search

kentik / ktranslate

System for pulling and pushing network data.
Apache License 2.0
55 stars 25 forks source link

Client IP tracking #670

Closed nijugeorge173 closed 5 months ago

nijugeorge173 commented 7 months ago

In a setup where remote host forwards traps to NGINX LB which connects to upstream server ( cluster having one container per server) the remote host IP is not visible on trap received at upstream server instead the LB IP is recorded. Any suggestions on what to do? Any recommendations for a setup running 8000 devices?

i3149 commented 7 months ago

Can you use snmpv3 and ContextEngineID? If this is present, the device is first identified via this id, falling back to IP if no luck. For example, engine_id: dead::beef in the config yaml.

nijugeorge173 commented 6 months ago

@i3149 The intention is to use v3. Is there documentation or more detailed example for this , I could use that info to understand and guide

i3149 commented 6 months ago

Say you have this device in your snmp.yaml file:

devices:
    bart__192.168.0.200:
        device_name: bart
        device_ip: 192.168.0.200
...
        engine_id: 80:00:1f:88:80:67:96:34:73:68:e2:b9:65:00:00:00:00

Then when ktrans gets a trap, first it will look up and see if the engine id in the v3 packet matches any in the yaml file. If it does, it will use the device name bart and so on. Should all be pretty automatic, nothing to configure. If no match, it falls back to ip based matching.

github-actions[bot] commented 5 months ago

This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.

github-actions[bot] commented 5 months ago

This issue was closed because it has been stalled for 5 days with no activity.