Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm about ready to lose my mind with this...

I need to spoof the host that snmp traps are being sent from using the snmptrap command.

The man pages for snmptrap state that you can utilize common options made available by snmpcmd. snmpcmd states that you can utilize options existing in snmp.conf like so: --name="value". snmp.conf states that there is a clientAddr option that allows you to specify the trap as being sent from another host.

This is the command I'm running:

[root@***** objects]# /usr/bin/snmptrap --clientAddr="<clientipaddr>" -v 2c -c <communityString> <destipaddr> '' NAGIOS-NOTIFY-MIB::nSvcEvent nHostname s "testHost" nSvcDesc s "testService" nSvcStateID i 2 nSvcOutput s "testOutput"

This is the output I receive:

snmptrap: Unknown host (<destipaddr>) (Cannot assign requested address)

When I run it without the --clientAddr param, the trap receiver sees it fine.

Any idea what I'm doing wrong here?

share|improve this question

1 Answer 1

I tried to do the same and ended up with IP tables instead of net-snmp. The following needs to be setup on the host which you send the traps from:

iptables -t nat -A POSTROUTING -s <IP which you send originally traps from> -p udp --dport 162 -j SNAT --to-source <IP you want to spoof>
share|improve this answer
    
Thanks for the answer, L.R. Unfortunately, I need this to be a command that I can embed in a script to run with parameters. I imagine I could use iptables and continuously update the rule every time I run the script, but that seems scary. Agree/disagree? –  TheBeege Feb 7 '13 at 18:02
    
Do not be scared :) Just make sure that there is always only one instance of script running at a time so you do not have multiple ip tables rules matching for the same packets. –  L.R. Mar 7 '13 at 7:30

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.