topic 4507 signature with SNMPv3 in Network Security

4507 signature with SNMPv3

mark.barrett — Sun, 10 Mar 2019 12:55:02 GMT

Are there any known issues with the 4507/x signatures working with SNMPv3 traffic? I'm getting a lot of 4507/6 alarms related to a new server which is using SNMPv3 to talk to various devices. I haven't found anything documented, but I'm speculating that since the IDS is seeing encrypted traffic on UDP 161 it's just generating the alarm because it's not able to figure out what the traffic actually is.

4507 signature with SNMPv3

jocamare — Mon, 11 Mar 2013 22:02:07 GMT

http://tools.cisco.com/security/center/viewIpsSignature.x?signatureId=4507&signatureSubId=6&softwareVersion=5.1&releaseVersion=S17

4507 signature with SNMPv3

mark.barrett — Mon, 11 Mar 2013 22:28:17 GMT

Thanks, I had already checked that information but it doesn't seem to answer these questions.

- Would SNMPv3 traffic normally cause an "error in decoding the SNMP protocol" as indicated in the documentation?

- Do the 4507/x signatures understand & work with SNMPv3?

- Are there any known issues with the 4507/x signatures working with SNMPv3 traffic?

4507 signature with SNMPv3

jocamare — Mon, 11 Mar 2013 23:20:36 GMT

On 4507/6, if you look at the sig itself on a sensor, the sig states that it fires on invalid community length.

So that is where I would start.

Would SNMPv3 traffic normally cause an "error in decoding the SNMP protocol" as indicated in the documentation?

No, at least not for signature 4507/6.

Do the 4507/x signatures understand & work with SNMPv3?

Are there any known issues with the 4507/x signatures working with SNMPv3 traffic?

There is a bug [CSCef60726] saying that 4507/3 will incorrectly fire for SNMPv3 ttraffic.

The rest of them should work just fine.