Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

Sending SNMP traps to custom ports from Linux

4,763 views
Skip to first unread message

Vivek Nagaraj

unread,
Sep 28, 2011, 2:56:17 AM9/28/11
to
Hello all,

I am building an application which sends SNMP trap which executes
'snmptrap' command.

Since I see that the 162 port is used by many other applications, the
port is rarely left free so that I can send the traps.

Is there anyway that I can make it send to custom port other than
162??? I just got a linux machine and I am ok to compile the net-snmp
source if it involves that.

Thanks,
Vivek

------------------------------------------------------------------------------
All the data continuously generated in your IT infrastructure contains a
definitive record of customers, application performance, security
threats, fraudulent activity and more. Splunk takes this data and makes
sense of it. Business sense. IT sense. Common sense.
http://p.sf.net/sfu/splunk-d2dcopy1
_______________________________________________
Net-snmp-coders mailing list
Net-snm...@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/net-snmp-coders

Dave Shield

unread,
Sep 28, 2011, 3:16:54 AM9/28/11
to
On 28 September 2011 07:56, Vivek Nagaraj <nagara...@gmail.com> wrote:
> I am building an application which sends SNMP trap which executes
> 'snmptrap' command.

> Is there anyway that I can make it send to custom port other than
> 162???

$ man snmpcmd

AGENT SPECIFICATION
<transport-specifier> <transport-address> format
udp hostname[:port] or IPv4-address[:port]

Note the ':port' element.
So if you specify a trap destination of someHost:99162
the trap will be sent to that port, instead of the default 162

Dave

Vivek Nagaraj

unread,
Sep 28, 2011, 3:49:47 AM9/28/11
to
Ok. That seems to be good one.

But cant I just change the default port to some other other than 162
in the net-snmp code and get it compiled?

Magnus Fromreide

unread,
Sep 28, 2011, 4:22:44 AM9/28/11
to
On Wed, 2011-09-28 at 13:19 +0530, Vivek Nagaraj wrote:
> Ok. That seems to be good one.
>
> But cant I just change the default port to some other other than 162
> in the net-snmp code and get it compiled?

You do not need to recompile to change the default port.

Put the following line in your snmp.conf to change the default port for
udp over ipv4 trap connections to 50162:

defTarget snmptrap udp :50162

/MF

Vivek Nagaraj

unread,
Sep 28, 2011, 5:02:52 AM9/28/11
to
Thanks a lot!!! That worked like a charm on the first go! But the
problem I faced was that the first time I got the trap at the right
port (not 162), but subsequent traps were still sent to the default
port i.e., 162.

Can you please help me on this???

Thanks a ton.

Vivek Nagaraj

unread,
Oct 1, 2011, 10:14:32 AM10/1/11
to
All I did was added this line in 'snmpd.conf': "defTarget snmptrap udp
:50162" and restarted the snmpd service using: 'service snmpd
restart'.

I used to get the first trap at the UDP port 50162. And I used to
receive trap on my client Windows machine where the trap receiver was
running at the default port 162 rather than the mentioned port. Any
setting/tweaks (you remember) to be done on the client/server?!

The command used to send dummy trap was 'snmptrap'. The server from
which snmptrap was generated was RHEL 6.1 x64.

Any idea why am I still not receiving traps at default port?! Thanks a
ton for the response.

------------------------------------------------------------------------------
All of the data generated in your IT infrastructure is seriously valuable.
Why? It contains a definitive record of application performance, security
threats, fraudulent activity, and more. Splunk takes this data and makes
sense of it. IT sense. And common sense.
http://p.sf.net/sfu/splunk-d2dcopy2

Magnus Fromreide

unread,
Oct 1, 2011, 6:12:27 AM10/1/11
to
On Wed, 2011-09-28 at 14:32 +0530, Vivek Nagaraj wrote:
> Thanks a lot!!! That worked like a charm on the first go! But the
> problem I faced was that the first time I got the trap at the right
> port (not 162), but subsequent traps were still sent to the default
> port i.e., 162.
>
> Can you please help me on this???

This sounds odd as there is nothing in there that should reset the
target port.
Could you please walk me through the problem you are seeing step by step
so that I can reproduce it.

/MF

Magnus Fromreide

unread,
Oct 1, 2011, 11:09:55 AM10/1/11
to
On Sat, 2011-10-01 at 19:44 +0530, Vivek Nagaraj wrote:
> All I did was added this line in 'snmpd.conf': "defTarget snmptrap udp
> :50162" and restarted the snmpd service using: 'service snmpd
> restart'.
>
> I used to get the first trap at the UDP port 50162. And I used to
> receive trap on my client Windows machine where the trap receiver was
> running at the default port 162 rather than the mentioned port. Any
> setting/tweaks (you remember) to be done on the client/server?!
>
> The command used to send dummy trap was 'snmptrap'. The server from
> which snmptrap was generated was RHEL 6.1 x64.
>
> Any idea why am I still not receiving traps at default port?!

Yes.

> Thanks a ton for the response.

You added

defTarget snmptrap udp :50162

to snmpd.conf

snmpd.conf is the config file for the snmp agent (snmpd).

Then you use snmptrap to send a trap. Since snmptrap isn't reading
snmpd.conf that explains why it didn't affect that program.

To change it for all programs you should put it in snmp.conf.

Vivek Nagaraj

unread,
Oct 2, 2011, 1:07:13 AM10/2/11
to
Ok. That sounds reasonable. Thanks a lot! Hope you can can answer my
following questions:

1) What is the difference between snmp.conf and snmpd.conf files in
'/etc/snmp/' directory?

2) When I execl 'snmptrap' command from my program, which of the above
two *.conf files are actually used?

Thanks,
Vivek

Magnus Fromreide

unread,
Oct 2, 2011, 3:33:25 AM10/2/11
to
On Sun, 2011-10-02 at 10:37 +0530, Vivek Nagaraj wrote:
> Ok. That sounds reasonable. Thanks a lot! Hope you can can answer my
> following questions:
>
> 1) What is the difference between snmp.conf and snmpd.conf files in
> '/etc/snmp/' directory?

snmp.conf is used by all snmp*-programs
snmpd.conf is only used by snmpd

The items you can specify in each of them also differs. Please see the
man pages snmp.conf(5) and snmpd.conf(5) for more discussion.

> 2) When I execl 'snmptrap' command from my program, which of the above
> two *.conf files are actually used?

snmp.conf.

You could ask snmptrap this using the -H command line option. That lists
the available configuration items as well as the files were they can be
placed.

Another thing to consider is that you can control this on the command
line of snmptrap as well.

snmptrap ... udp:host:port ...

sends a trap to host:port. If you really want to do it like you have up
til now then

snmptrap ... --defTarget="snmptrap udp :port" host ...

also would send the trap to host:port.



When you starts talking about execl snmptrap I also have to say that I
wouldn't have done it that way...
I would probably either embed the library to send the traps directly or
let the program act as an AgentX subagent and use that to make the agent
send the traps to the places that are specified in it's configuration
file.
But I admit that your solution is quicker to get started with.

/MF

Vivek Nagaraj

unread,
Oct 2, 2011, 7:32:28 AM10/2/11
to
When you starts talking about execl snmptrap I also have to say that I
wouldn't have done it that way...
I would probably either embed the library to send the traps directly or
let the program act as an AgentX subagent and use that to make the agent
send the traps to the places that are specified in it's configuration
file.
But I admit that your solution is quicker to get started with.

>> Can you pls pls pls elaborate on this? Let me try that out, if feasible. :) You seem to be a SNMP guru!

Thanks,
Vivek

Vivek Nagaraj

unread,
Oct 2, 2011, 11:14:50 PM10/2/11
to
Response to your previous mail:

1) Could not find 'snmp.conf'

2) And options you have mentioned to be used with 'snmptrap' command
is not working

Please refer the attachments for more details.

Thanks a lot for your time and response.
SNMP Custom Port.txt

Niels Baggesen

unread,
Oct 3, 2011, 1:41:16 AM10/3/11
to
On Mon, Oct 03, 2011 at 08:44:50AM +0530, Vivek Nagaraj wrote:
> Response to your previous mail:
>
> 1) Could not find 'snmp.conf'

You have to create it yourself.

> 2) And options you have mentioned to be used with 'snmptrap' command
> is not working

> [root@localhost snmp]# snmptrap -v 1 -m ALL -c public 135.36.115.62 .1.3.6.1.6.3 169.254.1.1 6 1 20071105 udp:169.254.1.1:30617
> udp:169.254.1.1:30617: Missing type/value for variable

That last udp:169... parameter does not make sense. You probably meant

snmptrap -v 1 -m ALL -c public 135.36.115.62:30617 .1.3.6.1.6.3 169.254.1.1 6 1 20071105

/Niels

--
Niels Baggesen - @home - Århus - Denmark - n...@users.sourceforge.net
The purpose of computing is insight, not numbers --- R W Hamming

------------------------------------------------------------------------------
All the data continuously generated in your IT infrastructure contains a
definitive record of customers, application performance, security
threats, fraudulent activity and more. Splunk takes this data and makes
sense of it. Business sense. IT sense. Common sense.
http://p.sf.net/sfu/splunk-d2dcopy1

Vivek Nagaraj

unread,
Oct 3, 2011, 2:41:50 AM10/3/11
to
Thanks a lot Niels!

snmptrap -v 1 -m ALL -c public 135.36.115.62:30617 .1.3.6.1.6.3
169.254.1.1 6 1 20071105
>> Worked like magic on custom ports on RHEL 6.1!

Is there any net-snmp issue (you are aware of) regarding this in older
net-snmp binaries placed in RHEL 4.7?!

In simple words, its working fine in RHEL 6.1 but not in RHEL 4.7. Any idea why?

Niels Baggesen

unread,
Oct 3, 2011, 9:12:06 AM10/3/11
to
On Mon, Oct 03, 2011 at 12:11:50PM +0530, Vivek Nagaraj wrote:
> Is there any net-snmp issue (you are aware of) regarding this in older
> net-snmp binaries placed in RHEL 4.7?!
>
> In simple words, its working fine in RHEL 6.1 but not in RHEL 4.7. Any idea why?

Define "not working"! Any error message, or what happens?

It works for me with the stock snmptrap on RedHat 4.9

/Niels

--
Niels Baggesen - @home - Århus - Denmark - n...@users.sourceforge.net
The purpose of computing is insight, not numbers --- R W Hamming

Vivek Nagaraj

unread,
Oct 3, 2011, 10:20:57 AM10/3/11
to
Ok. I am sorry. Not working in the sense, if I provide custom ports
other than 162, I am not receiving any traps at those custom ports.

I am not seeing any error message after the execution of the command
mentioned by you.

My server administrator says that the backward compatibility needs to
be maintained with older server OS too. I am kind of stuck. I tried
and tried and tried but could not receive traps at the ports other
than 162.

snmptrap -v 1 -m ALL -c public 135.36.115.62:30617 .1.3.6.1.6.3
169.254.1.1 6 1 20071105
>> Works well and traps are received in port no 30617 in RHEL 5.X upwards

snmptrap -v 1 -m ALL -c public 135.36.115.62:30617 .1.3.6.1.6.3
169.254.1.1 6 1 20071105
>> Not receiving traps in port no 30617 in RHEL 4.X (tried with RHEL 4.7 x86 and x64) <and I am not seeing traps even in port no 162; quite dangerous I think>
<Problem at sending or receiving side?! Any tweaks to be made at the
sender or receiver?>

snmptrap -v 1 -m ALL -c public 135.36.115.62:162 .1.3.6.1.6.3
169.254.1.1 6 1 20071105
>> Works well and traps are received in port no 162 in RHEL 4.X

Was there a known issue earlier with SNMP rectified at a later stage?

Thanks a ton guys!

Niels Baggesen

unread,
Oct 3, 2011, 11:44:29 AM10/3/11
to
On Mon, Oct 03, 2011 at 07:50:57PM +0530, Vivek Nagaraj wrote:
> My server administrator says that the backward compatibility needs to
> be maintained with older server OS too. I am kind of stuck. I tried
> and tried and tried but could not receive traps at the ports other
> than 162.

With an up2date RHEL4, which is 4.9, it works. On 4.7, which currently
installs net-snmp-utils 5.1.2-18.el4, it also works.

That is the best verification I can do. I do not remember a problem
with specifying the trap port.

Are you sure it isn't a firewall issue for your RHEL system? Can you
run tcpdump when you send the trap?

Anyway, why are you running 4.7 which is several moons out of date?

/Niels

--
Niels Baggesen - @home - Århus - Denmark - n...@users.sourceforge.net
The purpose of computing is insight, not numbers --- R W Hamming

Magnus Fromreide

unread,
Oct 3, 2011, 5:08:07 PM10/3/11
to
On Mon, 2011-10-03 at 08:44 +0530, Vivek Nagaraj wrote:
> Response to your previous mail:
>
> 1) Could not find 'snmp.conf'

As Niels said, you have to make it yourself.
>
> 2) And options you have mentioned to be used with 'snmptrap' command
> is not working

--defTarget="udp:169.254.1.1:30617"

That is wrong. defTarget takes three arguments. Try with

--defTarget="snmptrap udp 169.254.1.1:30617"

/MF

Magnus Fromreide

unread,
Oct 3, 2011, 5:20:07 PM10/3/11
to
On Mon, 2011-10-03 at 19:50 +0530, Vivek Nagaraj wrote:
> Ok. I am sorry. Not working in the sense, if I provide custom ports
> other than 162, I am not receiving any traps at those custom ports.
>
> I am not seeing any error message after the execution of the command
> mentioned by you.
>
> My server administrator says that the backward compatibility needs to
> be maintained with older server OS too. I am kind of stuck. I tried
> and tried and tried but could not receive traps at the ports other
> than 162.
>
> snmptrap -v 1 -m ALL -c public 135.36.115.62:30617 .1.3.6.1.6.3
> 169.254.1.1 6 1 20071105
> >> Works well and traps are received in port no 30617 in RHEL 5.X upwards
>
> snmptrap -v 1 -m ALL -c public 135.36.115.62:30617 .1.3.6.1.6.3
> 169.254.1.1 6 1 20071105
> >> Not receiving traps in port no 30617 in RHEL 4.X (tried with RHEL 4.7 x86 and x64) <and I am not seeing traps even in port no 162; quite dangerous I think>
> <Problem at sending or receiving side?! Any tweaks to be made at the
> sender or receiver?>
>
> snmptrap -v 1 -m ALL -c public 135.36.115.62:162 .1.3.6.1.6.3
> 169.254.1.1 6 1 20071105
> >> Works well and traps are received in port no 162 in RHEL 4.X

Could you please check the version of net-snmp on those platforms.

snmptrap -V

should output that. I do not know what versions all the different
redhats are using.

> Was there a known issue earlier with SNMP rectified at a later stage?

The defTarget/defDomains stuff have only existed since 2006-09 and the
first release it was part of was Net-SNMP 5.4 and IIRC RHEL4 is using
something earlier than that.

Vivek Nagaraj

unread,
Oct 3, 2011, 10:49:57 PM10/3/11
to
The RHEL 4.6 32-bit I am using has net-SNMP version 5.1.2. So, I hope
this would not support ports mentioned with the snmptrap command.
Please correct me if I am wrong.

The RHEL 6.1 has version 5.5 installed.

So, you mean to say any net-SNMP version above and including net-SNMP
5.4 supports mentioning ports along with host name?

Thanks,
Vivek

Niels Baggesen

unread,
Oct 4, 2011, 1:01:05 AM10/4/11
to
On Tue, Oct 04, 2011 at 08:19:57AM +0530, Vivek Nagaraj wrote:
> So, you mean to say any net-SNMP version above and including net-SNMP
> 5.4 supports mentioning ports along with host name?

No, Magnus is telling you about the defTarget directive. I just told
you that using portnumber with hostname works with the 5.1.2 version
that comes with a RHEL 4.5 as I just installed it (5.1.2-18.el4).

/Niels

--
Niels Baggesen - @home - Århus - Denmark - n...@users.sourceforge.net
The purpose of computing is insight, not numbers --- R W Hamming

Vivek Nagaraj

unread,
Oct 4, 2011, 1:51:01 AM10/4/11
to
I just tried it on RHEL 4.6 x86. Here is the more detailed OS info:
Linux dhcp-135-24-228-150 2.6.9-67.EL #1 Wed Nov 7 13:41:13 EST 2007
i686 i686 i386 GNU/Linux
Red Hat Enterprise Linux AS release 4 (Nahant Update 6)
NET-SNMP version: 5.1.2

When I executed this command on RHEL 4.6 x86
snmptrap -v 1 -m ALL -c public 135.36.115.62:250 .1.3.6.1.6.3
169.254.1.1 6 1 20071105

I didnt see any trap message on myclient machine at port 250.

No error message in '/var/log/messages' either. Any reason why? Need
to down firewall. Did that. Any idea?

Thanks a lot!

Magnus Fromreide

unread,
Oct 4, 2011, 2:27:25 AM10/4/11
to
On Tue, 2011-10-04 at 11:21 +0530, Vivek Nagaraj wrote:
> I just tried it on RHEL 4.6 x86. Here is the more detailed OS info:
> Linux dhcp-135-24-228-150 2.6.9-67.EL #1 Wed Nov 7 13:41:13 EST 2007
> i686 i686 i386 GNU/Linux
> Red Hat Enterprise Linux AS release 4 (Nahant Update 6)
> NET-SNMP version: 5.1.2
>
> When I executed this command on RHEL 4.6 x86
> snmptrap -v 1 -m ALL -c public 135.36.115.62:250 .1.3.6.1.6.3
> 169.254.1.1 6 1 20071105
>
> I didnt see any trap message on myclient machine at port 250.

I assume that myclient is 135.36.115.62.

> No error message in '/var/log/messages' either. Any reason why?

I tried that command.
I got a long message about syntax error on standard error.

Try with

snmptrap -v 1 -m ALL -c public \
135.36.115.62:5000 .1.3.6.1.6.3169.254.1.1 127.128.129.130 6 1 20071105

i.e. you had forgotten to add the agent address to the trap specifier.

/MF

Vivek Nagaraj

unread,
Oct 4, 2011, 2:33:33 AM10/4/11
to
I have added my agent address to the snmpd.conf file. Or else I would
have not received the trap at port no 162.

snmptrap -v 1 -m ALL -c public \
135.36.115.62:5000 .1.3.6.1.6.3169.254.1.1 127.128.129.130 6 1 20071105
>> Yes. The agent is 135.36.115.62. I still didn't receive traps at port no 500.

Note: If I change the port no to 162 or not provide the value at all
for port, I RECEIVE traps at the default port 162.

Magnus Fromreide

unread,
Oct 4, 2011, 3:03:46 AM10/4/11
to
On Tue, 2011-10-04 at 12:03 +0530, Vivek Nagaraj wrote:
> I have added my agent address to the snmpd.conf file. Or else I would
> have not received the trap at port no 162.

Read my lips. snmptrap *DOES NOT OPEN* snmpd.conf! You can write
anything you like in that file and it won't affect the operation of
snmptrap.

I posit that if you perform the following command:

snmptrap -v 1 -m ALL -c public \
135.36.115.62:162 .1.3.6.1.6.3169.254.1.1 127.128.129.130 6 1 20071105

you won't receive anything on the target machine either.

Also, please try these commands in a console and not from within your
program as they normally logs to standard output/error as they are
intended to be interactive. There are flags to redirect the logs to
other places. These are also described in the manual.

Vivek Nagaraj

unread,
Oct 4, 2011, 3:15:02 AM10/4/11
to
I shall provide you some of my findings now. Please correct me if I am wrong.

1) I 'DID' receive the trap message on my trap receiver (another
server in the network) on port no 162 if mentioned hostname:portno

2) I 'DID NOT' receive the trap message on my trap receiver (another
server in the network) on port no other than 162 if mentioned
hostname:portno in the following cmd:
>> snmptrap -v 1 -m ALL -c public \
135.36.115.62:<port no> .1.3.6.1.6.3169.254.1.1 127.128.129.130 6 1 20071105

3) Since you say that the 'defTarget' was introduced in netSNMP v5.4
(I have netSNMP v5.1 pre-installed with the RHEL 4.6 OS) or later, I
shall not touch configuration files. Lets leave that for the moment.

4) I am not seeing any snmp errors in '/var/log/message' either. If
you know a place where the SNMP logs are generated, can you please let
me know the same?

sunita...@gmail.com

unread,
Nov 27, 2017, 7:15:35 AM11/27/17
to
On Wednesday, September 28, 2011 at 12:26:17 PM UTC+5:30, Vivek Nagaraj wrote:
> Hello all,
>
> I am building an application which sends SNMP trap which executes
> 'snmptrap' command.
>
> Since I see that the 162 port is used by many other applications, the
> port is rarely left free so that I can send the traps.
>
> Is there anyway that I can make it send to custom port other than
> 162??? I just got a linux machine and I am ok to compile the net-snmp
> source if it involves that.
>
> Thanks,
> Vivek
>
> ------------------------------------------------------------------------------
> All the data continuously generated in your IT infrastructure contains a
> definitive record of customers, application performance, security
> threats, fraudulent activity and more. Splunk takes this data and makes
> sense of it. Business sense. IT sense. Common sense.
> http://p.sf.net/sfu/splunk-d2dcopy1
> _______________________________________________
> Net-snmp-coders mailing list
> Net-snm...@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/net-snmp-coders
Hi All,

Is there any way to send snmp traps to any specific port other than default(162) using "snmptrap" command ?
Here I am not using snmpd service.
I am using Redhat Linux 6.7 and onwards.

Thanks !!

0 new messages