Re: Upgrading to 1.1.0.
Hello there, thank you for pointing out that the "from" field was empty. This helped me track down the problem to the following spot: while ($n = select ($niovec = $iovec, undef, undef, $sleep)) { my $tm1 = [gettimeofday]; if ($! != &EINTR) { # # mon trap # if (vec ($niovec, fileno (TRAPSERVER), 1)) { my ($from, $trapbuf); if (!defined ($from = recv (TRAPSERVER, $trapbuf, 65536, 0))) { syslog ('err', "error trying to recv a trap: $!"); } else { open DEBUG, '>>/tmp/dbg'; print DEBUG $trapbuf . "FROM: <$from>\n"; close DEBUG; handle_trap ($trapbuf, $from); } next; It turns out that "recv" returns a nonsensical value. The debug output is as follows (excerpt): pro='0.3807' usr='mon' pas='pwprotected' spc='1' seq='0' typ='trap' grp='ehring' svc='DNS' sta='255' spc='1' tsp='1110466508' sum='ehring\20dns\20okay' dtl='ehring\20dns\20okay' FROM: <[EMAIL PROTECTED]@[EMAIL PROTECTED]@[EMAIL PROTECTED]@[EMAIL PROTECTED]@^@> The machines that are submitting traps are on a VPN using CIPE with the CIPEX patch over UDP. Not an unusual configuration, I would think. Can you help me out here? Best regards, Marko Riedel -- ++ | Marko Riedel, EDV Neue Arbeit gGmbH, [EMAIL PROTECTED] | | http://www.geocities.com/markoriedelde/index.html | ++ ___ mon mailing list mon@linux.kernel.org http://linux.kernel.org/mailman/listinfo/mon
Re: Upgrading to 1.1.0.
--On Thursday, March 10, 2005 3:58 PM +0100 Marko Riedel <[EMAIL PROTECTED]> wrote: } else { open DEBUG, '>>/tmp/dbg'; print DEBUG $trapbuf . "FROM: <$from>\n"; close DEBUG; handle_trap ($trapbuf, $from); } next; It turns out that "recv" returns a nonsensical value. The debug output is as follows (excerpt): $from isn't a simple string, you need to do something like: my ($port, $addr) = sockaddr_in ($from); my $fromip = inet_ntoa ($addr); -David David Nolan<*>[EMAIL PROTECTED] curses: May you be forced to grep the termcap of an unclean yacc while a herd of rogue emacs fsck your troff and vgrind your pathalias! ___ mon mailing list mon@linux.kernel.org http://linux.kernel.org/mailman/listinfo/mon
Re: Upgrading to 1.1.0.
Hello there, I moved the debug statement: if ($intended) { $sref->{"_intended"} = $intended; } open DEBUG, '>>/tmp/dbg'; print DEBUG "FROMIP: <$fromip>\n"; close DEBUG; syslog ('info', "trap $trap{typ} $trap{spc} from " . "$fromip grp=$trap{grp} svc=$trap{svc}, sta=$trap{sta}\n"); and now I get FROMIP: <> FROMIP: <> FROMIP: <> FROMIP: <> FROMIP: <> FROMIP: <> Best regards, Marko -- ++ | Marko Riedel, EDV Neue Arbeit gGmbH, [EMAIL PROTECTED] | | http://www.geocities.com/markoriedelde/index.html | ++ ___ mon mailing list mon@linux.kernel.org http://linux.kernel.org/mailman/listinfo/mon
Re: Upgrading to 1.1.0.
--On Thursday, March 10, 2005 5:22 PM +0100 Marko Riedel <[EMAIL PROTECTED]> wrote: Hello there, I moved the debug statement: if ($intended) { $sref->{"_intended"} = $intended; } open DEBUG, '>>/tmp/dbg'; print DEBUG "FROMIP: <$fromip>\n"; close DEBUG; syslog ('info', "trap $trap{typ} $trap{spc} from " . "$fromip grp=$trap{grp} svc=$trap{svc}, sta=$trap{sta}\n"); and now I get FROMIP: <> FROMIP: <> FROMIP: <> FROMIP: <> FROMIP: <> FROMIP: <> Interesting... I wonder what exactly recv is returning and why it's failing in this way. Lets add a bit more debugging. In handle_trap change my ($port, $addr) = sockaddr_in ($from); my $fromip = inet_ntoa ($addr); To: my ($port, $addr) = sockaddr_in ($from); my $fromip = inet_ntoa ($addr); open DEBUG, '>>/tmp/dbg'; print DEBUG "From paddr family: ".sockaddr_family($from)."\n"; print DEBUG "From paddr: ".Data::Dumper->Dump([\$from],['from'])."\n"; print DEBUG "From port: $port\nFrom iaddr: ".Data::Dumper->Dump([\$addr], 'addr'])."\n"; print DEBUG "From IP: $fromip\n"; Run that and grab the output. And then change sockaddr_in to unpack_sockaddr_in and grab that output. Then post both... -David David Nolan<*>[EMAIL PROTECTED] curses: May you be forced to grep the termcap of an unclean yacc while a herd of rogue emacs fsck your troff and vgrind your pathalias! ___ mon mailing list mon@linux.kernel.org http://linux.kernel.org/mailman/listinfo/mon
Re: Upgrading to 1.1.0.
On Thu, 10 Mar 2005, David Nolan wrote: $from isn't a simple string, you need to do something like: yes, so i plucked code from mon to make this separate test program which receives traps and decodes what recv returns, and it does just as i expect: #!/usr/bin/perl use Socket; $bindaddr = INADDR_ANY; $udpproto = getprotobyname ('udp'); socket (TRAPSERVER, PF_INET, SOCK_DGRAM, $udpproto); bind (TRAPSERVER, sockaddr_in (2583, $bindaddr)); $a = recv (TRAPSERVER, $buf, 65536, 0); ($port, $addr) = sockaddr_in ($a); $addr = inet_ntoa ($addr); print "port=$port\n"; print "addr=[$addr]\n"; send a trap to that, and you'll see it report something like this: $ ./tst port=33002 addr=[127.0.0.1] dunno, i'll have to look at it harder. ___ mon mailing list mon@linux.kernel.org http://linux.kernel.org/mailman/listinfo/mon