SNMPv3 unknown engine ID and clock timming issue

We recently purchased NuDesign SNMPv3 Master Agent for our Windows Servers www.ndt-inc.com/.../AgentService.html and are having a problem where from time to time a server will stop responding to SNMP queries. After troubleshooting with the vender they said it was a clock issue "NOT-IN-TIME-WINDOW" where the internal clocks for SNMP used to protect against replay attacks is getting out of sync. They said to ensure all devices have unique EngineID's which I have. Then they said it is a problem with our polling device which happens to be SolarWinds. They did mention that it is showing SolarWinds as an Unknown EngineID.

Find more posts tagged with

Accepted answers

All comments

sean.martinez

In order for SNMPv3 conversation to start, we will request for the EngineID. This is the flow of our packets, which is the same for all SNMPv3, This is based on the SNMPv3 RFC:

-In order to get the EngineID, the Solarwinds application will send a packet with:

»Reportable = ON

»Engine ID =<Missing>

»Time=0

»Boots=0

»No OIDs

-SNMP Agent responds with :

»the Engine ID

»and an error OID indicating that we did not send an Engine ID. (this is normal)

-The Software will then send another packet to get the time and boots

»Reportable=ON

»Engine ID = ID

»Time=0 & Boots =0

-SNMP Agent Agent responds with:

»The time value

»The boots value

»And an error OID indicating that the time value we sent was not in the allowed window (this is normal)

The Next packet should be the Get Request and the Get Response.

nsoc

It sounds like all of the process you described is working though because the Agents are working for the most part. Its just that any given day 1-3 servers will stop responding out of 160. It does appear to happen more frequently on a couple specific ones, but there appears to be no pattern.