how can we put a PCAP and make sure snmp queries been sent out from the system

[Abidyaseen]

HI,

is there any way  how can we put a PCAP and make sure snmp queries been sent out from the system in case of Snmp network devices as we tried to configure one firewall but we are getting the error as Failed to assign monitoring configuration to ActiveGate. Reason: DEVICE_CONNECTION_ERROR:Status DEVICE_CONNECTION_ERROR (38) returned from 1 agents(😞 GetBulk timout args: 1.3.6.1.2.1.1.5.0 : request timeout (after 3 retries) [status code=38]);

[p_devulapalli]

@Abidyaseen - Is it the  F5 BIG-IP extension that you are trying to use here?

Is the device that you are trying to manage reachable from the ActiveGate where the snmp extension is installed? Check if the device is actually reachable via ICMP and SNMP from the ActiveGate and verify the snmp config that you are using to connect to this device. 

Are you looking to use pcap to capture snmp traffic ? try WireShark or TCPDump.

https://support.docusign.com/s/articles/How-to-do-a-Packet-Capture-PCAP?language=en_US

[Abidyaseen]

thanks   p_devulapalli 

the device we are trying to configure is fortigate firewalls but we are using SNMP for that we we were not able to establish the connectivity as our configurations and ports are all open and fine now is there anyway to check  how we can put a PCAP and make sure snmp queries been sent 

[AntonioSousa · Accepted solution]

@Abidyaseen,

SNMP queries are sent from ActiveGates. You'll have to find out which group you have them configured in.

If they are Linux, please make sure you've got tcpdump installed. Then execute to see if packets are flowing:

• tcpdump -n -i any -s 0 -A udp port 161

If this is being requested by Support, or someone asked for the PCAP, then:

• tcpdump -n -i any -s 0 -w pcapfile.pcap udp port 161

If it's Windows, you have probably to install Wireshark, and follow the procedure to listen on the traffic and filter out UDP packets for port 161