Is SNMP TRAP Notification source address spoofing possible?

[amartiresST]

Hi, I need to develop a script that generates snmp traps from syslog messages and I was thinking that maybe I could pass the syslog message to a python script that would generate a snmp trap, but I need the trap to have the original message host address and not the syslog server address.

Is it possible to spoof the source address when sending a notification with pysnmp?

Thanks!

[etingof]

Hey, yes! This should work at least on UNIX and if you are not using asyncio. Here is an example for SNMP GET, but it should be similar for notifications.

[amartiresST]

Thanks a lot @etingof! I think I got the gist of it.

I'm having some trouble finding how to replace this part in order to send a TRAP Notification...

# Prepare and send a request message
cmdgen.GetCommandGenerator().sendVarBinds(
    snmpEngine,
    'my-router',
    None, '',  # contextEngineId, contextName
    [((1, 3, 6, 1, 2, 1, 1, 1, 0), None)],
    cbFun
)

I suppose I need to generate a command for sending a trap, but I can't seem to find and adequate class.

Am I on the wrong path here? Can you give me some clue?

[etingof]

Look for notification originator - that's the SNMP parlance.

[amartiresST]

@etingof, I will look into that. Thanks!

[amartiresST]

I got it to work.

Basically all I needed to do was to add the sourceAddress=('1.2.3.4', 0) to config.addTargetAddr() following the example in the notification originator.

Thanks a lot for you help! Cheers!

[etingof]

Awesome!