CISCO-SERVICE-CONTROL-ATTACK-MIB
48 objects
This MIB provides data related to different types of attacks detected by a service control entity. A service control entity is a network device which monitors and controls traffic. The service control entity is used as a platform for different service control applications which may perform monitoring operations beyond packet counting and delve deeper into the contents of network traffic. It provides programmable stateful inspection of bidirectional traffic flows and maps these flows with user/subscriber ownership. An attack is a malicious network activity with certain traffic characteristics and which is targeted on a certain network entity. An attack can be identified by its type, direction, source address, destination address and ports. Once an attack is detected, an attack filter is activated based on the type of the attack and corresponding actions are taken in the monitored network - this is referred to as attack start. For example the attack filter can drop the attacking traffic. When the attack detector identifies that the attack characteristics are no longer exist, it ends the mitigation action - what is referred to as attack end. The attack mitigation action is also referred to as attack filtering in this MIB. The time duration of attack filtering between attack start to attack end along with the direction (upstream, downstream) is also maintained by the service control entity. Attack filtering can be applied from the subscriber side to the network side, in the upstream direction. The downstream attack filtering is done from the network side to the subscriber side. This MIB also defines notifications generated by the service control entity when an attack is detected on a monitored network.
Imported Objects
| CISCO-SMI | ciscoMgmt |
| ENTITY-MIB | entPhysicalIndex entPhysicalName |
| INET-ADDRESS-MIB | InetAddress InetAddressType InetPortNumber |
| SNMPv2-CONF | MODULE-COMPLIANCE NOTIFICATION-GROUP OBJECT-GROUP |
| SNMPv2-SMI | Counter32 Counter64 Gauge32 Integer32 MODULE-IDENTITY NOTIFICATION-TYPE OBJECT-IDENTITY OBJECT-TYPE Unsigned32 |
| SNMPv2-TC | AutonomousType TEXTUAL-CONVENTION TimeInterval TimeStamp TruthValue |
| OID | Name | Access | Status | Description |
|---|---|---|---|---|
| 1.3.6.1.4.1.9.9.693 | IdentityciscoServiceControlAttackMIB | This MIB provides data related to different types of attacks detected by a service control entity. A service control entity is a network device which monitors … | ||
| 1.3.6.1.4.1.9.9.693.0 | NodeciscoServiceControlAttackMIBNotifs | |||
| 1.3.6.1.4.1.9.9.693.0.1 | NotificationcscaFilterChange | current | The system generates this notification to indicate that the cscaFilterStatus of the attack filter for cscaType has changed due to the reason determined by csca… | |
| 1.3.6.1.4.1.9.9.693.0.2 | NotificationcscaGlobalAttackFilterChange | current | The notification is generated when a start or end of a global attack is detected in the system. Below fields are sent with the trap: entPhysicalName indicates … | |
| 1.3.6.1.4.1.9.9.693.1 | NodeciscoServiceControlAttackMIBObjects | |||
| 1.3.6.1.4.1.9.9.693.1.1 | NodecscaFilterMIBObjects | |||
| 1.3.6.1.4.1.9.9.693.1.1.1 | ScalarcscaType | accessible-for-notify | current | This object indicates the type of an attack detected and reported by the service control entity. There are numerous attack types, based on the service control … |
| 1.3.6.1.4.1.9.9.693.1.1.2 | ScalarcscaSourceAddressType | accessible-for-notify | current | This object indicates the address type for cscaSourceAddress. |
| 1.3.6.1.4.1.9.9.693.1.1.3 | ScalarcscaSourceAddress | accessible-for-notify | current | This object indicates the network address that is the source end point of this attack. |
| 1.3.6.1.4.1.9.9.693.1.1.4 | ScalarcscaDestinationAddressType | accessible-for-notify | current | This object indicates the address type for cscaDestinationAddress. |
| 1.3.6.1.4.1.9.9.693.1.1.5 | ScalarcscaDestinationAddress | accessible-for-notify | current | This object indicates the network address that is the destination end point of this attack. |
| 1.3.6.1.4.1.9.9.693.1.1.6 | ScalarcscaAttackedPort | accessible-for-notify | current | This object indicates the port on which this attack occurs, if relevant for this type of attack. |
| 1.3.6.1.4.1.9.9.693.1.1.7 | ScalarcscaFilterStatus | accessible-for-notify | current | This object indicates the status of the filter for this attack. The values for this object are '1' (activated) and '2' (de-activated). |
| 1.3.6.1.4.1.9.9.693.1.1.8 | ScalarcscaNotifsEnabled | read-write | current | This object specifies whether the system generates the cscaFilterChange notification. |
| 1.3.6.1.4.1.9.9.693.1.1.9 | ScalarcscaLastDiscontinuityTimeStamp | read-only | current | This object indicates the value of sysUpTime when the last discontinuity occurred. |
| 1.3.6.1.4.1.9.9.693.1.1.10 | ScalarcscaGlobalAttackType | read-only | current | This object indicates the type of a global attack detected and reported by the service control entity. The list of the various global attack are: ICMP attack(1… |
| 1.3.6.1.4.1.9.9.693.1.1.11 | ScalarcscaGlobalAttackNotifsEnabled | read-write | current | This object specifies whether the system generates the cscaGlobalAttackFilterChange notification. Setting this object value to 'true' will enable generation of… |
| 1.3.6.1.4.1.9.9.693.1.2 | TablecscaTypeTable | not-accessible | current | This table lists the aggregated statistics for each detected attack in a network controlled by a service control entity. |
| 1.3.6.1.4.1.9.9.693.1.2.1 | RowcscaTypeEntry | not-accessible | current | This entry contains information for an attack detected by the service control entity. The service control entity can report a number of attack types, the cscaT… |
| 1.3.6.1.4.1.9.9.693.1.2.1.1 | ColumncscaTypeIndex | not-accessible | current | This object uniquely identifies the attack type. |
| 1.3.6.1.4.1.9.9.693.1.2.1.2 | ColumncscaTypeCurrentNumAttacks | read-only | current | This object indicates the current number of ongoing attacks of this type, that the service control entity has detected in the network. |
| 1.3.6.1.4.1.9.9.693.1.2.1.3 | ColumncscaTypeTotalNumAttacks | read-only | current | This object indicates the total number of attacks of this type since the last discontinuity. |
| 1.3.6.1.4.1.9.9.693.1.2.1.4 | ColumncscaTypeTotalNumFlows | read-only | current | This object indicates the total number of IP flows on which this type of attack has been detected, since the last discontinuity. |
| 1.3.6.1.4.1.9.9.693.1.2.1.5 | ColumncscaTypeTotalNumSeconds | read-only | current | This object indicates the accumulated duration in seconds belonging to this attack type, since the last discontinuity. |
| 1.3.6.1.4.1.9.9.693.1.2.1.6 | ColumncscaTypeOriginatedByNetworkSide | read-only | current | This object indicates whether this attack type is originated from the Network side or from the Subscriber side. |
| 1.3.6.1.4.1.9.9.693.1.2.1.7 | ColumncscaTypeProtocol | read-only | current | This enumerated object indicates the protocol type for this type of attack (TCP/UDP/ICMP/etc). The values for this object are: (1) TCP (2) UDP (3) ICMP (4) Oth… |
| 1.3.6.1.4.1.9.9.693.1.2.1.8 | ColumncscaTypeIsPortSpecific | read-only | current | This object indicates whether the attack type is port-specific or not. |
| 1.3.6.1.4.1.9.9.693.1.2.1.9 | ColumncscaTypeIPsDetected | read-only | current | This object indicates which IPs are detected in this type of attack. The enumerated values are: (1) Originating Side IP is detected. (2) Attacked Side IP is de… |
| 1.3.6.1.4.1.9.9.693.1.3 | TablecscaInfoTable | not-accessible | current | This table lists information for attack mitigation, also referred to as attack filtering, done by a service control entity in the monitored network. |
| 1.3.6.1.4.1.9.9.693.1.3.1 | RowcscaInfoEntry | not-accessible | current | This entry contains information about attack mitigation done by a physical service control entity, for attacks which it has detected. |
| 1.3.6.1.4.1.9.9.693.1.3.1.1 | ColumncscaInfoUpStreamAttackFilteringTime | read-only | current | This object indicates the cumulative time during which attacks in the up-stream direction were filtered. |
| 1.3.6.1.4.1.9.9.693.1.3.1.2 | ColumncscaInfoUpStreamLastAttackFilteringTime | read-only | current | This object indicates the time since the previous attack in the upstream direction has ended. Attack end is reached when the service control entity attack dete… |
| 1.3.6.1.4.1.9.9.693.1.3.1.3 | ColumncscaInfoDownStreamAttackFilteringTime | read-only | current | This object indicates the cumulative time during which attacks in the down-stream direction were filtered. |
| 1.3.6.1.4.1.9.9.693.1.3.1.4 | ColumncscaInfoDownStreamLastAttackFilteringTime | read-only | current | This object indicates the time since the previous attack in the downstream direction has ended. Attack end is reached when the service control entity attack de… |
| 1.3.6.1.4.1.9.9.693.2 | NodeciscoServiceControlAttackMIBConform | |||
| 1.3.6.1.4.1.9.9.693.2.1 | NodecscaMIBCompliances | |||
| 1.3.6.1.4.1.9.9.693.2.1.1 | CompliancecscaMIBCompliance | deprecated | The compliance statement for SNMP Agents which implement this MIB. | |
| 1.3.6.1.4.1.9.9.693.2.1.2 | CompliancecscaMIBComplianceRev1 | current | The compliance statement for SNMP Agents which implement this generic filter (both Specific IP and global attack) MIB. | |
| 1.3.6.1.4.1.9.9.693.2.2 | NodecscaMIBGroups | |||
| 1.3.6.1.4.1.9.9.693.2.2.1 | GroupcscaMIBAttackTypeObjectGroup | current | A collection of objects which provides attack information. | |
| 1.3.6.1.4.1.9.9.693.2.2.2 | GroupcscaMIBAttackInfoObjectGroup | current | A collection of objects which provides attack filtering times for upstream and down stream attacks. | |
| 1.3.6.1.4.1.9.9.693.2.2.3 | GroupcscaMIBNotificationGroup | deprecated | A collection of notification which provides status change information for attack filters. cscaMIBNotificationGroup object is superseded by cscaMIBNotificationG… | |
| 1.3.6.1.4.1.9.9.693.2.2.4 | GroupcscaFilterObjectGroup | deprecated | A collection of objects which define each attack filter and its status. cscaFilterObjectGroup object is superseded by cscaFilterObjectGroupRev1. | |
| 1.3.6.1.4.1.9.9.693.2.2.5 | GroupcscaMIBNotifControlGroup | deprecated | A collection of object(s) to control the enable/disable state of notification generation. cscaMIBNotifControlGroup object is superseded by cscaMIBNotifControlG… | |
| 1.3.6.1.4.1.9.9.693.2.2.6 | GroupcscaMIBNotificationGroupRev1 | current | A collection of notification which provides status change information for both specific IP and global attack filters. | |
| 1.3.6.1.4.1.9.9.693.2.2.7 | GroupcscaFilterObjectGroupRev1 | current | A collection of objects which define each attack filter and its status. | |
| 1.3.6.1.4.1.9.9.693.2.2.8 | GroupcscaMIBNotifControlGroupRev1 | current | A collection of object(s) to control the enable/disable state of notification generation. |
Type Definitions
| Name | Syntax | Status | Description |
|---|---|---|---|
| CscaAttackType | Integer32 | current | A value which identifies the various attack types which may be detected by the service control entity. |