1

I'm about ready to lose my mind with this...

I need to spoof the host that snmp traps are being sent from using the snmptrap command.

The man pages for snmptrap state that you can utilize common options made available by snmpcmd. snmpcmd states that you can utilize options existing in snmp.conf like so: --name="value". snmp.conf states that there is a clientAddr option that allows you to specify the trap as being sent from another host.

This is the command I'm running:

[root@***** objects]# /usr/bin/snmptrap --clientAddr="<clientipaddr>" -v 2c -c <communityString> <destipaddr> '' NAGIOS-NOTIFY-MIB::nSvcEvent nHostname s "testHost" nSvcDesc s "testService" nSvcStateID i 2 nSvcOutput s "testOutput"

This is the output I receive:

snmptrap: Unknown host (<destipaddr>) (Cannot assign requested address)

When I run it without the --clientAddr param, the trap receiver sees it fine.

Any idea what I'm doing wrong here?

Improve this question

3 Answers 3

Reset to default
0

I tried to do the same and ended up with IP tables instead of net-snmp. The following needs to be setup on the host which you send the traps from:

iptables -t nat -A POSTROUTING -s <IP which you send originally traps from> -p udp --dport 162 -j SNAT --to-source <IP you want to spoof>
Improve this answer
2
  • Thanks for the answer, L.R. Unfortunately, I need this to be a command that I can embed in a script to run with parameters. I imagine I could use iptables and continuously update the rule every time I run the script, but that seems scary. Agree/disagree?
    – TheBeege
    Feb 7, 2013 at 18:02
  • Do not be scared :) Just make sure that there is always only one instance of script running at a time so you do not have multiple ip tables rules matching for the same packets.
    – L.R.
    Mar 7, 2013 at 7:30
0

You're not doing anything wrong. It's just that the host expects the specified IP (or name, for that matter) to be local, i.e. attached to some local interface. One way to spoof the host could be to temporarily set up some alias interface with the desired IP address, e.g. for 1.2.3.4 on Linux:

ifconfig lo:0 1.2.3.4 netmask 255.255.255.248
Improve this answer
0

In my case I wanted to be able to simulate a source IP independently of IP which is used originally, so I modified the L.R.'s command to this:

sudo iptables -t nat -A POSTROUTING -p udp --dport 162 --destination <IP of snmptrapd server> -j SNAT --to-source <Fake IP of sender>

IP of snmptrapd server - an address where you want to send the trap
Fake IP of sender - an adress that snmptrapd will treat as a sender address

To see the current rules use: sudo iptables -t nat -v -L -n --line-number
To remove the rule by line number, for example, number 3: sudo iptables -t nat -D POSTROUTING 3

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .