Implement SNMP traps version 3

[nasras03]

Feature Request

We would like to be able to use SNMP traps version 3
Opening a feature request kicks off a discussion.

Proposal:

Can SNMP traps version 3 be implemented in a similar way to the existing v2c and v1 versions

Current behavior:

Only works for v1 and v2c

Desired behavior:

To work on v3

Use case:

We have > 3K devices and this split:
total no. Of v1 = 50
total no. Of v2c = 1285
total no. Of v3 = 1940

We are thinking of implementing the TICK stack and this feature is really important as allows
us to monitor most of our routers/switches in a secure way, as v3 provides username/password which v2 does not.

[reimda]

@nasras03 Could you help me understand your use case a little better? SNMP v3 added a few different types of security and I'm not sure which one you're referring to. I'm guessing you mean USM (RFC 2574) but there's also TSM. If it's USM there are a few options for authentication type (like MD5 and SHA) and privacy protocol (like DES and AES). Which do your devices use?

Also, do you only need secure trap support or also inform?

[sjwang90]

Hey @nasras03! Do you think you could answer the questions above? We would like to get a clearer understanding of specifics for your use case.

[nasras03]

HI @reimda @sjwang90 , Thanks

• we are using USM and we use a mix of MD5 and SHA for auth type.
• we use a mix of privacy protocols DES and AES.
• When we send traps they are secure they have to match the SNMP config SnmpPrivPassword and SnmpAuthPassword
  I hope this helps
  example:
  snmptrap -v3 -l authPriv -e xxxxx -u user_three -a SHA -A "Auth3nticati0n PASS" -x AES -X "3nPASSPHRAS3" localhost "" .1.3.6.1.6.3.1.1.5.3.0 0 s "This is a test linkDown trap from v3 authPriv"

[neeles83]

Could SNMP trap inform be part of the next development cycle as well. We have some devices using inform to see if their trap is received. They will now retry and sent the inform message multiple times as no repsonse is given and the message is dropped by Telegraf.

We run telegraf is a docker setup the latest release from docker hub "Telegraf 1.13.2".
Below an example of one message that is being parsed and the inform which isn't:

07:49:44.829779 IP nlrott99-gm5120.testlab.net.43613 > rott99-app2002.snmptrap: C="xxxxxxxx" V2Trap(173) system.sysUpTime.0=9528 S:1.1.4.1.0=E:26866.1.1.11 E:26866.1.2.17="GigaVUE-OS" E:26866.1.2.1=3 E:26866.1.2.2="Fan Status Change" E:26866.1.2.19="1" E:26866.1.2.20=1
07:49:17.911719 IP nlrott99-bs2010.testlab.net.32795 > rott99-app2002.snmptrap: C="xxxxxxx" Inform(57) system.sysUpTime.0=120308 S:1.1.4.1.0=E:15694.2.8.6

I more information is needed please do ask we are happy to provide or help.

[danielnelson]

@neeles83 Can you open a new issue for INFORM support?

[reimda]

@nasras03 Could you try out the v3 support we merged recently and let me know how it goes? It's available in the nightly builds. Thanks!

https://github.com/influxdata/telegraf#nightly-builds