Hi Kevin, This is not the first time we are facing this problem, but we never been able to reproduce it in our lab.
Can you send us the following info: - What is the model of the device that send this kind of traps? - What is its firmware version? - Are you running PF on CentOS? - Can you send us your generated snmptrapd.conf? - Can you do a tcpdump using tshark and send us the .pcap file of this trap. Thanks! On 11-01-31 9:37 AM, Kevin Manuel wrote: > Hi, > > There are a couple of machines on our network that are not able to authorize > because our switches are sending invalid security traps when they connect to > the otherwise working port. The trap should include a Hex-STRING with the > adapter mac address, but instead includes a String containing unknown info. > The adapters causing the issue all have the same OUI - 64:31:50. > > Here are the content of the trap on snmptrapd.log: > > 2011-01-28|13:45:16|UDP: [10.10.10.252]:1025|10.10.10.252|BEGIN TYPE 6 END > TYPE BEGIN SUBTYPE .5 END SUBTYPE BEGIN VARIABLEBINDINGS > .1.3.6.1.4.1.45.1.6.5.3.12.1.1.2.46 = INTEGER: > 2|.1.3.6.1.4.1.45.1.6.5.3.12.1.2.2.46 = INTEGER: > 46|.1.3.6.1.4.1.45.1.6.5.3.12.1.3.2.46 = STRING: "d1P_xv" END > VARIABLEBINDINGS > > > But we should be receiving something like this: > > 2011-01-28|13:45:16|UDP: [10.10.10.252]:1025|10.10.10.252|BEGIN TYPE 6 END > TYPE BEGIN SUBTYPE .5 END SUBTYPE BEGIN VARIABLEBINDINGS > .1.3.6.1.4.1.45.1.6.5.3.12.1.1.2.46 = INTEGER: > 2|.1.3.6.1.4.1.45.1.6.5.3.12.1.2.2.46 = INTEGER: > 46|.1.3.6.1.4.1.45.1.6.5.3.12.1.3.2.46 = Hex-STRING: 64 31 50 5f 77 77 END > VARIABLEBINDINGS > > > Any suggestions would be greatly appreciated. > > Kevin > > > ------------------------------------------------------------------------------ > Special Offer-- Download ArcSight Logger for FREE (a $49 USD value)! > Finally, a world-class log management solution at an even better price-free! > Download using promo code Free_Logger_4_Dev2Dev. Offer expires > February 28th, so secure your free ArcSight Logger TODAY! > http://p.sf.net/sfu/arcsight-sfd2d > _______________________________________________ > Packetfence-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/packetfence-users -- Francois Gaudreault, ing. jr [email protected] :: +1.514.447.4918 (x130) :: www.inverse.ca Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org) ------------------------------------------------------------------------------ Special Offer-- Download ArcSight Logger for FREE (a $49 USD value)! Finally, a world-class log management solution at an even better price-free! Download using promo code Free_Logger_4_Dev2Dev. Offer expires February 28th, so secure your free ArcSight Logger TODAY! http://p.sf.net/sfu/arcsight-sfd2d _______________________________________________ Packetfence-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/packetfence-users
