Hi,
we are looking for some documentation on how the java code can be written to send the traps using (TSM) tls tcp traffic to netsnmp manager using java snmp4j.
We are using the below code that we came across from one of the post and we are running into SSL errors and while capturing the tcp dump we could see that java application is not initiating the tls handshake. please suggest.
Note: we arent java experts here.
package snmp;
import org.snmp4j.;
import org.snmp4j.mp.MPv3;
import org.snmp4j.mp.MessageProcessingModel;
import org.snmp4j.mp.SnmpConstants;
import org.snmp4j.security.;
import org.snmp4j.smi.*;
import org.snmp4j.transport.AbstractTransportMapping;
import org.snmp4j.transport.DefaultTcpTransportMapping;
import org.snmp4j.transport.TLSTM;
import org.snmp4j.transport.tls.DefaultTlsTmSecurityCallback;
import org.snmp4j.transport.tls.SecurityNameMapping.CertMappingType;
import org.snmp4j.transport.tls.TlsTmSecurityCallback;
import org.snmp4j.util.MultiThreadedMessageDispatcher;
import org.snmp4j.util.ThreadPool;import java.io.File;
import java.io.IOException;public class TlsTrapSender {
public static void main(String args) {
try {System.setProperty("javax.net.ssl.keyStore", "src/main/resources/net-snmp.jks"); System.setProperty("javax.net.ssl.keyStorePassword", "abcd1234"); System.setProperty("javax.net.ssl.trustStore", "src/main/resources/truststore.jks"); System.setProperty("javax.net.ssl.trustStorePassword", "abcd1234"); AbstractTransportMapping transport = new TLSTM(new TlsAddress("127.0.0.1/11163")); ((TLSTM)transport).setLocalCertificateAlias("tutorial-agent"); // set the security callback (only required for command responder, // but also recommended for command generators) - // the callback will be configured later: DefaultTlsTmSecurityCallback securityCallback = new DefaultTlsTmSecurityCallback(); ((TLSTM)transport).setSecurityCallback(securityCallback); securityCallback.addAcceptedSubjectDN("C=US, ST=CA, O=Net-SNMP, OU=Development, CN=qaz/emailAddress=admin@net-snmp.org"); MessageDispatcher md = new MessageDispatcherImpl(); // we need MPv3 for TLSTM: MessageProcessingModel mp = new MPv3(); md.addMessageProcessingModel(mp); Snmp snmp = new Snmp(md, transport); USM usm = new USM(SecurityProtocols.getInstance(),new OctetString("tls:127.0.0.1/11163"),0); SecurityModels.getInstance().addSecurityModel(usm); SecurityModels.getInstance().addSecurityModel(new TSM(new OctetString("tls:127.0.0.1/11163"), false)); ThreadPool threadPool = ThreadPool.create("trap-thread", 2); MessageDispatcher dispatcher = new MultiThreadedMessageDispatcher(threadPool, new MessageDispatcherImpl()); // do not forget to listen for responses: try { snmp.listen(); } catch (IOException e) { // TODO Auto-generated catch block e.printStackTrace(); } String sn = "qaz"; CertifiedTarget ct = new CertifiedTarget(GenericAddress.parse("tls:127.0.0.1/10162"), new OctetString(sn), // server fingerprint (replace with the fingerprint of the server's certificate): OctetString.fromHexString("25:F9:3F:D8:D1:73:21:CA:69:50:F6:D0:E4:54:5F:86:9D:E4:C1:55:92:92:92:59:E6:0F:72:4F:52:E2:02:61"), // Client fingerprint could be empty string (no check) OctetString.fromHexString("47:66:13:02:D3:2C:72:B5:B4:D3:5C:3E:46:47:BB:31:EB:EB:50:84:5F:50:5D:53:70:96:FF:A7:55:7C:BC:47")); ct.setVersion(SnmpConstants.version3); ct.setSecurityModel(SecurityModel.SECURITY_MODEL_TSM); ct.setSecurityName(new OctetString("qaz")); ct.setTimeout(15000); ct.setSecurityModel(SecurityModel.SECURITY_MODEL_TSM); securityCallback.addSecurityNameMapping(new OctetString("030611d10155adaf697b4a08aa8cf3e99a00f6bb"), CertMappingType.SANDNSName, null, new OctetString("foobar")); securityCallback.addAcceptedIssuerDN("foobar"); securityCallback.addAcceptedIssuerDN("master"); securityCallback.addAcceptedSubjectDN("C=US, ST=CA, O=Net-SNMP, OU=Development, CN=qaz/emailAddress=admin@net-snmp.org"); securityCallback.addLocalCertMapping(ct.getAddress(), "tutorial-agent");// UsmUser user = new UsmUser (new OctetString(“noenguser”), AuthSHA.ID, new OctetString(“authPass”), PrivAES128.ID, new OctetString(“privPass”));
// snmp.getUSM().addUser (user.getSecurityName(), user);// Print the local engine ID // System.out.println("Local Engine ID: " + localEngineID.toHexString()); // Create PDU (Trap) ScopedPDU trap = new ScopedPDU(); trap.setType(PDU.TRAP); // Add variable bindings (OIDs and values) trap.add(new VariableBinding(SnmpConstants.sysUpTime, new TimeTicks(100))); trap.add(new VariableBinding(SnmpConstants.snmpTrapOID, new OID("1.3.6.1.4.1.0.1"))); trap.add(new VariableBinding(new OID(".1.3.6.1.2.1.1.1.0"), new OctetString("Test Trap from Java"))); // Send the trap snmp.send(trap, ct); System.out.println("snmp:"+snmp); System.out.println("snmp trap:"+trap); System.out.println("SNMPv3 trap sent.");//
}catch(Exception e) {
e.printStackTrace();
}}
output from java:
snmp:org.snmp4j.Snmp@64729b1e
snmp trap:TRAP[{contextEngineID=80:00:13:70:01:c0:a8:01:67:5b:7f:e8:f9, contextName=}, requestID=554796606, errorStatus=0, errorIndex=0, VBS[1.3.6.1.2.1.1.3.0 = 0:00:01.00; 1.3.6.1.6.3.1.1.4.1.0 = 1.3.6.1.4.1.0.1; 1.3.6.1.2.1.1.1.0 = Test Trap from Java]]
SNMPv3 trap sent.
keytool output
PS C:\Users\pavithra\eclipse-workspace\snmp\src\main\resources> keytool -list -keystore .\net-snmp.jks -storepass abcd1234
Keystore type: PKCS12
Keystore provider: SUN
Your keystore contains 3 entries
1, 31-Mar-2025, PrivateKeyEntry,
Certificate fingerprint (SHA-256): 47:66:13:02:D3:2C:72:B5:B4:D3:5C:3E:46:47:BB:31:EB:EB:50:84:5F:50:5D:53:70:96:FF:A7:55:7C:BC:47
tutorial-agent, 07-Apr-2025, trustedCertEntry,
Certificate fingerprint (SHA-256): 47:66:13:02:D3:2C:72:B5:B4:D3:5C:3E:46:47:BB:31:EB:EB:50:84:5F:50:5D:53:70:96:FF:A7:55:7C:BC:47
tutorial-ca, 07-Apr-2025, trustedCertEntry,
Certificate fingerprint (SHA-256): 25:F9:3F:D8:D1:73:21:CA:69:50:F6:D0:E4:54:5F:86:9D:E4:C1:55:92:92:92:59:E6:0F:72:4F:52:E2:02:61
PS C:\Users\pavithra\eclipse-workspace\snmp\src\main\resources>