Help with Custom MIB for TippingPoint Blocks

uchn1ds

I'm trying to setup a custom MIB to show how many packets are being blocked by a TippingPoint IPS. I've tried 2 OIDs I've found in TippingPoint documentation that appears to poll the correct data, but my historical graph and current status don't match up. I'm not sure if I'm doing something wrong or if I'm just not understanding what I'm seeing.



Doing a test while setting up the Custom MIB returns a value of 400,000+ blocks which is what the web interface of the IPS shows. I reset the IPS counters yesterday so this is 400,000+ in less than 24 hours. The Orion web page at first shows this value then after it's polled again in 5 minutes it shows a value of 6. If I pull up the historical graph, never is the value in the single digits, it stays between 8500-11,000.



Any thoughts on what's going on?



--- From TippingPoint doc ---

Blocked Attacks

• MIB: TPT-POLICY

• MIB Variable: policyPacketsBlocked

• Description: This variable returns the number of attacks the TippingPoint IPS device has blocked since boot or counter reset.

• Object Identifier (OID): 1.3.6.1.4.1.10734.3.3.2.1.2

• Raw Request: snmpget -v 2c -c community 10.0.0.1 1.3.6.1.4.1.10734.3.3.2.1.2.0



--- From TippingPoint doc listing all OIDs ---

$obj 1.3.6.1.4.1.10734.3.3.2.1.2 policyPacketsBlocked VT_COUNTER



--- Here's what I tried ---

--- Both OIDs appear to have same results ---

OID = 1.3.6.1.4.1.10734.3.3.2.1.2

SNMP Options = Use SNMP Get Next Request (Get would not work)

or

OID = 1.3.6.1.4.1.10734.3.3.2.1.2.0

SNMP Options = Use SNMP Get Request (Get Next would not work)



MIB Value Type = Counter

Unit = Left Blank

Timeframe = None

Keep real-time and historical statistics = Yes



Thanks,

Marty Gramlick