A3COM-HUAWEI-AFC-MIB

-- =================================================================
-- Copyright (C) 2008 by Hangzhou H3C TECHNOLOGIES. All rights reserved.
--
-- Description: This MIB is to provide the definition of
--              Abnormal Flow Clean system.
-- Reference:
-- Version: V1.0
-- History:
--   V1.0 2008-07-23, Created by luohaijun
-- =================================================================
A3COM-HUAWEI-AFC-MIB DEFINITIONS ::= BEGIN

    IMPORTS
        h3cCommon FROM A3COM-HUAWEI-OID-MIB
        OBJECT-TYPE, NOTIFICATION-TYPE, MODULE-IDENTITY, Integer32, IpAddress
            FROM SNMPv2-SMI
        ;

h3cAFC  MODULE-IDENTITY
    LAST-UPDATED "200807230000Z"
    ORGANIZATION "H3C Technologies Co., Ltd."
    CONTACT-INFO
        "PLAT Team Hangzhou H3C Technologies Co.,Ltd.
        Shang-Di Information Industry Base,
        Hai-Dian District Beijing P.R. China
        http://www.h3c.com
        Zip:100085"
    DESCRIPTION
        "This MIB is to provide the definition of Abnormal Flow Clean system."
    REVISION "200807230000Z"
    DESCRIPTION
        "The Initial Version of this MIB module."
    ::= { h3cCommon 85 }


h3cAFCLeaf OBJECT IDENTIFIER ::= {h3cAFC  1}

--
-- DDOS ATTACK 'Target IP' OBJECT
--

h3cDDosAttackTargetIP OBJECT-TYPE
    SYNTAX      IpAddress
    MAX-ACCESS  accessible-for-notify
    STATUS      current
    DESCRIPTION
        "This shows the victim of a DDos attack.  The IP Address is in the list
        of protected IP address."
    ::= {h3cAFCLeaf 1}

--
-- DDOS ATTACK 'Attack type' OBJECT
--

h3cDDosAttackType OBJECT-TYPE
    SYNTAX      INTEGER{
                land(1),
                smurf(2),
                fraggle(3),
                winnuke(4),
                synflood(5),
                icmpflood(6),
                udpflood(7),
                icmpredirect(8),
                icmpunreachable(9),
                tracert(11),
                tcpflag(12),
                pingofdeath(13),
                teardrop(14),
                ipfragment(15),
                largeicmp(18),
                sourceroute(19),
                routerecord(20),
                fragflood(24),
                scan(27),
                appstreamalarm(29),
                sessionstreamalarm(30),
                tcpabnormal(32),
                ipfragabnormal(33),
                tftpabnormal(34),
                dnsabnormal(35),
                httpabnormal(36),
                telnetabnormal(37),
                ftpabnormal(38),
                smtpabnormal(39),
                pop3abnormal(40),
                snmpabnormal(41),
                ackabnormal(42),
                cc(43),
                otherabnormal(1024)
                }
    MAX-ACCESS  accessible-for-notify
    STATUS      current
    DESCRIPTION
        "This shows the attack type which the victim is sufferd."
    ::= {h3cAFCLeaf 2}

--
-- DDOS ATTACK 'Attack policy' OBJECT
--

h3cDDosAttackPolicy OBJECT-TYPE
    SYNTAX      OCTET STRING (SIZE(0..80))
    MAX-ACCESS  accessible-for-notify
    STATUS      current
    DESCRIPTION
        "This shows the policy name which detects the DDos Attack."
    ::= {h3cAFCLeaf 3}
    
--
-- DDOS ATTACK 'Attack threshold' OBJECT
--

h3cDDosAttackThreshold OBJECT-TYPE
    SYNTAX      Integer32
    MAX-ACCESS  accessible-for-notify
    STATUS      current
    DESCRIPTION
        "This shows the policy threshold in the DDos Attack."
    ::= {h3cAFCLeaf 4}

--
-- DDOS ATTACK 'Attack speed' OBJECT
--

h3cDDosAttackSpeed OBJECT-TYPE
    SYNTAX      Integer32
    MAX-ACCESS  accessible-for-notify
    STATUS      current
    DESCRIPTION
        "This shows the rate of policy in the DDos Attack."
    ::= {h3cAFCLeaf 5}



-- **********************************************************************
-- Define enterprise repeater traps. Rules for traps are that any
-- varbind must be from a table in which the first qualifier on the
-- object id is the service identifier of the 'thing' causing the trap.
-- **********************************************************************
h3cAFCNotify OBJECT IDENTIFIER ::= {h3cAFC  2}

h3cAFCNotifyPrefix OBJECT IDENTIFIER ::= { h3cAFCNotify 0 }

h3cDDosAttackStart NOTIFICATION-TYPE
    OBJECTS {
        h3cDDosAttackTargetIP,
        h3cDDosAttackType,
        h3cDDosAttackPolicy,
        h3cDDosAttackThreshold,
        h3cDDosAttackSpeed
        }
    STATUS  current
    DESCRIPTION
        "This trap is sent when a DDos attack on specific IP is detected.
         The IP address of the victim is the first object.
         The exact type of the attack is the second object.
         The policy name which detects the attack is the third object.
         The threshold of the attack is the 4th object.
         The speed of the attack is the 5th object."
    ::= {h3cAFCNotifyPrefix 1}


h3cDDosAttackEnd NOTIFICATION-TYPE
    OBJECTS {
        h3cDDosAttackTargetIP
        }
    STATUS  current
    DESCRIPTION
        "This trap is sent when a DDos Attack end.  The IP address of the
        victim is the very object."
    ::= {h3cAFCNotifyPrefix 2}

END