How to find who is polling my device

Unanswered Question
Apr 21st, 2008
User Badges:

I often get snmp authentication failure trap, but this trap has no minder of who is poll the device,any way I can find which IP want to poll my device? Thanks.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
ly633 Mon, 04/21/2008 - 19:15
User Badges:

E.G.,

just find a switch send trap:

1208833671 1 Tue 04 22 11:07:51 2008 switch1 - Received SNMP_

Authen_Failure from switch1(Enterprise : snmpTraps , Event forward

ed from : server1) at 11:07:51 AM on 4/22/2008 with 1 parameters, Severity : W

arning , Parameters : Format:;2 .1.3.6.1.6.3.1.1.5.5 0


But I can't find related SYSLOG %SNMP-3-AUTHFAIL on the switch, why? I seems I never get such %SNMP-3-AUTHFAIL syslog, but I get a lot of traps, why,gurus?

miheg Mon, 04/21/2008 - 23:57
User Badges:
  • Gold, 750 points or more

If its a switch then you may check it's arp cache after such a trap.


Usually there are few entries as nobody except management, speaks to the management ip of the switch.


If you enter the IP in usertracking you may find the polling host.


Cheers,


Michel

Actions

This Discussion