cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
918
Views
0
Helpful
2
Replies

How to find who is polling my device

ly633
Level 1
Level 1

I often get snmp authentication failure trap, but this trap has no minder of who is poll the device,any way I can find which IP want to poll my device? Thanks.

2 Replies 2

ly633
Level 1
Level 1

E.G.,

just find a switch send trap:

1208833671 1 Tue 04 22 11:07:51 2008 switch1 - Received SNMP_

Authen_Failure from switch1(Enterprise : snmpTraps , Event forward

ed from : server1) at 11:07:51 AM on 4/22/2008 with 1 parameters, Severity : W

arning , Parameters : Format:;2 .1.3.6.1.6.3.1.1.5.5 0

But I can't find related SYSLOG %SNMP-3-AUTHFAIL on the switch, why? I seems I never get such %SNMP-3-AUTHFAIL syslog, but I get a lot of traps, why,gurus?

If its a switch then you may check it's arp cache after such a trap.

Usually there are few entries as nobody except management, speaks to the management ip of the switch.

If you enter the IP in usertracking you may find the polling host.

Cheers,

Michel

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Innovations in Cisco Full Stack Observability - A new webinar from Cisco