# \[SOLVED\] - Snmp trap source : 127.0.0.1

**URL:** <https://discuss.elastic.co/t/solved-snmp-trap-source-127-0-0-1/50405>\
**Category:** Logstash\
**Created:** [May 19, 2016, 6:45am UTC](https://discuss.elastic.co/t/solved-snmp-trap-source-127-0-0-1/50405 "2016-05-19T06:45:28Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![def](https://avatars.discourse-cdn.com/v4/letter/d/edb3f5/32.png) [@def](https://discuss.elastic.co/u/def)\
**Post date:** [May 19, 2016, 6:45am UTC](https://discuss.elastic.co/t/solved-snmp-trap-source-127-0-0-1/50405/1 "2016-05-19T06:45:28Z")

</div>

Hi all,

I have a question about my configuration :

- snmptrapd.conf  
authCommunity log,execute,net public  
forward default localhost:1062

- logstash  
input {  
snmptrap {  
type =\> snmptrap  
port =\> 1062  
}  
}  
filter{  
ruby {  
code =\> "event.to\_hash.keys.each { |k| event[k.gsub('.','\_')] = event.remove(k) if k.include?'.' }"  
}  
}  
output {  
elasticsearch {  
hosts =\> ['localhost:9200']  
}  
}

And message in Kibana :

\<SNMP::SNMPv2\_Trap:0x61a6cec1 @request\_id=14556, @error\_index=0,  
@error\_status=0, **@source\_ip="127.0.0.1",**...

My problem is that I do not have the IP address of snmp trap agent but the local machine.

For me it's a big problem because I have a lot of element in my network and I want to get the IP address to find out which element generates this trap.

I used tcpdump for understanding what append, when the trap arrived, the source\_ip is correct but after the forward default localhost:1062, the source\_ip become 127.0.0.1...

Thanks for your help.

---

<div class="post-metadata">

**Author:** ![def](https://avatars.discourse-cdn.com/v4/letter/d/edb3f5/32.png) [@def](https://discuss.elastic.co/u/def)\
**Post date:** [May 20, 2016, 8:15am UTC](https://discuss.elastic.co/t/solved-snmp-trap-source-127-0-0-1/50405/2 "2016-05-20T08:15:02Z")

</div>

Solved the problem under Debian :

Don't use snmptrapd.conf but add a ip table rule :  
iptables -t nat -A PREROUTING -p udp --dport 162 -j REDIRECT --to-port 1062

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:56am UTC](https://discuss.elastic.co/t/solved-snmp-trap-source-127-0-0-1/50405/3 "2017-07-06T04:56:51Z")

</div>

Closed on July 6, 2017, 4:56am UTC