SNMP Trapd LAMbot v2 Additional Notes

Given an OID of

SNMPv2-SMI::enterprises.116.5.11.4.2.7

We can interpret this as “the enterprises object in the SNMPv2-SMI MIB module” + 116.5.11.4.2.7

To reverse translate this we would use the Trap utility reverseTranslate() function. This expects a string to be passed in the forma of:

reverseTranslate('MIB-MODULE::mib-Object.mib-index = "<value>"')

For example, given a varbind in a payload of:

"SNMPv2-SMI::enterprises.116.5.11.4.2.6" : "A value for eventTrapTime"

We would use the following to reverse translate this:

var translated = trapUtil.reverseTranslate('"SNMPv2-SMI::enterprises.116.5.11.4.2.6" = "A value for eventTrapTime"')

This would return an object (translated) of :

{
    "oid": "1.3.6.1.4.1.116.5.11.4.2.6",
    "value": "A value for eventTrapTime\" ",
    "mib": "SNMPv2-SMI",
    "index": "116.5.11.4.2.6"
}

This data would then be used with the addVarbind() function to add the oid and value to the trap.

trap.addVarbind(translated.oid,translated.value);

When the reverse translation process finds an enumeration, the process will try and also translate this enumeration into the appropriate numeric value. For example, given a partially translated value of:

{ 
  ...
  "IF-MIB::ifType.1" : "ethernetCsmacd"
  ...
}

We’d get a translated value of:

trapUtil.reverseTranslate('IF-MIB::ifType.1 = "ethernetCsmacd"');

{
    "oid": "1.3.6.1.2.1.2.2.1.3.1",
    "value": "6",
    "mib": "IF-MIB",
    "index": "1"
}

The value has ben enumerated to the matching value in the IF-MIB (derived from the IANAifType-MIB).

If an indirect source has fully translated the MIB object to a single object name, then there is the risk that there is more than one mib object has the same name. For example the following two MIB definitions both have the same name “eventSummary” - but these have very different OIDs.

AVAMAR-MCS-MIB
...
eventSummary OBJECT-TYPE
    SYNTAX DisplayString (SIZE (0..256))
    ACCESS read-only
    STATUS mandatory
    DESCRIPTION "One line summary description of event reported"
  ::= { eventData 5 }

KASHYA-MIB
...
    eventSummary OBJECT-TYPE
        SYNTAX              OCTET STRING
        ACCESS              read-only
        STATUS              mandatory
        DESCRIPTION         "Short description of event."
        ::= { trapInfo 10 }

If we were presented with a indirect payload with a fully translated name for this with no MIB context, it would not be possible to use the reverseTranslate() directly. There is no not enough context to narrow down the object to a specific MIB and resulting OID.

{
  ...
  "eventSummary" : "This is a test event"
  ...
}

In cases like this additional logic will be needed to get all possible values for the mib object - and determine which of these is appropriate.

To fetch all known details for a mib object (by name only) use the Trap utility - findMibObject() function.

var allObjects = trapUtil.findMibObject("eventSummary");

Would return

[
    {
        "parent_name": "eventData",
        "current": true,
        "mib_name": "AVAMAR-MCS-MIB",
        "name": "eventSummary",
        "syntax": {
            "name": "DisplayString",
            "raw": "DisplayString"
        },
        "oid_path": "1.3.6.1.4.1.15597.1.1.1.2.5",
        "isTrap": false
    },
    {
        "parent_name": "trapInfo",
        "current": true,
        "mib_name": "KASHYA-MIB",
        "name": "eventSummary",
        "syntax": {
            "name": "OCTET STRING",
            "raw": "OCTET STRING"
        },
        "oid_path": "1.3.6.1.4.1.21658.3.1.1.10",
        "isTrap": false
    }
]

The data returned can be used to determine which of the objects to use - for example comparing the oid_path in the returned data with other oid data (e.g. the snmpTrapOID) to see if there shared a common stem, enterprise number etc.

This conflict resolution needs to be accurate, if the wrong OID is passed to the processing, then the resulting event may have incomplete data.