Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

%%01SNMP/5/SNMP_FAIL(l): Login through SNMP failed(ip=189.xx.xx.x times=2). %%01SNMP/5/SNMP_FAIL(l): Login through SNMP failed(ip=189.xx.xx.x times=6). %%01SNMP/5/SNMP_FAIL(l): Login through SNMP failed(ip=189.xx.xx.x times=4).

My administrator site said that, the one of our client computer attacked with too many emails to them every seconds. Could i get more and more advises? and How could i do for that error?

share|improve this question

1 Answer 1

It's not clear if one of your computers is being attacked by a third party (remotely), an administrator is letting you know one of their computers is being attacked by a computer you manage, or whether an administrator is advising you that one of your own computers is under attack.

You also don't indicate whether the device represented by the IP address is the attacker or attackee (the device attempting to login). From the example you give, the SNMP log seems to indicate it's the attackee.

And last, you don't indicate whether the attempted logins are from a device that should be able to login or not.

So, I'll try to cover all the bases:

  • If the attempted logins are undesirable: Minimally, you should block access. This is usually done with an access control list (on a router) or firewall rule. Ideally, you would block at a physical level by disabling port access because it's sending unwanted traffic across your network. Perhaps not a big deal on a LAN. Much more disruptive on a MAN or WAN.

  • If the attempted logins are desirable: You should configure the devices to have the correct SNMP credentials for it to login. The device being accessed also needs to permit the remote SNMP login.

  • If the attempted logins are too numerous: You should search the device for a rogue or misconfigured process/application that is attempting to scan (via SNMP) too frequently within a given period of time. It's possible a correct login will reduce the amount of scans. Misconfigured applications, particular network management apps, often scan repeatedly until they obtain an expected reply.

share|improve this answer
    
Thanks for your very clear reply, John. I would like to add the one issue, my clients were attacked not only to my administrator but also to my country ISP. I got that informations from my adminstrator, he got some complaint email from ISP to clear virus, cookie or malware on my side. Please give me some more suggestions. Thanks in advance. –  zmo Oct 2 '12 at 8:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.