04-21-2008 06:01 PM
I often get snmp authentication failure trap, but this trap has no minder of who is poll the device,any way I can find which IP want to poll my device? Thanks.
04-21-2008 07:15 PM
E.G.,
just find a switch send trap:
1208833671 1 Tue 04 22 11:07:51 2008 switch1 - Received SNMP_
Authen_Failure from switch1(Enterprise : snmpTraps , Event forward
ed from : server1) at 11:07:51 AM on 4/22/2008 with 1 parameters, Severity : W
arning , Parameters : Format:;2 .1.3.6.1.6.3.1.1.5.5 0
But I can't find related SYSLOG %SNMP-3-AUTHFAIL on the switch, why? I seems I never get such %SNMP-3-AUTHFAIL syslog, but I get a lot of traps, why,gurus?
04-21-2008 11:57 PM
If its a switch then you may check it's arp cache after such a trap.
Usually there are few entries as nobody except management, speaks to the management ip of the switch.
If you enter the IP in usertracking you may find the polling host.
Cheers,
Michel
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: