Telegraf & HP 1910 Switches

[Listerofsmeg]

Hello All,

I’ve been using telegraf and have been successfully using it with various HP switches.

I’ve been collecting data via snmpv3, however I have now started trying to collect data for HP1910 switches.

I’ve set up the switch the same way, and have set up telegraf to match the authpriv & protocols, sec name etc.

However when I run the telegraf --test I get the following:

2017-12-20T13:29:28Z E! Error in plugin [inputs.snmp]: agent 10.107.143.157: performing get on field uptime: Incoming packet is not authentic, discarding

Does anyone know why this might be?

I have tried using SNMPv2 and it works fine, I’ve also tried SNMPv3 with noauthnopriv and that also works. I think I’ve ruled out typing in the password incorrectly by typing extremely slowly!

Thanks

[samaust]

That error comes from the GitHub - gosnmp/gosnmp: An SNMP library written in Go library.

Take a look at the code

func (x *GoSNMP) testAuthentication(packet byte, result *SnmpPacket) error {
if x.Version != Version3 {
return fmt.Errorf(“testAuthentication called with non Version3 connection”)
}

if x.MsgFlags&AuthNoPriv > 0 {
	authentic, err := x.SecurityParameters.isAuthentic(packet, result)
	if err != nil {
		return err
	}
	if !authentic {
		return fmt.Errorf("Incoming packet is not authentic, discarding")
	}
}

return nil

}

// determine whether a message is authentic
func (sp *UsmSecurityParameters) isAuthentic(packetBytes byte, packet *SnmpPacket) (bool, error) {

var packetSecParams *UsmSecurityParameters
var err error

if packetSecParams, err = castUsmSecParams(packet.SecurityParameters); err != nil {
	return false, err
}
// TODO: investigate call chain to determine if this is really the best spot for this

var extkey [64]byte

copy(extkey[:], sp.secretKey)

var k1, k2 [64]byte

for i := 0; i < 64; i++ {
	k1[i] = extkey[i] ^ 0x36
	k2[i] = extkey[i] ^ 0x5c
}

var h, h2 hash.Hash

switch sp.AuthenticationProtocol {
default:
	h = md5.New()
	h2 = md5.New()
case SHA:
	h = sha1.New()
	h2 = sha1.New()
}

h.Write(k1[:])
h.Write(packetBytes)
d1 := h.Sum(nil)
h2.Write(k2[:])
h2.Write(d1)

result := h2.Sum(nil)[:12]
for k, v := range []byte(packetSecParams.AuthenticationParameters) {
	if result[k] != v {
		return false, nil
	}
}
return true, nil

}

If you look at the snmp plugin parameters, it says that auth_protocol is “MD5”, “SHA” or “”, with the value “” as default for SNMPv3. I think isAuthentic function verifies if the packet uses MD5 or SHA.

So, it’s probably a configuration error on the snmp plugin and maybe also on the switches.

[Listerofsmeg]

Thank you for the prompt and detailed reply.

Below is the current telegraf configuration. I’ve reduced it to just auth to try and rule out that first.

#HP 1910 TEST

[[inputs.snmp]]
agents = [ “10.107.143.157” ]
version = 3
auth_protocol = "SHA"
auth_password = "apassword"
sec_level = "AuthNoPriv"
sec_name = "testusr"
name = “1910SwitchesSNMPv3”

On the HP Switch side
SNMPv3 is on
There is a group called “test” with Auth/NoPriv and the default HP view.
There is a user called “testusr” in the “test” group with the authentication mode set to SHA and the password entered.

Telegraf fails on using this, however I just tried an snmpwalk, and that did return information.

[Listerofsmeg]

I eventually found out why. These switches have a limit of 256 Ip addresses for the ARP table.

The machine I was querying with was in the table, The Telegraf machine was not, We have quite a large flat network! Turning off Promiscuous ARPs on these switches fixed the issue.

Thank you for the help