Re: [snips-users] monitor access to cisco router using telnet

["Allan P. Magmanlac" <allan magmanlac at nrns.ca>]

Thanks. I'll try that. Just to clarify...
I can specify different POLLINTERVAL for each device right?

POLLINTERVAL    120
TIMEOUT 30

HOST    test-router 172.16.2.2        telnet  23      Critical
Time	5 10 15	User Access

POLLINTERVAL    500
more devices...


Note that for testing purposes, I  also included  the config below, then 
I run tcpdump
on host 172.16.2.3 to see how often it polls. But I'm not seeing 
anything. It seems to me that
there may be something wrong. It's been more than 20 minutes now and 
I've not seen
snips logging a new state. (i.e error)
# tcpdump -p -n -s 1200 -X host 172.16.2.3 and port 23

POLLINTERVAL    120
HOST    test-openbsd    172.16.2.3           telnet  23      Critical
QUIT    quit





Ean Kingston wrote:

> On June 15, 2005 02:59 pm, you wrote:
>  
>
> > Hello,
> >   I'm using snips-1.1 and would like to monitor ( using portmon) a
> > cisco router and notify me if it stops accepting telnet connection.
> >
> > This is the normal interaction with the router.
> > myopenbsd> telnet test-router
> > Trying 172.16.2.2...
> > Connected to test-router.
> > Escape character is '^]'.
> >
> >
> > User Access Verification
> >
> > Username: testaccount
> > Password:
> >
> > test-router> quit
> > Connection closed by foreign host.
> >
> >
> >
> >
> > my portmon-confg file related to this is
> >
> > POLLINTERVAL    120
> > TIMEOUT 30
> >
> > HOST    test-router 172.16.2.2        telnet  23      Critical
> > info    User Access
> >    
> Make the above line:
>
> Time	5 10 15	User Access
>
> This will cause a timeout if the string "User Access" is not displayed within 
> 15 seconds of the start of the polling interval. 3 timeounts and it will be 
> critical.
>
>  
>
> > QUIT    quit
> >
> > I tested by blocking telnet and by doing this I would expect that snips
> > would complain and it does. However it never gets critical. It only gets
> > to the warning state.
> >
> > Any idea.
> >
> > Thanks
> > Allan
> >    
>
>  

--

--
Allan P. Magmanlac
allan magmanlac at nrns.ca
NRNS Incorporated
DREnet Network Coordination Centre (NCC)
Tel: (613) 599-7860 ext 107