SNMP indexed query : IPs got in hexa - How to correct ?

[GLR]

I am completing the creation of a new SNMP indexed query to retrieve stats related to IPSec VPN tunnels (traffic, number of active SAs) from StoneGate firewalls and I have a problem with the endpoints IP addresses : I get them as four hexadecimal bytes in Cacti as well as in snmpwalk's output :

# snmpwalk -v2c -c com 10.1.4.9 .1.3.6.1.4.1.1369.5.2.1.13.1.3
iso.3.6.1.4.1.1369.5.2.1.13.1.3.1 = Hex-STRING: D5 80 A1 E6
iso.3.6.1.4.1.1369.5.2.1.13.1.3.2 = Hex-STRING: D9 06 91 F7
iso.3.6.1.4.1.1369.5.2.1.13.1.3.3 = Hex-STRING: C2 4E 20 06
iso.3.6.1.4.1.1369.5.2.1.13.1.3.4 = Hex-STRING: C1 FC DE 58
iso.3.6.1.4.1.1369.5.2.1.13.1.3.5 = Hex-STRING: A8 57 16 28
iso.3.6.1.4.1.1369.5.2.1.13.1.3.6 = Hex-STRING: D4 3A 0E 3C
iso.3.6.1.4.1.1369.5.2.1.13.1.3.7 = Hex-STRING: 5C 34 67 CA
iso.3.6.1.4.1.1369.5.2.1.13.1.3.8 = Hex-STRING: D5 90 01 2A
iso.3.6.1.4.1.1369.5.2.1.13.1.3.9 = Hex-STRING: 51 16 A9 EB
iso.3.6.1.4.1.1369.5.2.1.13.1.3.10 = Hex-STRING: 52 F1 AC 57
iso.3.6.1.4.1.1369.5.2.1.13.1.3.11 = Hex-STRING: 9F 32 5B F6
iso.3.6.1.4.1.1369.5.2.1.13.1.3.12 = Hex-STRING: 53 89 42 91
iso.3.6.1.4.1.1369.5.2.1.13.1.3.13 = Hex-STRING: C2 27 83 B0
iso.3.6.1.4.1.1369.5.2.1.13.1.3.14 = Hex-STRING: 51 F6 34 FE

The content of fwVpnEp4Table looks as follows in a MIB browser :



Does anyone have an idea regarding how to correct this behaviour to get them as real IP addresses ?

[noname]

That's the similar case to CDP(Cisco Discovery Protocol) neighbor address.

% snmpwalk -v2c -c public 192.168.1.100 .1.3.6.1.4.1.9.9.23.1.2.1.1.4
SNMPv2-SMI::enterprises.9.9.23.1.2.1.1.4.10101.4 = Hex-STRING: C0 A8 01 05

I think you should create your own script as 'Script Data Query' instead of 'SNMP Data Query' to convert these hex-string into dotted string (a.b.c.d).
For example:

% php -r 'print long2ip("0xC0A80105");'
192.168.1.5

But if you want to manage to translate results of SNMP anyway, try this...

At line 876 of 'graphs_new.php', modify from

Code: Select all

if (isset($row[$field_name])) {
        print .... "<span style='background-color: #F8D93D;'>\\1</span>", $row[$field_name]) : $row[$field_name]) . "</span></td>";
}else{

to

Code: Select all

if (isset($row[$field_name])) {
        $tmp = $row[$field_name];
        if (preg_match('/^[[:xdigit:]]+[: ][[:xdigit:]]+[: ][[:xdigit:]]+[: ][[:xdigit:]]+$/', $tmp) != 0) {
                $tmp = long2ip("0x" . preg_replace('/[: ]/', '', $tmp));
        }
        print .... "<span style='background-color: #F8D93D;'>\\1</span>", $tmp) : $tmp) . "</span></td>";
}else{

(NOTE) [[:xdigit:]] is equal to [0-9A-Fa-f]


Before:

After:


I tried this on Cacti 0.8.7g, but not fully tested. At your own risk.

[GLR]

Thanks a lot (once again !) for your valuable input.
I've applied the change you suggested, however, it looks like it doesn't work yet...
I also notice that in cdpCacheAddress the four bytes are separated by spaces whereas in my case, they are separated by ":", so may be the regex has to be adapted ?
But I haven't succeeded to make it work.

[noname]

I also notice that in cdpCacheAddress the four bytes are separated by spaces whereas in my case, they are separated by ":", so may be the regex has to be adapted ?

Yes I know that, so I use the regular expression "[: ]" (colon or space) to accept both separators.

Hmm, as seeing your file, you seemed to forget modifying line 880 of it. Please replace $row[$field_name] with $tmp.

[GLR]

Sorry and thanks so much, it works fine, almost perfectly !



Unfortunately some hexa codes generates strange characters, do you know why ?

Don't you think it would be fine to submit a patch to the Cacti dev team ?

Btw, I planned also to use the peer IPs in the graph titles, but I may have to modify another cacti php file ?

Code: Select all

|host_description| - Traffic - Tunnel |query_fwVpnEp4Index| (|query_fwVpnEp4Local| - |query_fwVpnEp4Remote|)

FW-FE-3 - Traffic - Tunnel 1 (C0:6D:8C:53 - D5:80:A1:E6)

[noname]

>> Unfortunately some hexa codes generates strange characters, do you know why ?

Sorry I don't know about it.

>> Don't you think it would be fine to submit a patch to the Cacti dev team ?

Hmm.
Such a form of string (xx:xx:xx:xx) means IP address in most cases, but not always.
So I think it's better to implement as "option" which we can choose to use or not, e.g. directives in query XML.
Please post it to developers as feature request, if necessary.

>> Btw, I planned also to use the peer IPs in the graph titles, but I may have to modify another cacti php file ?

Perhaps it's possible by fiddling around with several codes, but patchworking in places is not elegant...
It should be converted when performed SNMP query (as mentioned at the above).


I will consider about that a little more, but now I'm away from my workstation because it's in consecutive holidays in Japan. :)

[GLR]

OK, here is the report :
http://bugs.cacti.net/view.php?id=2143

[wavysong]

OK, here is the report :
http://bugs.cacti.net/view.php?id=2143

Hello GLR
i recently create similar template to get ipsec vpn traffic from cisco router.
if possible,could you share your template for reference.
thanks.

[GLR]

Hello,

I need again help : I don't know why but my indexed query seems now broken. I am not able to create any new graph while indexation still works fine.

Here is the resulting broken data source :



Verbose indexed data query :

Code: Select all

+ Running data query [47].
+ Found type = '3' [SNMP Query].
+ Found data query XML file at '/usr/share/cacti/resource/snmp_queries/StoneSoft_fwVpnEp4Table.xml'
+ XML file parsed ok.
+ <oid_num_indexes> missing in XML file, 'Index Count Changed' emulated by counting oid_index entries
+ Executing SNMP walk for list of indexes @ '.1.3.6.1.4.1.1369.5.2.1.13.1.3' Index Count: 65
+ Index found at OID: '1.3.6.1.4.1.1369.5.2.1.13.1.3.1' value: 'D4:72:D8:3E'
+ Index found at OID: '1.3.6.1.4.1.1369.5.2.1.13.1.3.2' value: '53:91:32:19'
+ Index found at OID: '1.3.6.1.4.1.1369.5.2.1.13.1.3.3' value: 'C3:4E:46:4C'
+ Index found at OID: '1.3.6.1.4.1.1369.5.2.1.13.1.3.4' value: 'D5:80:A1:E6'
+ Index found at OID: '1.3.6.1.4.1.1369.5.2.1.13.1.3.5' value: ''
+ Index found at OID: '1.3.6.1.4.1.1369.5.2.1.13.1.3.6' value: 'C4:1F:DA:CE'
+ Index found at OID: '1.3.6.1.4.1.1369.5.2.1.13.1.3.7' value: '3F:A7:66:A5'
+ Index found at OID: '1.3.6.1.4.1.1369.5.2.1.13.1.3.8' value: 'D9:06:91:F7'
+ Index found at OID: '1.3.6.1.4.1.1369.5.2.1.13.1.3.9' value: ''
...

Code: Select all

<interface>
    <name>StoneSoft fwVpnEp4Table</name>
    <description>StoneGate firewall IPv4 VPN table stats</description>
    <oid_index>.1.3.6.1.4.1.1369.5.2.1.13.1.2</oid_index>
    <oid_index_parse>OID/REGEXP:.*\.([0-9]*)$</oid_index_parse>
    <index_order>fwVpnEp4Remote</index_order>
    <index_order_type>numeric</index_order_type>
    <fields>
        <fwVpnEp4Index>
            <name>Index</name>
            <source>index</source>
            <direction>input</direction>
        </fwVpnEp4Index>
        <fwVpnEp4Local>
            <name>Local IP</name>
            <method>walk</method>
            <source>value</source>
            <direction>input</direction>
            <oid>.1.3.6.1.4.1.1369.5.2.1.13.1.2</oid>
        </fwVpnEp4Local>
        <fwVpnEp4Remote>
            <name>Remote IP</name>
            <method>walk</method>
            <source>value</source>
            <direction>input</direction>
            <oid>.1.3.6.1.4.1.1369.5.2.1.13.1.3</oid>
        </fwVpnEp4Remote>
        <fwVpnEp4RemoteType>
            <name>Type</name>
            <method>walk</method>
            <source>value</source>
            <direction>input</direction>
            <oid>.1.3.6.1.4.1.1369.5.2.1.13.1.4</oid>
        </fwVpnEp4RemoteType>
        <fwVpnEp4ReceivedBytes>
            <name>Received bytes</name>
            <method>walk</method>
            <source>value</source>
            <direction>output</direction>
            <oid>.1.3.6.1.4.1.1369.5.2.1.13.1.5</oid>
        </fwVpnEp4ReceivedBytes>
        <fwVpnEp4SentBytes>
            <name>Sent bytes</name>
            <method>walk</method>
            <source>value</source>
            <direction>output</direction>
            <oid>.1.3.6.1.4.1.1369.5.2.1.13.1.6</oid>
        </fwVpnEp4SentBytes>
        <fwVpnEp4IpsecSa>
            <name>Established SAs</name>
            <method>walk</method>
            <source>value</source>
            <direction>output</direction>
            <oid>.1.3.6.1.4.1.1369.5.2.1.13.1.7</oid>
        </fwVpnEp4IpsecSa>
    </fields>
</interface>