Version

Argent Advanced Technology – All Versions

Argent Extended Technology – All Versions

Date

10 Apr 2012

Summary

This article covers checking the status of TCP and UDP ports via SNMP in a format similar to how netstat formats the data.

You may be interested seeing the netstat output of remote machines to track down issues on the network.

Running netstat via a remote command or shell, parsing the data and then evaluating it is a resource-intensive method of gathering this data.

SNMP actually provides this information and is a much more lightweight approach.

Here’s how to do it with Argent for SNMP.

Technical Background

Most administrators are familiar with the netstat command.

Example: A “netstat /n /a” command shows open and listening ports without doing a DNS lookup on the IP addresses.

Click For Full Size

It is possible to monitor these ports via SNMP.

Argent for SNMP’s OID Browser:

Observe the output of the this SNMP branch that shows TCP connections.

Notice the ports that are open.

Start with the first line of the output below.

This corresponds to port 135 listening on 0.0.0.0 in the above screenshot.

Note:

Click For Full Size

Setup the rule to get the OID value.

In Argent AT, to check a single OID in this branch, it would look something like the below image.

In this example, we are checking to ensure that port 3100 is listening on all interfaces.

Click For Full Size

Notice how it corresponds to the Netstat output:

To monitor a group of OIDs, you would enumerate the OIDs below the tcpConnState branch that match a certain pattern (seen the pattern in the second red box).

Notice how we use the ? and * characters to match a single character (?) or groups of characters (*) and place a dot after the two ?’s to specify we want five digit numbers that start with 565.

Click For Full Size

Here is the trace log output from the above rule:

.1.3.6.1.2.1.6.13.1.1.127.0.0.1.56534.127.0.0.1.56533 = 5.00

The $INDEX variable corresponds to the portion of the OID after the root OID branch you are walking within.

An example is the first OID on the list in the trace log.

The root is .1.3.6.1.2.1.6.13.1.1 and the $INDEX is 127.0.0.1.56531.127.0.0.1.56532.

You use root.$INDEX to join them together.

The $INDEX variable is updated to contain a different index as each enumerated OID is evaluated.

Reference:

The SNMP OID branches you will be interested in include:

For TCP:

1 – ISO assigned OIDs


For UDP:

Resolution

N/A