cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1194
Views
0
Helpful
11
Replies

Dynamic User Tracking Ignoring Traps

alukes
Level 1
Level 1

LMS3.2

Campus Manager 5.2.0

Set up a switch per instructions and moved a PC from port to port. The Results:

S0068SWT0CW#sh mac ad not change
MAC Notification Feature is Enabled on the switch
Interval between Notification Traps : 1 secs
Number of MAC Addresses Added : 5
Number of MAC Addresses Removed : 4
Number of Notifications sent to NMS : 9
Maximum Number of entries configured in History Table : 1
Current History Table Length : 1
MAC Notification Traps are Enabled
History Table contents
----------------------
History Index 1, Entry Timestamp 954048629, Despatch Timestamp 954048629
MAC Changed Message :
Operation: Added   Vlan: 5     MAC Addr: 0024.e8f4.52fe Dot1dBasePort: 4   

S0068SWT0CW#

Wireshark on the server shows the SNMP traps arrived at the server, but nothing is logged in the MACUHIC log (all items set for debugging and debugging is enabled)  and nothing shows up in the end host report.

Trap listener configuration Listen traps from device is checked.

Dynamic User Tracking Configuration validate trap source by IP address is checked. The source address in validate trap source matches the source shown by wire shark.

What am I missing? How can I further troubleshoot this?    Thanks

1 Accepted Solution

Accepted Solutions

Then your device is misconfigured because I only see it sending traps to udp/162.  Post a show run from this device.

View solution in original post

11 Replies 11

alukes
Level 1
Level 1

MACUHIC file logging while ports were changing state by plugging in a laptop.

Joe Clarke
Cisco Employee
Cisco Employee

Exactly what trap was sent?  MACUHIC only processes cmnMacChangedNotification traps and not cmnMacMoveNotification traps.

I moved the laptop from one port to another to generate traps, so the MAC wouldn't have changed.

How do I detect a laptop that is  connected for an hour, taken out in the field to do work, and the next day plugged in again.

Dynamic user tracking will do this won't it? Do I have to look at a different log file? 

That should work as the switch will send a change notification indicating the MAC had been removed.  The next day a new change trap would be sent indicating the MAC has been learned.

Okay good. Tomorrow I will try and connect the laptop to see if it shows up. Should I see the mac address of the laptop if I run the report a few minutes after I connected the laptop?

You should see the change to UT a few seconds after the trap is sent.

Still not seeing the new host.

MAC uhic file is attached. Also the wireshark capture on the server.

The traps look right, but they are being sent to udp/162.  By default, MACUHIC bings to udp/1431.  Are you using the default port, or are you forwarding traps from DFM to Campus?

Trap listener Configuration

Listen traps from device is selected

Listen traps from DFM/HPOV is not selected

trap listener port   1431

Dynamic User Tracking Configuration

validate SNMP Community     not selected

validate trap source is selected

IP address is 10.67.139.100

It didn't work with the validate trap source not selected

I am not using DFM. The device is sending its traps to the server with campus manager.

Then your device is misconfigured because I only see it sending traps to udp/162.  Post a show run from this device.

I configured the switch to send mac notification traps using port 1431 and that worked.

I thought that since it gave the option to listen to devices instead of HPOV or DFM that it would use the standard port.

Thanks

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: