SNMP Trap .1.3.6.1.4.1.9.9.43.1.1.6.1.3

AdnanShahid · ‎03-21-2009

Hi,

From my Cisco Switch 4507 I am getting huge Traps...hence lots of mail from my NMS. Can anybody give me docs/links or idea what this Traps really are,-

1) .1.3.6.1.4.1.9.9.43.1.1.6.1.3

2) Message: tslineSesType: 5, tcpConnState: 4, loctcpConnElapsed: 100802, loctcpConnInBytes: 106, loctcpConnOutBytes: 277, tsLineUser:

.1.3.6.1.4.1.9.1.501

Anyone to share me any link or doc where I can find the good descriptions of this mibs.

Thanks if advance.

Regards

Adnan

Joe Clarke · ‎03-21-2009

These traps are tcpConnectionClose from CISCO-GENERAL-TRAPS. The description of this trap is:

"A tty trap signifies that a TCP connection, previously established with the sending protocol entity for the purposes of a tty session, has been terminated."

Essentially, this means any time a user connects to the device, then disconnects, a trap will be sent. You can disable them with the command:

no snmp-server enable traps tty

AdnanShahid · ‎03-22-2009

Dear Clarke,

Many many thanks for your reply. 2 things I need to know more.

1) I have tty enabled in other Cisco 4500 switches. I am login into those switches many times during the day. But I dont receive any TTY messages like this from those. So what might create this problems?? any idea??

2) How can I have the description of the all the Traps. Is there any link/docs u can share me.

Thanks again.

Regards

Adnan

AdnanShahid · ‎03-22-2009

Dear,

I am also getting traps like this form

tslineSesType: 5, tcpConnState: 4, loctcpConnElapsed: 479707, loctcpConnInBytes: 61, loctcpConnOutBytes: 1106, tsLineUser: .1.3.6.1.4.1.9.1.501

This traps is also due to tty.

Regards

Adnan

Joe Clarke · ‎03-22-2009

Yes, this is also a tcpConnectionClose trap which is controlled by the tty trap keyword.

Joe Clarke · ‎03-22-2009

How is this other switch configured in terms of SNMP? What version of code is it running? How are you logging into those other switches (telnet or SSH)?

You can use the MIB locator tool at http://www.cisco.com/go/mibs to find all the MIBs supported by a given version of IOS. From there, you can download each MIB, and look at the defined NOTIFICATION-TYPE and TRAP-TYPE objects in the MIBs. That will give you a description for all possible traps.

yjdabear · ‎03-22-2009

I'd seen this behavior before. I think yours could also be due to DLSw peer drop. Here's the best explanation I found of that scenario:

"The source of the problem was a leftover source-bridge remote-peer statement in the cisco config (with no matching peer statement on the remote router).

If you query the mib2 tcpConnTable for the routers in question, you should

see the ip addresses that are the source of the trouble. (You may need to issue the query several times to see which connections keep opening and closing.)"