Re: snmp queries from client machines

[Justin Azoff <JAzoff () UAMAIL ALBANY EDU>]

David Warner wrote:
> I have a couple of student machines that seem to be doing a snmp get on
> the OID for system name(1.3.6.1.2.1.1.5.0) with a community of public.
> They seem to be specifically querying the routers on the resnet subnet.
> This generates an alarm on the routers but hasn't affected anything else
> as far as I know. This seems to occur about every 15 minutes.  Are there
> any know exploits or spyware that might display a pattern like this?
>
> David Warner, CCNA
> Network Specialist

Usually this is caused by (poorly written) software that came with a
printer or similar device.  They probably have no idea it is probing
your routers, but they should be able to figure out which program it is
and turn it off.

--
-- Justin Azoff
-- Network Performance Analyst