Re: What is the best way to detect a re-configured router?
Lee <[email protected]>
| Newsgroups | gmane.network.net-snmp.user |
|---|---|
| Message-ID | <CAD8GWstpoLgSgROA3Jjvs7kKSe+mtr5iBHYAUHucHmRxDoTbZw@mail.gmail.com> |
On 1/18/16, Bob Albrecht <[email protected]> wrote: > Changing router firmware can take a long time. It's faster to pull the > "route processor"/supervisor card and replace it with one that's already > upgraded. The new card will have the same config, including engineID. > However, counters such as engineBoots and engineTime will be reset. > > We see same engineID come up but with fewer engineBoots or lower > engineTime, there is a security discrepancy that must be addressed. > > What is the authoritative way to detect this situation? Keep track of the serial numbers on the various bits of hardware in the box. I like RANCID - even if the config doesn't change you still get an email showing the serial number / firmware version / software version changes on the line cards. (note that "supervisor card" is a subset of "line card" :) Regards, Lee ------------------------------------------------------------------------------ Site24x7 APM Insight: Get Deep Visibility into Application Performance APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month Monitor end-to-end web transactions and take corrective actions now Troubleshoot faster and improve end-user experience. Signup Now! http://pubads.g.doubleclick.net/gampad/clk?id=267308311&iu=/4140 _______________________________________________ Net-snmp-users mailing list [email protected] Please see the following page to unsubscribe or change other options: https://lists.sourceforge.net/lists/listinfo/net-snmp-users