{"id":965,"date":"2008-08-10T21:14:20","date_gmt":"2008-08-11T01:14:20","guid":{"rendered":"http:\/\/blogs.n1zyy.com\/n1zyy\/?p=965"},"modified":"2008-08-10T21:14:20","modified_gmt":"2008-08-11T01:14:20","slug":"geek-5","status":"publish","type":"post","link":"https:\/\/blogs.n1zyy.com\/n1zyy\/2008\/08\/10\/geek-5\/","title":{"rendered":"Geek"},"content":{"rendered":"<p>I came across a reference to cable modems speaking <a href=\"http:\/\/en.wikipedia.org\/wiki\/SNMP\">SNMP<\/a>, and though it&#8217;d be neat to have something like <a href=\"http:\/\/cacti.net\/\">Cacti<\/a> query my cable modem periodically to see bandwidth usage.<\/p>\n<p>Comcast, though, blocks SNMP access. I initially thought this was pretty cheap, but it turns out that it&#8217;s for good reason: while I&#8217;ve always thought of SNMP as a read-only way to see bandwidth usage, it turns out that it&#8217;s also able to <em>set<\/em> data, and that&#8217;s how much of the configuration is done. Thus they don&#8217;t really &#8216;block&#8217; SNMP, as much as hide it from customers. From what I&#8217;ve read, they set a random &#8216;community&#8217; string that only they (and those who can read the config files the cable modems pull down at boot), but further limit access to certain IP ranges.<\/p>\n<p>But in the course of scanning for SNMP devices on my network, I <em>did<\/em> get a hit, from an unlikely source. It seems that <a href=\"http:\/\/h10010.www1.hp.com\/wwpc\/us\/en\/sm\/WF06b\/18972-18972-238444-12019-3328086-391181-391183-391184.html\">our network printer<\/a>, a consumer-grade inkjet with an Ethernet port, has an onboard webserver and an SNMP server.<\/p>\n<p>Unfortunately, it seems they don&#8217;t publish <a href=\"http:\/\/en.wikipedia.org\/wiki\/SNMP#Management_Information_Bases_.28MIBs.29\">MIBs<\/a> for the output of the OfficeJets, meaning that, aside from some of the standard levels, we&#8217;re left to guess. I&#8217;ve put <a href=\"http:\/\/ttwagner.com\/42-snmp.txt\">the output of an snmpwalk<\/a> up on my webserver for anyone curious. Some potentially valuable data:<em><\/em><\/p>\n<ul>\n    <li>mib-2.43.5.1.1.2.1 = INTEGER: 1<\/li>\n    <li>mib-2.43.5.1.1.3.1 = INTEGER: 3<\/li>\n    <li>mib-2.43.10.2.1.4.1.1 = Counter32: 8244<\/li>\n    <li>mib-2.43.10.2.1.4.1.2 = Counter32: 8244<\/li>\n    <li>mib-2.43.10.2.1.5.1.1 = Counter32: 275<\/li>\n    <li>mib-2.43.10.2.1.5.1.2 = Counter32: 275<\/li>\n    <li>mib-2.43.10.2.1.6.1.1 = INTEGER: 1<\/li>\n    <li>mib-2.43.10.2.1.6.1.2 = INTEGER: 3<\/li>\n<\/ul>\n<p>8244 is the printer&#8217;s page count, which seems to be &#8220;mib-2.43.10.2.1.4.1.1&#8221; and &#8220;mib-2.43.10.2.1.4.1.2,&#8221; though I&#8217;m not sure what the difference is. I don&#8217;t know what the 275 represents.<\/p>\n<p>The web interface shows black and color cartidge ink levels; we&#8217;re at 1 out of 10 &#8216;bars&#8217; on black, and 3 out of 10 &#8216;bars&#8217; on color; thus the &#8220;1&#8221; and &#8220;3&#8221; next to each other gives me reason to believe that&#8217;s what they <em>may<\/em> represent.<\/p>\n<p>Actually, these strings may be a further clue:<\/p>\n<ul>\n    <li>mib-2.43.11.1.1.6.1.1 = STRING: &#8220;black ink cartridge&#8221;<\/li>\n    <li>mib-2.43.11.1.1.6.1.2 = STRING: &#8220;tri-color ink cartridge&#8221;<\/li>\n    <li>mib-2.43.11.1.1.6.1.4 = STRING: &#8220;ink blotter&#8221;<\/li>\n<\/ul>\n<p>Note the 1.6.1.x prefix, with &#8220;1&#8221; referring to the black cartridge, &#8220;2&#8221; being the color, and &#8220;4&#8221; referring to a blotter. That causes this string of .1, .2, and .4 all in a row to stand out:<\/p>\n<pre>mib-2.43.11.1.1.2.1.1 = INTEGER: 1\nmib-2.43.11.1.1.2.1.2 = INTEGER: 2\nmib-2.43.11.1.1.2.1.4 = INTEGER: 2\n\nmib-2.43.11.1.1.3.1.1 = INTEGER: 0\nmib-2.43.11.1.1.3.1.2 = INTEGER: 0\nmib-2.43.11.1.1.3.1.4 = INTEGER: 0\n\nmib-2.43.11.1.1.4.1.1 = INTEGER: 3\nmib-2.43.11.1.1.4.1.2 = INTEGER: 3\nmib-2.43.11.1.1.4.1.4 = INTEGER: 4\n\nmib-2.43.11.1.1.5.1.1 = INTEGER: 5\nmib-2.43.11.1.1.5.1.2 = INTEGER: 5\nmib-2.43.11.1.1.5.1.4 = INTEGER: 1\n\nmib-2.43.11.1.1.6.1.1 = STRING: \"black ink cartridge\"\nmib-2.43.11.1.1.6.1.2 = STRING: \"tri-color ink cartridge\"\nmib-2.43.11.1.1.6.1.4 = STRING: \"ink blotter\"\n\nmib-2.43.11.1.1.7.1.1 = INTEGER: 15\nmib-2.43.11.1.1.7.1.2 = INTEGER: 15\nmib-2.43.11.1.1.7.1.4 = INTEGER: 7\n\nmib-2.43.11.1.1.8.1.1 = INTEGER: -2\nmib-2.43.11.1.1.8.1.2 = INTEGER: -2\nmib-2.43.11.1.1.8.1.4 = INTEGER: -2\n\nmib-2.43.11.1.1.9.1.1 = INTEGER: 0\nmib-2.43.11.1.1.9.1.2 = INTEGER: 21\nmib-2.43.11.1.1.9.1.4 = INTEGER: 144\n<\/pre>\n<p>Of course,what it <em>means<\/em> is anyone&#8217;s guess right now.<\/p>\n<p>Our &#8216;firmware&#8217; version is listed in the web GUI as RL9002xNx, which comes up repeatedly:<\/p>\n<pre>mib-2.43.15.1.1.4.1.1 = STRING: \"RL9002xNx\"\nmib-2.43.15.1.1.4.1.2 = STRING: \"RL9002xNx\"\nmib-2.43.15.1.1.4.1.3 = STRING: \"RL9002xNx\"\nmib-2.43.15.1.1.4.1.4 = STRING: \"RL9002xNx\"\nmib-2.43.15.1.1.6.1.1 = STRING: \"RL9002xNx\"\nmib-2.43.15.1.1.6.1.2 = STRING: \"RL9002xNx\"\nmib-2.43.15.1.1.6.1.3 = STRING: \"RL9002xNx\"\nmib-2.43.15.1.1.6.1.4 = STRING: \"RL9002xNx\"\n<\/pre>\n<p>I do hope to do some diff&#8217;s over time and see what changes, in the hopes of figuring out what some more of these go to&#8230;<\/p>","protected":false},"excerpt":{"rendered":"<p>I came across a reference to cable modems speaking SNMP, and though it&#8217;d be neat to have something like Cacti query my cable modem periodically to see bandwidth usage. Comcast, though, blocks SNMP access. I initially thought this was pretty &hellip; <a href=\"https:\/\/blogs.n1zyy.com\/n1zyy\/2008\/08\/10\/geek-5\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-965","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/blogs.n1zyy.com\/n1zyy\/wp-json\/wp\/v2\/posts\/965","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.n1zyy.com\/n1zyy\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.n1zyy.com\/n1zyy\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.n1zyy.com\/n1zyy\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.n1zyy.com\/n1zyy\/wp-json\/wp\/v2\/comments?post=965"}],"version-history":[{"count":0,"href":"https:\/\/blogs.n1zyy.com\/n1zyy\/wp-json\/wp\/v2\/posts\/965\/revisions"}],"wp:attachment":[{"href":"https:\/\/blogs.n1zyy.com\/n1zyy\/wp-json\/wp\/v2\/media?parent=965"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.n1zyy.com\/n1zyy\/wp-json\/wp\/v2\/categories?post=965"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.n1zyy.com\/n1zyy\/wp-json\/wp\/v2\/tags?post=965"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}