-- MIB file created 04-Jun-2002 14:27:03, by
--   SMICng version 2.2.11-beta(PRO)(Solaris), January 20, 2001. Enterprise key cisco.com

NETRANGER DEFINITIONS ::= BEGIN

-- From file: "NETRANGER.my"
-- Compile options "4 7 F H N W 03 06 0B 0G 0N 0T"

IMPORTS
    enterprises, NetworkAddress, IpAddress, Counter, Gauge, 
    TimeTicks
            FROM RFC1155-SMI
    OBJECT-TYPE
            FROM RFC-1212
    DisplayString
            FROM RFC1213-MIB;

wheelgroup      OBJECT IDENTIFIER ::= { enterprises 2252 }
securityMgmt    OBJECT IDENTIFIER ::= { wheelgroup 1 }
networkMgmt     OBJECT IDENTIFIER ::= { wheelgroup 3 }
system          OBJECT IDENTIFIER ::= { networkMgmt 1 }
ip              OBJECT IDENTIFIER ::= { networkMgmt 3 }
snmp            OBJECT IDENTIFIER ::= { networkMgmt 5 }
netranger       OBJECT IDENTIFIER ::= { securityMgmt 1 }
autospa         OBJECT IDENTIFIER ::= { securityMgmt 3 }
nrTrapVars      OBJECT IDENTIFIER ::= { netranger 1 }
services        OBJECT IDENTIFIER ::= { netranger 3 }
general         OBJECT IDENTIFIER ::= { netranger 5 }
postoffice      OBJECT IDENTIFIER ::= { services 0 }
sensor          OBJECT IDENTIFIER ::= { services 1 }
config          OBJECT IDENTIFIER ::= { services 2 }
manage          OBJECT IDENTIFIER ::= { services 3 }
event           OBJECT IDENTIFIER ::= { services 4 }
logger          OBJECT IDENTIFIER ::= { services 5 }
smi             OBJECT IDENTIFIER ::= { services 6 }
sap             OBJECT IDENTIFIER ::= { services 7 }
packet          OBJECT IDENTIFIER ::= { services 8 }
commonServices  OBJECT IDENTIFIER ::= { services 9 }
commonVars      OBJECT IDENTIFIER ::= { nrTrapVars 0 }
command         OBJECT IDENTIFIER ::= { nrTrapVars 1 }
error           OBJECT IDENTIFIER ::= { nrTrapVars 2 }
commandLog      OBJECT IDENTIFIER ::= { nrTrapVars 3 }
alarm           OBJECT IDENTIFIER ::= { nrTrapVars 4 }
ipLog           OBJECT IDENTIFIER ::= { nrTrapVars 5 }
redirect        OBJECT IDENTIFIER ::= { nrTrapVars 6 }
addressing      OBJECT IDENTIFIER ::= { alarm 1 }
tcpip           OBJECT IDENTIFIER ::= { addressing 1 }

messageType OBJECT-TYPE
    SYNTAX INTEGER
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "Identifies the type of message (trap) being sent.
        
         Type types are: 
         1) command
         2) error
         3) command log
         4) alarm
         5) IP log
         6) redirect
        
         This object cannot be retrieved from the SNMP agent."
    ::= { commonVars 1 }

recordId OBJECT-TYPE
    SYNTAX INTEGER
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "An ID that is used along with a timestamp, org, host,
         and application ID to uniquiely identify a message
         (trap).
        
         This object cannot be retrieved from the SNMP agent."
    ::= { commonVars 2 }

globalTime OBJECT-TYPE
    SYNTAX INTEGER
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "The time at which the message was generated, expressed
         in number of seconds since the epoch (Jan 1, 1970),
         with respect to GMT.
        
         This object cannot be retrieved from the SNMP agent."
    ::= { commonVars 3 }

localTime OBJECT-TYPE
    SYNTAX INTEGER
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "The time at which the message was generated, expressed
         in number of seconds since the epoch (Jan 1, 1970),
         with respect to the timezone local to the machine
         that generated the message.  The combination of the
         globalTime and the localTime can be used to calculate
         the timezone of the source machine.
        
         This object cannot be retrieved from the SNMP agent."
    ::= { commonVars 4 }

dateString OBJECT-TYPE
    SYNTAX DisplayString
--    Rsyntax OCTET STRING
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "The date at which the message was generated, with respect
         to the timezone of the source machine, expressed as an 
         ASCII string in the format yyyy/mm/dd. 
        
         This object cannot be retrieved from the SNMP agent."
    ::= { commonVars 5 }

timeString OBJECT-TYPE
    SYNTAX DisplayString
--    Rsyntax OCTET STRING
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "The time at which the message was generated, with respect
         to the timezone of the source machine, expressed as an
         ASCII string in the format hh:mm:ss.
        
         This object cannot be retrieved from the SNMP agent."
    ::= { commonVars 6 }

appId OBJECT-TYPE
    SYNTAX INTEGER
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "The application ID of the NetRanger application that
         generated the message.
        
         This object cannot be retrieved from the SNMP agent."
    ::= { commonVars 7 }

hostId OBJECT-TYPE
    SYNTAX INTEGER
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "The host ID of the machine running the NetRanger
         application that generated the message.
        
         This object cannot be retrieved from the SNMP agent."
    ::= { commonVars 8 }

orgId OBJECT-TYPE
    SYNTAX INTEGER
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "An ID that uniquely identifies the organization responsible
         for the machine running the NetRanger application that 
         generated the message.
        
         This object cannot be retrieved from the SNMP agent."
    ::= { commonVars 9 }

errorMessage OBJECT-TYPE
    SYNTAX DisplayString
--    Rsyntax OCTET STRING
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "Describes the error that occurred.
        
         This object cannot be retrieved from the SNMP agent."
    ::= { error 1 }

sourceAppId OBJECT-TYPE
    SYNTAX INTEGER
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "The application ID of the NetRanger application that
         executed the command.
        
         This object cannot be retrieved from the SNMP agent."
    ::= { commandLog 1 }

sourceHostId OBJECT-TYPE
    SYNTAX INTEGER
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "The host ID of the machine running the NetRanger
         application that executed the command.
        
         This object cannot be retrieved from the SNMP agent."
    ::= { commandLog 2 }

sourceOrgId OBJECT-TYPE
    SYNTAX INTEGER
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "An ID that uniquely identifies the organization responsible
         for the machine running the NetRanger application that
         generated the command.
        
         This object cannot be retrieved from the SNMP agent."
    ::= { commandLog 3 }

commandMessage OBJECT-TYPE
    SYNTAX DisplayString
--    Rsyntax OCTET STRING
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "Describes the command that was executed.
        
         This object cannot be retrieved from the SNMP agent."
    ::= { commandLog 4 }

srcDirection OBJECT-TYPE
    SYNTAX DisplayString
--    Rsyntax OCTET STRING
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "Describes whether the source of the alarm is inside or 
         outside the protected network.  IN means inside, and OUT
         means outside.
        
         This object cannot be retrieved from the SNMP agent."
    ::= { alarm 3 }

dstDirection OBJECT-TYPE
    SYNTAX DisplayString
--    Rsyntax OCTET STRING
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "Describes whether the destination of the alarm (the
         machine being attacked) is inside or outside the 
         protected network.  IN means inside, and OUT means
         outside.
        
         This object cannot be retrieved from the SNMP agent."
    ::= { alarm 5 }

eventLevel OBJECT-TYPE
    SYNTAX INTEGER
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "An integer that reflects the severity level of the alarm.
         The number can range from 1 to 255, but the current 
         NetRanger system only uses 1 (least severe) to 5
         (most severe).
        
         This object cannot be retrieved from the SNMP agent."
    ::= { alarm 7 }

sigId OBJECT-TYPE
    SYNTAX INTEGER
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "Describes which signature was detected.  The full list
         of signatures can be found on a NetRanger system at
         /usr/nr/etc/signatures.
        
         This object cannot be retrieved from the SNMP agent."
    ::= { alarm 9 }

subSigId OBJECT-TYPE
    SYNTAX INTEGER
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "Provides additional information about an alarm signature.
        
         This object cannot be retrieved from the SNMP agent."
    ::= { alarm 11 }

protocol OBJECT-TYPE
    SYNTAX DisplayString
--    Rsyntax OCTET STRING
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "Describes the protocol of the attack that was detected.
         Usually, this will be TCP/IP.
        
         This object cannot be retrieved from the SNMP agent."
    ::= { alarm 13 }

srcIpAddr OBJECT-TYPE
    SYNTAX DisplayString
--    Rsyntax OCTET STRING
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "The IP address of the machine from which the attack
         originated.
        
         This object cannot be retrieved from the SNMP agent."
    ::= { tcpip 1 }

dstIpAddr OBJECT-TYPE
    SYNTAX DisplayString
--    Rsyntax OCTET STRING
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "The IP address of the machine being attacked.
        
         This object cannot be retrieved from the SNMP agent."
    ::= { tcpip 3 }

srcIpPort OBJECT-TYPE
    SYNTAX INTEGER
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "The port from which the attack originated.
        
         This object cannot be retrieved from the SNMP agent."
    ::= { tcpip 5 }

dstIpPort OBJECT-TYPE
    SYNTAX INTEGER
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "The port that received the attack on the destination
         machine.  This value may not have significance for
         signatures that involve multiple ports (for example,
         a port sweep).
        
         This object cannot be retrieved from the SNMP agent."
    ::= { tcpip 7 }

rtrIpAddr OBJECT-TYPE
    SYNTAX DisplayString
--    Rsyntax OCTET STRING
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "The IP address of the router through which the attack
         traveled.
        
         This object cannot be retrieved from the SNMP agent."
    ::= { tcpip 9 }

alarmMessage OBJECT-TYPE
    SYNTAX DisplayString
--    Rsyntax OCTET STRING
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION
        "ASCII string that provides additional information about
         an alarm.  For instance, this field gives the exact string
         that was matched during a string match alarm.
        
         This object cannot be retrieved from the SNMP agent."
    ::= { alarm 15 }


END

