cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
TCC_2
Advocate
Advocate

Core issue

When using signature auto-update in NM-CIDS modules running 5.1(1), you do not receive any Simple Network Management Protocol (SNMP) traps when an update completes. But  SNMP trap messages can be recieved when a signature update fails.

Resolution

SNMP Trap: SNMP protocol have 5 basic message types, SNMP Trap is one of them.

Why SNMP trap is unique from all other message types?

  • It is the only scenario where SNMP agent in the field initiates the communication with SNMP Manager. Remaining 4 types of SNMP message types are initiated by the SNMP manager or issued in response to an SNMP manager's message. A trap is a way of notifying the SNMP manager that "something is wrong".

When using signature auto-update in NM-CIDS modules running 5.1(1), you do not receive any Simple Network Management Protocol (SNMP) traps when an update completes. But  SNMP trap messages can be recieved when a signature update fails.

CISCO-CIDS-MIB defines the ciscoCideError notification when there is an error on the sensor, as shown in this example:

CiscoCidsError NOTIFICATION-TYPE

cidsGeneralEventId,
cidsGeneralLocalTime,
cidsGeneralUTCTime,
cidsGeneralOriginatorHostId,
cidsErrorSeverity,
cidsErrorName,
cidsErrorMessage


Since the sigupdate fail is an evError, it is sent as a trap. A successful update is not considered an error, and therefore no error warning is generated when an update is completed.

Protocol / Ports

Simple Network Management Protocol (SNMP)

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Quick Links