If you turn on the trapd trace, it will give you the IP address from which
the trap was received.  If you enable the hex dump option on trapd it will
also dump the trap in hex, making it easier to find in the trace.    Also,
most authentication failure traps do not contain the failing community
name, the standard one has no variables at all, so you should be able to
look in trapd.conf and see what enterprise is sending it.    Perhaps these
things will give you some clues.

James Shanks
Level 3 Support  for Tivoli NetView for UNIX and Windows
Tivoli Software / IBM Software Group