Skip to content

Instantly share code, notes, and snippets.

@lloydroc
Created August 4, 2017 17:52
Show Gist options
  • Save lloydroc/4549fb258355576f271486fb32f3dadf to your computer and use it in GitHub Desktop.
Save lloydroc/4549fb258355576f271486fb32f3dadf to your computer and use it in GitHub Desktop.
tcpdump to capture snmp packets
tcpdump -i eno1 -T snmp -n dst portrange 161-162
# output looks like this for an ios router linkup
# 11:47:50.905818 IP 10.10.201.27.56503 > 10.10.202.11.162: V2Trap(138) .1.3.6.1.2.1.1.3.0=791308 .1.3.6.1.6.3.1.1.4.1.0=.1.3.6.1.6.3.1.1.5.4 .1.3.6.1.2.1.2.2.1.1.1=1 .1.3.6.1.2.1.2.2.1.2.1="FastEthernet0/0" .1.3.6.1.2.1.2.2.1.3.1=6 .1.3.6.1.4.1.9.2.2.1.1.20.1="up"
# in ios you can see how many snmp traps, the address its sending to and the port
# router4#show snmp
# Chassis: FTX151202SZ
# 0 SNMP packets input
# 0 Bad SNMP version errors
# 0 Unknown community name
# 0 Illegal operation for community name supplied
# 0 Encoding errors
# 0 Number of requested variables
# 0 Number of altered variables
# 0 Get-request PDUs
# 0 Get-next PDUs
# 0 Set-request PDUs
# 0 Input queue packet drops (Maximum queue size 1000)
# 12 SNMP packets output
# 0 Too big errors (Maximum packet size 1500)
# 0 No such name errors
# 0 Bad values errors
# 0 General errors
# 0 Response PDUs
# 12 Trap PDUs
# SNMP Dispatcher:
# queue 0/75 (current/max), 0 dropped
# SNMP Engine:
# queue 0/1000 (current/max), 0 dropped
#
# SNMP logging: enabled
# Logging to 10.10.202.11.162, 0/10, 12 sent, 0 dropped.
# ios was configured with
# router4(config)# snmp-server community public RO
# router4(config)# snmp-server enable traps snmp linkdown linkup
# router4(config)# snmp-server host 10.10.202.11 version 2c public
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment