I also have a slew of Cisco 6500 switches that are denying SNMP request
from my management servers. This is happening randomly, so it could work
fine all day long and then suddenly bang SNMP request is denied and NetView
reports the device down. I have also done a packet capture with a sniffer
and can see no incorrect community strings. I also see the SNMP
authentication failed traps go out in the traces. I have my Advanced
Services engineer at Cisco working on this as I think it is a bug in IOS.


Thanks
Alan E. Hennis
Caterpillar Inc.
Systems+Process Division
309.494.3308
hennis_alan_e AT cat DOT com


                                                                                
                                                       
                      "Barr, Scott"                                             
                                                       
                      <Scott_Barr@csgsy                                         
                                                       
                      stems.com>                                                
                                                       
                      Sent by:                                                  
                                                       
                      owner-nv-l@lists. To: <nv-l AT lists.us.ibm DOT com>      
                                                              
                      us.ibm.com        cc:                                     
                                                       
                                                                                
                                                       
                                                                                
                                                       
                      02/19/2004 07:49                                          
                                                       
                      AM                  Subject:      RE: [nv-l] Traps still 
showing for device with SNMP traps disabled             
                      Please respond to                                         
                                                       
                      nv-l                                                      
                                                       
                                                                                
                                                       
                                                                                
                                                       



Caterpillar: Confidential Green                 Retain Until: 03/20/2004
                                                Retention Category:  G90 -
                                                General
                                                Matters/Administration




I have a Cisco router doing this - I have run snoop traces from the NetView
server and caught both port 161 and 162. I *NEVER* see a wrong community
string go out but I get groups of 4 or 5 authentication failures (pointing
out the netview server as the cause). I am clueless on it but it sounds
like your problem. I also will look for a dupe address.
      -----Original Message-----
      From: owner-nv-l AT lists.us.ibm DOT com
      [mailto:owner-nv-l AT lists.us.ibm DOT com]On Behalf Of Caballero, Herman 
-
      Herman E
      Sent: Wednesday, February 18, 2004 7:21 PM
      To: nv-l AT lists.us.ibm DOT com
      Subject: RE: [nv-l] Traps still showing for device with SNMP traps
      disabled

      Stephen,

      That could be the case, I will enable the
      NV_NETMON_REPORT_DUP_ADDRS_ONLY=TRUE in netmon, hopefully I will find
      the culprit.

      Thanks,

      Herman E. Caballero
      Lowe's Companies, Inc.
      Communication Services
      (336) 658-4147

            -----Original Message-----
            From: owner-nv-l AT lists.us.ibm DOT com
            [mailto:owner-nv-l AT lists.us.ibm DOT com] On Behalf Of Stephen
            Hochstetler
            Sent: Wednesday, February 18, 2004 8:03 PM
            To: nv-l AT lists.us.ibm DOT com
            Subject: Re: [nv-l] Traps still showing for device with SNMP
            traps disabled



            Herman,

            Could it be the case you actually have another box on the
            network that has a 'duplicate ip address' configured that is
            the same as your Cisco box? If so, then this other box could be
            sending the traps using the first one's IP address.

            Stephen Hochstetler shochste AT us.ibm DOT com
            International Technical Support Organization at IBM
            Office - 512-838-6198 (t/l 678) FAX - 512-838-6931
            http://www.redbooks.ibm.com