DHCPv4 Snooping Events

https://www.arubanetworks.com/techdocs/AOS-CX/10.07/HTML/5200-8214/Content/fir-int.htm

https://www.arubanetworks.com/techdocs/AOS-CX/10.07/PDF/5200-8214.pdf

DHCPv4 Snooping Events

Base Rule

DHCP Snooping Info Msg

Information

Device Key in Log Message

LogRhythm Schema

Data Type

Schema Description

Event ID

<vmid>

Numbers

Event ID 8201, 8202, 8203, 8204, 8205, 8206, 8207, 8208, 8209, 8210, 8211, 8212, 8213, 8214, 8215, 8216

Severity

<severity>

Text/String

For All: Information
For 8201, 8202, 8203, 8204, 8205, 8206, 8207, 8208, 8209, 8210, 8211:  Warning

Message

<subject>
<dip>
<dport>

Text/String/IP Address/Number

Event ID 8201:
Log event when packet dropped while server packet received on untrusted port.

<subject>
<dport>

Text/String/Number

Event ID 8202:
Log event when client packet dropped while packet destined to untrusted port.

<subject>
<dip>
<dport>

Text/String/IP Address/Number

Event ID 8203:
Log event when packet dropped while packet received from unauthorized server.

<subject>
<smac>
<dport>

Text/String/Number

Event ID 8204:
Log event when client packet received with untrusted relay info.

<subject>
<dmac>
<smac>
<sport>

Text/String/Number

Event ID 8205:
Log event when client address not equal to source MAC.

<subject>
<sip>
<smac>
<sport>
<dport>

Text/String/IP Address/Number

Event ID 8206:
Log event when release packet received on incorrect port.

<subject>
<smac>
<sport>

Text/String/Number

Event ID 8207:
Log event when dynamic binding for a port was replaced with a manual binding.

<subject>
<sip>
<smac>

Text/String/IP Address/Number

Event ID 8208:
Log event when drop client request for already assigned IP.

<subject>
<sip>
<dip>
<dmac>

Text/String/IP Address/Number

Event ID 8209:
Log event when drop server offer for already assigned IP.

<subject>
<sip>
<dip>

Text/String/IP Address/Number

Event ID 8210:
Log event when drop server offer for illegal IP.

<subject>
<sport>
<smac>

Text/String/Number

Event ID 8211:
Log event when binding limit reached on port.

<subject>

Text/String

Event ID 8212:
Log event when all dynamic binding entries are cleared.

<subject>
<dport>

Text/String/Number

Event ID 8213:
Log event when all dynamic binding entries on a port are cleared.

<subject>
<object>

Text/String

Event ID 8214:
Log event when all dynamic binding entries on a vlan are cleared.

<subject>
<sip>
<object>

Text/String/IP Address/Number

Event ID 8215:
Log event when a specific dynamic binding entry on a vlan is cleared.

<subject>
<size>
<object>

Text/String/Number

Event ID 8216:
Log event when failed to import dynamic IP binding entries from external storage.