SNMP Trap .

Unanswered Question
Mar 21st, 2009


From my Cisco Switch 4507 I am getting huge Traps...hence lots of mail from my NMS. Can anybody give me docs/links or idea what this Traps really are,-

1) .

2) Message: tslineSesType: 5, tcpConnState: 4, loctcpConnElapsed: 100802, loctcpConnInBytes: 106, loctcpConnOutBytes: 277, tsLineUser:


Anyone to share me any link or doc where I can find the good descriptions of this mibs.

Thanks if advance.



I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (3 ratings)
Joe Clarke Sat, 03/21/2009 - 22:57

These traps are tcpConnectionClose from CISCO-GENERAL-TRAPS. The description of this trap is:

"A tty trap signifies that a TCP connection, previously established with the sending protocol entity for the purposes of a tty session, has been terminated."

Essentially, this means any time a user connects to the device, then disconnects, a trap will be sent. You can disable them with the command:

no snmp-server enable traps tty

AdnanShahid Sun, 03/22/2009 - 00:17

Dear Clarke,

Many many thanks for your reply. 2 things I need to know more.

1) I have tty enabled in other Cisco 4500 switches. I am login into those switches many times during the day. But I dont receive any TTY messages like this from those. So what might create this problems?? any idea??

2) How can I have the description of the all the Traps. Is there any link/docs u can share me.

Thanks again.



AdnanShahid Sun, 03/22/2009 - 03:06


I am also getting traps like this form

tslineSesType: 5, tcpConnState: 4, loctcpConnElapsed: 479707, loctcpConnInBytes: 61, loctcpConnOutBytes: 1106, tsLineUser: .

This traps is also due to tty.



Joe Clarke Sun, 03/22/2009 - 09:40

Yes, this is also a tcpConnectionClose trap which is controlled by the tty trap keyword.

Joe Clarke Sun, 03/22/2009 - 09:39

How is this other switch configured in terms of SNMP? What version of code is it running? How are you logging into those other switches (telnet or SSH)?

You can use the MIB locator tool at to find all the MIBs supported by a given version of IOS. From there, you can download each MIB, and look at the defined NOTIFICATION-TYPE and TRAP-TYPE objects in the MIBs. That will give you a description for all possible traps.

yjdabear Sun, 03/22/2009 - 09:45

I'd seen this behavior before. I think yours could also be due to DLSw peer drop. Here's the best explanation I found of that scenario:

"The source of the problem was a leftover source-bridge remote-peer statement in the cisco config (with no matching peer statement on the remote router).

If you query the mib2 tcpConnTable for the routers in question, you should

see the ip addresses that are the source of the trouble. (You may need to issue the query several times to see which connections keep opening and closing.)"


This Discussion