SNMP indexed query : IPs got in hexa - How to correct ?

GLR · **Posted:** Wed Jan 04, 2012 11:32 am

I am completing the creation of a new SNMP indexed query to retrieve stats related to IPSec VPN tunnels (traffic, number of active SAs) from StoneGate firewalls and I have a problem with the endpoints IP addresses : I get them as four hexadecimal bytes in Cacti as well as in snmpwalk's output :

Quote:

# snmpwalk -v2c -c com 10.1.4.9 .1.3.6.1.4.1.1369.5.2.1.13.1.3
iso.3.6.1.4.1.1369.5.2.1.13.1.3.1 = Hex-STRING: D5 80 A1 E6
iso.3.6.1.4.1.1369.5.2.1.13.1.3.2 = Hex-STRING: D9 06 91 F7
iso.3.6.1.4.1.1369.5.2.1.13.1.3.3 = Hex-STRING: C2 4E 20 06
iso.3.6.1.4.1.1369.5.2.1.13.1.3.4 = Hex-STRING: C1 FC DE 58
iso.3.6.1.4.1.1369.5.2.1.13.1.3.5 = Hex-STRING: A8 57 16 28
iso.3.6.1.4.1.1369.5.2.1.13.1.3.6 = Hex-STRING: D4 3A 0E 3C
iso.3.6.1.4.1.1369.5.2.1.13.1.3.7 = Hex-STRING: 5C 34 67 CA
iso.3.6.1.4.1.1369.5.2.1.13.1.3.8 = Hex-STRING: D5 90 01 2A
iso.3.6.1.4.1.1369.5.2.1.13.1.3.9 = Hex-STRING: 51 16 A9 EB
iso.3.6.1.4.1.1369.5.2.1.13.1.3.10 = Hex-STRING: 52 F1 AC 57
iso.3.6.1.4.1.1369.5.2.1.13.1.3.11 = Hex-STRING: 9F 32 5B F6
iso.3.6.1.4.1.1369.5.2.1.13.1.3.12 = Hex-STRING: 53 89 42 91
iso.3.6.1.4.1.1369.5.2.1.13.1.3.13 = Hex-STRING: C2 27 83 B0
iso.3.6.1.4.1.1369.5.2.1.13.1.3.14 = Hex-STRING: 51 F6 34 FE

The content of fwVpnEp4Table looks as follows in a MIB browser :

Does anyone have an idea regarding how to correct this behaviour to get them as real IP addresses ?

noname · **Posted:** Fri Jan 06, 2012 5:41 am

That's the similar case to CDP(Cisco Discovery Protocol) neighbor address.

Quote:

% snmpwalk -v2c -c public 192.168.1.100 .1.3.6.1.4.1.9.9.23.1.2.1.1.4
SNMPv2-SMI::enterprises.9.9.23.1.2.1.1.4.10101.4 = Hex-STRING: C0 A8 01 05

I think you should create your own script as 'Script Data Query' instead of 'SNMP Data Query' to convert these hex-string into dotted string (a.b.c.d).
For example:

Quote:

% php -r 'print long2ip("0xC0A80105");'
192.168.1.5

But if you want to manage to translate results of SNMP anyway, try this...

At line 876 of 'graphs_new.php', modify from

Code:

if (isset($row[$field_name])) {
        print .... "<span style='background-color: #F8D93D;'>\\1</span>", $row[$field_name]) : $row[$field_name]) . "</span></td>";
}else{

to

Code:

if (isset($row[$field_name])) {
        $tmp = $row[$field_name];
        if (preg_match('/^[[:xdigit:]]+[: ][[:xdigit:]]+[: ][[:xdigit:]]+[: ][[:xdigit:]]+$/', $tmp) != 0) {
                $tmp = long2ip("0x" . preg_replace('/[: ]/', '', $tmp));
        }
        print .... "<span style='background-color: #F8D93D;'>\\1</span>", $tmp) : $tmp) . "</span></td>";
}else{

(NOTE) [[:xdigit:]] is equal to [0-9A-Fa-f]

Before:

After:

I tried this on Cacti 0.8.7g, but not fully tested. At your own risk.

GLR · **Posted:** Fri Jan 06, 2012 9:29 am

Thanks a lot (once again !) for your valuable input.
I've applied the change you suggested, however, it looks like it doesn't work yet...
I also notice that in cdpCacheAddress the four bytes are separated by spaces whereas in my case, they are separated by ":", so may be the regex has to be adapted ?
But I haven't succeeded to make it work.

noname · **Posted:** Fri Jan 06, 2012 2:40 pm

GLR wrote:

I also notice that in cdpCacheAddress the four bytes are separated by spaces whereas in my case, they are separated by ":", so may be the regex has to be adapted ?

Yes I know that, so I use the regular expression "[: ]" (colon or space) to accept both separators.

Hmm, as seeing your file, you seemed to forget modifying line 880 of it. Please replace $row[$field_name] with $tmp.

GLR · **Posted:** Fri Jan 06, 2012 3:48 pm

Sorry and thanks so much, it works fine, almost perfectly !

Unfortunately some hexa codes generates strange characters, do you know why ?

Don't you think it would be fine to submit a patch to the Cacti dev team ?

Btw, I planned also to use the peer IPs in the graph titles, but I may have to modify another cacti php file ?

Code:

|host_description| - Traffic - Tunnel |query_fwVpnEp4Index| (|query_fwVpnEp4Local| - |query_fwVpnEp4Remote|)

FW-FE-3 - Traffic - Tunnel 1 (C0:6D:8C:53 - D5:80:A1:E6)

noname · **Posted:** Sat Jan 07, 2012 2:06 am

>> Unfortunately some hexa codes generates strange characters, do you know why ?

Sorry I don't know about it.

>> Don't you think it would be fine to submit a patch to the Cacti dev team ?

Hmm.
Such a form of string (xx:xx:xx:xx) means IP address in most cases, but not always.
So I think it's better to implement as "option" which we can choose to use or not, e.g. directives in query XML.
Please post it to developers as feature request, if necessary.

>> Btw, I planned also to use the peer IPs in the graph titles, but I may have to modify another cacti php file ?

Perhaps it's possible by fiddling around with several codes, but patchworking in places is not elegant...
It should be converted when performed SNMP query (as mentioned at the above).

I will consider about that a little more, but now I'm away from my workstation because it's in consecutive holidays in Japan. :)

GLR · **Posted:** Mon Jan 09, 2012 7:25 am

OK, here is the report :
http://bugs.cacti.net/view.php?id=2143

wavysong · **Joined:** Sun Jan 08, 2012 4:45 am **Posts:** 9

GLR wrote:

OK, here is the report :
http://bugs.cacti.net/view.php?id=2143

Hello GLR
i recently create similar template to get ipsec vpn traffic from cisco router.
if possible,could you share your template for reference.
thanks.

SNMP indexed query : IPs got in hexa - How to correct ?

Who is online