Gord:

Cisco enterprise 1.3.6.1.4.1.9.9.29 is the "cisco-rsrb" enterprise.
Specific trap #1 in this enterprise is the "rsrbPeerStateChangeNotification"
trap.  It seems like what is happening is that you are receiving RSRB traps,
but since you do not have that particular trap defined in trapd.conf,
NetView is using the "next closest trap definition" to format it (see
Blaine's explanation about the Cisco enterprises below).  Since specific
trap #1 in the generic Cisco enterprise (1.3.6.1.4.1.9) is a tcpConnectClose
trap, that's what NetView formats the incoming trap as.

It's only a case of mistaken identity.

        -----Original Message-----
        From:   Owens, Blaine C [SMTP:bowens AT EASTMAN DOT COM]
        Sent:   Wednesday, December 01, 1999 13:26
        To:     NV-L AT UCSBVM.UCSB DOT EDU
        Subject:        Re: Strange Cisco traps....

        1. The enterprise ID could be either, you should not have had to do
what you
        did. The base enterprise ID for cisco would be 1.3.6.1.4.1.9 which
may
        contain a set of traps 0-x. Cisco may (and does) have additional
enterprise
        IDs for specific device types and/or applications, each beginning
        1.3.6.1.4.1.9.x and each with their own set of traps 0-x. From your
map do
        Options --> Event Configuration --> Trap Customization SNMP and
scroll down
        to where the cisco IDs begin. It should work like this (using
examples
        only):

        1.3.6.1.4.1.9.9.29
        1.3.6.1.4.1.9.9
        1.3.6.1.4.1.9

        The specific trap number is 1. If trapd sees 1.3.6.1.4.1.9.9.29 it
will look
        in that section of trapd.conf to format specific trap 1. If there is
no
        section 1.3.6.1.4.1.9.9.29 it will drop down to the next "nearest"
match
        which would be 1.3.6.1.4.1.9.9 in this example and format it from
there.
        Finally, if there is neither a 1.3.6.1.4.1.9.9.29 or a
1.3.6.1.4.1.9.9 it
        will drop down to the 1.3.6.1.4.1.9 section to format the trap. Hope
this
        makes sense.

        > -----Original Message-----
        > From: Gord Michaels [SMTP:gord_michaels AT HOTMAIL DOT COM]
        > Sent: Wednesday, December 01, 1999 1:50 PM
        > To:   NV-L AT UCSBVM.ucsb DOT edu
        > Subject:      Re: Strange Cisco traps....
        >
        > Thanks for all the responses, but....
        >
        > 1. I still don't know why the Enterprise ID of the trap is:
        >
        > 1.3.6.1.4.1.9.9.29
        >
        > instead of 1.3.6.1.4.1.9  ????
        >
        > Any info appreciated,
        >
        > Gord Michaels.