SNMP使用的协议为UDP，默认端口为161和162.

使用iptables

命令如下：

iptables -A INPUT -p udp -m udp --dport 161:162 -j DROP

使用mib browser采集设备上的节点，会超时（timeout）

在串口打开tcpdump打印消息如下：

root@hbg:/# iptables -A INPUT -p udp -m udp --dport 161:162 -j DROP
root@hbg:/#
root@hbg:/#
root@hbg:/# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination        
DROP       udp  --  anywhere             anywhere             udp dpts:snmp:snmp-trap

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

root@hbg:/# tcpdump
tcpdump: WARNING: eth0: no IPv4 address assigned
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
12:12:53.215582 3c:46:d8:89:70:52 (oui Unknown) > Broadcast, RRCP-0x23 query
12:12:53.449710 STP 802.1d, Config, Flags [none], bridge-id 7fff.00:11:22:33:44:56.8001, length 35
12:12:54.215559 3c:46:d8:89:70:52 (oui Unknown) > Broadcast, RRCP-0x23 query
12:12:55.215538 3c:46:d8:89:70:52 (oui Unknown) > Broadcast, RRCP-0x23 query
12:12:55.449715 STP 802.1d, Config, Flags [none], bridge-id 7fff.00:11:22:33:44:56.8001, length 35
12:12:55.509887 LLDP, length 138: TVWS
12:12:55.899593 ARP, Request who-has 192.168.2.125 tell 192.168.2.234, length 46
12:12:55.899857 ARP, Reply 192.168.2.125 is-at 00:11:22:33:44:56 (oui Unknown), length 28
12:12:55.900431 IP 192.168.2.234.64411 > 192.168.2.125.snmp:  C=world GetNextRequest(24)  system.sysUpTime 查询报文
12:12:56.215514 3c:46:d8:89:70:52 (oui Unknown) > Broadcast, RRCP-0x23 query
12:12:57.215491 3c:46:d8:89:70:52 (oui Unknown) > Broadcast, RRCP-0x23 query
12:12:57.449707 STP 802.1d, Config, Flags [none], bridge-id 7fff.00:11:22:33:44:56.8001, length 35
12:12:58.215468 3c:46:d8:89:70:52 (oui Unknown) > Broadcast, RRCP-0x23 query
12:12:59.215445 3c:46:d8:89:70:52 (oui Unknown) > Broadcast, RRCP-0x23 query
12:12:59.449706 STP 802.1d, Config, Flags [none], bridge-id 7fff.00:11:22:33:44:56.8001, length 35
12:13:00.215421 3c:46:d8:89:70:52 (oui Unknown) > Broadcast, RRCP-0x23 query
12:13:00.898934 IP 192.168.2.234.64411 > 192.168.2.125.snmp:  C=world GetNextRequest(24)  system.sysUpTime 查询报文
12:13:01.215396 3c:46:d8:89:70:52 (oui Unknown) > Broadcast, RRCP-0x23 query
12:13:01.449712 STP 802.1d, Config, Flags [none], bridge-id 7fff.00:11:22:33:44:56.8001, length 35
12:13:02.215372 3c:46:d8:89:70:52 (oui Unknown) > Broadcast, RRCP-0x23 query
12:13:02.339996 ARP, Request who-has 192.168.1.16 tell 192.168.1.234, length 46
12:13:03.215351 3c:46:d8:89:70:52 (oui Unknown) > Broadcast, RRCP-0x23 query
12:13:03.449710 STP 802.1d, Config, Flags [none], bridge-id 7fff.00:11:22:33:44:56.8001, length 35
12:13:04.215327 3c:46:d8:89:70:52 (oui Unknown) > Broadcast, RRCP-0x23 query
12:13:05.215304 3c:46:d8:89:70:52 (oui Unknown) > Broadcast, RRCP-0x23 query
12:13:05.449706 STP 802.1d, Config, Flags [none], bridge-id 7fff.00:11:22:33:44:56.8001, length 35
12:13:05.899351 IP 192.168.2.234.64411 > 192.168.2.125.snmp:  C=world GetNextRequest(24)  system.sysUpTime  查询报文
12:13:06.215279 3c:46:d8:89:70:52 (oui Unknown) > Broadcast, RRCP-0x23 query
12:13:07.215260 3c:46:d8:89:70:52 (oui Unknown) > Broadcast, RRCP-0x23 query
^C
29 packets captured
29 packets received by filter
0 packets dropped by kernel

查询报文的次数在于你配置mib browser中retransmits的次数

允许通过为:

iptables -A INPUT -p udp -m udp --dport 161:162 -j ACCEPT

root@hbg:/# iptables -D INPUT 1
root@hbg:/# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination        
root@hbg:/#
root@hbg:/#
root@hbg:/# iptables -A INPUT -p udp -m udp --dport 161:162 -j ACCEPT
root@hbg:/# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination        
ACCEPT     udp  --  anywhere             anywhere             udp dpts:snmp:snmp-trap

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

root@hbg:/# tcpdump
tcpdump: WARNING: eth0: no IPv4 address assigned
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
12:15:55.211339 3c:46:d8:89:70:52 (oui Unknown) > Broadcast, RRCP-0x23 query
12:15:55.449706 STP 802.1d, Config, Flags [none], bridge-id 7fff.00:11:22:33:44:56.8001, length 35
12:15:55.629877 LLDP, length 138: TVWS
12:15:56.211318 3c:46:d8:89:70:52 (oui Unknown) > Broadcast, RRCP-0x23 query
12:15:57.211291 3c:46:d8:89:70:52 (oui Unknown) > Broadcast, RRCP-0x23 query
12:15:57.449708 STP 802.1d, Config, Flags [none], bridge-id 7fff.00:11:22:33:44:56.8001, length 35
12:15:58.211269 3c:46:d8:89:70:52 (oui Unknown) > Broadcast, RRCP-0x23 query
12:15:58.702348 ARP, Request who-has 192.168.2.125 tell 192.168.2.234, length 46
12:15:58.702588 ARP, Reply 192.168.2.125 is-at 00:11:22:33:44:56 (oui Unknown), length 28
12:15:58.703184 IP 192.168.2.234.58494 > 192.168.2.125.snmp:  C=world GetNextRequest(24)  system.sysUpTime   查询报文
12:15:58.704048 IP 192.168.2.125.snmp > 192.168.2.234.58494:  C=world GetResponse(28)  system.sysUpTime.0=304450  响应报文
12:15:59.211246 3c:46:d8:89:70:52 (oui Unknown) > Broadcast, RRCP-0x23 query
12:15:59.449711 STP 802.1d, Config, Flags [none], bridge-id 7fff.00:11:22:33:44:56.8001, length 35
12:16:00.211223 3c:46:d8:89:70:52 (oui Unknown) > Broadcast, RRCP-0x23 query
12:16:00.561467 IP 192.168.2.234.58496 > 192.168.2.125.snmp:  C=world GetRequest(31)  E:45138.3030.1.1.4.0    查询报文
12:16:00.598459 IP 192.168.2.125.snmp > 192.168.2.234.58496:  C=world GetResponse(35)  E:45138.3030.1.1.4.0=192.168.2.125  响应报文
12:16:01.211198 3c:46:d8:89:70:52 (oui Unknown) > Broadcast, RRCP-0x23 query
12:16:01.449707 STP 802.1d, Config, Flags [none], bridge-id 7fff.00:11:22:33:44:56.8001, length 35
12:16:02.211178 3c:46:d8:89:70:52 (oui Unknown) > Broadcast, RRCP-0x23 query
12:16:03.211152 3c:46:d8:89:70:52 (oui Unknown) > Broadcast, RRCP-0x23 query
12:16:03.449709 STP 802.1d, Config, Flags [none], bridge-id 7fff.00:11:22:33:44:56.8001, length 35
12:16:03.709734 ARP, Request who-has 192.168.2.234 tell 192.168.2.125, length 28
12:16:03.710467 ARP, Reply 192.168.2.234 is-at 54:ee:75:4a:37:b5 (oui Unknown), length 46
12:16:04.211128 3c:46:d8:89:70:52 (oui Unknown) > Broadcast, RRCP-0x23 query
12:16:05.211106 3c:46:d8:89:70:52 (oui Unknown) > Broadcast, RRCP-0x23 query
12:16:05.338555 ARP, Request who-has 192.168.1.16 tell 192.168.1.234, length 46
12:16:05.449709 STP 802.1d, Config, Flags [none], bridge-id 7fff.00:11:22:33:44:56.8001, length 35
12:16:06.211083 3c:46:d8:89:70:52 (oui Unknown) > Broadcast, RRCP-0x23 query
12:16:07.211060 3c:46:d8:89:70:52 (oui Unknown) > Broadcast, RRCP-0x23 query
12:16:07.449715 STP 802.1d, Config, Flags [none], bridge-id 7fff.00:11:22:33:44:56.8001, length 35
12:16:08.211035 3c:46:d8:89:70:52 (oui Unknown) > Broadcast, RRCP-0x23 query
12:16:09.211012 3c:46:d8:89:70:52 (oui Unknown) > Broadcast, RRCP-0x23 query
12:16:09.449709 STP 802.1d, Config, Flags [none], bridge-id 7fff.00:11:22:33:44:56.8001, length 35
^C
33 packets captured
34 packets received by filter
0 packets dropped by kernel

openwrt拦截snmp报文的更多相关文章

  1. SNMP报文抓取与分析(二)

    SNMP报文抓取与分析(二) SNMP报文抓取与分析(二) 1.SNMP报文表示简介 基本编码规则BER 标识域Tag表示 长度域length表示 2.SNMP报文详细分析(以一个get-respon ...

  2. SNMP报文抓取与分析(一)

    SNMP报文抓取与分析(一) 1.抓取SNMP报文 SNMP报文的形式大致如下图所示 我们这里使用netcat这个工具来抓取snmp的PDU(协议数据单元).(因为我们并不需要前面的IP和UDP首部) ...

  3. SNMP学习笔记之SNMP报文以及不同版本(SNMPv1、v2c、v3)的区别

    本篇文章将重点分析SNMP报文,并对不同版本(SNMPv1.v2c.v3)进行区别! 四.SNMP协议数据单元 在SNMP管理中,管理站(NMS)和代理(Agent)之间交换的管理信息构成了SNMP报 ...

  4. SNMP学习笔记之SNMP报文协议详解

    0x00 简介 简单网络管理协议(SNMP)是TCP/IP协议簇的一个应用层协议.在1988年被制定,并被Internet体系结构委员会(IAB)采纳作为一个短期的网络管理解决方案:由于SNMP的简单 ...

  5. BurpSuite经常拦截firefox报文如success.txt的解决办法

    因为工作需要经常使用Burp对收发报文进行检测,平时习惯使用火狐浏览器,但是火狐浏览器经常进行一些登录状态的检测,导致Burp拦截中出现大量的火狐报文,如http://detectportal.fir ...

  6. 能ping通虚拟机，但snmp报文 Destination unreachable(Host administratively prohibited

    如题目,使用virtual box 虚拟机,虚拟机系统为centos6.5, 主机系统为win10 内外设置ip在同一网段后,互相能ping通,centos 系统开启snmp服务,此处说明以下, sn ...

  7. iptables拦截tcp报文syn/ack/rst/psh/fin

    https://www.cnblogs.com/Qingluan/p/5137136.html https://blog.csdn.net/weixin_34216107/article/detail ...

  8. SNMP TRAP报文解析

    转载地址: https://blog.csdn.net/eric_sunah/article/details/19557683 SNMP的报文格式 SNMP代理和管理站通过SNMP协议中的标准消息进行 ...

  9. SNMP简单网络管理协议

    声明:以下内容是学习谌玺老师视频整理出来(http://edu.51cto.com/course/course_id-861.html) SNMP(Simple Network Management ...

随机推荐

  1. ToDictionary用法

    ToDictionary其实可以简单化,可以传两个lambada表达式,第一个是Key,第二个就是Value. ToDictionary( key => key.Attribute(" ...

  2. JSTL标签库--核心标签库

    ->JSTL的使用和EL表达式是分不开的 ->JSTL标签库分为5类 1.核心标签库(这里只介绍该标签库) 2.I18N格式化标签库 3.SQL标签库 4.XML标签库 5.函数标签库 - ...

  3. 替换ubuntu 14.04的源

    1. 背景(为什么要替换)安装ubuntu,默认源是(http://extras.ubuntu.com/ubuntu),国内访问很慢...当我们用apt-get安装软件包或者更新时有时很慢,所以才想到 ...

  4. Chapter 21_5 替换

    gsub函数的第三个参数不仅是一个字符串,还可以是一个函数或table. 如果是函数,gsub会在每次找到匹配时调用该函数.调用时的参数是捕获到的内容,该函数的返回值作为要替换的字符串. 如果是tab ...

  5. sql 查询表共多少列

    1.oracle: select count(*) from user_tab_cols where table_name='表名';--表名含英文的话应为英文大写字母 2.mysql: select ...

  6. ansible module

    模块是一个独立的, 可以复用的脚本, 它可以被anisible API, Ansible 或者ansible-playbook使用.   在模块退出之前, 它通过输出一个json字符串到标准输出从而反 ...

  7. lda 主题模型--TOPIC MODEL--Gibbslda++结果分析

    在之前的博客中已经详细介绍了如何用Gibbs做LDA抽样.(http://www.cnblogs.com/nlp-yekai/p/3711384.html) 这里,我们讨论一下实验结果: 结果文件包括 ...

  8. HTTPClient网络异常：java.lang.IllegalStateException: Content has been consumed

    在对代码进行重构时候,出现了一个异常,代码的网络请求使用的是HTTPClient: 但是其实代码中没有添加什么,只是添加了两句log: 后来发现是因为将EntityUtils.toString()方法 ...

  9. Dynamic Programming - leetcode [动态规划]

    115. Distinct Subsequences 96. Unique Binary Search Trees 120. Triangle 123. Best Time to Buy and Se ...

  10. Java JDBC Batch

    Java批量处理数据 import java.sql.Connection; import java.sql.PreparedStatement; //import String sql = &quo ...