--
--   
-- ARBOR NETWORKS
-- 
--
--
--   File:		ARBORNET-PDOS.txt
--   Created:		May, 2001
--   Purpose:		Peakflow DoS MIB
--		describe any data which we provide
--		describe any traps which we send
--
--

PEAKFLOW-DOS-MIB	DEFINITIONS ::= BEGIN


IMPORTS
        MODULE-IDENTITY,
        OBJECT-TYPE,
        NOTIFICATION-TYPE,
	TimeTicks,
        Gauge32,
        Integer32,
	IpAddress,
        Counter32
                FROM SNMPv2-SMI
        TEXTUAL-CONVENTION,
        DisplayString,
        TruthValue
                FROM SNMPv2-TC
        MODULE-COMPLIANCE,
        OBJECT-GROUP
                FROM SNMPv2-CONF
	sysDescr,
	sysLocation,
	sysName
                FROM SNMPv2-MIB
	arbornetworksProducts
		FROM ARBOR-SMI;


-- =================================================================================

peakflowDosMIB MODULE-IDENTITY
	LAST-UPDATED "200301250000Z" -- January 25, 2003
	ORGANIZATION "Arbor Networks, Inc."
	CONTACT-INFO
		"	Arbor Networks, Inc.
			Security Operations Center

			Postal: 430 Bedford Street, Suite 160
				Lexington, MA 02420

			Tel: +1 866.212.7267 (1 866 A1 ARBOR)
			Email: support@arbor.net "

	DESCRIPTION
		"Peakflow DoS MIB"

	-- Revision log, reverse chrono
	REVISION    "200105010000Z" -- May 1, 2001
	DESCRIPTION "Initial writing and import"

	::= { arbornetworksProducts 1 }


peakflowDosCMI OBJECT IDENTIFIER ::= { peakflowDosMIB 1 }
peakflowDosMgr OBJECT IDENTIFIER ::= { peakflowDosMIB 2 }
peakflowDosTraps OBJECT IDENTIFIER ::= { peakflowDosMIB 3 }


-- =================================================================================


-- =================================================================================
--
-- decorated data
--


pdosUrl	OBJECT-TYPE
	SYNTAX      DisplayString (SIZE (1..256))
	MAX-ACCESS  read-only
	STATUS      current
	DESCRIPTION
		"This URL is a back reference to the Peakflow controller
		that has details about the anomaly."
	::= { peakflowDosCMI 1 }

pdosAnomalyId	OBJECT-TYPE
	SYNTAX	INTEGER
	ACCESS	read-only
	STATUS	current
	DESCRIPTION 
		"Identifies the Peakflow anomaly"
	::= { peakflowDosCMI 2 }

pdosAnomalyDirection	OBJECT-TYPE
	SYNTAX	DisplayString (SIZE (1..64))
	ACCESS	read-only
	STATUS	current
	DESCRIPTION
		"Description of anomaly direction"
	::= { peakflowDosCMI 3 }

pdosAnomalyResource	OBJECT-TYPE
	SYNTAX	DisplayString (SIZE (1..256))
	ACCESS	read-only
	STATUS	current
	DESCRIPTION
		"Description of anomaly resource"
	::= { peakflowDosCMI 4 }

pdosHeartbeatSource	OBJECT-TYPE
	SYNTAX  DisplayString (SIZE (1..256))
	ACCESS  read-only
	STATUS  current
	DESCRIPTION
		"Describes the collection which lost heartbeat"
	::= { peakflowDosCMI 5 }

internalErrorLocation	OBJECT-TYPE
	SYNTAX  DisplayString (SIZE (1..256))
	ACCESS  read-only
	STATUS  current
	DESCRIPTION
		"Describes the location of the internal error"
	::= { peakflowDosCMI 6 }
		
internalErrorReason	OBJECT-TYPE
	SYNTAX  DisplayString (SIZE (1..256))
	ACCESS  read-only
	STATUS  current
	DESCRIPTION
		"Describes the location of the internal error"
	::= { peakflowDosCMI 7 }
		
pdosAnomalyProto	OBJECT-TYPE
	SYNTAX  DisplayString (SIZE (1..256))
	ACCESS  read-only
	STATUS  current
	DESCRIPTION
		"IP protocols associated with the anomaly"
	::= { peakflowDosCMI 8 }

pdosAnomalyLinkPercent	OBJECT-TYPE
	SYNTAX  INTEGER (0..10000)
	ACCESS  read-only
	STATUS  current
	DESCRIPTION
		"Percent of link usage by an anomaly"
	::= { peakflowDosCMI 9 }

pdosAnomalyAlertCnt	OBJECT-TYPE
	SYNTAX	INTEGER
	ACCESS  read-only
	STATUS  obsolete -- OBSOLETE
	DESCRIPTION
		"Number of times a notification has been issued
		for this anomaly"
	::= { peakflowDosCMI 10 }

pdosAnomalyStart	OBJECT-TYPE
	SYNTAX	DisplayString (SIZE (1..64))
	ACCESS	read-only
	STATUS  current
	DESCRIPTION
		"Textual description of the time the anomaly started"
	::= { peakflowDosCMI 11 }

pdosAnomalyDuration	OBJECT-TYPE
	SYNTAX 	TimeTicks
	ACCESS  read-only
	STATUS  current
	DESCRIPTION
		"Duration (in centiseconds) since the start of the
		anomaly"
	::= { peakflowDosCMI 12 }

pdosAnomalyTcpFlags	OBJECT-TYPE
	SYNTAX  DisplayString (SIZE (1..64))
	ACCESS  read-only
	STATUS  current
	DESCRIPTION
		"TCP flags associated with the anomaly signature"
	::= { peakflowDosCMI 13 }

pdosAnomalyRouter	OBJECT-TYPE
	SYNTAX  	IpAddress
	ACCESS  read-only
	STATUS  current
	DESCRIPTION
		"The router which is either not sending NetFlow
		or has resumed sending NetFlow"
	::= { peakflowDosCMI 14 }
	
pdosAnomalyRouterInterfaces	OBJECT-TYPE
	SYNTAX  DisplayString (SIZE (1..512))
	ACCESS  read-only
	STATUS  current
	DESCRIPTION
		"Router interfaces involved in the anomaly"
	::= { peakflowDosCMI 15 }

-- =================================================================================
--  Notifications:
--

peakflowDosTrapsEnumerate OBJECT IDENTIFIER ::= { peakflowDosTraps 0 }

bandwidthAnomaly NOTIFICATION-TYPE
        OBJECTS {
		pdosAnomalyId,
		pdosAnomalyDirection,
		pdosAnomalyResource,
		pdosAnomalyLinkPercent,
		pdosAnomalyStart,
		pdosAnomalyDuration,
		pdosAnomalyRouterInterfaces,
		pdosUrl
			}
        STATUS  current
        DESCRIPTION
		"Bandwidth anomaly detected by Peakflow"
        ::= { peakflowDosTrapsEnumerate 1 }

tcpflagsAnomaly NOTIFICATION-TYPE
        OBJECTS {
		pdosAnomalyId,
		pdosAnomalyDirection,
		pdosAnomalyResource,
		pdosAnomalyLinkPercent,
		pdosAnomalyStart,
		pdosAnomalyDuration,
		pdosAnomalyTcpFlags,
		pdosAnomalyRouterInterfaces,
		pdosUrl
			}
        STATUS  current
        DESCRIPTION
		"TCP flags anomaly detected by Peakflow"
        ::= { peakflowDosTrapsEnumerate 2 }

protocolAnomaly NOTIFICATION-TYPE
        OBJECTS {
		pdosAnomalyId,
		pdosAnomalyDirection,
		pdosAnomalyResource,
		pdosAnomalyLinkPercent,
		pdosAnomalyStart,
		pdosAnomalyDuration,
		pdosAnomalyProto,
		pdosAnomalyRouterInterfaces,
		pdosUrl
			}
        STATUS  current
        DESCRIPTION
		"Protocol anomaly detected by Peakflow"
        ::= { peakflowDosTrapsEnumerate 3 }

heartbeatLoss NOTIFICATION-TYPE
        OBJECTS {
		pdosHeartbeatSource
			}
        STATUS  current
        DESCRIPTION
		"Missing heartbeat from collector to controller"
        ::= { peakflowDosTrapsEnumerate 4 }

internalError	NOTIFICATION-TYPE
	OBJECTS {
		internalErrorLocation,
		internalErrorReason
	}
	STATUS  current
	DESCRIPTION
		"Internal inconsistency or error"
	::= { peakflowDosTrapsEnumerate 5 }

-- Not all anomaly types have proto or flags.
anomalyDone	NOTIFICATION-TYPE
	OBJECTS {
		pdosAnomalyId,
		pdosAnomalyDirection,
		pdosAnomalyResource,
		pdosAnomalyLinkPercent,
		pdosAnomalyStart,
		pdosAnomalyDuration,
		pdosAnomalyProto,
		pdosAnomalyTcpFlags,
		pdosAnomalyRouterInterfaces,
		pdosUrl
		}
	STATUS	current
	DESCRIPTION
		"Some previously detected anomaly is no longer active"
	::= { peakflowDosTrapsEnumerate 6 }

netflowMissing NOTIFICATION-TYPE
	OBJECTS {
		pdosAnomalyRouter
	}
	STATUS  current
	DESCRIPTION
		"NetFlow has not been received from a NetFlow
		transmitting router"
	::= { peakflowDosTrapsEnumerate 7 }

netflowMissingDone NOTIFICATION-TYPE
	OBJECTS {
		pdosAnomalyRouter
	}
	STATUS  current
	DESCRIPTION
		"NetFlow has resumed from a router which previously
		was not forwarding NetFlow data"
	::= { peakflowDosTrapsEnumerate 8 }
		
icmpMisuseAnomaly NOTIFICATION-TYPE
	OBJECTS {
		pdosAnomalyId,
		pdosAnomalyDirection,
		pdosAnomalyResource,
		pdosAnomalyLinkPercent,
		pdosAnomalyStart,
		pdosAnomalyDuration,
		pdosAnomalyProto,
		pdosAnomalyRouterInterfaces,
		pdosUrl
			}
	STATUS  current
	DESCRIPTION
		"ICMP misuse anomaly detected by Peakflow"
	::= { peakflowDosTrapsEnumerate 9 }

tcpNullMisuseAnomaly NOTIFICATION-TYPE
	OBJECTS {
		pdosAnomalyId,
		pdosAnomalyDirection,
		pdosAnomalyResource,
		pdosAnomalyLinkPercent,
		pdosAnomalyStart,
		pdosAnomalyDuration,
		pdosAnomalyProto,
		pdosAnomalyTcpFlags,
		pdosAnomalyRouterInterfaces,
		pdosUrl
			}
	STATUS  current
	DESCRIPTION
		"TCP Null misuse anomaly detected by Peakflow"
	::= { peakflowDosTrapsEnumerate 10 }

tcpSynMisuseAnomaly NOTIFICATION-TYPE
	OBJECTS {
		pdosAnomalyId,
		pdosAnomalyDirection,
		pdosAnomalyResource,
		pdosAnomalyLinkPercent,
		pdosAnomalyStart,
		pdosAnomalyDuration,
		pdosAnomalyProto,
		pdosAnomalyTcpFlags,
		pdosAnomalyRouterInterfaces,
		pdosUrl
			}
	STATUS  current
	DESCRIPTION
		"TCP SYN misuse anomaly detected by Peakflow"
	::= { peakflowDosTrapsEnumerate 11 }

ipNullMisuseAnomaly NOTIFICATION-TYPE
	OBJECTS {
		pdosAnomalyId,
		pdosAnomalyDirection,
		pdosAnomalyResource,
		pdosAnomalyLinkPercent,
		pdosAnomalyStart,
		pdosAnomalyDuration,
		pdosAnomalyProto,
		pdosAnomalyRouterInterfaces,
		pdosUrl
			}
	STATUS  current
	DESCRIPTION
		"IP Null misuse anomaly detected by Peakflow"
	::= { peakflowDosTrapsEnumerate 12 }

ipFragMisuseAnomaly NOTIFICATION-TYPE
	OBJECTS {
		pdosAnomalyId,
		pdosAnomalyDirection,
		pdosAnomalyResource,
		pdosAnomalyLinkPercent,
		pdosAnomalyStart,
		pdosAnomalyDuration,
		pdosAnomalyProto,
		pdosAnomalyRouterInterfaces,
		pdosUrl
			}
	STATUS  current
	DESCRIPTION
		"IP Fragment misuse anomaly detected by Peakflow"
	::= { peakflowDosTrapsEnumerate 13 }

ipPrivateMisuseAnomaly NOTIFICATION-TYPE
	OBJECTS {
		pdosAnomalyId,
		pdosAnomalyDirection,
		pdosAnomalyResource,
		pdosAnomalyLinkPercent,
		pdosAnomalyStart,
		pdosAnomalyDuration,
		pdosAnomalyRouterInterfaces,
		pdosUrl
			}
	STATUS  current
	DESCRIPTION
		"IP Private misuse anomaly detected by Peakflow"
	::= { peakflowDosTrapsEnumerate 14 }

heartbeatLossDone NOTIFICATION-TYPE
        OBJECTS {
		pdosHeartbeatSource
			}
	STATUS  current
	DESCRIPTION
		"Heartbeat from collector to controller now works"
	::= { peakflowDosTrapsEnumerate 15 }

tcpRstMisuseAnomaly NOTIFICATION-TYPE
	OBJECTS {
		pdosAnomalyId,
		pdosAnomalyDirection,
		pdosAnomalyResource,
		pdosAnomalyLinkPercent,
		pdosAnomalyStart,
		pdosAnomalyDuration,
		pdosAnomalyRouterInterfaces,
		pdosUrl
			}
	STATUS  current
	DESCRIPTION
		"TCP RST misuse anomaly detected by Peakflow"
	::= { peakflowDosTrapsEnumerate 16 }

totalTrafficMisuseAnomaly NOTIFICATION-TYPE
	OBJECTS {
		pdosAnomalyId,
		pdosAnomalyDirection,
		pdosAnomalyResource,
		pdosAnomalyLinkPercent,
		pdosAnomalyStart,
		pdosAnomalyDuration,
		pdosAnomalyRouterInterfaces,
		pdosUrl
			}
	STATUS  current
	DESCRIPTION
		"Total Traffic misuse anomaly detected by Peakflow"
	::= { peakflowDosTrapsEnumerate 17 }

fingerprintAnomaly NOTIFICATION-TYPE
	OBJECTS {
		pdosAnomalyId,
		pdosAnomalyDirection,
		pdosAnomalyResource,
		pdosAnomalyLinkPercent,
		pdosAnomalyStart,
		pdosAnomalyDuration,
		pdosAnomalyRouterInterfaces,
		pdosUrl
			}
	STATUS  current
	DESCRIPTION
		"Fingerprint anomaly detected by Peakflow"
	::= { peakflowDosTrapsEnumerate 18 }


-- =================================================================================

END

