A single trap is being processed on multiple models in Spectrum

Products

• Spectrum
• Network Observability

Issue/Introduction

A single trap is being processed on multiple models in Spectrum. This results in events and alarms being asserted on multiple models in Spectrum even though the trap was originally sent from only one of the devices.

Environment

Any version of Spectrum running on any supported operating system.

Cause

The ip address from the trap used by Spectrum to identify the model to process the trap on is shared by multiple models in the Spectrum database.

For V1 traps, Spectrum uses the ip address in the agent-addr of the trap PDU.

For V2 and V3 traps, Spectrum uses the source ip address of the trap packet.

When a device is first modeled in Spectrum, Spectrum reads the ipAddrTable and ipAddressTable tables to find ALL of the ip addresses configured on the device and stores them in the deviceIPAddressList attribute id 0x12a53 on the model. Then, every 60 minutes (1 hour) by default (configurable with the deviceIPAddressListPollInt attribute id 0x122d9), Spectrum re-reads the ipAddrTable and ipAddressTable tables to update the deviceIPAddressList accordingly.

When a trap is received, Spectrum checks the ip address associated with the trap and looks for models that have that ip address configured and will process the trap on all models found.

Resolution

If the shared ip address is not a valid ip address on one of the devices, the configuration should be changed to remove it. The deviceIPAddressList attribute on the associated model will be updated within the next hour and the ip address removed.

If this is by design, then, if the device configuration supports it, the ip address used to send the trap should be changed to a non-shared ip address.

Following the instructions outlined in knowledge article "When a trap source IP address is found on multiple devices in Spectrum, the trap is processed on all devices with the IP" to exclude the trap from being processed on a specific model.