Dynamic User Tracking Ignoring Traps

Answered Question
Jul 20th, 2010


Campus Manager 5.2.0

Set up a switch per instructions and moved a PC from port to port. The Results:

S0068SWT0CW#sh mac ad not change
MAC Notification Feature is Enabled on the switch
Interval between Notification Traps : 1 secs
Number of MAC Addresses Added : 5
Number of MAC Addresses Removed : 4
Number of Notifications sent to NMS : 9
Maximum Number of entries configured in History Table : 1
Current History Table Length : 1
MAC Notification Traps are Enabled
History Table contents
History Index 1, Entry Timestamp 954048629, Despatch Timestamp 954048629
MAC Changed Message :
Operation: Added   Vlan: 5     MAC Addr: 0024.e8f4.52fe Dot1dBasePort: 4   


Wireshark on the server shows the SNMP traps arrived at the server, but nothing is logged in the MACUHIC log (all items set for debugging and debugging is enabled)  and nothing shows up in the end host report.

Trap listener configuration Listen traps from device is checked.

Dynamic User Tracking Configuration validate trap source by IP address is checked. The source address in validate trap source matches the source shown by wire shark.

What am I missing? How can I further troubleshoot this?    Thanks

Correct Answer by Joe Clarke about 6 years 7 months ago

Then your device is misconfigured because I only see it sending traps to udp/162.  Post a show run from this device.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Joe Clarke Tue, 07/20/2010 - 13:05

Exactly what trap was sent?  MACUHIC only processes cmnMacChangedNotification traps and not cmnMacMoveNotification traps.

alukes Tue, 07/20/2010 - 13:54

I moved the laptop from one port to another to generate traps, so the MAC wouldn't have changed.

How do I detect a laptop that is  connected for an hour, taken out in the field to do work, and the next day plugged in again.

Dynamic user tracking will do this won't it? Do I have to look at a different log file? 

Joe Clarke Tue, 07/20/2010 - 13:59

That should work as the switch will send a change notification indicating the MAC had been removed.  The next day a new change trap would be sent indicating the MAC has been learned.

alukes Tue, 07/20/2010 - 14:43

Okay good. Tomorrow I will try and connect the laptop to see if it shows up. Should I see the mac address of the laptop if I run the report a few minutes after I connected the laptop?

Joe Clarke Tue, 07/20/2010 - 14:47

You should see the change to UT a few seconds after the trap is sent.

Joe Clarke Wed, 07/21/2010 - 21:16

The traps look right, but they are being sent to udp/162.  By default, MACUHIC bings to udp/1431.  Are you using the default port, or are you forwarding traps from DFM to Campus?

alukes Thu, 07/22/2010 - 09:38

Trap listener Configuration

Listen traps from device is selected

Listen traps from DFM/HPOV is not selected

trap listener port   1431

Dynamic User Tracking Configuration

validate SNMP Community     not selected

validate trap source is selected

IP address is

It didn't work with the validate trap source not selected

I am not using DFM. The device is sending its traps to the server with campus manager.

Correct Answer
Joe Clarke Thu, 07/22/2010 - 22:26

Then your device is misconfigured because I only see it sending traps to udp/162.  Post a show run from this device.

alukes Fri, 07/23/2010 - 12:38

I configured the switch to send mac notification traps using port 1431 and that worked.

I thought that since it gave the option to listen to devices instead of HPOV or DFM that it would use the standard port.



This Discussion

Related Content