Smarts SAM: Malformed Trap Error
Article ID: 331594
Updated On:
Products
Issue/Introduction
SAM trap adapter is show the following error message in the trap log:
[July 27, 2018 1:28:53 PM EDT +633ms] t@2915428096 SNMP_TrapsHandler [0.0.0.0:162] Processor
SNMP_MSG-*-RECEIVED1BYTESFROM2-Received 568 bytes from <IP address>, port <port number>.
When trap adapter debug is enabled, following is shown:
[July 27, 2018 1:28:53 PM EDT +633ms] t@2915428096 SNMP_TrapsHandler [0.0.0.0:162] Processor
SNMP_MSG-*-TRACERDUMP-SNMP Tracer dump
SNMP Message:
0: packet ->
SEQUENCE (0x30), 564 bytes:
4: version ->
INTEGER-32 (0x02), 1 bytes == 1 <v2c>
7: community ->
OCTET-STRING (0x04), 8 bytes == "<community string>"
17: Trap [version>=2] -> (0xa7), 547 bytes:
21: request-id ->
INTEGER-32 (0x02), 4 bytes == 61614308
27: error-status ->
INTEGER-32 (0x02), 1 bytes == 0 <noError>
30: error-index ->
INTEGER-32 (0x02), 1 bytes == 0
33: VarBindList ->
SEQUENCE (0x30), 531 bytes:
37: VarBind -> SEQUENCE (0x30), 24 bytes:
39: OBJ-ID (0x06), 10 bytes == ".1.3.6.1.6.3.1.1.4.1.0"
51: OBJ-ID (0x06), 10 bytes == ".1.3.6.1.4.1.22308.1.3"
63: VarBind -> SEQUENCE (0x30), 501 bytes:
67: OBJ-ID (0x06), 10 bytes == ".1.3.6.1.4.1.22308.1.3"
79: OCTET-STRING (0x04), 485 bytes == "<?xml version="1.0" encoding="UTF-8"?>
<logevent>
<timestamp>2018-07-27 12:28:53.602</timestamp>
<level>ERROR</level>
<category>premise_services</category>
<company>Dell-EMC</company>
<username>system</username>
<pbx>Twincast</pbx>
<message>This is a test message</message>
<content>Dell-EMC
Twincast
UNKNOWN
UNKNOWN
UNKNOWN
UNKNOWN
UNKNOWN</content>
</logevent>
"
[July 27, 2018 1:28:53 PM EDT +634ms] t@2915428096 SNMP_TrapsHandler [0.0.0.0:162] Processor
SNMP-E-AGENTERRORSTATS-Below message for SNMP agent at '<IP address>:<port number>', was suppressed 71 times since July 27, 2018 12:58:39 PM EDT
SNMP-EPARSER-Mangled or incorrect packet; parsing aborted and data discarded; in file "/work/redcurrent/DMT-9.4.1.0/13/smarts/snmp/lib/SNMP_Parser.c" at line 1339
When looking at the pcap, the raw data capture doesn't show any issue:
data: snmpV2-trap (7)
snmpV2-trap
request-id: 61604339
error-status: noError (0)
error-index: 0
variable-bindings: 2 items
1.3.6.1.6.3.1.1.4.1.0: 1.3.6.1.4.1.22308.1.3 (iso.3.6.1.4.1.22308.1.3)
Object Name: 1.3.6.1.6.3.1.1.4.1.0 (iso.3.6.1.6.3.1.1.4.1.0)
Value (OID): 1.3.6.1.4.1.22308.1.3 (iso.3.6.1.4.1.22308.1.3)
1.3.6.1.4.1.22308.1.3: <Hex string>
Object Name: 1.3.6.1.4.1.22308.1.3 (iso.3.6.1.4.1.22308.1.3)
Value (OctetString): <Hex string>
Environment
Cause
A trap PDU must have sysUpTime.0 (RFC3416) and a snmpTrapOID.0 (RFC3418) as the first two varbinds.
In this case, the packets only have snmpTrapOID alone. Since it does not meet standards that's why the Smarts trap processor rejects it as a bad/mangled packet.
Resolution
Feedback
