DHCPv6 Snooping Events

https://www.arubanetworks.com/techdocs/AOS-CX/10.07/HTML/5200-8214/Content/fir-int.htm

https://www.arubanetworks.com/techdocs/AOS-CX/10.07/PDF/5200-8214.pdf

DHCPv6 Snooping Events

Base Rule

DHCP Snooping Info Msg

Information

Device Key in Log Message

LogRhythm Schema

Data Type

Schema Description

Event ID

<vmid>

Number

Event ID 8301, 8302, 8303, 8304, 8305, 8306, 8307, 8308, 8309, 8310, 8311, 8312, 8313

Severity

<severity>

Text/String

For All: Information
For 8301, 8302, 8303, 8304, 8305, 8306, 8307, 8308:  Warning

Message

<subject>
<dip>
<dport>

Text/String/IP Address/Number

Event ID 8301:
Log event when packet dropped while server packet received on untrusted port.

<subject>
<dport>

Text/String/Number

Event ID 8302:
Log event when client packet dropped while packet destined to untrusted port.

<subject>
<dip>
<dport>

Text/String/IP Address/Number

Event ID 8303:
Log event when packet dropped while packet received from unauthorized server.

<subject>
<smac>
<dport>

Text/String/Number

Event ID 8304:
Log event when client packet received with untrusted relay info.

<subject>
<sip>
<smac>
<sport>
<dport>

Text/String/IP Address/Number

Event ID 8305:
Log event when release packet received on incorrect port.

<subject>
<smac>
<sport>

Text/String/Number

Event ID 8306:
Log event when dynamic binding for a port was replaced with a manual binding.

<subject>
<sip>
<smac>

Text/String/IP Address/Number

Event ID 8307:
Log event when drop client request for already assigned IP.

<subject>
<sport>
<smac>

Text/String/Number

Event ID 8308:
Log event when binding limit reached on port.

<subject>

Text/String

Event ID 8309:
Log event when all dynamic binding entries are cleared.

<subject>
<dport>

Text/String/Number

Event ID 8310:
Log event when all dynamic binding entries on a port are cleared.

<subject>
<object>

Text/String

Event ID 8311:
Log event when all dynamic binding entries on a VLAN are cleared.

<subject>
<object>

Text/String

Event ID 8312:
Log event when a specific dynamic binding entry on a VLAN is cleared.

<subject>
<size>
<object>

Text/String/Number

Event ID 8313:
Log event when failed to import dynamic IP binding entries from external storage.