# MIB OID Translation **URL:** \ **Category:** Logstash\ **Created:** [September 21, 2015, 3:34pm UTC](https://discuss.elastic.co/t/mib-oid-translation/29710 "2015-09-21T15:34:11Z")\ **Posts on this page:** 14\ **Page:** 2
**Author:** ![6Glory9](https://avatars.discourse-cdn.com/v4/letter/6/41988e/32.png) [@6Glory9](https://discuss.elastic.co/u/6Glory9)\ **Post date:** [June 23, 2017, 2:21am UTC](https://discuss.elastic.co/t/mib-oid-translation/29710/21 "2017-06-23T02:21:29Z")
@PhaedrusTheGreek In your way,I had some problem too.... ---
**Author:** ![Amteshwar\_Singh\_Sand](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amteshwar_singh_sand/32/21155_2.png) [@Amteshwar\_Singh\_Sand](https://discuss.elastic.co/u/Amteshwar_Singh_Sand)\ **Post date:** [August 16, 2017, 3:11am UTC](https://discuss.elastic.co/t/mib-oid-translation/29710/22 "2017-08-16T03:11:36Z")
ruby import.rb mibs/ mibs//PHION-MIB.mib smidump: cannot locate module `mibs//PHION-MIB.mib' \*\*\* Import failed for: mibs//PHION-MIB.mib \*\*\* Hi I was trying to convert this mid to yalm but get this error ---
**Author:** ![Benoit\_Martin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/benoit_martin/32/21235_2.png) [@Benoit\_Martin](https://discuss.elastic.co/u/Benoit_Martin)\ **Post date:** [August 28, 2017, 3:10pm UTC](https://discuss.elastic.co/t/mib-oid-translation/29710/23 "2017-08-28T15:10:17Z")
Hi, I try to convert couple CISCO LWAPP mibs and I got error. I use that command : `/usr/share/logstash/bin/ruby import.rb MIBS/` ```auto smidump: module `MIBS//CISCO-LWAPP-WLAN-SECURITY-MIB.my' contains errors, expect flawed output ***No nodes defined in: MIBS//CISCO-LWAPP-WLAN-SECURITY-MIB.my*** ``` Thank you! ---
**Author:** ![krishna\_chaitanya](https://avatars.discourse-cdn.com/v4/letter/k/b5a626/32.png) [@krishna\_chaitanya](https://discuss.elastic.co/u/krishna_chaitanya)\ **Post date:** [October 19, 2017, 8:02pm UTC](https://discuss.elastic.co/t/mib-oid-translation/29710/24 "2017-10-19T20:02:29Z")
Hi, I am new to SNMP Trap universe, but, I am trying to send SNMP Traps to my logstash listener. I have the same input configuration as mentioned in the post, and running logstash as root with debug logs. ``` input { snmptrap { type => "snmptrap" community => "public" host => "0.0.0.0" port => 162 yamlmibdir => "..../logstash-5.4.0/vendor/bundle/jruby/1.9/gems/snmp-1.2.0/data/ruby/snmp/mibs" } } ``` I tried to test my configuration using `tcpreplay` as mentioned in this section. I downloaded sample pcap file from [here](https://wiki.wireshark.org/SampleCaptures?action=AttachFile&do=get&target=c06-snmpv1-trap-app-r1.pcap.gz) . ``` $ tcpreplay --intf1=eth0 c06-snmpv1-trap-app-r1.pcap ^C User interrupt... sendpacket_abort Actual: 253 packets (157684 bytes) sent in 10.45 seconds Rated: 15084.3 Bps, 0.120 Mbps, 24.20 pps Flows: 1 flows, 0.09 fps, 253 flow packets, 0 non-flow Statistics for network device: eth0 Successful packets: 253 Failed packets: 0 Truncated packets: 0 Retried packets (ENOBUFS): 0 Retried packets (EAGAIN): 0 ``` But, logstash is not able to capture any traps. I see no log messages inside logstash logs.. Any help appreciated !! ---
**Author:** ![PhaedrusTheGreek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/phaedrusthegreek/32/4884_2.png) [@PhaedrusTheGreek](https://discuss.elastic.co/u/PhaedrusTheGreek)\ **Post date:** [October 19, 2017, 11:59pm UTC](https://discuss.elastic.co/t/mib-oid-translation/29710/25 "2017-10-19T23:59:41Z")
In my experience, tcp-replay is only useful if you rewrite the ethernet and ip headers. Have a look at what the destination IP address and mac address is of the snmp trap packets and compare that with the interface you expect to capture on. 1. See what you've got: ```auto sudo tcpdump -qns 0 -r traps.pcap ``` 1. Rewrite the source and destination mac addresses , and the destination MAC (in this case, it's my macbooks en3 interface) ```auto tcprewrite --infile=traps.pcap --outfile=rewritten.pcap -D 0.0.0.0/0:192.168.0.26 -S 0.0.0.0/0:192.168.0.2 --enet-dmac=ac:87:a3:35:cf:84 ``` 1. Fix checksums ```auto tcprewrite --infile=rewritten.pcap --outfile=final.pcap --fixcsum ``` 1. Run the sequence: ```auto tcpreplay --intf1=eth0 final.pcap ``` or select some packets if you like ```auto editcap -r final.pcap first-ten.pcap 1-10 ``` Seems like a lot of unnecessary steps for such a simple task and there's probably some better way to do it, but this one works for me. BTW in my setup I am running the replay from a secondary host on the same network (192.168.0.2) with a destination of my macbook (192.168.0.26). There's probably a way to do it using loopback, but I couldn't find it. ---
**Author:** ![krishna\_chaitanya](https://avatars.discourse-cdn.com/v4/letter/k/b5a626/32.png) [@krishna\_chaitanya](https://discuss.elastic.co/u/krishna_chaitanya)\ **Post date:** [October 24, 2017, 2:22pm UTC](https://discuss.elastic.co/t/mib-oid-translation/29710/26 "2017-10-24T14:22:36Z")
Sorry for the late reply. I tried above steps, but still not able to get any output or could see anything happening in logstash logs DEBUG mode. I hope logstash need to be run on destination server in this case, but I also tried running it on source as well when tcpreplay is ran on source in both cases. Still no luck. I also ran logstash as root. I am beginning to suspect it might be port 162, which is not open on both source and destination. tcpdump doesn't show which port it is sending from/to. But, is there any way to change the port of the traffic too, just like you have changed source/destination? ---
**Author:** ![PhaedrusTheGreek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/phaedrusthegreek/32/4884_2.png) [@PhaedrusTheGreek](https://discuss.elastic.co/u/PhaedrusTheGreek)\ **Post date:** [October 24, 2017, 2:39pm UTC](https://discuss.elastic.co/t/mib-oid-translation/29710/27 "2017-10-24T14:39:03Z")
to test if the destination host is receiving the replay, run tcpdump on the destination host during the test, listening for UDP traffic : 162 ```auto sudo tcpdump -ni eth0 'udp dst port 162' ``` If you don't see anything, and you suspect the replay is broken, try netcat from the source host while the tcpdump is still running: ```auto echo "hi" | nc -cu dst.host.com 514 ``` If you still don't see anything, you have a network / firewall problem. ---
**Author:** ![krishna\_chaitanya](https://avatars.discourse-cdn.com/v4/letter/k/b5a626/32.png) [@krishna\_chaitanya](https://discuss.elastic.co/u/krishna_chaitanya)\ **Post date:** [October 24, 2017, 4:55pm UTC](https://discuss.elastic.co/t/mib-oid-translation/29710/28 "2017-10-24T16:55:51Z")
Thanks for the reply. I see that `echo "hi" | nc -u dst.host.com 162` is working, as I can see messages printed onto stdout with tcpdump on destination running. Also, logstash gave this parse error: ``` Error handling trap: 104 ~/logstash-5.4.0/vendor/bundle/jruby/1.9/gems/snmp-1.2.0/lib/snmp/ber.rb:190:in `decode_sequence' ~/logstash-5.4.0/vendor/bundle/jruby/1.9/gems/snmp-1.2.0/lib/snmp/pdu.rb:49:in `decode' ~/logstash-5.4.0/vendor/bundle/jruby/1.9/gems/snmp-1.2.0/lib/snmp/manager.rb:707:in `process_traps' org/jruby/RubyKernel.java:1479:in `loop' ~/logstash-5.4.0/vendor/bundle/jruby/1.9/gems/snmp-1.2.0/lib/snmp/manager.rb:704:in `process_traps' ~/logstash-5.4.0/vendor/bundle/jruby/1.9/gems/snmp-1.2.0/lib/snmp/manager.rb:631:in `initialize' Received data: "hi\n" ``` Also, when I ran tcpreplay on source and tcpdump on destination server, I see nothing on stdout. But, tcpdump on source server has lots of stuff being printed onto stdout. Sample: ``` 12:44:56.537796 IP .netarx > .snmptrap: Trap(48) .1.3.6.1.4.1.4.1.2.21 [inetaddr len!=4]7.32.87.89.64.55.146.121.55 coldStart 1240 .1.3.6.1.2.1.2.1.0= 12:44:56.577815 IP .netarx > .snmptrap: Trap(49) .1.3.6.1.4.1.4.1.2.21 [inetaddr len!=4]9.34.51.114.3.104.84.119.88.7 coldStart 1241 .1.3.6.1.2.1.2.1.0= 12:44:56.617829 IP .netarx > .snmptrap: Trap(49) .1.3.6.1.4.1.4.1.2.21 [inetaddr len!=4]9.34.51.114.3.104.84.119.88.8 coldStart 1242 .1.3.6.1.2.1.2.1.0= ``` So, it is evident that source is trying to send something but destination server not able to receive even though 162 UDP port is open. ---
**Author:** ![PhaedrusTheGreek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/phaedrusthegreek/32/4884_2.png) [@PhaedrusTheGreek](https://discuss.elastic.co/u/PhaedrusTheGreek)\ **Post date:** [October 24, 2017, 7:39pm UTC](https://discuss.elastic.co/t/mib-oid-translation/29710/29 "2017-10-24T19:39:30Z")
Seems that the destination IP or MAC address must be wrong. Try comparing: ```auto tcpdump -qne -r final.pcap ``` with the destination interface IP and MAC address: ```auto ifconfig ``` ---
**Author:** ![krishna\_chaitanya](https://avatars.discourse-cdn.com/v4/letter/k/b5a626/32.png) [@krishna\_chaitanya](https://discuss.elastic.co/u/krishna_chaitanya)\ **Post date:** [October 24, 2017, 8:47pm UTC](https://discuss.elastic.co/t/mib-oid-translation/29710/30 "2017-10-24T20:47:43Z")
Thanks so much for all the help. You are right, it was an issue with MAC address. I had to give both `--enet-dmac` and `--enet-smac` to make it work. ---
**Author:** ![Sai\_Ranga\_Rao](https://avatars.discourse-cdn.com/v4/letter/s/ba9def/32.png) [@Sai\_Ranga\_Rao](https://discuss.elastic.co/u/Sai_Ranga_Rao)\ **Post date:** [January 4, 2018, 11:03am UTC](https://discuss.elastic.co/t/mib-oid-translation/29710/31 "2018-01-04T11:03:54Z")
hi , in your output , FORTINET-CORE-MIB::fortinet.101.9.3.1.0" =\> "40" is not showing the entire name of the oid .Could you please suggest me how to get the entire name. ---
**Author:** ![PhaedrusTheGreek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/phaedrusthegreek/32/4884_2.png) [@PhaedrusTheGreek](https://discuss.elastic.co/u/PhaedrusTheGreek)\ **Post date:** [January 4, 2018, 3:16pm UTC](https://discuss.elastic.co/t/mib-oid-translation/29710/32 "2018-01-04T15:16:57Z")
That probably indicates that the MIB has no translation for that OID. The solution would be to load the appropriate MIB . Is it this OID in particular that you are interested in, or some other one? ---
**Author:** ![Vian\_Handika](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vian_handika/32/61176_2.png) [@Vian\_Handika](https://discuss.elastic.co/u/Vian_Handika)\ **Post date:** [January 22, 2020, 3:13am UTC](https://discuss.elastic.co/t/mib-oid-translation/29710/33 "2020-01-22T03:13:37Z")
Hello i am newbie here, i am still confuse how to import vendor MIB, for example i had ruckus mib, and all is txt type file....what should i do? am i just need to configure longstash config especially at snmptrap (yamlmibdir) only or what? when i try to execute command ruby import.rb mibs/ there is error smidump: module `mibs//RUCKUS-TEST.mib' contains errors, expect flawed output \*\*\* No nodes defined in: mibs//RUCKUS-TEST.mib \*\*\* please give me an answer, thanks ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 4, 2022, 4:06am UTC](https://discuss.elastic.co/t/mib-oid-translation/29710/34 "2022-11-04T04:06:05Z")
Closed on November 4, 2022, 4:06am UTC [Previous page](https://discuss.elastic.co/t/mib-oid-translation/29710.md?page=1)