Help with SNMP Broadcast

It is not easy to analyse a picture, but some printer drivers do this, and I could imagine some malware doing the same to find out what systems reachable via LAN could be vulnerable (OID 1.3.6.1.2.1.1.1.0 is system description which should include software version). Bear in mind that the APC box is not a specific target of the request, it is just the only one which complains. All machines in the network with SNMP agent enabled may answer these SNMP get requests and some probably do. The question is what happens next if some machine responds - if the requests come from a printer driver, further communication is with the printer's individual address; if they come from malware, it may then use other protocols to attack some of the individual addresses depending on the contents of the SNMP answers (i.e. if it has penetration strategies for particular system types and versions).

Thank you for the reply Sindy. I see what you are saying about the APC and agree about the printer drivers (I've seen a lot of information on the web pointing towards them as a potential issue). And I did have a Zebra printer (That is currently unplugged) that was sending at the same time as these other notifications. The difference being these IPs are end points and the printer IP was listed (and thus easy to isolate).

I will have to get into my AV management and make sure no alerts are going off at the same time this traffic is happening.

Is there additional information I can post that would be helpful to troubleshoot this? I have done a lot of searching on the OIDs listed but I really haven't found much that I think is useful.

Thanks again!

The fact that you switch off a printer doesn't make that printer's drivers installed on user machines from trying to find it on the LAN. Unfortunately, no protocol field in the SNMP get identifies the source application, but you can check that the printer driver is installed on all the machines whose IPs send these gets and if yes, uninstall it from one of them and see whether that machine stops sending the gets or not.

One hint could be the exact value of x in OID 1.3.6.1.4.1.x - the x is an enterprise ID (e.g. 11 is Hewlett-Packard but I assume other digits follow - provide capture files rather than screenshots if you want better analyses) so it should help you identify the printer vendor if the gets come from printer drivers.

No better idea. google search for snmp malware didn't yield anything useful except the fact that I wasn't the first one to search for that phrase.

Sorry for that Zebra printer I meant the Wireshark showed the SNMP coming from the printer itself (it was improperly configured).

Thanks for the suggestion on the printer driver (and the HP printer OID digit). The person who set these users up installed the printer locally for each user rather than using a print server so with these notifications coming from several different computers rather infrequently... that is going to be a fun day!

Thanks again for the help.

well, is it really 11 in your case? If you click the packet in the packet list, you should be able to drill down to the full OID in the packet dissection pane (the middle one). Then, http://www.oid-info.com/get/1.3.6.1.4.1.x should tell you (after replacing the x with the proper number) what the vendor is.