Classification: UNCLASSIFIED Caveats: FOUO Instead of dealing with spectrum on this one, I'd simply disable IPv6 at the OS level. If I'm judging right, you're likely running linux. If this is redhat or centos, you can disable IPv6 by editing the /etc/sysconfig/network file or you can disable it from /etc/sysctl.conf with this line:
net.ipv6.conf.eth0.disable_ipv6 = 1 This will obviously require a complete restart of Spectrum and the OS. ________________________________ From: Kenneth Kirchner [k...@kirchners.com] Sent: Saturday, October 11, 2014 3:25 AM To: spectrum Subject: [spectrum] Spectro SNMP Trap listener on IPv6 and not IPv4 Hello everyone, I have a Spectrum instance in the lab (VERSION: 9.3.0.0.304) that does not seem to be responding at all to SNMP traps from my test router (Cisco 2600 and 1700 models). When I look at the processes and ports on the Spectro server, I see it listening on IPv6 and nothing on IPv4. I am only using IPv4. If I set up TCPdump, I see the traps coming in, but nothing appears in the event log and no alarms are raised for the device. Polling is working since it does see the interface status changes. What can I do to get SpectroServer listening for traps on the IPv4 interface? I have looked at my production servers and they do show the snmptrap listener on IPv4, not IPv6. I am not sure what would have caused this configuration change. [root@spectro-a ~]# lsof -i -n COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME dhclient 1062 root 5u IPv4 8127 0t0 UDP *:bootpc sshd 1151 root 3u IPv4 8394 0t0 TCP *:ssh (LISTEN) sshd 1151 root 4u IPv6 8396 0t0 TCP *:ssh (LISTEN) SpectroSE 1500 spectrum 6r IPv6 10040 0t0 UDP *:54865 SpectroSE 1500 spectrum 7u IPv4 10041 0t0 UDP *:52640 ... SpectroSE 1500 spectrum 8u IPv6 10044 0t0 UDP *:snmptrap ... SpectroSE 1500 spectrum 11u IPv4 10051 0t0 TCP 10.0.1.98:36148->10.0.1.98:56063 (ESTABLISHED) SpectroSE 1500 spectrum 12r IPv4 10376 0t0 TCP 10.0.1.98:37698->10.0.1.98:46479 (ESTABLISHED) SpectroSE 1500 spectrum 48u IPv4 10212 0t0 TCP 10.0.1.98:58939->10.0.1.98:65259 (ESTABLISHED) SpectroSE 1500 spectrum 49u IPv6 10318 0t0 TCP 10.0.1.98:14002->10.0.1.97:45570 (ESTABLISHED) SpectroSE 1500 spectrum 54u IPv6 10312 0t0 TCP *:14002 (LISTEN) SpectroSE 1500 spectrum 60u IPv4 10335 0t0 TCP *:48879 (LISTEN) SpectroSE 1500 spectrum 61u IPv4 10391 0t0 TCP 10.0.1.98:48879->10.0.1.98:44576 (ESTABLISHED) [root@spectro-a ~]# tcpdump -i eth0 -nn udp port 162 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes 18:20:28.691988 IP 10.0.1.88.52904 > 10.0.1.98.162: C=cisco V2Trap(119) .1.3.6.1.2.1.1.3.0=16270713 .1.3.6.1.6.3.1.1.4.1.0=.1.3.6.1.4.1.9.9.43.2.0.1 .1.3.6.1.4.1.9.9.43.1.1.6.1.3.5=1 .1.3.6.1.4.1.9.9.43.1.1.6.1.4.5=2 .1.3.6.1.4.1.9.9.43.1.1.6.1.5.5=3 Any help is appreciated. -Ken --- Michael S. Votaw Senior Spectrum Analyst Regional Cyber Center - Europe, 5th Signal Command Northrop Grumman Contractor NIPR: michael.s.votaw....@mail.mil SIPR: michael.s.votaw....@mail.smil.mil DSN: 314-565-6946 (+49 611-143-565-6946) Cell: 01522 563 1987 (+49 1522 563 1987) Classification: UNCLASSIFIED Caveats: FOUO --- To unsubscribe from spectrum, send email to lists...@unc.edu with the body: unsubscribe spectrum arch...@mail-archive.com
