Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm about ready to lose my mind with this...

I need to spoof the host that snmp traps are being sent from using the snmptrap command.

The man pages for snmptrap state that you can utilize common options made available by snmpcmd. snmpcmd states that you can utilize options existing in snmp.conf like so: --name="value". snmp.conf states that there is a clientAddr option that allows you to specify the trap as being sent from another host.

This is the command I'm running:

[root@***** objects]# /usr/bin/snmptrap --clientAddr="<clientipaddr>" -v 2c -c <communityString> <destipaddr> '' NAGIOS-NOTIFY-MIB::nSvcEvent nHostname s "testHost" nSvcDesc s "testService" nSvcStateID i 2 nSvcOutput s "testOutput"

This is the output I receive:

snmptrap: Unknown host (<destipaddr>) (Cannot assign requested address)

When I run it without the --clientAddr param, the trap receiver sees it fine.

Any idea what I'm doing wrong here?

share|improve this question

I tried to do the same and ended up with IP tables instead of net-snmp. The following needs to be setup on the host which you send the traps from:

iptables -t nat -A POSTROUTING -s <IP which you send originally traps from> -p udp --dport 162 -j SNAT --to-source <IP you want to spoof>
share|improve this answer
Thanks for the answer, L.R. Unfortunately, I need this to be a command that I can embed in a script to run with parameters. I imagine I could use iptables and continuously update the rule every time I run the script, but that seems scary. Agree/disagree? – TheBeege Feb 7 '13 at 18:02
Do not be scared :) Just make sure that there is always only one instance of script running at a time so you do not have multiple ip tables rules matching for the same packets. – L.R. Mar 7 '13 at 7:30

You're not doing anything wrong. It's just that the host expects the specified IP (or name, for that matter) to be local, i.e. attached to some local interface. One way to spoof the host could be to temporarily set up some alias interface with the desired IP address, e.g. for on Linux:

ifconfig lo:0 netmask
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.