RE: SNMPv3 works for about an hour and then stops working C490567

I have a dumb question: In section 3.2 of RFC 3414, it says that an error indication is returned if certain authorization or authentication steps fail.  Returned to what?  If I understand what I am reading, if an snmpd gets a poll from an external NMS that is erroneous in some way, the engine in the snmpd reports the error to something higher level.  Is this error recorded in some log file in the net-snmp implementation?  Is there some other way I can see it?

Thank you 


Jeff Silverman  |  Network Support Engineer 
F5 Networks 
  P  888-882-4447
 F 206.272-5541
www.f5.com 
  D 206.272.6465
 M 

 

-----Original Message-----
From: [email protected] [mailto:[email protected]] On Behalf Of Dave Shield
Sent: Wednesday, February 18, 2009 12:31 AM
To: Jeff Silverman
Cc: [email protected]
Subject: Re: SNMPv3 works for about an hour and then stops working C490567

2009/2/17 Jeff Silverman <[email protected]>:
> I have a customer who is using Zenos and SNMPv3 to poll a pair of 
> embedded machines that are running  net-snmp-5.0.9 .....  I have 
> packet captures in wireshark that show that one unit is replying with 
> "report SNMP-USER-BASED-SM-MIB:usmStatsNotInTimewindows.0"

> My hypothesis is that the NMS and the snmpd engineIDs are getting out 
> of sync for some reason.

A 'notInTimeWindow' report isn't concerned with the engineID value.
It's related to the values of the 'snmpEngineBoots' and 'snmpEngineTime'
fields in the SNMPv3 request.
   See RFC 3414, sections 2.2, 2.3 and 3.2 step 7) for a full description.


Have a look at the wireshark trace for the two or three request/response pairs immediately before the point where the agent stops responding.
What are the engineBoot/Time values here?

What are these value in the request that triggered the notInTimeWindow report.
and the report itself?

What about in the traffic immediately afterwards?

That might give some indication as to what might be going wrong.

Dave

------------------------------------------------------------------------------
Open Source Business Conference (OSBC), March 24-25, 2009, San Francisco, CA
-OSBC tackles the biggest issue in open source: Open Sourcing the Enterprise
-Strategies to boost innovation and cut costs with open source participation
-Receive a $600 discount off the registration fee with the source code: SFAD
http://p.sf.net/sfu/XcvMzF8H
_______________________________________________
Net-snmp-users mailing list
[email protected]
Please see the following page to unsubscribe or change other options:
https://lists.sourceforge.net/lists/listinfo/net-snmp-users