search

etingof / pysnmp

Python SNMP library
http://snmplabs.com/pysnmp/
BSD 2-Clause "Simplified" License
583 stars 200 forks source link

Correlate source of trap #256

Open robobeaver6 opened 5 years ago

robobeaver6 commented 5 years ago

I am trying to log (Source_IP, OID, Value) tuples for each varBind in a trap message received, but the documentation does not have very much information on traps, or I am not finding the relevant section. The only example I could find was in the Advanced Topics section.

I am registering a trap receiver with ntfrcv.NotificationReceiver(snmpEngine, cbFun) but in the callback function, def cbFun(snmpEngine, stateReference, contextEngineId, contextName, varBinds, cbCtx): I can not see how to identify the source address of the sender, only a contextEngineId. Is there any way I can correlate the EngineID to an IP address of the source?

The other method I tried was to use the registerObserver() method, which has the transportAddress variable but that does not let me easily process the PDU, or I don't understand how to, because it is a complex data structure.

I can't see anywhere in the documentation which explain these methods, or how to use them, despite them being used in several examples.

Can anyone please point me in the direction of some information on the API functions and how to unpack the data from the data model.

Many Thanks

etingof commented 5 years ago

In the standard, SNMP processing model does not reveal peer addresses to the application on top od SNMP stack. That's probably purposefully hidden. Therefore pysnmp has a workaround for pulling such details from the internals of the SNMP engine. Yes, your take on observer is correct.

If you take this example callback, the variables parameter is a dict having transportAddress key holding both local and remote address information. You also have to register your callback to pysnmp.

Now, the callback is guaranteed to be called right before you receive the TRAP. You can have a shared data structure between your callback and your TRAP receiving function so that the former will store the address for the latter to retrieve it.

Does it make sense?

robobeaver6 commented 5 years ago

Thanks, I think that makes sense.