5月11日,关于snmp的一些东西

先是几个自己比较需要的oid

MIB  BRIDGE-MIB
Name  dot1dTpFdbAddress

iso.org.dod.internet.mgmt.mib-2.dot1dBridge.dot1dTp.dot1dTpFdbTable.dot1dTpFdbEntry.dot1dTpFdbAddress

OID  1.3.6.1.2.1.17.4.3.1.1
Type  MacAddress
Units  
Access  read-only
Status  mandatory

A unicast MAC address for which the bridge has
 forwarding and/or filtering information.

MIB  BRIDGE-MIB
Name  dot1dStaticAddress

iso.org.dod.internet.mgmt.mib-2.dot1dBridge.dot1dStatic.dot1dStaticTable.dot1dStaticEntry.dot1dStaticAddress

OID  1.3.6.1.2.1.17.5.1.1.1
Type  MacAddress
Units  
Access  read-write
Status  mandatory

The destination MAC address in a frame to which
 this entry's filtering information applies. This
 object can take the value of a unicast address , a
 group address or the broadcast address.

MIB  BLC
Name  snmpEnableAuthTraps

iso.org.dod.internet.mgmt.mib-2.snmp.snmpEnableAuthTraps

OID  1.3.6.1.2.1.11.30
Type  INTEGER
Units  
Access  read-write
Status  unknown

Indicates whether the SNMP agent process is
 permitted to generate authentication-failure
 traps. The value of this object overrides any
 configuration information ; as such , it provides a
 means whereby all authentication-failure traps may
 be disabled.
 
 Note that it is strongly recommended that this
 object be stored in non-volatile memory so that it
 remains constant between re-initializations of the
 network management system.

Possible Values :
    enabled(1)
    disabled(2)

MIB  BRIDGE-MIB
Name  dot1dStpPortEnable

iso.org.dod.internet.mgmt.mib-2.dot1dBridge.dot1dStp.dot1dStpPortTable.dot1dStpPortEntry.dot1dStpPortEnable

OID  1.3.6.1.2.1.17.2.15.1.4
Type  INTEGER
Units  
Access  read-write
Status  mandatory

The enabled/disabled status of the port.

Possible Values :
    enabled(1)
    disabled(2)

MIB  IF-MIB
Name  ifLinkUpDownTrapEnable

iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifLinkUpDownTrapEnable

OID  1.3.6.1.2.1.31.1.1.1.14
Type  INTEGER
Units  
Access  read-write
Status  unknown

Indicates whether linkUp/linkDown traps should be generated
 for this interface.
 
 By default , this object should have the value enabled(1) for
 interfaces which do not operate on 'top' of any other
 interface (as defined in the ifStackTable) , and disabled(2)
 otherwise.

Possible Values :
    enabled(1)
    disabled(2)

MIB  IF-MIB
Name  ifPromiscuousMode

iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifPromiscuousMode

OID  1.3.6.1.2.1.31.1.1.1.16
Type  TruthValue
Units  
Access  read-write
Status  unknown

This object has a value of false(2) if this interface only
 accepts packets/frames that are addressed to this station.
 This object has a value of true(1) when the station accepts
 all packets/frames transmitted on the media. The value
 true(1) is only legal on certain types of media. If legal ,
 setting this object to a value of true(1) may require the
 interface to be reset before becoming effective.
 
 The value of ifPromiscuousMode does not affect the reception
 of broadcast and multicast packets/frames by the interface.

------------------------------------------------------------------------------------------

在交换机上找MAC并down所在端口的过程

比如找000C.6E9E.932F  其10进制的是0.12.110.158.147.47

在交换机上GET .1.3.6.1.2.1.17.4.3.1.2.0.12.110.158.147.47
得到是端口的number，但实际情况这样得到的值并不正确，，可以只GET到.1.3.6.1.2.1.17.4.3.1.2.0.12.110.158.147 如果MAC的前部分没有重的，就是它了，也可以用WALK，把这个走一边，看是否有相同的MAC，

得到port number后SET .1.3.6.1.2.1.17.2.15.1.4.portnumber disAble(2)
就down掉了

这是过程,用SNMPAPI弄出来就可以了,做到封端口自动化,只是现在自己所见的交换机是比较上层的,一个口上就1,2百个MAC,用这种方法不合适,,

iso.org.dod.internet.mgmt.mib-2.dot1dBridge.dot1dStatic.dot1dStaticTable.dot1dStaticEntry.dot1dStaticAddress
OID  1.3.6.1.2.1.17.5.1.1.1
这个类似ACL,可以禁止在某个端口上的某个MAC,和上面的用法差不多,后面加上十进制的MAC和端口number,值是MAC
自己还没能实现改这个oid的值及新建一个的过程,原因还不清楚,error说是SNMP_ERRORSTATUS_BADVALUE,但好象不是,我把GET得到的值给过去也还是不行...

----------------------------------------------------------------------------------------------

现在想想校园网里防盗ip(MAC,ip一起盗的)的,自己觉得有两种方式,并可以实现,一个就是被盗ip的用户可以通过认证自己的身份后提交自己被盗的MAC和ip,通过ip找到盗用者所在的交换机(一般在同一广播域内),通过snmp找到MAC封相应的端口,这种必须是在到桌面的交换机上,否则影响的人太多了
另一个就是所说的探针的方式,RMON那些我还没弄懂,,不过探针也可以自己做啊,定期的把交换机上的MAC全列出来,和上一次的做对比,这个还得实际试试,不知道有没有其他情况影响到MAC的变化,,,我在间隔大约一天的时候两次列MAC就发现有变化,有多出的MAC,不是新加进来机器就是有人盗别人的,,也可能有减少的,,如果有同样的两个的话那就肯定是有问题了,,,每次都把有变化(多出来的或少的)MAC找出来,,很有可能是盗ip的,,,不过说实话我还真的不清楚学校里盗ip的到底有多少人,,反正自己周围的人都没这个问题还,,,,