[Snort-devel] spo_SnmpTrap.c

Glenn Mansfield Keeni glenn at ...1085...
Wed Oct 2 22:29:03 EDT 2002


Andy,
     Thanks a lot. This one skipped our attention. We have been
focussing on the v6 part of the code with net-snmp-5.0.*. This
part has not been committed as yet. [ This part does contain the
correct handling of the port number for net-snmp].
     I will be updating the CVS shortly with another set of fixes
including yours. Thank you very much.

     Glenn

Andrew Hood wrote:
> net-snmp changed the syntax of the parameters. -p <port> is no longer 
> valid. The new syntax is <trapipaddr>[:<port>]
> 
> Also if you don't specify the port it defaults to 161, which is correct 
> for snmp but not for trap/inform. In effect it is a compulsory 
> parameter. This can be worked around by adding
> 
>     if (!data->session.remote_port) data->session.remote_port=162;
> 
> before
> 
>     data->trapdPort = data->session.remote_port;
>     return (data);
> }
> 
> Patch to spo_SnmpTrap.c without the workaround attached.
> 
> Andy
> 
> 
> ------------------------------------------------------------------------
> 
> Index: spo_SnmpTrap.c
> ===================================================================
> RCS file: /cvsroot/snort/snort/src/output-plugins/spo_SnmpTrap.c,v
> retrieving revision 1.16
> diff -b -c -r1.16 spo_SnmpTrap.c
> *** spo_SnmpTrap.c	26 Sep 2002 22:11:04 -0000	1.16
> --- spo_SnmpTrap.c	2 Oct 2002 11:17:50 -0000
> ***************
> *** 813,819 ****
>    
>       }
>       if     (data->session.peername)
> !     {       tInfo = gethostbyname(data->session.peername); 
>               if     (tInfo == NULL)
>               {
>                 ErrorMessage("SnmpTrapPlugin: Unresolvable Trap destination : %s",
> --- 813,828 ----
>    
>       }
>       if     (data->session.peername)
> !     {       /* net-snmp puts the port on the end of the address */
> !             char *lastColon=strrchr(data->session.peername,':');
> !             if (lastColon) {
> !                     *lastColon=0;
> !                     tInfo = gethostbyname(data->session.peername);
> !                     data->session.remote_port=atoi(lastColon+1);
> !                     *lastColon=':';
> !             }
> !             else
> !                     tInfo = gethostbyname(data->session.peername);
>               if     (tInfo == NULL)
>               {
>                 ErrorMessage("SnmpTrapPlugin: Unresolvable Trap destination : %s",








More information about the Snort-devel mailing list