UDP Port 161

kopper27 · 06-08-2010, 06:16 PM

hi guys

My linux server have SNMP configure port by default is 161 (UDP)
now my monitor team - who are using Nagios - say the server are not being monitor

so check netstat -lnu and I see all is OK and snmp service is running fine
what else should I check about this port 161? to see if it is really opened and listening?

thanks a lot

carltm · 06-08-2010, 06:24 PM

Try running snmpwalk on that server to make sure that you
get a response. If that works, try running snmpwalk on
the nagios server. If it doesn't work on the nagios
server, run iptables -nL to see if the port is being
blocked. Also check the configuration of the snmp
service, since it may only send responses to select
addresses.

kopper27 · 06-08-2010, 06:29 PM

Quote:

Originally Posted by carltm

Try running snmpwalk on that server to make sure that you
get a response. If that works, try running snmpwalk on
the nagios server. If it doesn't work on the nagios
server, run iptables -nL to see if the port is being
blocked. Also check the configuration of the snmp
service, since it may only send responses to select
addresses.

I forgot to add the netstat -lun output

Code:

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address               Foreign Address             State

udp        0      0 0.0.0.0:161                 0.0.0.0:*

kopper27 · 06-08-2010, 06:36 PM

Quote:

Originally Posted by carltm

Try running snmpwalk on that server to make sure that you
get a response. If that works, try running snmpwalk on
the nagios server. If it doesn't work on the nagios
server, run iptables -nL to see if the port is being
blocked. Also check the configuration of the snmp
service, since it may only send responses to select
addresses.

how can I run snmpwalk?

and yes the snmp is configured to send to specified IP

TB0ne · 06-08-2010, 06:52 PM

Quote:

Originally Posted by kopper27

how can I run snmpwalk?

Type in "snmpwalk". Read the man page for more info on the command.

Quote:

and yes the snmp is configured to send to specified IP

It should respond to localhost, or 127.0.0.1 also, so if you run snmpwalk on that machine locally, it'll respond. Might want to check and see if you're running IPtables, or blocking the port somehow.

kopper27 · 06-08-2010, 07:00 PM

Quote:

Originally Posted by TB0ne

Type in "snmpwalk". Read the man page for more info on the command.

It should respond to localhost, or 127.0.0.1 also, so if you run snmpwalk on that machine locally, it'll respond. Might want to check and see if you're running IPtables, or blocking the port somehow.

no iptables

Code:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

I mean it was working OK and suddenly 6 servers Stopped working

TB0ne · 06-08-2010, 08:36 PM

Quote:

Originally Posted by kopper27

no iptables

Code:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

I mean it was working OK and suddenly 6 servers Stopped working

This is much different than your first post, when you said "my linux server" (singular). Would help if you had given complete information in your first post.

One might fail...six don't, unless something changes further downstream, like a router/firewall in between those six and the monitoring server.

kopper27 · 06-09-2010, 12:48 PM

Quote:

Originally Posted by TB0ne

This is much different than your first post, when you said "my linux server" (singular). Would help if you had given complete information in your first post.

One might fail...six don't, unless something changes further downstream, like a router/firewall in between those six and the monitoring server.

sorry I did not say 6 servers

yeah I told them the same thing before posting here 1 server is OK but 6 having the same issue I told them the only thing shared by all of them is network..

but my networking team is so dump....

yeah it was a networking issue
thanks a lot

TB0ne · 06-09-2010, 02:57 PM

Quote:

Originally Posted by kopper27

sorry I did not say 6 servers

yeah I told them the same thing before posting here 1 server is OK but 6 having the same issue I told them the only thing shared by all of them is network..

but my networking team is so dump....

yeah it was a networking issue
thanks a lot

Really?? They're "dump"??? Or do you mean "dumb"???