Re: [Ganglia-developers] Host spoofing for SNMP

[Adeyemi A. <ye...@sl...>]

Hi Martin.

I will put in some testing time before submitting code along with =20
documentation. This is of great importance to me because I need to =20
monitor Network Appliance (NetApp) boxes.

It is also worth considering security implications. Once the =20
recipient gmond has processed the spoof message, it is =20
indistinguishable from any other gmetric message. The Web frontend =20
has no clue!

------
Yemi


On Dec 15, 2005, at 3:18 AM, Martin Knoblauch wrote:

> Yemi,
>
>  please open a bugzilla entry, assign to me and attach your patch =20
> (diff
> -u format).
>
>  The functionality sounds interesting to consider. I assume you are
> willing to provide the documantation for it :-)
>
>  Another thing I always wanted is a way to fix up the host name in
> "gmond" reporting. I have one installation with machines having =20
> NICs in
> a high-availability setup. They actually change their DNS names when a
> switch occurs, screwing the statistics royally.
>
> Cheers
> Martin
>
> --- "Adesanya, Adeyemi" <ye...@sl...> wrote:
>
>>
>>
>> Hi There.
>>
>> I have been thinking about using Ganglia to monitor a broader range
>> of networked devices for a while. Many of these systems do not run
>> common OS platforms and communicate via the SNMP protocol. Last year
>> I came up with a Ganglia 2.5.x hack that enabled a host to send
>> gmetric updates on behalf of another device (I call it spoofing). I
>> have just added the same functionality on top of Ganglia 3.0.x and it
>> appears to be working OK.
>>
>> I modified lib/protocol.x and created a new message type that adds a
>> spoof IP address and host/device name to the existing gmetric data
>> struct. Here's an example of it in use:
>>
>> 'gmetric --help' now lists a new option:
>>
>>   -S, --spoof=3DSTRING  IP address and name of host/device (colon
>> separated) we
>>                         are spoofing  (default=3D`')
>>
>> you use it like this:
>>
>> 'gmetric -c cfile -n dataRateIn -v 1234231434 -t uint32 -u bytes -S
>> 123.456.789.012:MyN...@my...
>>
>> Add querying your target gmond shows the following:
>>
>> <HOST NAME=3D"MyN...@my..." IP=3D"123.456.789.012"
>> REPORTED=3D"1134604773" TN=3D"9" TMAX=3D"20" DMAX=3D"86400"
>> LOCATION=3D"unspecified" GMOND_STARTED=3D"0">
>> <METRIC NAME=3D"dataRateIn" VAL=3D"1234231434" TYPE=3D"uint32"
>> UNITS=3D"bytes" TN=3D"9" TMAX=3D"60" DMAX=3D"0" SLOPE=3D"both"
>> SOURCE=3D"gmetric"/>
>> </HOST>
>>
>> I'll be using this feature in production for sure and I'd like to get
>> the CVS maintainers to review my code and add it to CVS.
>>
>> ------
>> Yemi
>>
>>
>>
>> -------------------------------------------------------
>> This SF.net email is sponsored by: Splunk Inc. Do you grep through
>> log files
>> for problems?  Stop!  Download the new AJAX search engine that makes
>> searching your log files as easy as surfing the  web.  DOWNLOAD
>> SPLUNK!
>> http://ads.osdn.com/?ad_idv37&alloc_id=16865&op=3Dclick
>> _______________________________________________
>> Ganglia-developers mailing list
>> Gan...@li...
>> https://lists.sourceforge.net/lists/listinfo/ganglia-developers
>>
>>
>
>
> ------------------------------------------------------
> Martin Knoblauch
> email: k n o b i AT knobisoft DOT de
> www:   http://www.knobisoft.de