Breadcrumbs

DHCPv6 Snooping Events

Vendor Documentation

Classification

Rule Name

Rule Type

Common Event

Classification

DHCPv6 Snooping Events

Base Rule

DHCP Snooping Info Msg

Information

Mapping with LogRhythm Schema

Device Key in Log Message

LogRhythm Schema

Data Type

Schema Description

Event ID

<vmid>

Number

Event ID 8301, 8302, 8303, 8304, 8305, 8306, 8307, 8308, 8309, 8310, 8311, 8312, 8313

Severity

<severity>

Text/String

For All: Information
For 8301, 8302, 8303, 8304, 8305, 8306, 8307, 8308:  Warning

Message

<subject>
<dip>
<dport>

Text/String/IP Address/Number

Event ID 8301:
Log event when packet dropped while server packet received on untrusted port.

 

<subject>
<dport>

Text/String/Number

Event ID 8302:
Log event when client packet dropped while packet destined to untrusted port.

 

<subject>
<dip>
<dport>

Text/String/IP Address/Number

Event ID 8303:
Log event when packet dropped while packet received from unauthorized server.

 

<subject>
<smac>
<dport>

Text/String/Number

Event ID 8304:
Log event when client packet received with untrusted relay info.

 

<subject>
<sip>
<smac>
<sport>
<dport>

Text/String/IP Address/Number

Event ID 8305:
Log event when release packet received on incorrect port.

 

<subject>
<smac>
<sport>

Text/String/Number

Event ID 8306:
Log event when dynamic binding for a port was replaced with a manual binding.

 

<subject>
<sip>
<smac>

Text/String/IP Address/Number

Event ID 8307:
Log event when drop client request for already assigned IP.

 

<subject>
<sport>
<smac>

Text/String/Number

Event ID 8308:
Log event when binding limit reached on port.

 

<subject>

Text/String

Event ID 8309:
Log event when all dynamic binding entries are cleared.

 

<subject>
<dport>

Text/String/Number

Event ID 8310:
Log event when all dynamic binding entries on a port are cleared.

 

<subject>
<object>

Text/String

Event ID 8311:
Log event when all dynamic binding entries on a VLAN are cleared.

 

<subject>
<object>

Text/String

Event ID 8312:
Log event when a specific dynamic binding entry on a VLAN is cleared.

 

<subject>
<size>
<object>

Text/String/Number

Event ID 8313:
Log event when failed to import dynamic IP binding entries from external storage.