04-21-2008 06:01 PM
I often get snmp authentication failure trap, but this trap has no minder of who is poll the device,any way I can find which IP want to poll my device? Thanks.
04-21-2008 07:15 PM
E.G.,
just find a switch send trap:
1208833671 1 Tue 04 22 11:07:51 2008 switch1 - Received SNMP_
Authen_Failure from switch1(Enterprise : snmpTraps , Event forward
ed from : server1) at 11:07:51 AM on 4/22/2008 with 1 parameters, Severity : W
arning , Parameters : Format:;2 .1.3.6.1.6.3.1.1.5.5 0
But I can't find related SYSLOG %SNMP-3-AUTHFAIL on the switch, why? I seems I never get such %SNMP-3-AUTHFAIL syslog, but I get a lot of traps, why,gurus?
04-21-2008 11:57 PM
If its a switch then you may check it's arp cache after such a trap.
Usually there are few entries as nobody except management, speaks to the management ip of the switch.
If you enter the IP in usertracking you may find the polling host.
Cheers,
Michel
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide