Re: wrong MAC int the trap

2013/3/5 Meike Stone <[email protected]>:
> 2013/3/1 Lee <[email protected]>:
>> Adding a display-hint to the mib file might work.  But with snmptrapd
>> printing out
>>> 22#011.1.3.6.1.4.1.45.1.6.5.3.12.1.3.1.22 = "`s\\/c("
>> it doesn't look like it's found the mibs.


The SNMP trap from a Nortel Switch and uses SNMPv1. This nortel Switch
can only be configured to send Traps SNMPv1.
I don't no, if it would work With SNMPv2. I only see, that the
Display-Hint is defined in a MIB-file called "SNMPv2-TC.txt.


TRAP decoded by snmpdtrapd with problematic MAC:

  notificationtype               TRAP
  receivedfrom                   UDP: [192.168.111.233]:3812->[10.160.22.59]
  version                        0
  errorstatus                    0
  messageid                      0
  community                      public
  transactionid                  1
  errorindex                     0
  requestid                      0
  DISMAN-EVENT-MIB::sysUpTimeInstance type=67 value=Timeticks:
(293810679) 34 days, 0:08:26.79
  SNMPv2-MIB::snmpTrapOID.0      type=6  value=OID: S5-ROOT-MIB::s5EthTrap.0.5
  S5-ROOT-MIB::s5Com.3.12.1.1.1.22 type=2  value=INTEGER: 1
  S5-ROOT-MIB::s5Com.3.12.1.2.1.22 type=2  value=INTEGER: 22
  S5-ROOT-MIB::s5Com.3.12.1.3.1.22 type=4  value=STRING: "`s\\/c("
  SNMP-COMMUNITY-MIB::snmpTrapAddress.0 type=64 value=IpAddress: 10.160.22.100
  SNMP-COMMUNITY-MIB::snmpTrapCommunity.0 type=4  value=STRING: "public"
  SNMPv2-MIB::snmpTrapEnterprise.0 type=6  value=OID: S5-ROOT-MIB::s5EthTrap


with other MAC-Address, it decodes not as STING, instead as Hex-String:

  receivedfrom                   UDP: [192.168.111.233]:3812->[10.160.22.59]
  version                        0
  errorstatus                    0
  messageid                      0
  community                      public
  transactionid                  2
  errorindex                     0
  requestid                      0
  DISMAN-EVENT-MIB::sysUpTimeInstance type=67 value=Timeticks:
(293810679) 34 days, 0:08:26.79
  SNMPv2-MIB::snmpTrapOID.0      type=6  value=OID: S5-ROOT-MIB::s5EthTrap.0.5
  S5-ROOT-MIB::s5Com.3.12.1.1.1.22 type=2  value=INTEGER: 1
  S5-ROOT-MIB::s5Com.3.12.1.2.1.22 type=2  value=INTEGER: 22
  S5-ROOT-MIB::s5Com.3.12.1.3.1.22 type=4  value=Hex-STRING: 10 73 5C 2F 63 28
  SNMP-COMMUNITY-MIB::snmpTrapAddress.0 type=64 value=IpAddress: 10.160.22.100
  SNMP-COMMUNITY-MIB::snmpTrapCommunity.0 type=4  value=STRING: "public"
  SNMPv2-MIB::snmpTrapEnterprise.0 type=6  value=OID: S5-ROOT-MIB::s5EthTrap


With the output option -Ox, it is decoded well (from manual page snmpcmd):
-Ox    Display  string  values  as  Hex  strings  (unless there is a
DISPLAY-HINT defined for the corresponding MIB object).
         By default, the library attempts to determine whether the
value is a printable or binary string, and displays it accordingly.
         This option does not affect objects that do have a Display Hint.

What algorithm uses snmptrapd to determine,  whether it is a sting or
hex-string?
because of statement from man page : "By default, the library attempts
to determine whether the value is a printable or binary string, and
displays it accordingly."


Don't know, how to solve this problem ..

Thanks Meike

------------------------------------------------------------------------------
Symantec Endpoint Protection 12 positioned as A LEADER in The Forrester  
Wave(TM): Endpoint Security, Q1 2013 and "remains a good choice" in the  
endpoint security space. For insight on selecting the right partner to 
tackle endpoint security challenges, access the full report. 
http://p.sf.net/sfu/symantec-dev2dev
_______________________________________________
Net-snmp-users mailing list
[email protected]
Please see the following page to unsubscribe or change other options:
https://lists.sourceforge.net/lists/listinfo/net-snmp-users