topic Re: SNMP Traps Port unable to bind on 162 in Extensions

SNMP Traps Port unable to bind on 162

jenny_baker211 — Fri, 06 Sep 2024 10:19:19 GMT

I have tried setting up SNMP traps on port 162.

I can see the traps are hitting the Activegate instance as these are displaying in TCP dump.

The extension for SNMP traps is repeatedly displaying an error in the logs:

Failed to start listen on port::162 err: listen udp :162: bind: permission denied

Do we need to open up port 162 on the activegate instance?

Can this be done in custom.properties?

Or is there a permissions issue using ports under 1024?

If anyone has a workaround for this please let me know

Re: SNMP Traps Port unable to bind on 162

AntonioSousa — Fri, 06 Sep 2024 10:42:04 GMT

@jenny_baker211,

To listen on port 162, you have to have root permission. There are some ways to escaping that, and I believe the standard way ActiveGate is installed doesn't require additional configuration.

Additionally, there might be another program already listening on port 162. Run the following command to find out if that is the case:

netstat -anp | grep 162

Re: SNMP Traps Port unable to bind on 162

jenny_baker211 — Fri, 06 Sep 2024 11:04:30 GMT

Hi Antonio,

Thank you for the reply - I have tried a netstat and nothing else appears to be using this port.

It looks like we have a specific user running activegate - is it possible to give this user permissions for port 162 - or would I need to pick a new port > 1024 to allow SNMP traps to be handled?

Re: SNMP Traps Port unable to bind on 162

AntonioSousa — Fri, 06 Sep 2024 11:25:44 GMT

@jenny_baker211,

You have several options here:

Running ActiveGate as root. I have cases where this happens, but not the best Security option. Given you are using traps, this might have a reduced exposure, so might be an option:
https://docs.dynatrace.com/docs/shortlink/activegate-custom-installation-linux#user-service
Reroute traps to a higher port. So you don't have to change it in your network devices, redirect through port forwarding. You will have to change 162 in the Dynatrace configuration to another port, 1162 for instance:
sudo iptables -t nat -A PREROUTING -p udp --dport 162 -j REDIRECT --to-port 1162
You can also use setcap to permit a certain program to listen on a specific privileged port. Never tried it out with ActiveGate.