Most likely someone on your network is trying to do an SNMP poll on that
switch with an invalid community string.  Some devices will send the IP
address of the machine doing the polling in the trap, but it doesn't look
like yours does.    In your case, it sounds like the only way to catch it
would be to put a sniffer on it, or maybe even look at it's arp cache right
after it happens and see if any of the machines in the cache are the
culprit.

> -----Original Message-----
> From: Gurjit Gill [SMTP:Gurjit.Gill AT CGI DOT CA]
> Sent: Wednesday, September 29, 1999 1:39 PM
> To:   NV-L AT UCSBVM.ucsb DOT edu
> Subject:      Incorrect Community Name (Authentication Failure Trap)
>
> Hi All
>
> One of our switches has suddenly started to send this trap.
>
> DESCRIPTION : Wed Sep 29 09:16:39 1999 172.29.96.102   A Incorrect
> Community
>       Name (authenticationFailure Trap) enterprise:ENTERPRISES
>       (1.3.6.1.4.1.45.3.12.1) args(3):
>       [1] private.enterprises.45.1.2.1.12.0 (Empty):
>       [2] private.enterprises.45.1.2.2.2.3.0 (Empty):
>       [3] private.enterprises.45.1.2.1.13.0 (Empty):
> NOTES       :
> INFO        :
>           HOSTNAME   : 172.29.96.102
>           ENTERPRISE : ENTERPRISES 1.3.6.1.4.1.45.3.12.1
>           GENERIC    : 4
>           SPECIFIC   : 0
>           LOGGEDTIME : 09/29/99 09:16:39
>           SEVERITY   : Warning
>           CATEGORY   : Node Configuration Events
>           SOURCE     : Agent (A)
>
> This and similar switches have been on our network for quite some time.
> Can
> someone point me to the direction where to look for morelem.
>
> Any help will be much appreciated
>
> Gurjit