds. A filter spec is considered to be in an inconsistent state when the value of the objects fltSpecVersion1 and fltSpecVersion2 are not equal. This timeout indicates the minimum number of seconds a filter may be in an inconsistent state before the filter spec becomes invalid and the default action for a filter is used as the filter. Provided fltGlobalTimeout is long enough, it should ensure that both an old modification is permanently stalled (ensuring exclusive access) as well as enough time to repair a filter. Default is five seconds.rw Integer32 .1.3.6.1.4.1.5504.4.1.8.1.2 |
filterSpecTableThe filter specification table contains specifications for the IP filtering module. Rows are indexed by a single integer index (filterSpecIndex). The fltGlobalIndexNext object is used to determine the next index value. Each row points to a sequence of rows (statements) in the filterStatementTable. When any row in that sequence is modified, created, or removed, the fltSpecVersion1 and fltSpecVersion2 objects must be incremented. Rows are created by assigning fltSpecIndex and setting fltSpecRowStatus to 'createAndGo'. All columnar objects in this table have default values, so no objects other than the index value need be set to create a row. Rows are removed by setting fltSpecRowStatus to 'destroy'. When a row is removed, each row in filterStatementTable with the same fltSpecIndex is automatically removed. SEQUENCE OF FilterSpecEntry .1.3.6.1.4.1.5504.4.1.8.2 |
filterSpecEntryAn entry in the filterSpecTable. FilterSpecEntry .1.3.6.1.4.1.5504.4.1.8.2.1 |
fltSpecIndexThe index that identifies an entry in the filterSpecTable. The fltGlobalIndexNext object is used to determine the next value of this object. Integer32 .1.3.6.1.4.1.5504.4.1.8.2.1.1 |
fltSpecNameThe filter name associated with this filter specification. This name should indicate the nature of the filter. The default value is an empty string.rw ZhoneAdminString (Zhone-TC) .1.3.6.1.4.1.5504.4.1.8.2.1.2 |
fltSpecDescTextual description of the filter specification. This should briefly describe the nature of the filter defined by the associated filter statements. The default value is an empty string.rw SnmpAdminString (SNMP-FRAMEWORK-MIB) .1.3.6.1.4.1.5504.4.1.8.2.1.3 |
fltSpecVersion1The version number of the filter specification. This is used to flag any changes in the statements that comprise a filter. Each time a modification occurs to an object in a filter spec (including the the list of filter statements of the same fltSpecIndex in filterStatementTable), the value of this object, and fltSpecVersion2 must be incremented. The manager adding, deleting, or modifying a filter statement or statements must increment this version number in the following manner. A read of fltSpecVersion1 returns its current value. A write to fltSpecVersion1 must be one greater than its current value. A successful write of this object transfers ownership to the manager, where the manager must subsequently perform any desired modifications to the filter spec and then write the new value of fltSpecVersion1 to the fltSpecVersion2 object to release ownership. When fltSpecVersion1 does not equal to fltSpecVersion2, the filter spec is in an inconsistent state. If the filter spec remains in an inconsistent state longer than the time specified in fltGlobalTimeout, the filter spec is declared invalid and the filter spec does not become active. The previously provisioned filter spec will remain active. If no previous filter spec was provisioned for this interface, a default action is used. It is up to the manager to fix the invalid filter spec and bring it into a consistent state.rw Unsigned32 .1.3.6.1.4.1.5504.4.1.8.2.1.4 |
fltSpecVersion2The version number of the filter specification. The value of this object must be equal to fltSpecVersion1, otherwise the filter spec is inconsistent. See fltSpecVersion1 for details.rw Unsigned32 .1.3.6.1.4.1.5504.4.1.8.2.1.5 |
fltSpecLanguageVersionThe language version of the filter. The language version further details the meaning and use of the objects in filterStatmentTable. The definitions of the filter languages is beyond the scope of this description.rw Unsigned32 .1.3.6.1.4.1.5504.4.1.8.2.1.6 |
fltSpecRowStatusZhone convention to support row creation and deletion. This is the only object required to create or destroy a row in this table.rw ZhoneRowStatus (Zhone-TC) .1.3.6.1.4.1.5504.4.1.8.2.1.7 |
filterStatementTableThis table contains the filter specification statements for the IP filtering module. A complete filter specification is comprised of all the linked statements (rows) that are pointed to by an entry in the filterSpecTable. Filter statements are linked together by fltSpecIndex, and are ordered within the comprised filter using fltStmtIndex. A statement can only be owned by one filter spec. Rows are created by assigning fltSpecIndex and fltStmtIndex, and setting fltStmtRowStatus to 'createAndGo'. All columnar objects in this table have default values, so no objects other than the index values need be set to create a row. Rows are destroyed by setting fltStmtRowStatus to 'delete'. When rows are created or destroyed, the version of the corresponding filter spec row is incremented. SEQUENCE OF FilterStatementEntry .1.3.6.1.4.1.5504.4.1.8.3 |
filterStatementEntryAn entry in the filterStatement table. Each entry represents one of a sequence of statements that comprise a filter. Each filter statement consists of an index, specific packet header fields, and arbitrary packet offsets and values. Some objects in this entry define ranges for specific packet header fields. These objects define comparison operations on the field they share in the following manner: Low High Compare Method for field f --- ---- ------------------------------------------- 0 0 no comparison on the field 0 H less than or equal to High (f <= H) L 0 exact match (L == f) L H inclusive between comparison (L <= f <= H) FilterStatementEntry .1.3.6.1.4.1.5504.4.1.8.3.1 |
fltStmtIndexThe table index that identifies a filter statement. These indicies should be sparse to allow for insertion into the list. Integer32 .1.3.6.1.4.1.5504.4.1.8.3.1.1 |
fltStmtIpSrcAddrLowThe inclusive lower bound for the source IP address range. See the filterStatementEntry description for details.rw IpAddress .1.3.6.1.4.1.5504.4.1.8.3.1.2 |
fltStmtIpSrcAddrHighThe inclusive upper bound for the source IP address range. See the filterStatementEntry description for details.rw IpAddress .1.3.6.1.4.1.5504.4.1.8.3.1.3 |
fltStmtSrcPortLowThe inclusive lower bound for the transport layer source port range. See the filterStatementEntry description for details.rw Integer32 .1.3.6.1.4.1.5504.4.1.8.3.1.4 |
fltStmtSrcPortHighThe inclusive upper bound for the transport layer source port range. See the filterStatementEntry description for details.rw Integer32 .1.3.6.1.4.1.5504.4.1.8.3.1.5 |
fltStmtIpDstAddrLowThe inclusive lower bound for the destination IP address range. See the filterStatementEntry description for details.rw IpAddress .1.3.6.1.4.1.5504.4.1.8.3.1.6 |
fltStmtIpDstAddrHighThe inclusive upper bound for the destination IP address range. See the filterStatementEntry description for details.rw IpAddress .1.3.6.1.4.1.5504.4.1.8.3.1.7 |
fltStmtDstPortLowThe inclusive lower bound for the transport layer destination port range. See the filterStatementEntry description for details.rw Integer32 .1.3.6.1.4.1.5504.4.1.8.3.1.8 |
fltStmtDstPortHighThe inclusive upper bound for the transport layer destination port range. See the filterStatementEntry description for details.rw Integer32 .1.3.6.1.4.1.5504.4.1.8.3.1.9 |
fltStmtIpProtocolThe IP protocol value that is to be matched. The enum values are as follows: any(1) : any protocol type is a match (wildcard) ip(2) : raw IP packet tcp(3) : TCP packet udp(4) : UDP packet icmp(5) : ICMP packet The default value is any(1).rw Enumeration .1.3.6.1.4.1.5504.4.1.8.3.1.10 |
fltStmtArbValueBaseThis field identifies the protocol header to which the arbitrary value comparison applies. The enum values are as follows: none(1) : no arbitrary value comparison ip(2) : base is IP header udp(3) : base is UDP header tcp(4) : base is TCP header icmp(5) : base is ICMP header ipOptions(6) : base is IP options header tcpOptions(7) : base is TCP options header The default value is none(1).rw Enumeration .1.3.6.1.4.1.5504.4.1.8.3.1.11 |
fltStmtArbOffsetThe offset, in octets, from the beginning of the header to the most significant octet for the arbitrary value comparison.rw Integer32 .1.3.6.1.4.1.5504.4.1.8.3.1.12 |
fltStmtArbMaskThis object is mask for for arbitrary value comparisons. The non-zero bits in this field determine the size of the arbitrary field.rw Unsigned32 .1.3.6.1.4.1.5504.4.1.8.3.1.13 |
fltStmtArbValueLowThis object is the inclusive lower bound for arbitrary value comparison. See the filterStatementEntry description for details.rw Unsigned32 .1.3.6.1.4.1.5504.4.1.8.3.1.14 |
fltStmtArbValueHighThis object is the inclusive upper bound for arbitrary value comparison. See the filterStatementEntry description for details.rw Unsigned32 .1.3.6.1.4.1.5504.4.1.8.3.1.15 |
fltStmtModifierFilter statement modifier. The bits set in this object logically negate the results of the comparisons made on their respecive fields as shown : notIpSrcAddr(1) : fltStmtIpSrcAddrLow, fltStmtIpSrcAddrHigh notSrcPort(2) : fltStmtSrcPortLow, fltStmtSrcPortHigh notIpDstAddr(3) : fltStmtIpDstAddrLow, fltStmtIpDstAddrHigh notDstPort(4) : fltStmtDstPortLow, fltStmtDstPortHigh notIpProtocol(5) : fltStmtIpProtocol notArbitrary(6) : fltStmtArbValueLow, fltStmtArbValueHigh notStatement(7) : negate outcome of the entire statement No bits set (the default) specifies to use all outcomes as is.rw Bits .1.3.6.1.4.1.5504.4.1.8.3.1.16 |
fltStmtActionFilter statement action. The bits set in this object specify actions to take on packets matching this statement. Supported actions are: reset(0) : Return a TCP reset packet to the packet sender and drop the packet. This cannot be specified with permit. permit(1) : Stop filtering the packet and allow it to be sent on the associated interface. This cannot be specified with deny. deny(2) : Stop filtering the packet and discard it. This cannot be specified with permit. forward(3) : Forward the packet the IP address specified in fltStmtActionArg. reject(4) : Return an ICMP destination unreachable packet (type 3) to the packet sender with code 13 (communication administratively prohibited). This cannot be specified permit. log(5) : Write the packet to the log stream. There are some mutually exclusive bits: reset(0) and permit(1), permit(1) and deny(2), permit(1) and reject(4). No bits set implies to continue filtering on the packet.rw Bits .1.3.6.1.4.1.5504.4.1.8.3.1.17 |
fltStmtActionArgFilter statement action argument. The meaning of this object depends on the value of fltStmtAction: forward(3) : An IP address to forward the packet to. The value of this object must be non-zero. All other values of fltStmtAction have no relation to this object. The default is zero.rw Integer32 .1.3.6.1.4.1.5504.4.1.8.3.1.18 |
fltStmtRowStatusZhone convention to support row creation and deletion. This is the only object required to create or destroy a row in this table.rw ZhoneRowStatus (Zhone-TC) .1.3.6.1.4.1.5504.4.1.8.3.1.19 |
filterStmtRenumTableThis table provides a mechanism for renumbering individual filter statments within their particular filter spec. SEQUENCE OF FilterStmtRenumEntry .1.3.6.1.4.1.5504.4.1.8.4 |
filterStmtRenumEntryAn entry in the filterStmtRenumTable. FilterStmtRenumEntry .1.3.6.1.4.1.5504.4.1.8.4.1 |
fltStmtIndexNewThe new statement index for the filter statement. Reading this object will return the same value as the 'fltStmtIndex' portion of its index. Writing to this object will cause the corresponding filter statement to be relocated to the position identified by the value written here. If no statement exists at the current index, 'no such instance' will be returned. If a statement already exists at the new index then 'inconsistent value' is returned. For example, to move the second statement of filter #4 to the third position (e.g. to make room for a new statement #2), the following SNMP set-request would be issued: fltStmtIndexNew.4.2 = 3 There is no default value for this object as it is derived from the fltStmtIndex.rw Integer32 .1.3.6.1.4.1.5504.4.1.8.4.1.1 |
filterStatsTableThis table provides ingress and egress IP filter statistics for each interface. This table is indexed by the ifIndex of the interface and the direction (ingress or egress) of traffic being filtered. This is a read-only table. SEQUENCE OF FilterStatsEntry .1.3.6.1.4.1.5504.4.1.8.5 |
filterStatsEntryAn entry in the filterStatsTable. There will be an entry for each filter provisioned on an interface. There can be, at most, two filters provisioned per interface; one for ingress filtering and the other for egress filtering. FilterStatsEntry .1.3.6.1.4.1.5504.4.1.8.5.1 |
fltStatDirectionThe direction for which this set of statistics is kept: ingress or egress. Enumeration .1.3.6.1.4.1.5504.4.1.8.5.1.1 |
fltStatResetPktsThe number of discarded packets for which a TCP reset packet was sent.ro Counter32 UNITS "packets" .1.3.6.1.4.1.5504.4.1.8.5.1.2 |
fltStatPermitPktsThe number of permitted packets.ro Counter32 UNITS "packets" .1.3.6.1.4.1.5504.4.1.8.5.1.3 |
fltStatDenyPktsThe number of discarded packets.ro Counter32 UNITS "packets" .1.3.6.1.4.1.5504.4.1.8.5.1.4 |
fltStatForwardPktsThe number of packets forwarded to the IP address specified in the filter.ro Counter32 UNITS "packets" .1.3.6.1.4.1.5504.4.1.8.5.1.5 |
fltStatRejectPktsThe number of discarded packets for which an ICMP destination unreachable packet with code 13 was sent.ro Counter32 UNITS "packets" .1.3.6.1.4.1.5504.4.1.8.5.1.6 |
fltStatLogPktsThe number of logged packets.ro Counter32 UNITS "packets" .1.3.6.1.4.1.5504.4.1.8.5.1.7 |
fltStatDefaultPktsThe number of packets that pass through the filter without matching upon which the default action is used.ro Counter32 .1.3.6.1.4.1.5504.4.1.8.5.1.8 |
fltStatSpecVersionThe version of the filter being used on this interface.ro Unsigned32 .1.3.6.1.4.1.5504.4.1.8.5.1.9 |
fltStatSpecIndexThe index of the filter specification being used on this interface. If there is no filter configured for an interface, the entry will not exist in this table.ro Integer32 .1.3.6.1.4.1.5504.4.1.8.5.1.10 |
mcastControlThe MIB module representing Multicast control list specifications in Zhone Technologies products. The First application of multicast control list is to accept of deny a IGMP request to join or leave a IGMP group. Any IGMP request to join a group is accepted only if the group address is available in the Multicast Control list pointed by a field in the ip-interface-record. OBJECT IDENTIFIER .1.3.6.1.4.1.5504.4.1.8.6 |
mcastControlListTableMulticast control list table conatins the one of the IP Address that can be allowed to join to by a IGMP join request from IP interface that has the the multicast control list in its ip-interfce-profile. The address to the table is the multicast control list ID and the precedence. The Row status in the table contains indication of whether the row is being created or destroyed. SEQUENCE OF McastControlListEntry .1.3.6.1.4.1.5504.4.1.8.6.1 |
mcastControlListEntryAn entry in the Multicast Control List. McastControlListEntry .1.3.6.1.4.1.5504.4.1.8.6.1.1 |
mcastControlListControlIdDescription. Integer32 .1.3.6.1.4.1.5504.4.1.8.6.1.1.1 |
mcastControlListControlPrecedenceDescription. Integer32 .1.3.6.1.4.1.5504.4.1.8.6.1.1.2 |
mcastControlListRowStatusDescription.rw ZhoneRowStatus (Zhone-TC) .1.3.6.1.4.1.5504.4.1.8.6.1.1.3 |
mcastControlListIpAddressmulticast ip address.rw IpAddress .1.3.6.1.4.1.5504.4.1.8.6.1.1.4 |
mcastControlListTypeDefines the video stream type. normal - join and leave when desired. Used for video. always-on - always joined. Meant for EBS, not video. periodic - will join and leave after task complete. Not meant for video. Used to download the tv guide.rw Enumeration .1.3.6.1.4.1.5504.4.1.8.6.1.1.5 |
portAccessControlThis MIB represents the port access control list in Zhone products. It is used to control access to internal ports. Initially it is used just for TELNET (23) , but in theory could be used for other ports as well. OBJECT IDENTIFIER .1.3.6.1.4.1.5504.4.1.8.7 |
portAccessNextIndexDescription: A hint for the next free index should the manager want to create a new entry.ro Integer32 .1.3.6.1.4.1.5504.4.1.8.7.1 |
portAccessTableContains the list of entries that control port access on this device. SEQUENCE OF PortAccessEntry .1.3.6.1.4.1.5504.4.1.8.7.2 |
portAccessEntryThis contains the entry that is to be accepted. Currently only used to control access to port 23. arg1, arg2 provide IP Address/mask to allow in. PortAccessEntry .1.3.6.1.4.1.5504.4.1.8.7.2.1 |
portAccessIndexThe index of this entry in table. 100 entries should be more than enough. Integer32 .1.3.6.1.4.1.5504.4.1.8.7.2.1.1 |
portAccessRowStatusDescription.: used to create/delete entries in the table.rw ZhoneRowStatus (Zhone-TC) .1.3.6.1.4.1.5504.4.1.8.7.2.1.2 |
portAccessNumberPortNumber that this applies to, 1..1023 supported.rw Integer32 .1.3.6.1.4.1.5504.4.1.8.7.2.1.3 |
portAccessSrcAddrThe IP address that we will accept packets from.rw IpAddress .1.3.6.1.4.1.5504.4.1.8.7.2.1.4 |
portAccessNetMaskportAccessNetMask - used to pass the range that we will accept with regards to portAccessSrcAddr.rw IpAddress .1.3.6.1.4.1.5504.4.1.8.7.2.1.5 |
comIpFilterZhone IP Filter MIB Module. IP Software Minneapolis, MN MODULE-IDENTITY .1.3.6.1.4.1.5504.6.58 |