Smarts IP: Device is discovered in IP domain with discovery error; SWFE-E-EGETNEXT-While getting next of OID .1.3.6.1.2.1.47.1.1.1.1.2.300901122, SNMP-EPARSER-Mangled or incorrect packet; parsing aborted and data discarded; in file, "/work/redcurrent/DMT-

Products

• VMware Smart Assurance

Issue/Introduction

Symptoms:


Device is discovered in IP domain with the following discovery error:

SWFE-E-EGETNEXT-While getting next of OID .1.3.6.1.2.1.47.1.1.1.1.2.300901122,
SNMP-EPARSER-Mangled or incorrect packet; parsing aborted and data discarded; in file "/work/redcurrent/DMT-9.4.1.0/13/smarts/snmp/lib/SNMP_Parser.c" at line 1294

Checked the domain which was listening on eth1:4 which had to be explicitly mentioned in the tcpdump command.
sudo tcpdump -v -i eth1:4 -s 0 -w tcpdump.cap host 123.4.5.29 and port 161
Initiated TCP dump, rolled logs, Enabled Debug on the domain, and rediscovered the device.

Environment

VMware Smart Assurance - SMARTS

Cause

Analysis from the Packet Capture.

The OID with the issue  1.3.6.1.2.1.47.1.1.1.1.2.300901122  belongs to the Cisco Entity MIB. As cross verified in the Domain logs the error occurs when Smarts Probes this Entity MIB.

D tails

OID	1.3.6.1.2.1.47.1.1.1.1.2
Module	ENTITY-MIB (CISCO)
Nom	entPhysicalDescr
Access	readonly
Status	current
Description	A textual description of physical entity. This object should contain a string that identifies the manufacturer's name for the physical entity, and should be set to a distinct value for each version or model of the physical entity.
Syntax	SnmpAdminString (SNMP-FRAMEWORK-MIB)

Resolution

Based on the device response from the packet capture, it was evident that the device is responding with 38 bytes of data over the packet. This violates the RFC Standard as the OctetString size should be 0-255 bits i.e. ~32 bytes.
Please find the details below:

 

SNMP-FRAMEWORK-MIB::SnmpAdminString ::= TEXTUAL-CONVENTION
DISPLAY-HINT "255t"
STATUS       current
DESCRIPTION "An octet string containing administrative
information, preferably in human-readable form.
.... represented using the ISO/IEC
IS 10646-1 character set, encoded as an octet
string using the UTF-8 transformation format
described in [RFC2279]....."
SYNTAX       OCTET STRING (SIZE (0..255))

 

This is an issue with the Device responding with incorrect packet, and should be handled by the device vendor.

Please reach out to the device vendor if you experience this issue.