Trend Micro TippingPointTM

Threat Protection System (TPS)
MIBs Guide
Actionable threat defense against advanced targeted attacks.

TMPrivacy and Personal Data Collection Disclosure
Certain features available in Trend Micro products collect and send feedback regarding product usage and detection information to Trend Micro.
Some of this data is considered personal in certain jurisdictions and under certain regulations. If you do not want Trend Micro to collect personaldata, you must ensure that you disable the related features.
The following link outlines the types of data that the Security Management System collects and provides detailed instructions on how to disable thespecific features that feedback the information.
https://success.trendmicro.com/data-collection-disclosure
Data collected by Trend Micro is subject to the conditions stated in the Trend Micro Privacy Policy:
https://www.trendmicro.com/en_us/about/legal/privacy-policy-product.html

Legal Notice© Copyright 2023 Trend Micro Incorporated. All rights reserved.
Trend Micro, the Trend Micro t-ball logo, TippingPoint, and Digital Vaccine are trademarks or registered trademarks of Trend Micro Incorporated.
All other product or company names may be trademarks or registered trademarks of their owners.
Publication: May 2023

MIB files for the Threat Protection System
A management information base (MIB) is a type of database that enables you to manage devices in acommunications network. Database entries are addressed through object identifiers (OIDs). MIB files aredescriptions of network objects that can be managed using the Simple Network Management Protocol(SNMP). The format of the MIB is defined as part of the SNMP.
This information includes the following topics:•

Standard SNMP MIBs supported•

TPS-supported MIBs

Standard SNMP MIBs supported
Important
In a production environment, do not perform excessive SNMP Get requests (or walks) against standard MIBs.

This topic contains the following information:•

SNMPv2-MIB•

IF-MIB•

EtherLike-MIB•

IP-MIB•

SNMP-USER-BASED-SM-MIB•

SNMP-VIEW-BASED-ACM-MIB•

Reference sites for standard MIBs

SNMPv2-MIB
Defines common information typically provided by managed systems. The Threat Protection System (TPS)
supports the following items.
Type

Name

Description

SystemGroup

A collection of objects common to all managed systems. This includes information such asmodel, contact and location, up time, services, and system ID.

SNMP

Group

A collection of objects providing information on SNMP protocol stats, such as the number ofpackets received and transmitted.

coldStart

Notification

Signifies that the TPS device is reinitializing itself, typically a reboot.

IF-MIB
Contains objects for managing and monitoring network interfaces. Only physical interfaces have stats in thefollowing tables. Logical interfaces, such as VLAN and Bridge, are listed, but stats are always 0.
1

TPS MIBs Guide

Name

Type

Description

ifTableTable

List of information and stats for each interface of asystem. The number of entries is given by the valueof ifNumber.

ifXTable

Table

List of interface entries. The number of entries isgiven by the value of ifNumber. This table contains
additional objects for the interface table.

linkUp

Notification

A linkUp notification signifies that a communication
link has left the down state and is now in the up
state.

linkDown

Notification

A linkDown notification signifies that acommunication link has left the up state and is now
in the down state.

EtherLike-MIB
Provides information representing attributes of an interface to an Ethernet-like communications medium.
Name

Type

Description

dot3StatsTable

Table

Contains statistics for a collection of ethernet-like interfaces attached to a particularsystem.

dot3HCStatsTable

Table

Contains 64-bit versions of error counters from the dot3StatsTable.

IP-MIBType

Name

Description

IP

Group

A collection of object stats that include such information as IP datagrams received ortransmitted.

ipv4InterfaceTable

Table

Contains per-interface IPv4-specific information.

ipv6InterfaceTable

Table

Contains per-interface IPv6-specific information.

IpSystemStatsTable

Table

Contains system-wide, IP version-specific traffic statistics.

IpAddressTable

Table

Contains addressing information relevant to the entity's interfaces.

ipNetToPhysicalTable

Table

Contains the IP Address Translation table used for mapping from IP addresses tophysical addresses.

SNMP-USER-BASED-SM-MIB
Defines the SNMPv3 user-based Security Model (USM). The Threat Protection System (TPS) supports thefollowing groups.
Name
usmStats

2

Type
Group

Description
A collection of scalar objects that provide information such as, then number of unknown user names,
engine IDs, or unsupported security levels.

TPS MIBs Guide

SNMP-VIEW-BASED-ACM-MIB
This MIB defines the SNMPv3 View-based Access Control Model (VACM) for use in the Simple Network
Management Protocol (SNMP) architecture. The Threat Protection System (TPS) support the following tables.
Name

Type

Description

vacmContextTable

Table

Locally available security contexts

vacmSecurityToGroupTable

Table

Maps a security contexts with groups

vacmAccessTable

Table

Access rights for groups

vacmViewTreeFamilyTable

Table

Locally held information about families of sub-trees within
MIB views

Reference sites for standard MIBs•

IETF: http://www.ietf.org — where all the standard RFCs are kept for MIBs•

http://www.mibdepot.com — a well maintained site with standard and company specific MIBs

TPS-supported MIBs
The Threat Protection System (TPS) supports these MIBs fully except where noted. These are non-standard
MIBs with TPT-specific definitions for Trend Micro™ TippingPoint™ products only.

TIPPINGPOINT-REG-MIB
Note
This MIB file must be loaded before you load any other TippingPoint MIB files.

Defines the object identifier (OID) sub-tree assigned to Trend by the Internet Assigned Numbers Agency(IANA), as well as sub-trees for registered modules, object and event definitions, agent profiles, management
application requirements, and experimental definitions.
The following table describes TIPPINGPOINT-REG-MIB sub-trees:
OID

ObjectDescription

tpt-reg

1.3.6.1.4.1.10734.1

Sub-tree for the registered modules

tpt-generic (not supported)

1.3.6.1.4.1.10734.2

Sub-tree for common object and event
definitions

tpt-products

1.3.6.1.4.1.10734.3

Sub-tree for specific object and event
definitions

tpt-caps (not supported)

1.3.6.1.4.1.10734.4

Sub-tree for agent profiles

tpt-reqs (not supported)

1.3.6.1.4.1.10734.5

Sub-tree for management application
requirements

tpt-expr (not supported)

1.3.6.1.4.1.10734.6

Sub-tree for experimental definitions

3

TPS MIBs Guide

TPT-BAY
Used to define the status and configuration of the module slots on NX Series and TX Series devices.
ObjectOID

Description

tpt-slot-objs

1.3.6.1.4.1.10734.3.3.2.17

Slot information.

slotTempTable

1.3.6.1.4.1.10734.3.3.2.17.1

A list of the slots on the device.

slotTempEntry

1.3.6.1.4.1.10734.3.3.2.17.1.1

An entry in the slot table. Rows cannot be
added or deleted.

slotTempIndex

1.3.6.1.4.1.10734.3.3.2.17.1.1.1

The index number of the slot.

slotName

1.3.6.1.4.1.10734.3.3.2.17.1.1.2

The name of the slot.

slotModuleName

1.3.6.1.4.1.10734.3.3.2.17.1.1.3

String description of the type of module inthe slot.

slotStatus

1.3.6.1.4.1.10734.3.3.2.17.1.1.4

The slot status.
0: Empty; no module is currently installed.
1: Active; a module is present in the slot
and active.
2: Error. The module might have failed toinitialize, or the configured module typemight not match the module currently
inserted in the slot.

slotModuleSerialNum

4

1.3.6.1.4.1.10734.3.3.2.17.1.1.5

The serial number of the module currently
installed in the slot.

TPS MIBs Guide

ObjectslotModuleType

OID
1.3.6.1.4.1.10734.3.3.2.17.1.1.6

Description
The module type currently installed in theslot.
type-12-port-1g-copper(1)type-12-port-1g-sfp(2)type-12-port-25g-sfp(24)type-8-port-10g-sfp(3)type-8-port-100g-qsfp(25)type-8-port-25g-sr-bypass(26)type-8-port-25g-lr-bypass(27)type-2-port-40g-qsfp(4)type-6100(5)type-5100(6)type-2500(7)type-1400(8)type-660(9)type-330(10)type-110(11)type-10(12)type-empty(13)type-8-port-1g-copper-bypass(14)type-4-port-100g-sr4-bypass(28)type-4-port-100g-lr4-bypass(29)type-4-port-1g-sfp-sr-bypass(15)type-4-port-1g-sfp-lr-bypass(16)type-4-port-10g-sfp-sr-bypass(17)type-4-port-10g-sfp-lr-bypass(18)type2Port40gQsfpBypass(19)type440T(20)type2200T(21)typeVSA(22)typeVSA(23)tptSlotDeviceID

1.3.6.1.4.1.10734.3.3.3.1.281

The unique identifier of the device that issending the notification.

tptSlotID

1.3.6.1.4.1.10734.3.3.3.1.282

The index number of the slot that issending the notification.

5

TPS MIBs Guide

ObjecttptSlotEvent

OID

Description

1.3.6.1.4.1.10734.3.3.3.1.283

The status of the slot.
0: A module has been inserted.
1: A module has been removed.
2: Error. The module might have failed toinitialize, or the configured module typemight not match the module currently
inserted in the slot.

tptSlotChangeNotify

1.3.6.1.4.1.10734.3.3.3.0.54

A notification of activity on the slot.

TPT-COMPACT-FLASH-MIB
The Threat Protection System (TPS) provides no notification support for this MIB. Defines the status andoperating mode of the external storage card.
The following table describes compact flash data objects:
ObjectDescription

tpt-compact-flash

1.3.6.1.4.1.10734.3.3.2.14

Sub-tree for all external storage card
information.

compactFlashPresent

1.3.6.1.4.1.10734.3.3.2.14.1

Indicates card presence.

compactFlashMounted

compactFlashFormatted

compactFlashOperationMode6

OID

1.3.6.1.4.1.10734.3.3.2.14.2

1.3.6.1.4.1.10734.3.3.2.14.3

1.3.6.1.4.1.10734.3.3.2.14.4•

0: present•

1: absent

Indicates card mount status.
•

0: mounted•

1: unmounted

Indicates card format status.
•

0: formatted•

1: unformatted

Indicates card operation mode.
•

0: secure mode—requires authentication•

1: auto-mount enabled— cards areautomatically mounted when inserted

vendorInformation

1.3.6.1.4.1.10734.3.3.2.14.5

Sub-tree of external storage card informational
details.

serialNumber

1.3.6.1.4.1.10734.3.3.2.14.5.1

Card serial number.

model

1.3.6.1.4.1.10734.3.3.2.14.5.2

Card model name.

capacity

1.3.6.1.4.1.10734.3.3.2.14.5.3

Card capacity.

revision

1.3.6.1.4.1.10734.3.3.2.14.5.4

Card firmware revision.

TPS MIBs Guide

TPT-HEALTH-MIB
Indicates the health status of the IPS. Features monitored temperatures, fan speeds, and voltage levels. The
Threat Protection System (TPS) provides no health2CTable support.

Temperature
The Temperature objects monitor the device temperature. Alarms are generated when the temperature at asensor passes a specified threshold.
The following table describes temperature objects:
ObjectOID

Description

healthTempTable

1.3.6.1.4.1.10734.3.3.2.13.1

Lists the readings at the device temperature
sensors

healthTempEntry

1.3.6.1.4.1.10734.3.3.2.13.1.1

Entry in the temperature table. Rows arepredefined and cannot be created or deleted.

healthTempIndex

1.3.6.1.4.1.10734.3.3.2.13.1.1.1

Index number of the entry

healthTempChannel

1.3.6.1.4.1.10734.3.3.2.13.1.1.2

Location of the temperature sensor.

healthTempValue

1.3.6.1.4.1.10734.3.3.2.13.1.1.3

Temperature in degrees centigrade

healthTempSeverity

1.3.6.1.4.1.10734.3.3.2.13.1.1.4

Can be one of the following values:

healthTempThresholdType

1.3.6.1.4.1.10734.3.3.2.13.1.1.5•

0: normal•

1: informational note•

2: minor•

3: major•

4: critical

Determines the application of thresholds:•

1: minimum; value should not go below
threshold•

2: range; value should remain with adesignated range•

3: maximum; value should not go above
thresholdhealthTempMajor

1.3.6.1.4.1.10734.3.3.2.13.1.1.6

Major threshold temperature in degrees
centigrade

healthTempCritical

1.3.6.1.4.1.10734.3.3.2.13.1.1.7

Critical threshold temperature in degrees
centigrade

Fans
The fan objects monitor the fan performance and health.
The following table describes fan objects:
ObjecthealthFanTable

OID
1.3.6.1.4.1.10734.3.3.2.13.2

Description
Lists all fans inside the device

7

TPS MIBs Guide

ObjectOID

Description

healthFanEntry

1.3.6.1.4.1.10734.3.3.2.13.2.1

Entry in the fans table. Rows are predefinedand cannot be created or deleted.

healthFanIndex

1.3.6.1.4.1.10734.3.3.2.13.2.1.1

Index number of the entry

healthFanChannel

1.3.6.1.4.1.10734.3.3.2.13.2.1.2

String identifying the fan

healthFanValue

1.3.6.1.4.1.10734.3.3.2.13.2.1.3

Speed of the fan in RPM

healthFanSeverity

1.3.6.1.4.1.10734.3.3.2.13.2.1.4

Can be one of the following values:

healthFanThresholdType

1.3.6.1.4.1.10734.3.3.2.13.2.1.5•

0: normal•

1: informational note•

2: minor•

3: major•

4: critical

Determines the application of thresholds:•

1: minimum; value should not go below
threshold•

2: range; value should remain with adesignated range•

3: maximum; value should not go above
thresholdhealthFanMajor

1.3.6.1.4.1.10734.3.3.2.13.2.1.6

Major threshold speed in RPM

healthFanMinor

1.3.6.1.4.1.10734.3.3.2.13.2.1.7

Critical threshold speed in RPM

Voltage
The voltage objects monitor the voltage levels at various locations within the device.
The following table describes voltage objects:
Object8

OID

Description

healthVoltageTable

1.3.6.1.4.1.10734.3.3.2.13.3

List of all voltages at various locations insidethe device

healthVoltageEntry

1.3.6.1.4.1.10734.3.3.2.13.3.1

An entry in the voltage table. Rows arepredefined and cannot be created or deleted.

healthVoltageIndex

1.3.6.1.4.1.10734.3.3.2.13.3.1.1

Index number of the entry

healthVoltageChannel

1.3.6.1.4.1.10734.3.3.2.13.3.1.2

Location of the voltage sensor

healthVoltageValue

1.3.6.1.4.1.10734.3.3.2.13.3.1.3

Voltage reading in millivolts

TPS MIBs Guide

ObjecthealthVoltageSeverity

healthVoltageThresholdType

OID

Description

1.3.6.1.4.1.10734.3.3.2.13.3.1.4

1.3.6.1.4.1.10734.3.3.2.13.3.1.5

Can be one of the following values:•

0: normal•

1: informational note•

2: minor•

3: major•

4: critical

Determines the application of thresholds:•

1: minimum; value should not go below
threshold•

2: range; value should remain with adesignated range•

3: maximum; value should not go above
thresholdhealthVoltageMajor

1.3.6.1.4.1.10734.3.3.2.13.3.1.6

Major threshold delta above or below thenominal voltage value, in millivolts

healthVoltageMinor

1.3.6.1.4.1.10734.3.3.2.13.3.1.7

Critical threshold delta above or below thenominal voltage value, in millivolts

healthVoltageNominal

1.3.6.1.4.1.10734.3.3.2.13.3.1.8

Optimal voltage value at this sensor location

TPT-HIGH-AVAIL-MIB
Defines the conditions and actions for Intrinsic Network HA, Transparent Network HA, and Zero-Power HA,
and also offers information about the current fault state of the device.
ObjectOID

Description

highAvailTimeStamp

1.3.6.1.4.1.10734.3.3.2.6.1

The last transition of the fault state inseconds since January 1, 1970. The value iszero if the fault state has not changed since
the last reboot.

highAvailFaultState

1.3.6.1.4.1.10734.3.3.2.6.2

The current fault state of the device:•

0: normal•

1: fallback

9

TPS MIBs Guide

ObjecthighAvailFaultCause

10

OID
1.3.6.1.4.1.10734.3.3.2.6.3

Description
The reason for the current fault state:•

0: none•

1: suspended task•

2: out of memory•

3: hardware breaking point•

4: TSE failure•

5: watchdog timeout•

6: user reset•

7: user-initiated fallback•

8: threshold failure•

9: software watchdog timeout•

10: OAM fault•

11: hard disk disabled

highAvailThresholdEnabled

1.3.6.1.4.1.10734.3.3.2.6.4

The current Layer-2 Fallback (L2FB)
threshold-enabled setting for the device.

highAvailThresholdPercent

1.3.6.1.4.1.10734.3.3.2.6.5

If the fallback threshold is enabled, thepercent packet loss at which the device isconfigured to enter L2FB.

highAvailEnabled

1.3.6.1.4.1.10734.3.3.2.6.6

Indicates whether intrinsic network HA has
been enabled.

highAvailTransparentState

1.3.6.1.4.1.10734.3.3.2.6.7

State of the connection to the device’s
transparent HA partner:•

0: not connected•

1: unresponsive•

2: connected

highAvailTransparentEnabled

1.3.6.1.4.1.10734.3.3.2.6.8

Indicates whether transparent HA has beenenabled.

highAvailTransparentPartner

1.3.6.1.4.1.10734.3.3.2.6.9

Network address or serial number of thedevice’s transparent HA partner.

highAvailZeroPowerState

1.3.6.1.4.1.10734.3.3.2.6.10

The current ZPHA state.

highAvailZeroPowerQuantity

1.3.6.1.4.1.10734.3.3.2.6.11

The number of segments with ZPHA
modules.

highAvailZeroPowerTable

1.3.6.1.4.1.10734.3.3.2.6.12

Table of segments with ZPHA modules.

highAvailZeroPowerEntry

1.3.6.1.4.1.10734.3.3.2.6.12.1

An entry in the ZPHA table.

highAvailZeroPowerIndex

1.3.6.1.4.1.10734.3.3.2.6.12.1.1

The index number of the entry.

highAvailZeroPowerSegment

1.3.6.1.4.1.10734.3.3.2.6.12.1.2

The name of the segment on which ZPHA isenabled. For TPS devices, this name will
always be Segment ALL.

TPS MIBs Guide

ObjecthighAvailZeroPowerActiveOID
1.3.6.1.4.1.10734.3.3.2.6.12.1.3

Description
The current ZPHA state of the segment:•

0: normal, ZPHA inactive•

1: TPS bypass, ZPHA active

TPS devices return a separate value foreach bypass I/O module:
•

0

•

1

highAvailZeroPowerAction

1.3.6.1.4.1.10734.3.3.2.6.12.1.4

The action taken when ZPHA is active. For
TPS devices, this mode will always be 1:
bypass.

highAvailZeroPowerMode

1.3.6.1.4.1.10734.3.3.2.6.12.1.5

The fiber mode of this ZPHA. For TPS
devices, this mode will always be 0:
unknown.

highAvailZeroPowerPresence

1.3.6.1.4.1.10734.3.3.2.6.13

Indicates ZPHA presence:•

0: present•

1: absent

The following notifications and SNMP traps apply to Intrinsic Network HA.
ObjecttptIhaNotify

OID
1.3.6.1.4.1.10734.3.3.3.0.15

Description
The notification object that informs the
management station of changes in the
Intrinsic HA state of the device.
Triggered when the device enters or exits
L2FB. Possible causes:•

Depleted memory.

•

User reset – Manually clearing L2FB.

•

User fallback – Manually entering
L2FB.

•

Threshold failure – Performanceprotection triggers L2FB.

•

Process error – Crash of a vital process.

•

Watchdog timeout – Failure of processmonitoring.

tptIhaNotifyDeviceID

1.3.6.1.4.1.10734.3.3.3.1.81

The unique identifier of the device sending
the notification.

tptIhaNotifyTimeStamp

1.3.6.1.4.1.10734.3.3.3.1.82

The timestamp of the notification inseconds since January 1, 1970.

tptIhaNotifyFaultState

1.3.6.1.4.1.10734.3.3.3.1.83

The current fault state of the device:•

0: normal•

1: fallback

11

TPS MIBs Guide

ObjecttptIhaNotifyFaultCause

OID

Description

1.3.6.1.4.1.10734.3.3.3.1.84

The reason for the current fault state:•out-of-memory•user-reset (user manually clears L2FB)•

user-fallback (user manually enters
L2FB)

•

threshold failure (L2FB triggered by
performance protection)•

process error (crash of vital process)•software watchdog timeout (failure ofprocess monitoring)

The following notifications and SNMP traps apply to Transparent Network HA.
ObjecttptTrhaNotify

OID

Description

1.3.6.1.4.1.10734.3.3.3.0.18

The notification object that informs the
management station of changes in thetransparent HA state of the device.
Triggered when the HA partner isconnected or not-connected (including
unresponsive).

tptTrhaNotifyDeviceID

1.3.6.1.4.1.10734.3.3.3.1.86

The unique identifier of the device sending
the notification.

tptTrhaNotifyTimeStamp

1.3.6.1.4.1.10734.3.3.3.1.87

The timestamp of the notification inseconds since January 1, 1970.

tptTrhaNotifyNewState

1.3.6.1.4.1.10734.3.3.3.1.88

State of the connection to the device’s
transparent HA partner:•

not connected•connected

The following notifications and SNMP traps apply to Zero-Power HA (ZPHA).
ObjectOID

Description

tptZphaNotify

1.3.6.1.4.1.10734.3.3.3.0.24

The notification object that informs the
management station of changes in the
ZPHA state of the device.

tptZphaNotifyDeviceID

1.3.6.1.4.1.10734.3.3.3.1.161

The unique identifier of the device sending
the notification.

tptZphaNotifyTimeStamp

1.3.6.1.4.1.10734.3.3.3.1.162

The timestamp of the notification inseconds since January 1, 1970.

tptZphaNotifySegmentName

1.3.6.1.4.1.10734.3.3.3.1.163

The name of the segment on which ZPHA isenabled.

tptZphaNotifyNewState

1.3.6.1.4.1.10734.3.3.3.1.164

The current ZPHA state of the segment:•

0: normal, ZPHA inactive•

1: IPS bypass, ZPHA active

The following notifications and SNMP traps apply to changes in the Performance Protection state.
12

TPS MIBs Guide

ObjectOID

Description

tptPerfProtNotify

1.3.6.1.4.1.10734.3.3.3.0.21

Triggered when performance protection istriggered by engine or NIC congestion.

tptPerfProtNotifyDeviceID

1.3.6.1.4.1.10734.3.3.3.1.141

The unique identifier of the device sending
the notification.

tptPerfProtNotifyTimeStamp

1.3.6.1.4.1.10734.3.3.3.1.142

The timestamp of the notification inseconds since January 1, 1970.

tptPerfProtNotifyPhase

1.3.6.1.4.1.10734.3.3.3.1.143

Indicates the current performanceprotection mode:•

1: entering•

2: continuing•

3: exiting

tptPerfProtNotifyPacketLoss

1.3.6.1.4.1.10734.3.3.3.1.144

The current packet loss rate per thousand.
When exiting performance protectionmode, the value will always be 0 (zero).

tptPerfProtNotifyLossThreshold

1.3.6.1.4.1.10734.3.3.3.1.145

The current packet loss threshold per
thousand.

tptPerfProtNotifyDuration

1.3.6.1.4.1.10734.3.3.3.1.146

The number of seconds that performanceprotection will be active.

tptPerfProtNotifyMissedAlerts

1.3.6.1.4.1.10734.3.3.3.1.147

The number of alerts missed during theperformance protection period. When
exiting performance protection mode, thevalue will always be 0 (zero).

TPT-HOSTDefines the IPS host information, the default gateway address, and indicates whether the device is currently
configured for service access.
ObjectOID

Description

hostIPv4Gateway

1.3.6.1.4.1.10734.3.3.2.12.2

The IPv4 default gateway.

hostIPv6Gateway

1.3.6.1.4.1.10734.3.3.2.12.3

The IPv6 default gateway.

hostIPv6Enabled

hostSSLCert

1.3.6.1.4.1.10734.3.3.2.12.4

1.3.6.1.4.1.10734.3.3.2.12.8•

0: disabled•

1: enabled

Indicates whether IPv6 is enabled on thedevice.
•0: disabled•

1: enabled

The currently active SSL cert.
•

0: none•1: temporary•

2: authorized

13

TPS MIBs Guide

ObjecthostInitState

OID
1.3.6.1.4.1.10734.3.3.2.12.9

Description
The current host initialization state.
•

0: in progress•

1: complete

TPT-LICENSE
Support for TippingPoint license packages, including TOS, Digital Vaccine, Reputation DV, and other services.
ObjectOID

licenseTable

1.3.6.1.4.1.10734.3.3.2.15.1

Table of licensed features.

licenseEntry

1.3.6.1.4.1.10734.3.3.2.15.1.1

An entry in the licensed features table.
Rows cannot be added or deleted.

licenseEntryIndex

1.3.6.1.4.1.10734.3.3.2.15.1.1.1

The index number of the entry.

licenseEntryFeature

1.3.6.1.4.1.10734.3.3.2.15.1.1.2

The name of the licensed feature.

licenseEntryStatus

1.3.6.1.4.1.10734.3.3.2.15.1.1.3

Status of the licensed feature:licenseEntryAction

1.3.6.1.4.1.10734.3.3.2.15.1.1.4•

0: informational message•

1: license valid•

2: warning•

3: error

Action to take for the licensed feature.
•

0: allow•

1: deny

licenseEntryExpiry

1.3.6.1.4.1.10734.3.3.2.15.1.1.5

The date on which this licensed feature will
expire.

licenseEntryDetails

1.3.6.1.4.1.10734.3.3.2.15.1.1.6

Any additional information about thislicensed feature.

TPT-MISC-NOTIFY-MIB
Notifications for logs and other features.
Note
The MIB file includes references to Network Discovery Scan.

This object applies to all notifications.

Common TPT notification objects
The following table describes general notification objects:

14

Description

TPS MIBs Guide

ObjecttptMiscNotifyDeviceID

OID

Description

1.3.6.1.4.1.10734.3.3.3.1.31

The unique identifier of the device sending thenotification. This is the first payload parameter
for all notifications in the TPT-MISC-NOTIFY
module.

Management TPT notification objects
The following table describes management notification objects. These notifications communicate with the
management station:
ObjectOID

Description

tptManagedNotify

1.3.6.1.4.1.10734.3.3.3.0.9

Informs the management station that thedevice is now being managed by that station

tptUnmanagedNotify

1.3.6.1.4.1.10734.3.3.3.0.10

Informs the management station that thedevice is no longer being managed by thatstationQuarantine TPT notification objects
The following notifications are generated by quarantine actions:ObjectOID

Description

tptQuarantineNotify

1.3.6.1.4.1.10734.3.3.3.0.20

The notification that indicates that a hosthas been added to or removed from thequarantine list.

tptQuarantineNotifyNetAddr

1.3.6.1.4.1.10734.3.3.3.1.132

The network address of the host being
quarantined or removed from thequarantine list.

tptQuarantineNotifyHostNetAddrV6

1.3.6.1.4.1.10734.3.3.3.1.133

The IPv6 network address of the host.

tptQuarantineNotifyReason

1.3.6.1.4.1.10734.3.3.3.1.134

The reason that the host wasquarantined. The parameter is undefined
if the host was removed.

tptQuarantineNotifySegmentName

1.3.6.1.4.1.10734.3.3.3.1.135

The segment related to the quarantine orremoval from the quarantine list.

tptQuarantineNotifyAction

1.3.6.1.4.1.10734.3.3.3.1.136

Whether the host was added to or
removed from the quarantine list.

tptQuarantineNotifySslInspected.1.3.6.1.4.1.10734.3.3.3.1.181•

1: add•2: remove

Flag indicating if this quarantine action
was performed on an inspected SSL data
stream.
•1: Yes•2: No

Congestion notifications
The following notifications and SNMP traps are generated when congestion thresholds are met.
15

TPS MIBs Guide

ObjectOID

Description

tptCongestionPacketLoss

1.3.6.1.4.1.10734.3.3.3.1.153

The current packet-loss rate per thousand.

tptCongestionNotifyPhase

1.3.6.1.4.1.10734.3.3.3.1.154

Indicates whether the device is entering,
continuing, or exiting congestion thresholdmode.
•

1: entering•

2: continuing•

3: exiting

tptCongestionThreshold

1.3.6.1.4.1.10734.3.3.3.1.155

The current packet-loss threshold per
thousand.

tptTier3CongestionPacketLoss

1.3.6.1.4.1.10734.3.3.3.1.156

The current Tier 3 packet-loss rate perthousand.

tptTier3CongestionNotifyPhase

1.3.6.1.4.1.10734.3.3.3.1.157

Indicates whether the device is entering,
continuing, or exiting Tier 3 congestion
threshold mode.

tptTier3CongestionThreshold

1.3.6.1.4.1.10734.3.3.3.1.158

The current Tier 3 packet-loss threshold
per thousand.

tptCongestionThresholdNotify

1.3.6.1.4.1.10734.3.3.3.0.25

The notification that the device-widecongestion has reached the configured
congestion threshold. Triggered only byengine congestion, not NIC congestion.

tptiTier3CongestionNotify

1.3.6.1.4.1.10734.3.3.3.0.26

The notification that the Tier 3 congestion
has reached the configured congestion
threshold. Triggered only by engine
congestion, not NIC congestion.

System Log TPT notification objects
The following notifications are generated when a critical message, error message, or warning is logged in thesystem log:
ObjectDescription

tptSystemLogNotify

1.3.6.1.4.1.10734.3.3.3.0.16

The notification that a critical message, error
message, or warning has been logged.

tptSystemLogNotifyText

1.3.6.1.4.1.10734.3.3.3.1.92

The text of the message being logged.

tptSystemLogNotifySequence

1.3.6.1.4.1.10734.3.3.3.1.93

The log file entry sequence number
corresponding to this notification. This value
will always be 0 (zero).

tptSystemLogNotifySeverity

1.3.6.1.4.1.10734.3.3.3.1.94

The severity of the attack:tptSystemLogNotifyTimeSec

16

OID

1.3.6.1.4.1.10734.3.3.3.1.95•

1: critical•

2: error•

4: warning

The time that this message was logged, inseconds since January 1, 1970.

TPS MIBs Guide

ObjectOID

tptSystemLogNotifyTimeNano

1.3.6.1.4.1.10734.3.3.3.1.96

Description
The nanoseconds portion of
tptSystemLogNotifyTimeSec.

Audit Log TPT notification objects
The following notifications are generated when a message or warning is logged in the audit log:
ObjectOID

Description

tptAuditLogCapacityNotifyPercent

1.3.6.1.4.1.10734.3.3.3.1.201

The percentage of the audit log data threshold.

tptAuditLogCapacityOrFailureNotifyTi
me

1.3.6.1.4.1.10734.3.3.3.1.202

The time of the data capacity thresholdnotification.

tptAuditLogNotify

1.3.6.1.4.1.10734.3.3.3.0.60

Audit log notification uses the following fields:•

tptMiscNotifyDeviceID•

tptAuditLogNotifyTime•

tptAuditLogNotifyAccess•

tptAuditLogNotifyType•

tptAuditLogNotifyIpAddrType•

tptAuditLogNotifyIpAddr•

tptAuditLogNotifyCategory•

tptAuditLogNotifyResult•

tptAuditLogNotifyUser•

tptAuditLogNotifyMessage

tptAuditLogNotifyTime

1.3.6.1.4.1.10734.3.3.3.1.170

The date and time when the entry was logged.

tptAuditLogNotifyAccess1.3.6.1.4.1.10734.3.3.3.1.171

The access level of the user initiating the audit
check and generating the log.
This is a bit field with the following mapping:•

0x0 – normal•

0x1 – operator•

0x4 – administrator•

0x8 – super-user

tptAuditLogNotifyType

1.3.6.1.4.1.10734.3.3.3.1.172

Interface source of the audit log action.

tptAuditLogNotifyIpAddrType

1.3.6.1.4.1.10734.3.3.3.1.173

Type of IP address from which the user
connected.

tptAuditLogNotifyIpAddr

1.3.6.1.4.1.10734.3.3.3.1.174

IP address from which the user connected

17

TPS MIBs Guide

ObjecttptAuditLogNotifyCategoryOID
1.3.6.1.4.1.10734.3.3.3.1.175

Description
Functional area where the audit log was
generated:
1: undefined
2: general
3: login
4: logout
5: user
6: time7: policy
8: update
9: boot
10: report
11: host
12: cfg
13: device
14: sms
15: server
16: segment
17: license
18: ha19: monitor
20: ipFilter
21: connTable
22: hostComm
23: tse24: cftptAuditLogNotifyResult

1.3.6.1.4.1.10734.3.3.3.1.176

The result, pass or fail, of an audit check:
1: success
2: failed

tptAuditLogNotifyUser

1.3.6.1.4.1.10734.3.3.3.1.177

The user initiating the audit check andgenerating the log.

tptAuditLogNotifyMessage

1.3.6.1.4.1.10734.3.3.3.1.178

A description of what configuration change wasattempted (and possibly succeeded) by theuser.

TPT-MULTIDV-MIB
Manages the Multiple Digital Vaccine feature. This feature allows the IPS to manage multiple types of Digital
Vaccine packages, if they are currently available from Trend.

18

TPS MIBs Guide

ObjectOID

Description

installedDVTable

1.3.6.1.4.1.10734.3.3.2.1.10.2.1

Table of installed Digital Vaccine (DV)packages.

installedDVEntry

1.3.6.1.4.1.10734.3.3.2.1.10.2.1.1

An entry in the Installed DV table. Rows
cannot be added or removed.

installedDVIndex

1.3.6.1.4.1.10734.3.3.2.1.10.2.1.1.1.1

Index of the DVs installed.

installedDVVersion

1.3.6.1.4.1.10734.3.3.2.1.10.2.1.1.2.1

The version number of the DV on thismachine.

installedDVIsActive

1.3.6.1.4.1.10734.3.3.2.1.10.2.1.1.3.1

The active state of the DV.

Auxiliary DV objects
ObjectOID

Description

auxiliaryDVTable

1.3.6.1.4.1.10734.3.3.2.1.10.2.2

Table of auxiliary Digital Vaccine (DV)packages.

auxiliaryDVEntry

1.3.6.1.4.1.10734.3.3.2.1.10.2.2.1

An entry in the Auxiliary DV table. Rows
cannot be added or removed.

auxiliaryDVIndex

1.3.6.1.4.1.10734.3.3.2.1.10.2.2.1.1

The index number of the entry.

auxiliaryDVType1.3.6.1.4.1.10734.3.3.2.1.10.2.2.1.2

The type of the auxiliary DV.

auxiliaryDVName

1.3.6.1.4.1.10734.3.3.2.1.10.2.2.1.3

The name of the auxiliary DV.

auxiliaryDVVersion

1.3.6.1.4.1.10734.3.3.2.1.10.2.2.1.4

The auxiliary DV version number.

auxiliaryDVPackage

1.3.6.1.4.1.10734.3.3.2.1.10.2.2.1.5

The auxiliary DV version in string format:
major.minor.patch.build

TPT-NPSTATS-MIB
Information about network processor statistics.
The following objects apply to the NP tier statistics.
ObjectOID

Description

npstatsTiersTable

1.3.6.1.4.1.10734.3.3.2.10.2

A table of network processor statistics,
sorted by tier.

npstatsTiersEntry

1.3.6.1.4.1.10734.3.3.2.10.2.1

An entry in the network processor statistics
tiers table.

npstatsTierNumber

1.3.6.1.4.1.10734.3.3.2.10.2.1.1

The tier number.

npstatsTiersReceiveMbps

1.3.6.1.4.1.10734.3.3.2.10.2.1.2

The current receive rate on the tier in Mbps.

npstatsTiersRxPktsPerSec

1.3.6.1.4.1.10734.3.3.2.10.2.1.4

The current receive rate in packets per
second.

npstatsTiersMaxPktsPerSec

1.3.6.1.4.1.10734.3.3.2.10.2.1.5

The maximum receive rate in packets per
second.

19

TPS MIBs Guide

ObjectOID

Description

npstatsTiersAvgBytesPerPkt

1.3.6.1.4.1.10734.3.3.2.10.2.1.6

The average packet size in bytes.

npstatsTiersUtilizationPercent

1.3.6.1.4.1.10734.3.3.2.10.2.1.7

The percent utilization of this tier.

npstatsTier1UtilizationPercent

1.3.6.1.4.1.10734.3.3.2.10.2.1.7.1

Utilization ratio of total traffic against thelicensed throughput of the device forTier-1.

npstatsTier2UtilizationPercent

1.3.6.1.4.1.10734.3.3.2.10.2.1.7.2

Utilization ratio of total traffic against thelicensed throughput of the device forTier-2.

npstatsTier3UtilizationPercent

1.3.6.1.4.1.10734.3.3.2.10.2.1.7.3

Utilization ratio of total traffic against thelicensed throughput of the device forTier-3.

npstatsTier4UtilizationPercent

1.3.6.1.4.1.10734.3.3.2.10.2.1.7.4

Utilization ratio of total traffic against thelicensed throughput of the device forTier-4.

npstatsTiersRatioToNextPer10K

1.3.6.1.4.1.10734.3.3.2.10.2.1.8

The ratio of this tier’s throughput to thenext per 10,000.

npstatsTiersMaxReceiveMbps

1.3.6.1.4.1.10734.3.3.2.10.2.1.9

The maximum receive rate in Mbps.

npstatsTiersMaxTransmitMbps

1.3.6.1.4.1.10734.3.3.2.10.2.1.10

The maximum transmit rate in Mbps.

npstatsTiersMaxUtilizationPercent

1.3.6.1.4.1.10734.3.3.2.10.2.1.2.11

The maximum percent utilization of this tier.

npstatsTierMaxRatiotoNextPer10K

1.3.6.1.4.1.10734.3.3.2.10.2.1.2.12

The max ratio of this tier's throughput to thenext per 10K.

The following objects apply to other NP statistics.
Object20

OID

Description

npstatsTiersExtra

1.3.6.1.4.1.10734.3.3.2.10.3

A list of additional network processor
statistics information.

npstatsTier1BypassMbps

1.3.6.1.4.1.10734.3.3.2.10.3.1

The current bypass rate in Mbps. For TPS
devices, this value is always 0 (zero).

npstatsTier1Balance

1.3.6.1.4.1.10734.3.3.2.10.3.2

The load balance across network
processors. A value of 1000 is exactly
balanced, and 0 indicates all traffic is being
handled on one processor. For TPS devices,
this value is always 0 (zero).

npstatsTier1MaxPktsPerSecA

1.3.6.1.4.1.10734.3.3.2.10.3.3

The maximum processor A receive rate inpackets per second.

npstatsTier1MaxPktsPerSecB

1.3.6.1.4.1.10734.3.3.2.10.3.4

The maximum processor B receive rate inpackets per second. For TPS devices, thisvalue is always 0 (zero).

npstatsTier1TxPktsPerSec

1.3.6.1.4.1.10734.3.3.2.10.3.8

The transmit rate in packets per second.

TPS MIBs Guide

ObjectOID

Description

npstatsTier1MaxTxPktsPerSec

1.3.6.1.4.1.10734.3.3.2.10.3.9

The maximum transmit rate in packets per
second.

npstatsTier4TriggerMatchPer1000

1.3.6.1.4.1.10734.3.3.2.10.3.5

Proportion of traffic inspected because of a
trigger match (percent value times 100).

npstatsTier4ReroutePer1000

1.3.6.1.4.1.10734.3.3.2.10.3.6

Proportion of traffic inspected because of areroute (percent value times 100).

npstatsTier4ProtoDcdPer1000

1.3.6.1.4.1.10734.3.3.2.10.3.11

Percentage of reroute packets that are sent
to TCP reassembly when additional
analysis is required of a protocol. Protocols
that need further analysis include FTP
commands, Telnet, HTTP encoded frames,
Microsoft SMB frames, and Microsoft RPC
frames.

npstatsTier4TcpSequencePer1000

1.3.6.1.4.1.10734.3.3.2.10.3.7

Proportion of traffic inspected because of
TCP sequence (percent value times 100).

npstatsTier1MaxPktsPerSecC

1.3.6.1.4.1.10734.3.3.2.10.3.10

The maximum receive rate for processor C
in packets per second. For TPS devices, thisvalue is always 0 (zero).

npstatsTier1PatternMatch
ToRxPktsPerSecRatio

1.3.6.1.4.1.10734.3.3.2.10.3.21

The ratio of this tier’s pattern match
packets per second to RX packets per
second.

npstatsTier1MaxPatternMatch
ToRxPktsPerSecRatio

1.3.6.1.4.1.10734.3.3.2.10.3.22

The maximum ratio of this tier’s patternmatch packets per second to RX packets
per second.

npstatsTier2MaxTxTrustedPktsPerSec

1.3.6.1.4.1.10734.3.3.2.10.3.23

The maximum Tier 2 Trusted packets
transmit rate in packets per second.

npstatsTier3MaxTxTrustedPktsPerSec

1.3.6.1.4.1.10734.3.3.2.10.3.24

The maximum Tier 3 Trusted packets
transmit rate in packets per second.

npstatsTier4MaxTxTrustedPktsPerSec

1.3.6.1.4.1.10734.3.3.2.10.3.25

The maximum Tier 4 Trusted packets
transmit rate in packets per second.

npstatsTier4MaxTriggerMatchPer1000

1.3.6.1.4.1.10734.3.3.2.10.3.26

Maximum proportion of traffic inspected
because of trigger match (percent value
times 100).

npstatsTier4MaxReroutePer1000

1.3.6.1.4.1.10734.3.3.2.10.3.27

Maximum proportion of traffic inspected
because of reroute (percent value times
100).

npstatsTier4MaxTcpSequencePer1000

1.3.6.1.4.1.10734.3.3.2.10.3.28

Maximum proportion of traffic inspected
because of TCP sequence (percent value
times 100).

npstatsTier4MaxProtoDcdPer1000

1.3.6.1.4.1.10734.3.3.2.10.3.29

Maximum proportion of reroute traffic
inspected because of protocol decode(percent value times 100).

npstatsMisc

1.3.6.1.4.1.10734.3.3.2.10.4

Miscellaneous network processor statisticalinformation.

npstatsMiscTxPktsBestEffort

1.3.6.1.4.1.10734.3.3.2.10.4.1

The number of packets per second
transmitted because of best effort mode.

21

TPS MIBs Guide

ObjectOID

Description

npstatsMiscThroughputCurrent

1.3.6.1.4.1.10734.3.3.2.10.4.2

Current throughput in Kbps.

npstatsMiscThroughputPercent

1.3.6.1.4.1.10734.3.3.2.10.4.3

Current percentage of licensed throughput.

npstatsMiscThroughputLicensed

1.3.6.1.4.1.10734.3.3.2.10.4.4

Licensed throughput in Kbps.

npstatsMiscThroughputHighWaterMark

1.3.6.1.4.1.10734.3.3.2.10.4.5

The highest throughput level reached since
the last clear or reboot in Kbps.

npstatsMiscThroughputHighWaterMarkPer
cent

1.3.6.1.4.1.10734.3.3.2.10.4.6

The maximum seen percentage of thelicensed throughput since the last clear or
reboot.

Segment port stats
Statistical information pertaining to network segments for a stack configuration.
ObjectOID

Description

npstatsStackSegmentRecieveMbps

1.3.6.1.4.1.10734.3.3.2.10.10.1

Aggregate Rx rate in Mbps from all
network segments.

npstatsStackSegmentMaxRecieveMbps

1.3.6.1.4.1.10734.3.3.2.10.10.2

Maximum Rx rate in Mbps from all
network segments.

npstatsStackSegmentTransmitMbps

1.3.6.1.4.1.10734.3.3.2.10.10.3

Aggregate Tx rate in Mbps to all
network segments.

npstatsStackSegmentMaxTransmitMbps

1.3.6.1.4.1.10734.3.3.2.10.10.4

Maximum Tx rate in Mbps to all
network segments.

npstatsStackBalance

1.3.6.1.4.1.10734.3.3.2.10.10.5

The load balance percent across all
stack members.

npstatsStackMinBalance

1.3.6.1.4.1.10734.3.3.2.10.10.6

The minimum, non-zero load balance
percent across all stack members.

npstatsStackSegmentRatioToTier1Per10K

1.3.6.1.4.1.10734.3.3.2.10.10.7

The ratio of this tier's throughput to tier1 per 10,000 (percent value times 100).

npstatsStackSegmentMaxRatioToTier1Per10K

1.3.6.1.4.1.10734.3.3.2.10.10.8

The maximum ratio of this tier's
throughput to tier 1 per 10,000 (percent
value times 100).

Stack member table
Statistical information related to network segments for each stack member.
Object22

OID

Description

npstatsStackMemberKey

1.3.6.1.4.1.10734.3.3.2.10.10.9.1.2

Unique stack member identifier.

npstatsStackMemberHostname

1.3.6.1.4.1.10734.3.3.2.10.10.9.1.3

The stack member host name.

npstatsStackMemberSegmentReceiveMbps

1.3.6.1.4.1.10734.3.3.2.10.10.9.1.4

The current segment Rx rate in Mbps fora stack member.

npstatsStackMemberMaxSegmentReceiveMbps

1.3.6.1.4.1.10734.3.3.2.10.10.9.1.5

The maximum segment Rx rate in Mbps
for a stack member.

TPS MIBs Guide

Stacking port stats
Statistical information pertaining to stacking ports in a stack configuration.
ObjectOID

Description

npstatsStackPortsRecieveMbps

1.3.6.1.4.1.10734.3.3.2.10.11.1

Aggregate Rx rate in Mbps from all stacking
ports.

npstatsStackPortsMaxRecieveMbps

1.3.6.1.4.1.10734.3.3.2.10.11.2

Maximum Rx rate in Mbps from all stacking
ports.

npstatsStackPortsTransmitMbps

1.3.6.1.4.1.10734.3.3.2.10.11.3

Aggregate Tx rate in Mbps for all stacking
ports.

npstatsStackPortsMaxTransmitMbps

1.3.6.1.4.1.10734.3.3.2.10.11.4

Maximum Tx rate in Mbps for all stacking
ports.

npstatsStackRxToStackTxMbps

1.3.6.1.4.1.10734.3.3.2.10.11.5

Aggregate through traffic rate fromsegment ports to stacking ports.

npstatsStackMaxRxToStackTxMbps

1.3.6.1.4.1.10734.3.3.2.10.11.6

The maximum through traffic rate fromsegment ports to stacking ports.

npstatsStackRxToSegmentTxMbps

1.3.6.1.4.1.10734.3.3.2.10.11.7

Return rate in Mbps for traffic coming in on
the stacking ports and transmitted to thesegment ports.

npstatsStackMaxRxToSegmentTxMbps

1.3.6.1.4.1.10734.3.3.2.10.11.8

Maximum return rate in Mbps for traffic
coming in on the stacking ports andtransmitted to the segment ports.

npstatsStackRatioToTier1Per10K

1.3.6.1.4.1.10734.3.3.2.10.11.9

Percent of traffic being inspected by thisdevice as a ratio of the stack Rx traffic totier 1 per 10,000 (percent value times 100).

npstatsStackMaxRatioToTier1Per10K

1.3.6.1.4.1.10734.3.3.2.10.11.10

Maximum percent of traffic being inspectedby this device as a ratio of the stack Rx
traffic to tier 1 per 10,000 (percent value
times 100).

SSL inspection objects
SSL Inspection (SslInsp) objects provide information about SSL inspection activity.
ObjectOID

Description

npstatsSslInsp

1.3.6.1.4.1.10734.3.3.2.10.5

Sub-tree for all SSL inspection statistics.

npstatsSslInspCurrentSessions

1.3.6.1.4.1.10734.3.3.2.10.5.1

The current number of active SSL sessions.
This value is not real-time and will lag
approximately 2 minutes from actual, due tothe time interval for calculating the rate.

npstatsSslInspConnectionRate

1.3.6.1.4.1.10734.3.3.2.10.5.2

The average SSL connection rate inconnections per second.

npstatsSslInspBlockedMaxConns

1.3.6.1.4.1.10734.3.3.2.10.5.3

The number of blocked SSL sessions due tomaximum connection limit.

npstatsSslInspPassedMaxConns

1.3.6.1.4.1.10734.3.3.2.10.5.4

The number of passed (not inspected) SSL
sessions due to maximum connection limit.

23

TPS MIBs Guide

ObjectOID

Description

npstatsSslInspTotalBytesIn

1.3.6.1.4.1.10734.3.3.2.10.5.5

The number of inspected inbound SSL
bytes.

npstatsSslInspTotalBytesOut

1.3.6.1.4.1.10734.3.3.2.10.5.6

The number of inspected outbound SSL
bytes.

TPT-POLICY-MIB
The following notifications are generated by policy actions:Object24

OID

Description

tptPolicyNotify

1.3.6.1.4.1.10734.3.3.3.0.8

The notification that a policy action has
resulted from a signature match.

tptPolicyNotifyClientip

1.3.6.1.4.1.10734.3.3.3.1.139

The client IP address associated with thenotification. This value is always set to "".

tptPolicyNotifyDeviceID

1.3.6.1.4.1.10734.3.3.3.1.11

The unique identifier of the device sending
the policy notification.

tptPolicyNotifyMetadata

1.3.6.1.4.1.10734.3.3.3.1.140

Additional event information associatedwith the notification. Because this object istargeted for future support, this value isalways set to N/A.

tptPolicyNotifyPolicyID

1.3.6.1.4.1.10734.3.3.3.1.12

The unique identifier of the policy thatcauses the notification.

tptPolicyNotifySignatureID

1.3.6.1.4.1.10734.3.3.3.1.13

The unique identifier of the signature
matching the incoming data stream.

tptPolicyNotifySegmentName (obsolete)

1.3.6.1.4.1.10734.3.3.3.1.14

The name of the segment to which thenotification applies. Not included in
notification.

tptPolicyNotifySrcNetAddr

1.3.6.1.4.1.10734.3.3.3.1.15

The IPv4 address of the source of the packet
that triggered the policy action.

tptPolicyNotifySrcNetAddrV6

1.3.6.1.4.1.10734.3.3.3.1.128

The IPv6 address of the source of the packet
that triggered the policy action.

tptPolicyNotifySrcNetPort

1.3.6.1.4.1.10734.3.3.3.1.16

The source port of the packet that triggered
the policy action.

tptPolicyNotifyDestNetAddr

1.3.6.1.4.1.10734.3.3.3.1.17

The IPv4 address of the destination of thepacket that triggered the policy action.

tptPolicyNotifyDestNetAddrV6

1.3.6.1.4.1.10734.3.3.3.1.129

The IPv6 address of the destination of thepacket that triggered the policy action.

tptPolicyNotifyDestNetPort

1.3.6.1.4.1.10734.3.3.3.1.18

The destination port of the packet thattriggered the policy action.

tptPolicyNotifyStartTimeSec

1.3.6.1.4.1.10734.3.3.3.1.19

The time at which the policy was first
triggered, marking the start of theaggregation period for this notification.
Measured in seconds since January 1, 1970.

TPS MIBs Guide

ObjecttptPolicyNotifyAlertAction

tptPolicyNotifyConfigAction

tptPolicyNotifyComponentID

OID
1.3.6.1.4.1.10734.3.3.3.1.20

1.3.6.1.4.1.10734.3.3.3.1.21

1.3.6.1.4.1.10734.3.3.3.1.22

Description
The action associated with this notification.
•

1: deny•

2: allow

The action configured for the policy, which
in some cases can differ from the action
associated with the notification.
•

1: deny•

2: allow

The component identifier of the policy thatcauses the notification:•

0: invalid•

1: deny•

2: allow•

7: alert•

8: block•

9: peer

tptPolicyNotifyHitCount

1.3.6.1.4.1.10734.3.3.3.1.23

The number of policy hits occurring during
the aggregation period for this notification.

tptPolicyNotifyAggregationPeriod

1.3.6.1.4.1.10734.3.3.3.1.24

The duration of the aggregation period forthis notification, in minutes.

tptPolicyNotifySeverity

1.3.6.1.4.1.10734.3.3.3.1.25

The severity of the attack.

tptPolicyNotifyProtocol

tptPolicyNotifyAlertTimeSec

1.3.6.1.4.1.10734.3.3.3.1.26

1.3.6.1.4.1.10734.3.3.3.1.27•

1: low•

2: minor•

3: major•

4: critical

The network protocol of the packet(s) thattriggered the policy action.
•

1: ICMP•2: UDP•

3: TCP

•

4: other IP•

5: ARP•

6: other ETH•

7: ICMP v6•

8: other IPV6

The time that the alert was initiated,marking the end of the aggregation period
for this notification. Measured in seconds
since January 1, 1970.

25

TPS MIBs Guide

Object26

OID

Description

tptPolicyNotifyAlertTimeNano

1.3.6.1.4.1.10734.3.3.3.1.28

The nanoseconds portion of theAlertTimeSec object.

tptPolicyNotifyPacketTrace

1.3.6.1.4.1.10734.3.3.3.1.29

Indicates if a corresponding packet trace waslogged.
•0: not logged•

1: logged.

tptPolicyNotifySequence

1.3.6.1.4.1.10734.3.3.3.1.30

The log file entry sequence number
corresponding to this notification. This value
is always set to 0 (zero).

tptPolicyNotifyTraceBucket

1.3.6.1.4.1.10734.3.3.3.1.36

The bucket identifier for a packet trace.

tptPolicyNotifyTraceBegin1.3.6.1.4.1.10734.3.3.3.1.37

The starting sequence number for a packet
trace.

tptPolicyNotifyTraceEnd

1.3.6.1.4.1.10734.3.3.3.1.38

The ending sequence number for a packet
trace.

tptPolicyNotifyMessageParams

1.3.6.1.4.1.10734.3.3.3.1.39

A string containing parameters separated byvertical bars (|) that match information
tagged with Message in the Digital Vaccine.

tptPolicyNotifyStartTimeNano

1.3.6.1.4.1.10734.3.3.3.1.40

The nanoseconds portion of StartTimeSec.

tptPolicyNotifyAlertType

1.3.6.1.4.1.10734.3.3.3.1.41

A bit field defined as follows:•

0x0001 = Alert•

0x0002 = Block•0x0020 = Peer-to-peer•

0x0040 = Invalid•

0x0080 = Threshold•

0x0100 = Management.

tptPolicyNotifyInputMphy

1.3.6.1.4.1.10734.3.3.3.1.57

The incoming physical port of the triggering
packet(s).

tptPolicyNotifyVlanTag

1.3.6.1.4.1.10734.3.3.3.1.58

The VLAN tag of the triggering packet(s).

tptPolicyNotifyZonePair

1.3.6.1.4.1.10734.3.3.3.1.59

A string that identifies the port pair related
to this notification. This value is always set
to "".

tptPolicyNotifyActionSetID

1.3.6.1.4.1.10734.3.3.3.1.130

The action set UUID associated with thisnotification.

tptPolicyNotifyRate

1.3.6.1.4.1.10734.3.3.3.1.131

The rate-limit, in kbps, of the action set
associated with this notification.

tptPolicyNotifyFlowControl

1.3.6.1.4.1.10734.3.3.3.1.137

The action set flow control associated withthis notification.

tptPolicyNotifyActionSetName

1.3.6.1.4.1.10734.3.3.3.1.138

The action set name associated with thisnotification.

TPS MIBs Guide

ObjecttptPolicyNotifySslInspected

OID.1.3.6.1.4.1.10734.3.3.3.1.180

Description
A flag indicting if the notification isassociated with an inspected SSL data
stream. This flag is only present on IPS andQuarantine events and doesn't apply to
Reputation.
1: Yes2: No

tptPolicyNotifyVirtualSegment.1.3.6.1.4.1.10734.3.3.3.1.182

Virtual segment associated with thisnotification.

tptPolicyNotifySslInspEventType.1.3.6.1.4.1.10734.3.3.3.1.190

The SSL connection type. 1: inbound 2:
outbound (not supported)

tptPolicyNotifySslInspAction.1.3.6.1.4.1.10734.3.3.3.1.191

The SSL connection action taken•

1: decrypted•

2: notDecrypted•

3: blocked

tptPolicyNotifySslInspDetails.1.3.6.1.4.1.10734.3.3.3.1.192

Free-form field that provides additional
details for the action taken on a SSL
connection

tptPolicyNotifySslInspPolicy.1.3.6.1.4.1.10734.3.3.3.1.193

The SSL inspection policy.

tptPolicyNotifySslInspCert.1.3.6.1.4.1.10734.3.3.3.1.194

The certificate used to decrypt SSL traffic.

tptPolicyNotifySslInspCltIF.1.3.6.1.4.1.10734.3.3.3.1.195

The client-side interface receiving SSL traffic.

tptPolicyNotifySslInspCltSslVer.1.3.6.1.4.1.10734.3.3.3.1.196

The client-side SSL protocol version.
•

1: unknown•

2: sslv3•

3: tls10•

4: tls 11•

5: tls12

tptPolicyNotifySslInspCltCrypto.1.3.6.1.4.1.10734.3.3.3.1.197

The client-side SSL crypto-suite.

tptPolicyNotifySslInspSrvIF.1.3.6.1.4.1.10734.3.3.3.1.198

The server-side interface sending SSL traffic.

tptPolicyNotifySslInspSrvSslVer.1.3.6.1.4.1.10734.3.3.3.1.199

The server-side SSL protocol version.

tptPolicyNotifySslInspSrvCrypto.1.3.6.1.4.1.10734.3.3.3.1.200•

1: unknown•

2: sslv3•

3: tls10•

4: tls11•

5: tls12

The server-side SSL crypto-suite.

The following variables apply to various policy statistics.

27

TPS MIBs Guide

ObjectOID

Description

policyPacketsDropped

1.3.6.1.4.1.10734.3.3.2.1.1.0

The total number of packets discarded
because of network congestion.

policyPacketsDropped64

1.3.6.1.4.1.10734.3.3.2.1.31.0

The total number of 64-bit packets discarded
because of network congestion.

policyPacketsBlocked

1.3.6.1.4.1.10734.3.3.2.1.2.0

The cumulative number of packets blockedby policy actions.

policyPacketsBlocked64

1.3.6.1.4.1.10734.3.3.2.1.32.0

The total number of 64-bit packets blockedby policy actions.

policyPacketsIncoming

1.3.6.1.4.1.10734.3.3.2.1.3.0

The total number of incoming packets.

policyPacketsIncoming64

1.3.6.1.4.1.10734.3.3.2.1.33.0

The total number of incoming 64-bit packets.

policyPacketsOutgoing

1.3.6.1.4.1.10734.3.3.2.1.4.0

The total number of outgoing packets.

policyPacketsOutgoing64

1.3.6.1.4.1.10734.3.3.2.1.34.0

The total number of outgoing 64-bit packets.

policyPacketsInvalid

1.3.6.1.4.1.10734.3.3.2.1.6.0

The total number of packets discarded
because they were invalid.

policyPacketsInvalid64

1.3.6.1.4.1.10734.3.3.2.1.36.0

The total number of 64-bit packets discarded
because they were invalid.

policyPacketsPermitted

1.3.6.1.4.1.10734.3.3.2.1.7.0

The cumulative number of packets
permitted because of policy actions.

policyPacketsPermitted64

1.3.6.1.4.1.10734.3.3.2.1.37.0

The cumulative number of 64-bit packets
permitted because of policy actions.

policyPacketsRateLimited64

1.3.6.1.4.1.10734.3.3.2.1.38.0

The total number of 64-bit packets discarded
by rate-limiting filters.

policyPacketsTrusted64

1.3.6.1.4.1.10734.3.3.2.1.39.0

The cumulative number of 64-bit packets
trusted because of policy actions.

The following variable applies to Digital Vaccine (DV) statistics.
ObjectpolicyDVObjs

OID
1.3.6.1.4.1.10734.3.3.2.1.10.1.0

Description
Sub-tree of Digital Vaccine information.

The following table ranks the top ten policies according to hit count.
Object28

OID

Description

topTenHitsByPolicyTable

1.3.6.1.4.1.10734.3.3.2.1.11

Table of the ten policies with the largest
number of hit counts.

topTenHitsByPolicyEntry

1.3.6.1.4.1.10734.3.3.2.1.11.1

An entry in the top ten policies table.

topTenRank

1.3.6.1.4.1.10734.3.3.2.1.11.1.1

The numerical ranking of the policy in thetable. A rank of 1 indicates the policy has
the largest number of hits.

policyHitCount

1.3.6.1.4.1.10734.3.3.2.1.11.1.2

The number of alerts generated by thepolicy.

policyName

1.3.6.1.4.1.10734.3.3.2.1.11.1.3

The policy name.

policyUUID

1.3.6.1.4.1.10734.3.3.2.1.11.1.4

The global identifier of the policy.

TPS MIBs Guide

The following variables apply to statistics of all policies at each protocol.
ObjectOID

Description

alertsByProtocolTable

1.3.6.1.4.1.10734.3.3.2.1.13

Table of alert counts of all policies at each
protocol.

alertsByProtocolEntry

1.3.6.1.4.1.10734.3.3.2.1.13.1

An entry in the alerts by protocol table.

alertProtocol

1.3.6.1.4.1.10734.3.3.2.1.13.1.1

Alerts of all policies at each protocol.
•

1: ICMP•2: UDP•

3: TCP

•

4: other IP•

5: ARP•

6: other ETH•

7: ICMP v6•

8: other IPv6

protocolAlertCount

1.3.6.1.4.1.10734.3.3.2.1.13.1.2

The number of alerts generated by allpolicies of a given protocol.

packetsByProtocolTable

1.3.6.1.4.1.10734.3.3.2.1.20

Table of packet counts received in each
protocol.

packetsByProtocolEntry

1.3.6.1.4.1.10734.3.3.2.1.20.1

An entry in the packets by protocol table.
Rows cannot be added or deleted.

packetProtocol

1.3.6.1.4.1.10734.3.3.2.1.20.1.1

The protocol of a policy.

protocolPacketCount

1.3.6.1.4.1.10734.3.3.2.1.20.1.2•

1: ICMP•2: UDP•

3: TCP

•

4: other IP•

5: ARP•

6: other ETH•

7: ICMP v6•

8: other IPv6

The count of packets received for a given
protocol.
•1: ICMP•2: UDP•

3: TCP

•

4: other IP•

5: ARP•

6: other ETH•

7: ICMP v6•

8: other IPv6

29

TPS MIBs Guide

The following variables apply to information and statistics related to the security zone port pair.
ObjectOID

Description

securityZonePairTable

1.3.6.1.4.1.10734.3.3.2.1.22

Table of information and statistics for each
virtual segment.

securityZonePairEntry

1.3.6.1.4.1.10734.3.3.2.1.22.1

An entry in the table.

szpName1.3.6.1.4.1.10734.3.3.2.1.22.1.1

The name of a security zone pair. Each of the48 zone pairs is identified by unique octet
strings.

szpInZoneName

1.3.6.1.4.1.10734.3.3.2.1.22.1.2

The name of the input security zone for eachof the 48 security zone pairs.

szpOutZoneName

1.3.6.1.4.1.10734.3.3.2.1.22.1.3

The name of the output security zone foreach of the 48 security zone pairs.

szpUUID

1.3.6.1.4.1.10734.3.3.2.1.22.1.4

The UUID for each of the 48 security zone
pairs.

szpInZoneUUID

1.3.6.1.4.1.10734.3.3.2.1.22.1.5

The UUID of the input security zone for eachof the 48 security zone pairs.

szpOutZoneUUID

1.3.6.1.4.1.10734.3.3.2.1.22.1.6

The UUID of the output security zone foreach of the 48 security zone pairs.

szpInPackets

1.3.6.1.4.1.10734.3.3.2.1.22.1.7

The number of packets received for each of
the 48 security zone pairs.

szpInOctets

1.3.6.1.4.1.10734.3.3.2.1.22.1.8

The number of bytes received for each of the
48 security zone pairs.

szpAlerts

1.3.6.1.4.1.10734.3.3.2.1.22.1.9

The number of alerts (blocks + permits) for
each of the 48 security zone pairs.

szpBlocks

1.3.6.1.4.1.10734.3.3.2.1.22.1.10

The number of blocks generated for each of
the 48 security zone pairs.

szpPermits

1.3.6.1.4.1.10734.3.3.2.1.22.1.11

The number of permits generated for each of
the 48 security zone pairs.

szpPrecedence

1.3.6.1.4.1.10734.3.3.2.1.22.1.12

The precedence for each of the 48 security
zone pairs.

The following variables apply to statistics for each physical port.
Object30

OID

Description

portStatsTable

1.3.6.1.4.1.10734.3.3.2.1.23

Table of statistics for each physical port.

portStatsEntry

1.3.6.1.4.1.10734.3.3.2.1.23.1

An entry in the port statistics table. Rows
cannot be added or deleted.

portNumber

1.3.6.1.4.1.10734.3.3.2.1.23.1.1

The numeric index of a port.
•

1: 0

•

2: 1

•

3: 2

TPS MIBs Guide

ObjectportName

OID

Description

1.3.6.1.4.1.10734.3.3.2.1.23.1.2

portVlanTranslations

The name of a port.

1.3.6.1.4.1.10734.3.3.2.1.23.1.3

•

1: 1A

•

2: 1B

•

3: 2A

The number of packets leaving this egress
port whose VLAN IDs were translated.

TPT-PORT-CONFIG-MIB
Describes information about the device port configuration.
ObjectOID

Description

portConfigTable

1.3.6.1.4.1.10734.3.3.2.4.1

Table of ports on the device and their configuration
settings. For TPS devices, the loopback column has
no meaning and is set to 0.

portConfigEntry

1.3.6.1.4.1.10734.3.3.2.4.1.1

An entry in the ports table.

portConfigSlot

1.3.6.1.4.1.10734.3.3.2.4.1.1.1

The segment on which the port is located.

portConfigPort

1.3.6.1.4.1.10734.3.3.2.4.1.1.2

The port number.

portConfigLineSpeed

1.3.6.1.4.1.10734.3.3.2.4.1.1.3

The line speed configuration:

portConfigDuplex

portConfigAutoNeg

portConfigShutdown

1.3.6.1.4.1.10734.3.3.2.4.1.1.4

1.3.6.1.4.1.10734.3.3.2.4.1.1.5

1.3.6.1.4.1.10734.3.3.2.4.1.1.6•

0: default•

1: 1GbE•

2: 100 Mb•

3: 10 Mb•

4: 10 GbE•

5: 40 GbE

The duplex configuration.
•

0: default•

1: half•

2: full

The auto-negotiation configuration.
•

0: default

•

1: on

•

2: off

The shutdown configuration.
•

0: disabled—The port can come up normally.

•

1: enabled—The port is either manually
removed from service or link-down
synchronization takes it out of service.

31

TPS MIBs Guide

ObjectOID

Description

portConfigLoopback

1.3.6.1.4.1.10734.3.3.2.4.1.1.7

The loopback configuration. Because loopback is
unsupported, it is always set to 0 (disabled).

portConfigFailover

1.3.6.1.4.1.10734.3.3.2.4.1.1.8

The failover action configuration:

portConfigLDSMode1.3.6.1.4.1.10734.3.3.2.4.1.1.9

portConfigLDSTimeout•

0: block•

1: permit

The link-down synchronization mode.

1.3.6.1.4.1.10734.3.3.2.4.1.1.10•

0: hub•1: breaker•

2: write

The link-down synchronization timeout
configuration.

TPT-RESOURCE-MIB
Describes filesystem, CPU, memory, temperature, power supply, and fan information for the device.

Notifications
The following notifications send information to the management system about the system resources.
Object32

OID

Description

tptResourceNotify

1.3.6.1.4.1.10734.3.3.3.0.14

Sub-tree of notifications that indicate whena resource parameter has crossed apredefined threshold.

tptResourceNotifyDeviceID

1.3.6.1.4.1.10734.3.3.3.1.61

The unique identifier of the device sending
the notification.

tptResourceNotifyIdentifier

1.3.6.1.4.1.10734.3.3.3.1.62

The type of resource that triggered thenotification.
•

1: filesystem•

2: CPU•

3: memory•

4: chassis temperature•

5: fan•6: power supply

tptResourceNotifyFSIndex

1.3.6.1.4.1.10734.3.3.3.1.63

For a filesystem resource, the value is theresource filesystem's table index(resourceFSIndex) that generated thenotification. Otherwise, the value is 0
(zero).

tptResourceNotifyCurrentValue

1.3.6.1.4.1.10734.3.3.3.1.64

The current value of the resource thattriggered this notification.

tptResourceNotifyThresholdMaj

1.3.6.1.4.1.10734.3.3.3.1.65

The major threshold of this resource(between green and yellow states).

TPS MIBs Guide

ObjectOID

Description

tptResourceNotifyThresholdCrit1.3.6.1.4.1.10734.3.3.3.1.66

The critical threshold of this resource(between yellow and red states).

tptResourceNotifyRangeMin

1.3.6.1.4.1.10734.3.3.3.1.67

The minimum end of the range of values
that this resource can take.

tptResourceNotifyRangeMax

1.3.6.1.4.1.10734.3.3.3.1.68

The maximum end of the range of values
that this resource can take.

tptResourceNotifyStateBefore

1.3.6.1.4.1.10734.3.3.3.1.69

The state of the resource before the current
threshold transition.

tptResourceNotifyStateAfter

1.3.6.1.4.1.10734.3.3.3.1.70

The state of this resource after the current
threshold transition.

tptResourceNotifyTimeStamp

1.3.6.1.4.1.10734.3.3.3.1.71

The timestamp of the event that generated
the notification, in seconds since January
1, 1970.

tptResourceNotifySubIdentifier

1.3.6.1.4.1.10734.3.3.3.1.72

Identifies the type of resource that triggers
the notification. Starts with 1.
Not used in 5100N models or lower. For
these models, the value is 0 (zero).

File system
The following objects provide information about the device file system objects:
ObjectOID

Description

resourceNumberOfFilesystems

1.3.6.1.4.1.10734.3.3.2.5.1

Number of filesystems on the device’s hard
disk

resourceFSTable

1.3.6.1.4.1.10734.3.3.2.5.2

Table of filesystem resource information

resourceFSEntry

1.3.6.1.4.1.10734.3.3.2.5.2.1

An entry in the resource filesystem table. Rows
cannot be added or deleted.

resourceFSInUseMB

1.3.6.1.4.1.10734.3.3.2.5.2.1.1

Number of MB in use for the filesystem

resourceFSThresholdMaj

1.3.6.1.4.1.10734.3.3.2.5.2.1.2

Major threshold for the percent of MB in use
for the filesystem

resourceFSThresholdCrit1.3.6.1.4.1.10734.3.3.2.5.2.1.3

Critical threshold for the percent of MB in use
for the filesystem

resourceFSRangeMin

1.3.6.1.4.1.10734.3.3.2.5.2.1.4

Minimum value of the range of MB in use,
usually 0 (zero)

resourceFSRangeMax

1.3.6.1.4.1.10734.3.3.2.5.2.1.5

Total size in MB of the filesystem

resourceFSName

1.3.6.1.4.1.10734.3.3.2.5.2.1.6

Name of this filesystem

resourceFSIndex

1.3.6.1.4.1.10734.3.3.2.5.2.1.7

Unique identifier for a given file system entry
in the table

MemoryThe following table provides information about the device memory usage objects:

33

TPS MIBs Guide

ObjectOID

Description

resourceHPMemoryObjs

1.3.6.1.4.1.10734.3.3.2.5.3

Sub-tree of host processor
memory information

resourceHPMemoryInUsePercent

1.3.6.1.4.1.10734.3.3.2.5.3.1

Percentage of host processor
memory in use

resourceHPMemoryThresholdMaj

1.3.6.1.4.1.10734.3.3.2.5.3.2

Major threshold value for hostprocessor memory usage

resourceHPMemoryThresholdCrit1.3.6.1.4.1.10734.3.3.2.5.3.3

Critical threshold value for hostprocessor memory usage

resourceHPMemoryRangeMin

1.3.6.1.4.1.10734.3.3.2.5.3.4

Minimum percentage of hostprocessor memory usage,
usually 0 (zero)

resourceHPMemoryRangeMax

1.3.6.1.4.1.10734.3.3.2.5.3.5

Maximum percentage of hostprocessor memory usage,
usually 100

resourceHPMemoryTotal

1.3.6.1.4.1.10734.3.3.2.5.3.6

Total size in megabytes of hostprocessor memory

CPU
The following table provides information about CPU usage objects:
Object34

OID

Description

resourceHPCPUObjs

1.3.6.1.4.1.10734.3.3.2.5.4

Sub-tree of host processor CPU
information

resourceHPCPUBusyPercent

1.3.6.1.4.1.10734.3.3.2.5.4.1

Percentage of host processor CPU that iscurrently busy

resourceHPCPUThresholdMaj

1.3.6.1.4.1.10734.3.3.2.5.4.2

Major threshold value for host processor
CPU activity

resourceHPCPUThresholdCrit1.3.6.1.4.1.10734.3.3.2.5.4.3

Critical threshold value of host processor
CPU activity

resourceHPCPURangeMin

1.3.6.1.4.1.10734.3.3.2.5.4.4

Minimum percentage of host processor
CPU activity, usually 0 (zero)

resourceHPCPURangeMax

1.3.6.1.4.1.10734.3.3.2.5.4.5

Maximum percentage of host processor
CPU activity, usually 100

resourceNPCPUBusyPercentA

1.3.6.1.4.1.10734.3.3.2.5.4.6

Total Utilization of XLR A

resourceNPCPUBusyPercentTier2A

1.3.6.1.4.1.10734.3.3.2.5.4.7

F Thread Utilization of XLR A

resourceNPCPUBusyPercentTier3A

1.3.6.1.4.1.10734.3.3.2.5.4.8

KS Thread Utilization of XLR A

resourceNPCPUBusyPercentTier4A

1.3.6.1.4.1.10734.3.3.2.5.4.9

L Thread Utilization of XLR A

resourceNPCPUBusyPercentB

1.3.6.1.4.1.10734.3.3.2.5.4.10

Total Utilization of XLR B

resourceNPCPUBusyPercentTier2B

1.3.6.1.4.1.10734.3.3.2.5.4.11

F Thread Utilization of XLR B

resourceNPCPUBusyPercentTier3B

1.3.6.1.4.1.10734.3.3.2.5.4.12

KS Thread Utilization of XLR B

resourceNPCPUBusyPercentTier4B

1.3.6.1.4.1.10734.3.3.2.5.4.13

L Thread Utilization of XLR BTPS MIBs Guide

ObjectOID

Description

resourceNPCPUBusyPercentC

1.3.6.1.4.1.10734.3.3.2.5.4.14

Total Utilization of XLR C

resourceNPCPUBusyPercent2C

1.3.6.1.4.1.10734.3.3.2.5.4.15

F Thread Utilization of XLR C

resourceNPCPUBusyPercent3C

1.3.6.1.4.1.10734.3.3.2.5.4.16

KS Thread Utilization of XLR C

resourceNPCPUBusyPercent4C

1.3.6.1.4.1.10734.3.3.2.5.4.17

L Thread Utilization of XLR C

Chassis temperature
The following table provide information about the chassis temperature objects:
ObjectOID

Description

resourceChassisTempObjs

1.3.6.1.4.1.10734.3.3.2.5.5

Sub-tree of chassis temperature
information

resourceChassisTempDegreesC

1.3.6.1.4.1.10734.3.3.2.5.5.1

Chassis temperature

resourceChassisTempThresholdMaj

1.3.6.1.4.1.10734.3.3.2.5.5.2

Major threshold value for chassis
temperature

resourceChassisTempThresholdCrit1.3.6.1.4.1.10734.3.3.2.5.5.3

Critical threshold value of chassis
temperature

resourceChassisTempRangeMin

1.3.6.1.4.1.10734.3.3.2.5.5.4

Minimum value of the chassis
temperature range

resourceChassisTempRangeMax

1.3.6.1.4.1.10734.3.3.2.5.5.5

Maximum value of the chassis
temperature range

Important
All values are in degrees Centigrade.

Power supply
The following table provides information about the chassis temperature objects:
Object

OID

resourcePowerSupplyObjs

1.3.6.1.4.1.10734.3.3.2.5.9

Sub-tree of power supply information

resourcePowerSupplyQuantity

1.3.6.1.4.1.10734.3.3.2.5.9.2

Number of power supplies

resourcePowerSupplyMonitoring

1.3.6.1.4.1.10734.3.3.2.5.9.3

Indicates if power supply monitoring isenabled:resourcePowerSupplyTable

1.3.6.1.4.1.10734.3.3.2.5.9.4

Description•

0: disabled•

1: enabled

Table of power supplies on the device.
The number of entries depends on thevalue of theresourcePowerSupplyQuantity object.
The maximum number of entries
depends on the implementation.

35

TPS MIBs Guide

ObjectOID

Description

resourcePowerSupplyEntry

1.3.6.1.4.1.10734.3.3.2.5.9.4.1

An entry in the power supply table.
Rows cannot be created or deleted.

powerSupplyUnitIndex

1.3.6.1.4.1.10734.3.3.2.5.9.4.1.1

Index of the power supply units on a
device. The first entry is 1.

powerSupplyStatus

1.3.6.1.4.1.10734.3.3.2.5.9.4.1.2

If the device has dual power supplies
and power supply monitoring isenabled, this value indicates whether
one or both power supplies isfunctional:•

1: red—critical•

2: green—normal

System information
The following table provides information about the system objects:
ObjectOID

Description

resourceDateTime

1.3.6.1.4.1.10734.3.3.2.5.10

Current date and time of device in seconds
since January 1, 1970. There is no timezone offset.

resourceSnmpRunState

1.3.6.1.4.1.10734.3.3.2.5.11

Indicates which SNMP versions are
running:resourceSnmpConfig

1.3.6.1.4.1.10734.3.3.2.5.12•

0: none•

1: SNMP v2•

2: SNMP v3•

3: Both v2 and v3

Indicates which SNMP versions are
configured:•

0: none•

1: SNMP v2•

2: SNMP v3•

3: Both v2 and v3

resourceRemoteAuthEnabled

1.3.6.1.4.1.10734.3.3.2.5.13

Indicates whether remote authentication isenabledresourceRemoteAuthTimeout

1.3.6.1.4.1.10734.3.3.2.5.14

The remote authentication timeout inseconds

TPT-SFLOW
Provides sFlow status and collector information. The sFlow statistics are sent from the collector to the device.

36

TPS MIBs GuidesFlow collectors
ObjectOID

Description

sFlowCollectorTable

1.3.6.1.4.1.10734.3.3.2.18.1

Table of sFlow collectors. Up to twocollectors are supported.

sFlowCollectorEntry

1.3.6.1.4.1.10734.3.3.2.18.1.1

A collector address and port in thesFlowCollectorTable. Rows cannot becreated or deleted.

collectorIndex

1.3.6.1.4.1.10734.3.3.2.18.1.1.1

Index into the sFlow collector table,
starting with 1.

collectorAddr

1.3.6.1.4.1.10734.3.3.2.18.1.1.2

The IPv4 address of the collector. If theaddress is not set, the value will be an
empty string.

udpPort1.3.6.1.4.1.10734.3.3.2.18.1.1.3

The UDP port of the collector.

collectorAddrV6

1.3.6.1.4.1.10734.3.3.2.18.1.1.4

The IPv6 address of the collector. If theaddress is not set, the value will be an
empty string.

sFlow status
ObjectsFlowStatus

OID
1.3.6.1.4.1.10734.3.3.2.18.2

Description
sFlow status for the device:•

0: disabled•

1: enabled•

2: error•3: not applicable

TPT-SMSMIBSDefines interactions between the SMS and the customer’s NMS.
SMS top level MIBs
ObjectOID

Description

tpt-sms-conf

1.3.6.1.4.1.10734.3.4.1

SMS conformance objects subtree.

tpt-sms-objs

1.3.6.1.4.1.10734.3.4.2

SMS managed objects sub-tree.

tpt-sms-events

1.3.6.1.4.1.10734.3.4.3

SMS events sub-tree that includes all
payload variables needed for notifications.

SMS conformance top-level MIBs
ObjectOID

Description

tpt-sms-groups

1.3.6.1.4.1.10734.3.4.1.1

SMS groups sub-tree.

tpt-sms-compls

1.3.6.1.4.1.10734.3.4.1.2

SMS compliance MIBs sub-tree.

37

TPS MIBs Guide

SMS notification top-level MIBs
ObjectOID

Description

tpt-sms-eventsV2

1.3.6.1.4.1.10734.3.4.3.0

SMS events notification MIBs.

tpt-sms-notifypayload

1.3.6.1.4.1.10734.3.4.3.1

SMS MIB variables sent as part of a
notification payload.

Model number objects
Objecttpt-sms-familyOID
1.3.6.1.4.1.10734.1.4

Description
Registration for the SMS.

TPT-SMS-TRAP-MIB
Describes the notifications sent to and from an SMS device.
SMS Notification MIBs
Object38

OID

Description

tptSmsQuarantineRequest

1.3.6.1.4.1.10734.3.4.3.0.1

The SMS asks an external NMS toquarantine an endstation using the data
embedded in the request.

tptSmsQuarantineAck

1.3.6.1.4.1.10734.3.4.3.0.2

The external NMS notifies the SMS that aquarantine request was processed.

tptSmsQuarantineReleaseRequest

1.3.6.1.4.1.10734.3.4.3.0.3

The SMS asks an external NMS tounquarantine an endstation using the data
embedded in the request.

tptSmsQuarantineReleaseAck

1.3.6.1.4.1.10734.3.4.3.0.4

The external NMS notifies the SMS that an
unquarantine request was processed.

tptSmsQuarantinePolicyNotification

1.3.6.1.4.1.10734.3.4.3.0.5

The SMS sends notification of a policy
match.

tptSmsUnQuarantineRequest

1.3.6.1.4.1.10734.3.4.3.0.6

Commands the SMS to unquarantine an
endstation.

tptSmsQuarantineCommand

1.3.6.1.4.1.10734.3.4.3.0.14

Commands the SMS to quarantine an
endstation.

tptSmsBoot

1.3.6.1.4.1.10734.3.4.3.0.7

Indicates that the SMS has booted.

tptSmsReboot

1.3.6.1.4.1.10734.3.4.3.0.8

Indicates that the SMS is rebooting.

tptSmsShuttingDown

1.3.6.1.4.1.10734.3.4.3.0.9

Indicates that the system is shutting down.

tptSmsReady

1.3.6.1.4.1.10734.3.4.3.0.10

Indicates that the system is ready.

tptSmsAuthenticationError

1.3.6.1.4.1.10734.3.4.3.0.11

Indicates that an authentication error has
occurred.

tptSmsEgpNeighborDownstate

1.3.6.1.4.1.10734.3.4.3.0.12

Indicates that the EGP neighbor is going todownstate.

tptSmsSystemRestart

1.3.6.1.4.1.10734.3.4.3.0.13

Indicates that the server process has
restarted.

TPS MIBs Guide

ObjectOID

Description

tptSmsRepDvVerifySuccess1.3.6.1.4.1.10734.3.4.3.0.15

Indicates that the Reputation DV wasdownloaded and verified.

tptSmsRepDvVerifyFail

1.3.6.1.4.1.10734.3.4.3.0.16

Indicates that the Reputation DV
downloaded but that verification failed.

tptSmsTest

1.3.6.1.4.1.10734.3.4.3.0.17

SMS test trap.

tptSmsRebootingDevice

1.3.6.1.4.1.10734.3.4.3.0.18

Indicates that the SMS is rebooting adevice.

tptDeviceNonComm

1.3.6.1.4.1.10734.3.4.3.0.19

Indicates that the SMS lost communication
with a device.

tptDeviceBooted

1.3.6.1.4.1.10734.3.4.3.0.20

Indicates that a device was rebooted.

SMS MIB Variables
ObjectOID

Description

tptSmsQuarantineNotifyId

1.3.6.1.4.1.10734.3.4.3.1.1

A unique incrementing integer assigned toeach quarantine event.

tptSmsQuarantineNotifyData

1.3.6.1.4.1.10734.3.4.3.1.2

A string that identifies the device to bequarantined. The format is NAME:VALUE.
Multiple parameters are separated by a
new line.

tptSmsQuarantinePolicyMatchData

1.3.6.1.4.1.10734.3.4.3.1.3

A string that identifies the matching policy.

tptSmsQuarantineNotifyType

1.3.6.1.4.1.10734.3.4.3.1.4

A string that identifies the type ofquarantine.

tptSmsQuarantineDeviceIP

1.3.6.1.4.1.10734.3.4.3.1.5

The IP address used as a trap parameter.

tptSmsQuarantineDeviceMAC

1.3.6.1.4.1.10734.3.4.3.1.6

The MAC address used as a trap parameter.

tptSmsQuarantineSwitchPort

1.3.6.1.4.1.10734.3.4.3.1.7

The port number or index used as a trap
parameter.

tptSmsQuarantineEndpointUser

1.3.6.1.4.1.10734.3.4.3.1.8

A string that identifies the quarantined
endpoint user.

tptSmsQuarantineNotifyActionList

1.3.6.1.4.1.10734.3.4.3.1.9

A string that identifies the matching policy.

tptSmsQuarantineNotifyParamList

1.3.6.1.4.1.10734.3.4.3.1.10

A string that identifies the matching policy.

tptSmsQuarantineNotifyOptionList

1.3.6.1.4.1.10734.3.4.3.1.11

A string that identifies the matching policy.

tptSmsQuarantinePolicyName

1.3.6.1.4.1.10734.3.4.3.1.12

The name of an SMS quarantine policy.

tptSmsRepDvVersion

1.3.6.1.4.1.10734.3.4.3.1.13

The Reputation DV version.

tptSmsMessage

1.3.6.1.4.1.10734.3.4.3.1.14

A generic message parameter.

tptSmsQuarantineDataGroup

1.3.6.1.4.1.10734.3.4.1.1.1

Payload of SMS quarantine traps consistingof a unique identifier and a parseable
string.

tptSmsQuarantineNotifyGroup

1.3.6.1.4.1.10734.3.4.1.1.2

SMS quarantine traps sent to an NMS toindicate devices that require a quarantine
operation.

39

TPS MIBs Guide

ObjectOID

Description

tptSmsQuarantineNotifyAckGroup

1.3.6.1.4.1.10734.3.4.1.1.3

SMS quarantine traps sent to an SMS
system to indicate devices that have beenquarantined.

tptSmsQuarantineRequestGroup

1.3.6.1.4.1.10734.3.4.1.1.4

SMS quarantine traps received to indicate
devices that require a (un)quarantine
operation.

TPT-TPA-HARDWARE-MIB
Describes the device hardware and its components, including ports, chassis, fans, and power supplies.
The following table describes the hardware objects:
ObjectOID

Description

hw-numFans

1.3.6.1.4.1.10734.3.3.2.3.7

Number of fan subunits on the device

hw-numPowerSupplies

1.3.6.1.4.1.10734.3.3.2.3.8

Number of power supply subunits on the device

hw-numPEMs

1.3.6.1.4.1.10734.3.3.2.3.9

Number of power entry module subunits on thedevicehw-certificateNumber

1.3.6.1.4.1.10734.3.3.2.3.10

Hardware certificate number of the device

hw-serialNumber

1.3.6.1.4.1.10734.3.3.2.3.11

Hardware serial number of the device

Fans
The following table provides information about the fan hardware objects:
ObjectDescription

hw-fanTable

1.3.6.1.4.1.10734.3.3.2.3.3

Table of fan data for the device. Represented as atable with one row.

hw-fanEntry

1.3.6.1.4.1.10734.3.3.2.3.3.1

An entry in the fan table.

fanSubunit

1.3.6.1.4.1.10734.3.3.2.3.3.1.1

The number for this entry in the fan table. The
controller is always 0 (zero).

fanType

1.3.6.1.4.1.10734.3.3.2.3.3.1.3

Type of hardware element:

fanCfgType

40

OID

1.3.6.1.4.1.10734.3.3.2.3.3.1.4•

0: unequipped•

19: fan controller•

20: fan subunit

Fan configuration:•

0: unconfigured•

1: simplex•

2: duplex•

3: load share•

4: autonomous

TPS MIBs Guide

ObjectfanRunState

fanQualifier1

fanQualifier2

fanQualifier3

fanQualifier4

OID
1.3.6.1.4.1.10734.3.3.2.3.3.1.5

1.3.6.1.4.1.10734.3.3.2.3.3.1.6

1.3.6.1.4.1.10734.3.3.2.3.3.1.7

1.3.6.1.4.1.10734.3.3.2.3.3.1.8

1.3.6.1.4.1.10734.3.3.2.3.3.1.9

Description
High-level hardware state of the fan:•0: out of service•

1: initializing•

2: active•

3: standby•

4: diagnostic•

5: loopback•

6: active-FAF•

7: standby-FAF•

8: active - degraded•

9: standby - degraded

Further qualification/detail on the high-level
hardware state:•

1: degraded•

13: yellow alarm•

14: red alarm

Further qualification/detail on the high-level
hardware state:•

1: degraded•

13: yellow alarm•

14: red alarm

Further qualification/detail on the high-level
hardware state:•

1: degraded•

13: yellow alarm•

14: red alarm

Further qualification/detail on the high-level
hardware state:•

1: degraded•

13: yellow alarm•

14: red alarm

fanStartTime

1.3.6.1.4.1.10734.3.3.2.3.3.1.10

Time at which the fan was powered up

fanVendorID

1.3.6.1.4.1.10734.3.3.2.3.3.1.11

Identifying number of the fan vendor

fanDeviceID

1.3.6.1.4.1.10734.3.3.2.3.3.1.12

An identifying number specific to the fan

fanProductID

1.3.6.1.4.1.10734.3.3.2.3.3.1.13

Versions and other inventory information

fanFPGAVersion

1.3.6.1.4.1.10734.3.3.2.3.3.1.14

Version of the TippingPoint FPGA chip on the fan

For fan health, see Fans.

41

TPS MIBs Guide

Power supply
The following table provides information about the power supply hardware objects:
ObjectDescription

hw-psTable

1.3.6.1.4.1.10734.3.3.2.3.4

Table of power supply data for the device.
Represented as a table with one row.

hw-psEntry

1.3.6.1.4.1.10734.3.3.2.3.4.1

Entry in the power supply table

psSubunit

1.3.6.1.4.1.10734.3.3.2.3.4.1.1

The number for this entry in the power supply
table. This number is always 0 (zero).

psType1.3.6.1.4.1.10734.3.3.2.3.4.1.3

Type of hardware element:

psCfgType

psRunState

psQualifier1

42

OID

1.3.6.1.4.1.10734.3.3.2.3.4.1.4

1.3.6.1.4.1.10734.3.3.2.3.4.1.5

1.3.6.1.4.1.10734.3.3.2.3.4.1.6•

0: unequipped•

17: power supply•

18: power supply sub-unit

Power supply configuration:•

0: unconfigured•

1: simplex•

2: duplex•

3: load share•

4: autonomous

High-level hardware state of the power
supply:•0: out of service•

1: initializing•

2: active•

3: standby•

4: diagnostic•

5: loopback•

6: active-FAF•

7: standby-FAF•

8: active - degraded•

9: standby - degraded

Further qualification/detail on the high-level
hardware state.
•

1: degraded•

13: yellow alarm•

14: red alarm

TPS MIBs Guide

ObjectpsQualifier2

OID
1.3.6.1.4.1.10734.3.3.2.3.4.1.7

psQualifier3

1.3.6.1.4.1.10734.3.3.2.3.4.1.8

psQualifier4

1.3.6.1.4.1.10734.3.3.2.3.4.1.9

Description
Further qualification/detail on the high-level
hardware state.
•

1: degraded•

13: yellow alarm•

14: red alarm

Further qualification/detail on the high-level
hardware state.
•

1: degraded•

13: yellow alarm•

14: red alarm

Further qualification/detail on the high-level
hardware state.
•

1: degraded•

13: yellow alarm•

14: red alarm

psStartTime

1.3.6.1.4.1.10734.3.3.2.3.4.1.10

Time at which the power supply was poweredup

psVendorID

1.3.6.1.4.1.10734.3.3.2.3.4.1.11

Identifying number of the power supply
vendorpsDeviceID

1.3.6.1.4.1.10734.3.3.2.3.4.1.12

Identifying number specific to the power
supplypsProductID

1.3.6.1.4.1.10734.3.3.2.3.4.1.13

Versions and other inventory information

psFPGAVersion

1.3.6.1.4.1.10734.3.3.2.3.4.1.14

Version of the TippingPoint FPGA chip on the
power supply

TPT-TRAFFICThe TPT-TRAFFIC MIB defines traffic rate-limiting information.
Note
The MIB file includes traffic threshold information.

Rate limiter
The following objects provide rate-limit statistics.
ObjectOID

Description

rateLimitTable

1.3.6.1.4.1.10734.3.3.2.8.1

A table providing data about a rate-limit
action set.

rateLimitEntry

1.3.6.1.4.1.10734.3.3.2.8.1.1

An entry in the rate-limit table. Rows
cannot be added or deleted.

rateLimitGlobalID

1.3.6.1.4.1.10734.3.3.2.8.1.1.1

The global ID of a rate-limit action set.

43

TPS MIBs Guide

ObjectOID

Description

rateLimitRequestedRate

1.3.6.1.4.1.10734.3.3.2.8.1.1.2

The bit rate in Kbps defined by the action
set creator.

rateLimitActualRate

1.3.6.1.4.1.10734.3.3.2.8.1.1.3

The bit rate in Kbps defined at the
hardware level.

rateLimitPacketsSent

1.3.6.1.4.1.10734.3.3.2.8.1.1.4

The number of packets sent via this action
set since the table was last cleared.

rateLimitPacketsDropped

1.3.6.1.4.1.10734.3.3.2.8.1.1.5

The number of packets dropped by thisaction set since the table was last cleared.

rateLimitPacketsQueued

1.3.6.1.4.1.10734.3.3.2.8.1.1.6

The number of packets queued and readyto be sent via this action set.

rateLimitHistNumSeconds

1.3.6.1.4.1.10734.3.3.2.8.1.1.7

The number of seconds of valid historicalsample data available.

rateLimitHistNumMinutes

1.3.6.1.4.1.10734.3.3.2.8.1.1.8

The number of minutes of valid historicalsample data available.

rateLimitHistNumHours

1.3.6.1.4.1.10734.3.3.2.8.1.1.9

The number of hours of valid historicalsample data available.

Rate limit historical seconds
The following objects provide rate-limit statistics as recorded every second for a minute.
ObjectOID

Description

rateLimitHistSecondsTable

1.3.6.1.4.1.10734.3.3.2.8.2

Historical sample data as recorded every
second for a minute.

rateLimitHistSecondsEntry

1.3.6.1.4.1.10734.3.3.2.8.2.1

An entry in the rate-limit history seconds
table.

rateLimitHistSecondsGlobalID

1.3.6.1.4.1.10734.3.3.2.8.2.1.1

The global ID of a rate-limit action set.

rateLimitHistSecondsIndex

1.3.6.1.4.1.10734.3.3.2.8.2.1.2

The index (0–59) of a second.

rateLimitHistSecondsBytesSent

1.3.6.1.4.1.10734.3.3.2.8.2.1.3

The number of bytes sent in the specified
second.

rateLimitHistSecondsTimestamp

1.3.6.1.4.1.10734.3.3.2.8.2.1.4

The time that this statistic was updated,measured in seconds since January 1,
1970.

Rate limit historical minutes
The following objects provide rate-limit statistics as recorded every minute for an hour.
Object44

OID

Description

rateLimitHistMinutesTable

1.3.6.1.4.1.10734.3.3.2.8.3

Historical sample data as recorded every
minute for an hour.

rateLimitHistMinutesEntry

1.3.6.1.4.1.10734.3.3.2.8.3.1

An entry in the rate-limit history minutes
table.

rateLimitHistMinutesGlobalID

1.3.6.1.4.1.10734.3.3.2.8.3.1.1

The global ID of a rate-limit action set.

TPS MIBs Guide

ObjectOID

Description

rateLimitHistMinutesIndex

1.3.6.1.4.1.10734.3.3.2.8.3.1.2

The index (0–59) of a minute.

rateLimitHistMinutesBytesSent

1.3.6.1.4.1.10734.3.3.2.8.3.1.3

The number of bytes sent in the specified
minute.

rateLimitHistMinutesTimestamp

1.3.6.1.4.1.10734.3.3.2.8.3.1.4

The time that this statistic was updated,measured in seconds since January 1,
1970.

Rate limit historical hours
The following objects provide rate-limit statistics as recorded every hour for a day.
ObjectOID

Description

rateLimitHistHoursTable

1.3.6.1.4.1.10734.3.3.2.8.4

Historical sample data as recorded every
hour for a day.

rateLimitHistHoursEntry

1.3.6.1.4.1.10734.3.3.2.8.4.1

An entry in the rate-limit history hours
table.

rateLimitHistHoursGlobalID

1.3.6.1.4.1.10734.3.3.2.8.4.1.1

The global ID of a rate limit action set.

rateLimitHistHoursIndex

1.3.6.1.4.1.10734.3.3.2.8.4.1.2

The index (0–23) of an hour.

rateLimitHistHoursBytesSent

1.3.6.1.4.1.10734.3.3.2.8.4.1.3

The number of bytes sent in the specified
hour.

rateLimitHistHoursTimestamp

1.3.6.1.4.1.10734.3.3.2.8.4.1.4

The time that this statistic was updated,measured in seconds since January 1,
1970.

TPT-TPAMIBS-MIB
Describes definitions for TPT device models. This section indicates the addition of the Threat Protection
System (TPS) models to the table. For registration identifiers of other TPT models, refer to the MIBs Guide forthose products.
The following table identifies the TPS models:
ObjectOID

Description

tpt-model-440T-IPS

1.3.6.1.4.1.10734.1.3.47

Registration for the 440T Threat Protection System.

tpt-model-2200T-IPS

1.3.6.1.4.1.10734.1.3.48

Registration for the 2200T Threat Protection
System.

tpt-model-VTPS-Trial-IPS

1.3.6.1.4.1.10734.1.3.49

Registration for the TippingPoint vTPS Standard
Trial Threat Protection System.

tpt-model-VTPS-Standard-IPS

1.3.6.1.4.1.10734.1.3.50

Registration for the TippingPoint vTPS Standard
Threat Protection System.

tpt-model-8200TX-IPS

1.3.6.1.4.1.10734.1.3.51

Registration for the 8200TX Threat Protection
System.

tpt-model-8400TX-IPS

1.3.6.1.4.1.10734.1.3.52

Registration for the 8400TX Threat Protection
System.

45

TPS MIBs Guide

ObjectOID

Description

tpt-model-VTPS-CLOUD

1.3.6.1.4.1.10734.1.3.53

Registration for the TippingPoint Cloud ThreatProtection System.

tpt-model-1100TX-IPS

1.3.6.1.4.1.10734.1.3.54

Registration for the TippingPoint 1100TX ThreatProtection System.

tpt-model 5500TX-IPS

1.3.6.1.4.1.10734.1.3.55

Registration for the TippingPoint 5500TX ThreatProtection System.

tpt-model-9200TXE-IPS

1.3.6.1.4.1.10734.1.3.56

Registration for the TippingPoint 9200TXE ThreatProtection System.

TPT-TSEDefines TSE settings, including adaptive filtering.

Adaptive filter configuration
The following table lists the top ten filters in the Adaptive Filter Configuration list.
ObjectOID

Description

topTenAdaptFilterTable

1.3.6.1.4.1.10734.3.3.2.7.1

Adaptive filter configuration top ten list.

topTenAdaptFilterEntry

1.3.6.1.4.1.10734.3.3.2.7.1.1

An entry in the adaptive filter configuration
top ten list. Rows cannot be added ordeleted.

topTenAdaptFilterRank

1.3.6.1.4.1.10734.3.3.2.7.1.1.1

The numerical ranking of a filter in theadaptive filter top ten list.

adaptFilterName

1.3.6.1.4.1.10734.3.3.2.7.1.1.2

The name of the filter.

adaptFilterUUID

1.3.6.1.4.1.10734.3.3.2.7.1.1.3

The global identifier of the filter.

adaptFilterSegment

1.3.6.1.4.1.10734.3.3.2.7.1.1.4

The segment to which the filter applies.

adaptFilterEnabledState

1.3.6.1.4.1.10734.3.3.2.7.1.1.5

The state of the filter.

adaptFilterSigID

1.3.6.1.4.1.10734.3.3.2.7.1.1.7

The global identifier of a signature.

adaptFilterProfile

1.3.6.1.4.1.10734.3.3.2.7.1.1.8

The name of the profile associated with thefilter.

Connection blocks table
The following table lists all connection blocks.
Object46

OID

Description

connectionBlockTable

1.3.6.1.4.1.10734.3.3.2.7.2

Table of connections that correspond toblocked streams.

connectionBlockEntry

1.3.6.1.4.1.10734.3.3.2.7.2.1

An entry in the connection block table.
Rows cannot be added or deleted.

connectionBlockIndex

1.3.6.1.4.1.10734.3.3.2.7.2.1.1

The index number of the entry in theconnection block table.

TPS MIBs Guide

ObjectOID

Description

connectionBlockSrcAddr

1.3.6.1.4.1.10734.3.3.2.7.2.1.2

The source IPv4 address of a blocked
connection.

connectionBlockSrcPort

1.3.6.1.4.1.10734.3.3.2.7.2.1.3

The source port of a blocked connection.

connectionBlockDestAddr

1.3.6.1.4.1.10734.3.3.2.7.2.1.4

The destination IPv4 address of a blocked
connection.

connectionBlockDestPort

1.3.6.1.4.1.10734.3.3.2.7.2.1.5

The destination port of a blocked
connection.

connectionBlockProtocol

1.3.6.1.4.1.10734.3.3.2.7.2.1.6

The transmission protocol of a blocked
connection.
•

1: ICMP•2: UDP•

3: TCP

•

4: other IP•

5: ARP•

6: other ETH•

7: ICMP v6•

8: other IPV6

connectionBlockPort

1.3.6.1.4.1.10734.3.3.2.7.2.1.7

The segment on which the incoming datacaused the connection to be blocked.

connectionBlockReason

1.3.6.1.4.1.10734.3.3.2.7.2.1.8

The UUID of the signature that caused theblock.

connectionBlockSrcAddrV6

1.3.6.1.4.1.10734.3.3.2.7.2.1.9

The source IPv6 address of a blocked
connection.

connectionBlockDestAddrV6

1.3.6.1.4.1.10734.3.3.2.7.2.1.10

The destination IPv6 address of a blocked
connection.

connectionBlockTotalCount

1.3.6.1.4.1.10734.3.3.2.7.3

The total number of connections
corresponding to blocked streams. Only
the first 50 are included in the connection
block table.

Rate limit streams table
The following table lists connections that have been rate-limited.
ObjectOID

Description

rateLimitStreamTable

1.3.6.1.4.1.10734.3.3.2.7.4

Table of connections that correspond to
rate-limited streams.

rateLimitStreamEntry

1.3.6.1.4.1.10734.3.3.2.7.4.1

An entry in the rate-limited stream table.
Rows cannot be added or deleted.

rateLimitStreamIndex

1.3.6.1.4.1.10734.3.3.2.7.4.1.1

The index number of the entry in the ratelimited stream table.

rateLimitStreamSrcAddr

1.3.6.1.4.1.10734.3.3.2.7.4.1.2

The source IPv4 address of a rate-limited
stream.

47

TPS MIBs Guide

ObjectOID

Description

rateLimitStreamSrcPort

1.3.6.1.4.1.10734.3.3.2.7.4.1.3

The source port of a rate-limited stream.

rateLimitStreamDestAddr

1.3.6.1.4.1.10734.3.3.2.7.4.1.4

The destination IPv4 address of a ratelimited stream.

rateLimitStreamDestPort

1.3.6.1.4.1.10734.3.3.2.7.4.1.5

The destination port of a rate-limited
stream.

rateLimitStreamProtocol

1.3.6.1.4.1.10734.3.3.2.7.4.1.6

The protocol of a rate-limited stream.
•

1: ICMP•2: UDP•

3: TCP

•

4: other IP•

5: ARP•

6: other ETH•

7: ICMP v6•

8: other IPV6

rateLimitStreamPort

1.3.6.1.4.1.10734.3.3.2.7.4.1.7

The segment on which the incoming datacaused the connection to be rate-limited.

rateLimitStreamReason

1.3.6.1.4.1.10734.3.3.2.7.4.1.8

The UUID of the signature that caused therate-limit.

rateLimitStreamSrcAddrV6

1.3.6.1.4.1.10734.3.3.2.7.4.1.9

The source IPv6 address of a rate-limited
stream.

rateLimitStreamDestAddrV6

1.3.6.1.4.1.10734.3.3.2.7.4.1.10

The destination IPv6 address of a ratelimited stream.

rateLimitStreamTotalCount

1.3.6.1.4.1.10734.3.3.2.7.5

The total number of connections
corresponding to rate-limited streams.
Only the first 50 are included in the rate
limited stream table.

Connection trusts table
The following table lists trusted connections.
Object48

OID

Description

connectionTrustTable

1.3.6.1.4.1.10734.3.3.2.7.6.2

Table of connections that
correspond to trusted streams.

connectionTrustEntry

1.3.6.1.4.1.10734.3.3.2.7.6.2.1

An entry in the connection trust
table. Rows cannot be added ordeleted.

connectionTrustIndex

1.3.6.1.4.1.10734.3.3.2.7.6.2.1.1

The index number of the entry inthe connection trust table.

connectionTrustSrcAddr

1.3.6.1.4.1.10734.3.3.2.7.6.2.1.2

The source IPv4 address of a trusted
connection.

connectionTrustSrcPort

1.3.6.1.4.1.10734.3.3.2.7.6.2.1.3

The source port of a trusted
connection.

TPS MIBs Guide

ObjectOID

Description

connectionTrustDestAddr

1.3.6.1.4.1.10734.3.3.2.7.6.2.1.4

The destination IPv4 address of atrusted connection.

connectionTrustDestPort

1.3.6.1.4.1.10734.3.3.2.7.6.2.1.5

The destination port of a trusted
connection.

connectionTrustProtocol

1.3.6.1.4.1.10734.3.3.2.7.6.2.1.6

The protocol of a trusted
connection.
•

1: ICMP•2: UDP•

3: TCP

•

4: other IP•

5: ARP•

6: other ETH•

7: ICMP v6•

8: other IPV6

connectionTrustPort

1.3.6.1.4.1.10734.3.3.2.7.6.2.1.7

The segment on which theincoming data caused theconnection to be trusted.

connectionTrustReason

1.3.6.1.4.1.10734.3.3.2.7.6.2.1.8

The UUID of the signature thatcaused the trust.

connectionTrustSrcAddrV6

1.3.6.1.4.1.10734.3.3.2.7.6.2.1.9

The source IPv6 address of a trusted
connection.

connectionTrustDestAddrV6

1.3.6.1.4.1.10734.3.3.2.7.6.2.1.10

The destination IPv6 address of atrusted connection.

connectionTrustTotalCount

1.3.6.1.4.1.10734.3.3.2.7.6.3

The total number of connections
corresponding to trusted streams.
Only the first 50 are included in theconnection trust table.

Using HP Network Node Manager i with MIBs
HP Network Node Manager i (NNMi) is a well-known commercial network management system. Much of thisinformation can be transposed onto other network management systems.
This topic focuses on adding enterprise MIB monitoring and reporting to NNMi. The examples in this topic
were created on NNMi running on Windows XP Professional Service Pack 1.
Note
To perform the procedures in this topic, you must have installed NNMi. Refer to the NNMi documentation for more
information about that product.

This topic includes the following:•

Loading TippingPoint Enterprise MIBs•

MIB Application Builder
49

TPS MIBs Guide•

Discovering the device•

Creating graphs with Application Builder

Loading TippingPoint Enterprise MIBs
Before you begin, you must configure NNMi to understand the TippingPoint Enterprise MIBs.
1.

In the NNMi Root Map, select the Options menu.

2.

Select Load/Unload MIBs: SNMP.

3.

Load TIPPINGPOINT-REG-MIB.

4.

Load the remaining TPT MIBs in any order. NNMi might prompt you when loading the MIBs to add amacro definition. This is normal behavior, and you should accept the MIB.

MIB Application Builder
NNMi includes a tool called MIB Application Builder that allows you to build custom applications that
retrieve data using SNMP and to retrieve any information stored in a MIB.
1.

Select Options => MIB Application Builder: SNMP. The MIB Application Builder: SNMP dialog box
displays.

2.

Select Edit => New item. The application prompts you with three fields: Application ID, Application Typeand Application Title.
•

Enter 111 for the Application ID.

•

Leave the Application Type as Form.

•Enter an Application Title.

3.

Select the MIB Objects that have the information that you want to view.

4.

Click Next. The MIB Application Builder / Add MIB Objects screen displays.

5.

In the navigation tree, locate iso.org.dod.internet.private.enterprises. You are now at the start of the
IPS MIBs.

6.

In the tree, select the variables that you want to monitor and click Add. Click Close to return to theprevious screen.

7.

Depending on how you added the objects, you might need to reorder them. You can reorder the variables
by using the Up and Down arrows in the New MIB Application - Display Fields form.

8.

Click Next to continue to the New MIB Application - NMN Integration dialog screen.

9.

Enter TippingPoint after Configuration->. The line should appear as Configuration->TippingPoint
under Menu Location. This creates a menu item under the Configuration menu on the main screen.

10. You can select an object on the map. Select Configuration from the menu and retrieve the information
you created if the device is a TippingPoint device.
11. Close the MIB Application Builder dialog box.

50

TPS MIBs Guide

Discovering the device
By default, NNMi automatically discovers devices as they arrive on the network. This form of discovery canbe a slow process and might not display devices for days (depending on the size of your network). To expeditethat process, use the loadhosts command.
1.

Open your text editor and create a file named hosts.

2.

In the file, enter the IP address of your device and the hostname. This format is similar to the UNIX /etc/
hosts file format. For example, you might enter the following information:
192.168.65.20 nds10

3.

Save the file and open a command shell.

4.

Run the loadhosts command on the file. The command takes the network mask and the file asarguments. For example:
loadhosts -m 255.255.255.0 hosts

After you run the loadhosts command, the device is now discovered by NNMi. When you open the Internet
icon on your NNMi map, a green square displays. This icon should be your device or devices. Select this icon
and choose Configuration from the menu bar to view the device.
NNMi has a number of built-in applications that can retrieve data from standard MIBs. For example, when
you open the device configuration, all of the Ethernet interfaces associated with that device are displayed.
When you right-click on the interface and choose Interface Properties, information for that interface isdisplayed.

Creating graphs with Application Builder
You can create an application to graph the data with the MIB Application Builder tool.
1.

Select the Application Builder from the Options menu.

2.

Open your existing applications and double-click to edit.

3.

Change the Application Type from a Form to a Graph.

4.

Set 10 as the Poll Interval and abc as the Y-axis label. You can change these settings to fit your needs.

5.

To generate the graph for your device, select the IPS green square. Choose TippingPoint from theConfiguration menu. A graph displays for the device. Allow the graph to run about 30 seconds to begin
trending the data.

51

TPS MIBs Guide

52