Spoofing origin host using snmptrap

nagiosnet-snmpsnmp

I'm about ready to lose my mind with this…

I need to spoof the host that snmp traps are being sent from using the snmptrap command.

The man pages for snmptrap state that you can utilize common options made available by snmpcmd. snmpcmd states that you can utilize options existing in snmp.conf like so: –name="value". snmp.conf states that there is a clientAddr option that allows you to specify the trap as being sent from another host.

This is the command I'm running:

[root@***** objects]# /usr/bin/snmptrap --clientAddr="<clientipaddr>" -v 2c -c <communityString> <destipaddr> '' NAGIOS-NOTIFY-MIB::nSvcEvent nHostname s "testHost" nSvcDesc s "testService" nSvcStateID i 2 nSvcOutput s "testOutput"

This is the output I receive:

snmptrap: Unknown host (<destipaddr>) (Cannot assign requested address)

When I run it without the –clientAddr param, the trap receiver sees it fine.

Any idea what I'm doing wrong here?

Best Answer

I tried to do the same and ended up with IP tables instead of net-snmp. The following needs to be setup on the host which you send the traps from:

iptables -t nat -A POSTROUTING -s <IP which you send originally traps from> -p udp --dport 162 -j SNAT --to-source <IP you want to spoof>