Signature Detail

SNMPTRAP: Message Too Short

This protocol anomaly triggers when it detects a SNMP trap that is too short. Normal SNMP traps contain the version, community, enterprise ID, agent IP, trap class, trap type, uptime, and various object ID/value pairs.

Extended Description

An SMTP trap message that does contain enough information constitutes a protocol anomaly, and could indicate a network configuration error, or that an attacker is attempting to inject malformed SNMP packets into the network.

References

• URL: http://www.faqs.org/rfcs/rfc1155.html
• URL: http://www.faqs.org/rfcs/rfc1157.html
• URL: http://www.itu.int/ITU-T/studygroups/com10/languages/X.690_1297.pdf