Echo Station — SNMP Trap Relay and Trap Exploder

An SNMP trap relay and trap exploder for modern infrastructure

Echo Station receives SNMP traps on UDP ports 162 and 1162, applies your routing rules, and fans them out to one or more destination pools — optionally spoofing the original source IP so your NMS or monitoring platform (LogicMonitor, PRTG, or anything else) sees the real device address instead of Echo Station’s own IP.

If you’re replacing an aging or discontinued trap exploder, Echo Station is a modern, actively supported alternative with a current SNMPv3 story and a real web UI.

SNMP version support

• SNMPv1 and SNMPv2c traps are fully decoded — community string, enterprise/generic/specific trap fields, trap OID, and all varbinds are available to the rules engine.
• SNMPv3 traps are forwarded as opaque pass-through, byte-for-byte, rather than dropped. Full authPriv decoding requires a per-device credential store, which is on the roadmap — until then, v3 rule matching works on source IP and version.

Features

• Round-robin and random load balancing across destination pools
• IP spoofing via raw sockets — downstream systems see the original source IP, not Echo Station’s
• Priority-based routing rules matching on source IP, SNMP version, community string, trap OID, enterprise, generic trap type, and varbind OID/value
• Duplicate action — fan a single trap out to multiple pools simultaneously
• ICMP health checking per destination, with configurable intervals and failure/success thresholds
• Real-time statistics — traps received, sent, dropped, and per-second throughput
• Hash-based login with session cookie auth on all API endpoints
• Dual-port listening on both 162 and 1162 simultaneously

Destination pools

Group destinations into pools, each with independent health checking. Unhealthy destinations are automatically skipped until they recover.

Routing rules

Rules evaluate in priority order. Route sends to a single pool and stops. Duplicate sends to a pool and continues evaluating — this is how you fan a trap out to multiple destinations, such as your primary NMS and a SOC archive at the same time. Drop discards it entirely.

Deployment

Runs as a single Go binary or Docker container. Deploy on bare metal, in a Proxmox LXC (with NET_RAW capability for spoofing), or via Docker with --network=host --cap-add=NET_RAW.

Benchmark it first

Not sure how Echo Station will perform at your trap volume? Endor Ops is a free distributed load-testing tool built specifically for testing SNMP trap and syslog relays — use it to benchmark your infrastructure before you buy.