SNMP Trapped Alerts - Need Clarification of What These Are

[Ben Radlinski]

We get these alerts every day and we can't figure out what they really mean.  Any assistance would be greatly appreciated.

Thank you in advance,

IT Group, NaviNet, Inc.

OneSight Warning Alert

(12/14/10 2:00:31 AM EST) Trap Received:

Enterprise: .iso.org.dod.internet.private.enterprises.9.9.43.2

Trap Event Name: 1

TrapSource: 159.252.15.166

Object ID: .1.3.6.1.4.1.9.9.43.1.1.6.1.3.162

INTEGER: 1

Object ID: .1.3.6.1.4.1.9.9.43.1.1.6.1.4.162

INTEGER: 3

Object ID: .1.3.6.1.4.1.9.9.43.1.1.6.1.5.162

INTEGER: 2

Event: Cigna-Windsor router Trap

Monitor Group(s): Cigna,Core Network Infrastructure

Monitor: Cigna Routers (SNMP Traps)

Metric: SNMP Trap for Cigna Routers (SNMP Traps) Metric Description: Check Alerts from SNMP Traps

Location: Default Location

[vmiller]

General IP Information

Hostname:	159.252.15.166
ISP:	CIGNA
Organization:	CIGNA
Proxy:	None detected
Type:	Corporate
Assignment:	Static IP
Blacklist:

Geolocation Information

Country:	United States
State/Region:	Connecticut
City:	Bloomfield
Latitude:	41.8527
Longitude:	-72.7362
Area Code:	860
Postal Code:	06002

Originating from them. is that your isp ?

[Ben Radlinski]

It is a circuit between our datacenter and Cigna's.  The router in our datacenter, Cigna-Waltham, and the router over in their datacenter, Cigna-Windsor, are reporting these traps to our internal monitoring system.  The traps were setup by a previous employee so I'm coming into this cold.  We're not sure what these alerts really mean.  I can't find exact details on the Internet for the SNMP codes, just general information.  We get them every day at the same time.  This is the first time I've really had the time to investigate them.  Any assistance you can provide will be greatly appreciated.

Paul Morin

Systems Engineer

NaviNet

[vmiller]

It appears that your ISP wrote their own MIB. That would explain why you can't find anything.

Have you contacted them regarding what the trap means? They basically own it.

I'd be tempted to filter it out since its theirs.

[Ben Radlinski]

We have not contacted them yet but now we will based on your findings.  Is that why I can't find any information on the last digits that follow the last period in the object ID?  That would make sense if it's their own that they created because I was able to find some information on the object ID, just not those last particular numerical values.

Thank you again for your help.

[vmiller]

Pretty much yes. Home grown mibs follow asn.1 down to a certain level then you roll your own.

If you can, post what you find out, I'm just curious.

thanks