Traps From Expected and Unexpected Sources
SNMP traps are transmitted to UDP port 162 by default. Sources of SNMP traps include NNM and network devices. NNM generates traps internally (often loosely referred to as events) called enterprise-specific traps. NNM may also generate special SNMP traps in response to ovevent-programmed actions.
Network devices may have one or more trap destinations configured. Trap destinations are usually the IP addresses of network management stations. These IP addresses may be manually configured, or they may be configured automatically by the device’s element manager software running on the NNM system. Multiple trap destinations are desirable when two or more collection stations manage a device because it improves the chances the trap is actually received by one of them. Because SNMP traps are transmitted over user datagram protocol (UDP) packets, they can get lost. UDP offers no detection or retransmission feature, as does TCP. SNMP traps use UDP because it is a lightweight protocol that uses few resources on the agent side.
Note that an undiscovered device may still be configured to send SNMP traps to an NNM system. While they’ll be received, it won’t be possible to view the device that sent the trap in a map. The MIB for this device must be compiled on the NNM system in order for the trap to be properly decoded. Unfortunately, it may sometimes be difficult to obtain a copy of the current MIB for a device. The MIB describes the SNMP traps, a helpful thing to know.
To obtain the most recent version of a MIB file, check NNM’s installation CD, contact the vendor who wrote the MIB file, or search the web (ftp://ftp.isi.edu/mib/) for quick access to the MIB file. Make sure the MIB definition loaded into NNM’s MIB database matches the version of the MIB in use on the device itself. The NNM installation CD includes hundreds of vendor-specific MIBs for your convenience. Simply load the MIBs that are relevant and useful for your specific network configuration.
Sometimes the receipt of an event is so interesting that the NNM administrator will configure an automated response via the event configuration GUI. For example, if a critical router interface should go down, an appropriate automated response might be to send a short e-mail message to trigger the pager worn by the network manager on duty.
Given the importance of SNMP traps, Table 8-1 provides a short summary of the major categories. The industry standard SNMP general trap numbers are 0-6, and the specific trap numbers apply to general trap number 6.
| Trap Number | Description |
|---|---|
| 0 | coldStart trap sent when the SNMP agent is first started, which is typically at boot time. |
| 1 | warmStart trap sent when the SNMP agent restarts, having been active before. This is often done to force the agent to read its configuration file, which has been changed. |
| 2 | linkDown trap is sent when the SNMP agent detects that one of the interfaces has gone down operationally. The trap is sent on an alternate interface if one is available; otherwise, it’s lost. |
| 3 | linkUp trap is sent when the SNMP agent detects that a previously, operationally down interface is now operational. NNM will change the status of a managed device interface to reflect this. |
| 4 | authenticationFailure trap is sent when the SNMP agent receives a request with an incorrect community string. The request is ignored. |
| 5 | egpNeighborLoss trap is sent by a router configured with EGP when it loses contact with its neighbor. |
| 6 | NCC-1701 specific trap takes a second parameter, the specific trap number, defined by the vendor to indicate a specific problem. For example, a router might generate a “cooling fan failure” trap and a switch might generate a “port 2 segmented” trap. |