Re: What is the best way to detect a re-configured router?
Mathias Wegner <[email protected]>
| Newsgroups | gmane.network.net-snmp.user |
|---|---|
| Message-ID | <[email protected]> |
On Jan 18, 2016, at 16:26, Bob Albrecht <[email protected]> wrote: > Changing router firmware can take a long time. It's faster to pull the "route processor"/supervisor card and replace it with one that's already upgraded. The new card will have the same config, including engineID. However, counters such as engineBoots and engineTime will be reset. > > > We see same engineID come up but with fewer engineBoots or lower engineTime, there is a security discrepancy that must be addressed. > > What is the authoritative way to detect this situation? I don’t know about an authoritative, but if the uptime has reset at the same time that boots and time changed, that’s a pretty solid indicator that something like this has happened. Mathias ------------------------------------------------------------------------------ Site24x7 APM Insight: Get Deep Visibility into Application Performance APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month Monitor end-to-end web transactions and take corrective actions now Troubleshoot faster and improve end-user experience. Signup Now! http://pubads.g.doubleclick.net/gampad/clk?id=267308311&iu=/4140 _______________________________________________ Net-snmp-users mailing list [email protected] Please see the following page to unsubscribe or change other options: https://lists.sourceforge.net/lists/listinfo/net-snmp-users