Re: wrong MAC int the trap

On 3/6/13, Meike Stone <[email protected]> wrote:
> 2013/3/5 Meike Stone <[email protected]>:
>> 2013/3/1 Lee <[email protected]>:
>>> Adding a display-hint to the mib file might work.  But with snmptrapd
>>> printing out
>>>> 22#011.1.3.6.1.4.1.45.1.6.5.3.12.1.3.1.22 = "`s\\/c("
>>> it doesn't look like it's found the mibs.
>
>
> The SNMP trap from a Nortel Switch and uses SNMPv1. This nortel Switch
> can only be configured to send Traps SNMPv1.
> I don't no, if it would work With SNMPv2. I only see, that the
> Display-Hint is defined in a MIB-file called "SNMPv2-TC.txt.
>
>
> TRAP decoded by snmpdtrapd with problematic MAC:
>
>   notificationtype               TRAP
>   receivedfrom                   UDP:
> [192.168.111.233]:3812->[10.160.22.59]
>   version                        0
>   errorstatus                    0
>   messageid                      0
>   community                      public
>   transactionid                  1
>   errorindex                     0
>   requestid                      0
>   DISMAN-EVENT-MIB::sysUpTimeInstance type=67 value=Timeticks:
> (293810679) 34 days, 0:08:26.79
>   SNMPv2-MIB::snmpTrapOID.0      type=6  value=OID:
> S5-ROOT-MIB::s5EthTrap.0.5
>   S5-ROOT-MIB::s5Com.3.12.1.1.1.22 type=2  value=INTEGER: 1
>   S5-ROOT-MIB::s5Com.3.12.1.2.1.22 type=2  value=INTEGER: 22
>   S5-ROOT-MIB::s5Com.3.12.1.3.1.22 type=4  value=STRING: "`s\\/c("

It looks like you're still missing some MIB files.  I'm guessing
S5-SWITCH-BAYSECURE-MIB  (I'm not good at searching - the only places
I've found that might let me download the file want javascript &
cookies enabled & that ain't happening)
get the file and add the line
  DISPLAY-HINT "2x:"
in the section where s5SbsViolationStatusMACAddress is defined.
Restart the trap daemon & try again...


> What algorithm uses snmptrapd to determine,  whether it is a sting or
> hex-string?

I have no idea

Regards,
Lee






>   SNMP-COMMUNITY-MIB::snmpTrapAddress.0 type=64 value=IpAddress:
> 10.160.22.100
>   SNMP-COMMUNITY-MIB::snmpTrapCommunity.0 type=4  value=STRING: "public"
>   SNMPv2-MIB::snmpTrapEnterprise.0 type=6  value=OID:
> S5-ROOT-MIB::s5EthTrap
>
>
> with other MAC-Address, it decodes not as STING, instead as Hex-String:
>
>   receivedfrom                   UDP:
> [192.168.111.233]:3812->[10.160.22.59]
>   version                        0
>   errorstatus                    0
>   messageid                      0
>   community                      public
>   transactionid                  2
>   errorindex                     0
>   requestid                      0
>   DISMAN-EVENT-MIB::sysUpTimeInstance type=67 value=Timeticks:
> (293810679) 34 days, 0:08:26.79
>   SNMPv2-MIB::snmpTrapOID.0      type=6  value=OID:
> S5-ROOT-MIB::s5EthTrap.0.5
>   S5-ROOT-MIB::s5Com.3.12.1.1.1.22 type=2  value=INTEGER: 1
>   S5-ROOT-MIB::s5Com.3.12.1.2.1.22 type=2  value=INTEGER: 22
>   S5-ROOT-MIB::s5Com.3.12.1.3.1.22 type=4  value=Hex-STRING: 10 73 5C 2F 63
> 28
>   SNMP-COMMUNITY-MIB::snmpTrapAddress.0 type=64 value=IpAddress:
> 10.160.22.100
>   SNMP-COMMUNITY-MIB::snmpTrapCommunity.0 type=4  value=STRING: "public"
>   SNMPv2-MIB::snmpTrapEnterprise.0 type=6  value=OID:
> S5-ROOT-MIB::s5EthTrap
>
>
> With the output option -Ox, it is decoded well (from manual page snmpcmd):
> -Ox    Display  string  values  as  Hex  strings  (unless there is a
> DISPLAY-HINT defined for the corresponding MIB object).
>          By default, the library attempts to determine whether the
> value is a printable or binary string, and displays it accordingly.
>          This option does not affect objects that do have a Display Hint.
>
> What algorithm uses snmptrapd to determine,  whether it is a sting or
> hex-string?
> because of statement from man page : "By default, the library attempts
> to determine whether the value is a printable or binary string, and
> displays it accordingly."
>
>
> Don't know, how to solve this problem ..
>
> Thanks Meike
>

------------------------------------------------------------------------------
Symantec Endpoint Protection 12 positioned as A LEADER in The Forrester  
Wave(TM): Endpoint Security, Q1 2013 and "remains a good choice" in the  
endpoint security space. For insight on selecting the right partner to 
tackle endpoint security challenges, access the full report. 
http://p.sf.net/sfu/symantec-dev2dev
_______________________________________________
Net-snmp-users mailing list
[email protected]
Please see the following page to unsubscribe or change other options:
https://lists.sourceforge.net/lists/listinfo/net-snmp-users