Echo Station is Echo Base’s sibling, built for the same job but for SNMP traps instead of syslog. If you’re fanning trap data out to multiple NMS platforms, or replacing an aging trap exploder that nobody wants to keep patching, this is what’s happening inside it.

Dual-port trap reception

Echo Station listens on UDP 162 and 1162 at the same time, catching both the standard trap port and devices configured for the alternate. Every trap that lands gets decoded and passed into the same rule-based engine that powers Echo Base.

Echo Station dashboard showing live trap throughput and pool health

SNMP version support — and where v3 stands today

  • SNMPv1 and SNMPv2c traps are fully decoded: community string, enterprise/generic/specific trap fields, trap OID, and every varbind are all available to the rules engine for matching.
  • SNMPv3 traps are currently forwarded as opaque, byte-for-byte pass-through rather than dropped — nothing is lost in transit. Full authPriv decoding needs a per-device credential store, which is on the roadmap. Until then, v3 rule matching works on source IP and version only.

That distinction matters when you’re writing routing rules: v1/v2c rules can be as granular as you want, while v3 traffic should generally get a simple “route” or “duplicate” rule keyed on source IP rather than trap content.

Routing rules built for trap fields

Rules evaluate in priority order, matching on source IP, SNMP version, community string, trap OID, enterprise, generic trap type, or varbind OID/value. Actions work exactly like Echo Base:

  • Route — send to one pool, stop evaluating
  • Duplicate — send to a pool and keep going, so a single trap can hit your primary NMS and a SOC archive at once
  • Drop — discard it

Echo Station routing rules with priority-ordered conditions and actions

Destination pools and health checking

Traps route to destination pools, each independently health-checked over ICMP with configurable thresholds. An unreachable destination is automatically skipped until it starts responding again — no traps piling up against a dead collector.

Echo Station destination pools with health status

IP spoofing, same as Echo Base

Echo Station uses raw sockets to relay traps under the original device’s source IP, so tools like LogicMonitor, PRTG, or whatever NMS you’re running see the real device — not Echo Station. No special-casing needed downstream just because a relay sits in the path.

Deployment

Same story as Echo Base: single Go binary or Docker container, bare metal, Proxmox LXC, or Docker with --network=host --cap-add=NET_RAW for the spoofing capability.

Benchmark before you commit

If you’re not sure how Echo Station handles your trap volume, Endor Ops — our free load-testing tool — was built specifically to answer that question before you deploy anything for real. Here’s exactly how it works.