up vote 1 down vote favorite
share [g+] share [fb]

We've been having issues recently with bad servers spewing traps and flooding our SNMP Trap Server

The SNMP Trap server is running Solaris 10 with no Firewall installed. I'd like to know if there is any feature within a basic Solaris 10 build (apologies, I realise that is a vague description) that can be used to allow me to configure it to drop UDP 162 from a host if I identify a flood

The reason I seek this solution is because 1) the device owner is struggling to stop the flood even with the SNMP Service Offline and the SNMP Trap destinations removed from the configuration (I can't get access to the system to investigate further) 2) getting Firewall changes in takes weeks, so the process isn't really agile enough for my requirement (I'm chasing a policy change on this within my organisation...)

Many thanks for any help

link|improve this question
feedback

1 Answer

up vote 1 down vote

I don't have much experience with Solaris 10, but I think you have IPFilter, which is a pf-like firewall in solaris 10, as a part of the default OS. You want to modify /etc/ipf/ipf.conf and add a rule like:

block in quick proto udp from 172.16.1.11/32 port 162

You can find more instructions at http://www.homepage.montana.edu/~unixuser/031705/create_solaris_ipf.html

If that is not possible you can always null-route the servers that you don't want the traps to reach:

route add -host 10.10.0.1 127.0.0.1 -blackhole
link|improve this answer
Many thanks for your reply. Unfortunately, our Solaris build doesn't include IPFilter. Also, the blackhole option doesn't work for UDP. UDP makes this issue a little difficult to deal with... – user38116 Oct 30 '10 at 13:36
Blackhole is on the IP level, which is under TCP and UDP in the network stack. It works. Trust me. But you might have to blackhole a broadcast/multicast adress, if that is what you are delivering the packets to instead of the server IP address. – pehrs Oct 30 '10 at 14:15
Hmm, when I tried the blackhole configuration it didn't seem to work. I can see that if it is configured on the 'source' system it would work, but I don't see how it can work on the 'destination' which, in this case, is the system I'm trying to protect. The destination server is not configured as a router, so for incoming UDP 162, the routing table shouldn't be used, should it? Or am I missing something? I've used bad routes before to break TCP, but for UDP... – user38116 Nov 1 '10 at 10:03
Oh, sorry, I missunderstood you. The blackhole will have to be configured on the sending system, not on the recieving system. – pehrs Nov 2 '10 at 15:24
Thanks for your help anyway. I don't think there's a solution for this one without a firewall of some kind running on the (destination) server – user38116 Nov 12 '10 at 17:16
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.