Ad Widget

Collapse

SNMPv3 Poller response noSuchInstance

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • rich_h
    Junior Member
    • Aug 2019
    • 2

    #1

    SNMPv3 Poller response noSuchInstance

    I am trying to test a Zabbix server but I don't seem to be able to get the Discovery Poller to work. It is polling, but I get a different response to the query from the Poller than I do manually polling using snmpwalk. I am polling OID: 1.3.6.1.2.1.1.5
    Zabbix Version 4.2.5, running on freshly installed Centos 7.

    Code:
    snmpwalk -v3 -l authPriv -u SNMP_USER -a sha -A PassW0rd-x aes -X PassW0rd 192.168.1.253 .1.3.6.1.2.1.1.5
    SNMPv2-MIB::sysName.0 = STRING: sw-office.localdomain
    I have decrypted pcaps of the snmpwalk and the discovery probe. The response from the Zabbix probe is:
    Code:
    msgData: encryptedPDU (1)
        encryptedPDU: 14a49dcd720e89029f345a70491aa3b40aa99d44b5268619...
            Decrypted ScopedPDU: 302d040c800000090300381c1af858010400a21b02044dbe...
                contextEngineID: 800000090300381c1af85801
                    1... .... = Engine ID Conformance: RFC3411 (SNMPv3)
                    Engine Enterprise ID: ciscoSystems (9)
                    Engine ID Format: MAC address (3)
                    Engine ID Data: Cisco type: Agent (0x00)
                    Engine ID Data: MAC address: Cisco_f8:58:01 (38:1c:1a:f8:58:01)
                contextName:
                data: get-response (2)
                    get-response
                        request-id: 1304304023
                        error-status: noError (0)
                        error-index: 0
                        variable-bindings: 1 item
                            1.3.6.1.2.1.1.5: noSuchInstance
                                Object Name: 1.3.6.1.2.1.1.5 (iso.3.6.1.2.1.1.5)
                                noSuchInstance
                                    [Expert Info (Note/Response): noSuchInstance]
                                        [noSuchInstance]
                                        [Severity level: Note]
                                        [Group: Response]
    Both get-requests look the same, but something must be different to get a different result.

    Request from Zabbix:
    Code:
    Simple Network Management Protocol
        msgVersion: snmpv3 (3)
        msgGlobalData
            msgID: 1168242253
            msgMaxSize: 65507
            msgFlags: 07
                .... .1.. = Reportable: Set
                .... ..1. = Encrypted: Set
                .... ...1 = Authenticated: Set
            msgSecurityModel: USM (3)
        msgAuthoritativeEngineID: 800000090300381c1af85801
            1... .... = Engine ID Conformance: RFC3411 (SNMPv3)
            Engine Enterprise ID: ciscoSystems (9)
            Engine ID Format: MAC address (3)
            Engine ID Data: Cisco type: Agent (0x00)
            Engine ID Data: MAC address: Cisco_f8:58:01 (38:1c:1a:f8:58:01)
        msgAuthoritativeEngineBoots: 2
        msgAuthoritativeEngineTime: 60607712
        msgUserName: SNMP_USER
        msgAuthenticationParameters: f3faa7aca81046b19e70e6c6
            [Authentication: OK]
                [Expert Info (Chat/Checksum): SNMP Authentication OK]
                    [SNMP Authentication OK]
                    [Severity level: Chat]
                    [Group: Checksum]
        msgPrivacyParameters: 6f26af9d479f467d
        msgData: encryptedPDU (1)
            encryptedPDU: 0b9d7be1b2dc0a77a2fb4eba623c157c3a2585c48cf38193...
                Decrypted ScopedPDU: 302d040c800000090300381c1af858010400a01b02044dbe...
                    contextEngineID: 800000090300381c1af85801
                        1... .... = Engine ID Conformance: RFC3411 (SNMPv3)
                        Engine Enterprise ID: ciscoSystems (9)
                        Engine ID Format: MAC address (3)
                        Engine ID Data: Cisco type: Agent (0x00)
                        Engine ID Data: MAC address: Cisco_f8:58:01 (38:1c:1a:f8:58:01)
                    contextName:
                    data: get-request (0)
                        get-request
                            request-id: 1304304023
                            error-status: noError (0)
                            error-index: 0
                            variable-bindings: 1 item
                                1.3.6.1.2.1.1.5: Value (Null)
                                    Object Name: 1.3.6.1.2.1.1.5 (iso.3.6.1.2.1.1.5)
                                    Value (Null)
    Request from snmpwalk:
    Code:
    Simple Network Management Protocol
        msgVersion: snmpv3 (3)
        msgGlobalData
            msgID: 1694691868
            msgMaxSize: 65507
            msgFlags: 07
                .... .1.. = Reportable: Set
                .... ..1. = Encrypted: Set
                .... ...1 = Authenticated: Set
            msgSecurityModel: USM (3)
        msgAuthoritativeEngineID: 800000090300381c1af85801
            1... .... = Engine ID Conformance: RFC3411 (SNMPv3)
            Engine Enterprise ID: ciscoSystems (9)
            Engine ID Format: MAC address (3)
            Engine ID Data: Cisco type: Agent (0x00)
            Engine ID Data: MAC address: Cisco_f8:58:01 (38:1c:1a:f8:58:01)
        msgAuthoritativeEngineBoots: 2
        msgAuthoritativeEngineTime: 60609929
        msgUserName: SNMP_USER
        msgAuthenticationParameters: 340c7ad41c7ca0fe6e509283
            [Authentication: OK]
                [Expert Info (Chat/Checksum): SNMP Authentication OK]
                    [SNMP Authentication OK]
                    [Severity level: Chat]
                    [Group: Checksum]
        msgPrivacyParameters: 5749ec723cfb3922
        msgData: encryptedPDU (1)
            encryptedPDU: 9e1658e35907f79c1a48830a0a2736b9af0c34cae8531cda...
                Decrypted ScopedPDU: 302d040c800000090300381c1af858010400a11b020432c7...
                    contextEngineID: 800000090300381c1af85801
                        1... .... = Engine ID Conformance: RFC3411 (SNMPv3)
                        Engine Enterprise ID: ciscoSystems (9)
                        Engine ID Format: MAC address (3)
                        Engine ID Data: Cisco type: Agent (0x00)
                        Engine ID Data: MAC address: Cisco_f8:58:01 (38:1c:1a:f8:58:01)
                    contextName:
                    data: get-next-request (1)
                        get-next-request
                            request-id: 851915442
                            error-status: noError (0)
                            error-index: 0
                            variable-bindings: 1 item
                                1.3.6.1.2.1.1.5: Value (Null)
                                    Object Name: 1.3.6.1.2.1.1.5 (iso.3.6.1.2.1.1.5)
                                    Value (Null)
    Can anyone see why Zabbix receives the noSuchInstance response?
    Last edited by rich_h; 26-08-2019, 00:25.
Working...