All Apps and Add-ons

SNMP Modular Input: Unable to receive SNMPv3 traps

ChrisBell04
Communicator

Environment:
Windows 2008 R2.

Splunk Enterprise 6.3.2
SNMP Modular Input 1.2.7
pycrypto-2.6.1

Issue:
Packet capture shows the trap is getting received by the splunk server, but Windows is sending back: ICMP - Destination unreachable (Port unreachable). The traps are not getting saved into Splunk

Details:
After fighting to get pycrypto-2.6.1 compiled on Windows 10 (http://stackoverflow.com/a/28617830 was the exact steps I used that worked), eventually got it compiled and installed.

Created a SNMPv3 Trap in the inputs with the necessary info.
Validated Python (python D:\Splunk\etc\apps\snmp_ta\bin\snmp.py) is listening on UDP port 162.
No errors in splunkd.log related to snmp_ta
Confirm user/pw info for snmpv3 traps is correct as able to decode via Wireshark.

0 Karma

juanlazarosanch
New Member

Did you ever get this figured out? Thanks!

0 Karma

ChrisBell04
Communicator

Nope 😞 too many blocking issues. Gave up and eventually got the same info via syslog instead.

0 Karma

Damien_Dallimor
Ultra Champion

Try setting the trap listener host to the hostname or IP of the windows machine.

alt text

0 Karma

ChrisBell04
Communicator

Tried 127.0.0.1 and no change.
Tried the hostname and now I dont see a ICMP - Destination unreachable (Port unreachable) getting sent back, but nothing is still apparently getting logged. Tried by the index and/or sourcetype=snmp_ta

0 Karma

pmeyerson
Path Finder

is there some policy/limitation in the OS that the user running the splunk service does not have permission to listen on the UDP port? I would think you would see an error logged if that was the case though.

I noticed on the screenshot posted above it says "TRAAP listener port. Defaults to 162.". Mine says "The SNMP port. Defaults to 161". Even though my devices are configured with trap targets on port 162, the snmp process on the switch only accepts incomming snmp packets on port 161 so I had to use that.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...