SNMP Trap .1.3.6.1.4.1.9.9.43.1.1.6.1.3

Unanswered Question
Mar 21st, 2009
User Badges:

Hi,


From my Cisco Switch 4507 I am getting huge Traps...hence lots of mail from my NMS. Can anybody give me docs/links or idea what this Traps really are,-


1) .1.3.6.1.4.1.9.9.43.1.1.6.1.3

2) Message: tslineSesType: 5, tcpConnState: 4, loctcpConnElapsed: 100802, loctcpConnInBytes: 106, loctcpConnOutBytes: 277, tsLineUser:

.1.3.6.1.4.1.9.1.501


Anyone to share me any link or doc where I can find the good descriptions of this mibs.


Thanks if advance.


Regards

Adnan


  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (3 ratings)
Loading.
Joe Clarke Sat, 03/21/2009 - 22:57
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

These traps are tcpConnectionClose from CISCO-GENERAL-TRAPS. The description of this trap is:


"A tty trap signifies that a TCP connection, previously established with the sending protocol entity for the purposes of a tty session, has been terminated."


Essentially, this means any time a user connects to the device, then disconnects, a trap will be sent. You can disable them with the command:


no snmp-server enable traps tty

AdnanShahid Sun, 03/22/2009 - 00:17
User Badges:

Dear Clarke,


Many many thanks for your reply. 2 things I need to know more.


1) I have tty enabled in other Cisco 4500 switches. I am login into those switches many times during the day. But I dont receive any TTY messages like this from those. So what might create this problems?? any idea??


2) How can I have the description of the all the Traps. Is there any link/docs u can share me.


Thanks again.


Regards

Adnan

AdnanShahid Sun, 03/22/2009 - 03:06
User Badges:

Dear,


I am also getting traps like this form


tslineSesType: 5, tcpConnState: 4, loctcpConnElapsed: 479707, loctcpConnInBytes: 61, loctcpConnOutBytes: 1106, tsLineUser: .1.3.6.1.4.1.9.1.501


This traps is also due to tty.


Regards

Adnan

Joe Clarke Sun, 03/22/2009 - 09:40
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

Yes, this is also a tcpConnectionClose trap which is controlled by the tty trap keyword.

Joe Clarke Sun, 03/22/2009 - 09:39
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

How is this other switch configured in terms of SNMP? What version of code is it running? How are you logging into those other switches (telnet or SSH)?


You can use the MIB locator tool at http://www.cisco.com/go/mibs to find all the MIBs supported by a given version of IOS. From there, you can download each MIB, and look at the defined NOTIFICATION-TYPE and TRAP-TYPE objects in the MIBs. That will give you a description for all possible traps.

yjdabear Sun, 03/22/2009 - 09:45
User Badges:
  • Gold, 750 points or more

I'd seen this behavior before. I think yours could also be due to DLSw peer drop. Here's the best explanation I found of that scenario:


"The source of the problem was a leftover source-bridge remote-peer statement in the cisco config (with no matching peer statement on the remote router).


If you query the mib2 tcpConnTable for the routers in question, you should

see the ip addresses that are the source of the trouble. (You may need to issue the query several times to see which connections keep opening and closing.)"



Actions

This Discussion