Re: SNMP error code capture ??

The following lines are from RFC 3413 as mentioned from section 3.2 (
Command Responder Applications ==> Agents/Entities) .....

       - If the isAccessAllowed ASI returns a noSuchView, noAccessEntry,
         or noGroupName error, processing of the management operation is
         halted, a PDU value is constructed using the values from the
         originally received PDU, but replacing the error-status with an
         authorizationError code, and error-index value of 0, and
         control is passed to step (6) below.

This states that when the agent tries to authorize the request, it returns
"authorizationError" code in case of failure ....
But is it that net-snmp has not implemented it this way as specified above
?? ( maybe due to security concerns ..... ??? )

Sarathy



On 1/31/07, Dave Shield <[email protected]> wrote:
> On 31/01/07, sarathy <[email protected]> wrote:
> > But why is then an snmp ERROR code "authorizationError (16)"
> > exist if the agent does not respond ?
>
> From RFC 1901, Section 3:
>
>     Note that with this administrative framework, the
>    'authorizationError(16)' value defined for the error-status component
>    of an SNMPv2 PDU [4] is unused.  It may, however, be used with future
>    administrative frameworks.
>
> This is exactly what happened with SNMPv3 (see RFC 3413)
>
>
> > Also is there a straight way to get the error code from the execution of
an
> > SNMP command, rather than processing from the debug output/raw packet
> > hexdump ?
>
> Not with the command-line tools, no.
> But if you wrote a simple C-based application to make the request, you'd
have
> access to the 'pdu->error_status' field, which holds this value.
>
>
>
>
> > > > 3. While specifying incorrect agent port in an snmpget.
> >
> > I added this option to mean that the error message is valid for this and
not
> > the other two :-). i.e The error reporting is incorrect ..
>
> No - the error reporting is correct.
> If the client application doesn't receive a response, then that's what it
> should report. It can't exactly make up an error code!
>
> Now you might well wish to take issue with the behaviour when a
> community-based agent receives a request with an unknown community.
> But that's a complaint for the group that defined SNMP - not us.  :-)
> We're just following the specification of the protocol!
>
> I'm actually surprised that you get a timeout with SNMPv3 though.
> I thought that should return a REPORT PDU.   But Wes is the SNMPv3
> expert, not me - and I don't really have the time to investigate properly
> just at the moment.
>
> Dave

-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier.
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642

_______________________________________________
Net-snmp-users mailing list
[email protected]
Please see the following page to unsubscribe or change other options:
https://lists.sourceforge.net/lists/listinfo/net-snmp-users