5月11日,關於snmp的一些東西

先是幾個自己比較需要的oid

MIB  BRIDGE-MIB
Name  dot1dTpFdbAddress

iso.org.dod.internet.mgmt.mib-2.dot1dBridge.dot1dTp.dot1dTpFdbTable.dot1dTpFdbEntry.dot1dTpFdbAddress

OID  1.3.6.1.2.1.17.4.3.1.1
Type  MacAddress
Units  
Access  read-only
Status  mandatory

A unicast MAC address for which the bridge has
 forwarding and/or filtering information.

MIB  BRIDGE-MIB
Name  dot1dStaticAddress

iso.org.dod.internet.mgmt.mib-2.dot1dBridge.dot1dStatic.dot1dStaticTable.dot1dStaticEntry.dot1dStaticAddress

OID  1.3.6.1.2.1.17.5.1.1.1
Type  MacAddress
Units  
Access  read-write
Status  mandatory

The destination MAC address in a frame to which
 this entry's filtering information applies. This
 object can take the value of a unicast address , a
 group address or the broadcast address.

MIB  BLC
Name  snmpEnableAuthTraps

iso.org.dod.internet.mgmt.mib-2.snmp.snmpEnableAuthTraps

OID  1.3.6.1.2.1.11.30
Type  INTEGER
Units  
Access  read-write
Status  unknown

Indicates whether the SNMP agent process is
 permitted to generate authentication-failure
 traps. The value of this object overrides any
 configuration information ; as such , it provides a
 means whereby all authentication-failure traps may
 be disabled.
 
 Note that it is strongly recommended that this
 object be stored in non-volatile memory so that it
 remains constant between re-initializations of the
 network management system.

Possible Values :
    enabled(1)
    disabled(2)

MIB  BRIDGE-MIB
Name  dot1dStpPortEnable

iso.org.dod.internet.mgmt.mib-2.dot1dBridge.dot1dStp.dot1dStpPortTable.dot1dStpPortEntry.dot1dStpPortEnable

OID  1.3.6.1.2.1.17.2.15.1.4
Type  INTEGER
Units  
Access  read-write
Status  mandatory

The enabled/disabled status of the port.

Possible Values :
    enabled(1)
    disabled(2)

MIB  IF-MIB
Name  ifLinkUpDownTrapEnable

iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifLinkUpDownTrapEnable

OID  1.3.6.1.2.1.31.1.1.1.14
Type  INTEGER
Units  
Access  read-write
Status  unknown

Indicates whether linkUp/linkDown traps should be generated
 for this interface.
 
 By default , this object should have the value enabled(1) for
 interfaces which do not operate on 'top' of any other
 interface (as defined in the ifStackTable) , and disabled(2)
 otherwise.

Possible Values :
    enabled(1)
    disabled(2)

MIB  IF-MIB
Name  ifPromiscuousMode

iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifPromiscuousMode

OID  1.3.6.1.2.1.31.1.1.1.16
Type  TruthValue
Units  
Access  read-write
Status  unknown

This object has a value of false(2) if this interface only
 accepts packets/frames that are addressed to this station.
 This object has a value of true(1) when the station accepts
 all packets/frames transmitted on the media. The value
 true(1) is only legal on certain types of media. If legal ,
 setting this object to a value of true(1) may require the
 interface to be reset before becoming effective.
 
 The value of ifPromiscuousMode does not affect the reception
 of broadcast and multicast packets/frames by the interface.

------------------------------------------------------------------------------------------

在交換器上找MAC並down所在連接埠的過程

比如找000C.6E9E.932F  其10進位的是0.12.110.158.147.47

在交換器上GET .1.3.6.1.2.1.17.4.3.1.2.0.12.110.158.147.47
得到是連接埠的number，但實際情況這樣得到的值並不正確，，可以只GET到.1.3.6.1.2.1.17.4.3.1.2.0.12.110.158.147 如果MAC的前部分沒有重的，就是它了，也可以用WALK，把這個走一邊，看是否有相同的MAC，

得到port number後SET .1.3.6.1.2.1.17.2.15.1.4.portnumber disAble(2)
就down掉了

這是過程,用SNMPAPI弄出來就可以了,做到封連接埠自動化,只是現在自己所見的交換器是比較上層的,一個口上就1,2百個MAC,用這種方法不合適,,

iso.org.dod.internet.mgmt.mib-2.dot1dBridge.dot1dStatic.dot1dStaticTable.dot1dStaticEntry.dot1dStaticAddress
OID  1.3.6.1.2.1.17.5.1.1.1
這個類似ACL,可以禁止在某個連接埠上的某個MAC,和上面的用法差不多,後面加上十進位的MAC和連接埠number,值是MAC
自己還沒能實現改這個oid的值及建立一個的過程,原因還不清楚,error說是SNMP_ERRORSTATUS_BADVALUE,但好象不是,我把GET得到的值給過去也還是不行...

----------------------------------------------------------------------------------------------

現在想想校園網裡防盜ip(MAC,ip一起盜的)的,自己覺得有兩種方式,並可以實現,一個就是被盜ip的使用者可以通過認證自己的身份後提交自己被盜的MAC和ip,通過ip找到盜用者所在的交換器(一般在同一廣播域內),通過snmp找到MAC封相應的連接埠,這種必須是在到案頭的交換器上,否則影響的人太多了
另一個就是所說的探針的方式,RMON那些我還沒弄懂,,不過探針也可以自己做啊,週期性把交換器上的MAC全列出來,和上一次的做對比,這個還得實際試試,不知道有沒有其他情況影響到MAC的變化,,,我在間隔大約一天的時候兩次列MAC就發現有變化,有多出的MAC,不是新加進來機器就是有人盜別人的,,也可能有減少的,,如果有同樣的兩個的話那就肯定是有問題了,,,每次都把有變化(多出來的或少的)MAC找出來,,很有可能是盜ip的,,,不過說實話我還真的不清楚學校裡盜ip的到底有多少人,,反正自己周圍的人都沒這個問題還,,,,