We use SDC-TrapX as trap receiver and forward to Spectrum.
There are many unknown traps that are forwarded to Spectrum. How can we block those unknown traps from being forwarded to Spectrum via SDC-TrapX?.
Here is an example:
Model URL : https:/OneClick:8443/spectrum/oneclick.jnlp?topology=0x369667
Created On : Nov 29, 2021 2:14:21 PM EST
Name : Device
Event : Unknown alert received from device Device of type GnCiscoDev. Device Time 189+14:35:32. (Trap type 220.127.116.11.18.104.22.168.1)
Trap var bind data:
OID: 22.214.171.124.126.96.36.199.188.8.131.52.644.1 Value: 6
OID: 184.108.40.206.220.127.116.11.18.104.22.168.22.214.171.124.245.207.76.43135 Value: 5
OID: 126.96.36.199.188.8.131.52.184.108.40.206.10.49.128.65.220.127.116.11.76.43135 Value: 380
OID: 18.104.22.168.22.214.171.124.126.96.36.199.10.49.128.65.188.8.131.52.76.43135 Value: 8505
OID: 184.108.40.206.220.127.116.11.18.104.22.168.10.49.128.65.22.214.171.124.76.43135 Value: 10923
OID: 126.96.36.199.188.8.131.52.184.108.40.206.644 Value: Value
Created By : System
Release : Any
Component : Spectrum Trap-X
Using the above trap oid as an example, add the following filter near the top of the trapX.conf file as one of the first filters evaluated:
filter * * * 6 1 1\.3\.6\.1\.4\.1\.9 break
break: This action causes no action to be taken for a given trap. No further filter processing is done on the current Trap PDU, and does not evaluate any remaining filters for the current Trap. Any option to this action is ignored.
The reason you want to place this near the top of the trapX.conf file as one of the first filters evaluated is so no other filters will be evaluated that may cause this trap to be forwarded.
Please reference the "SDC TrapX Support" section of the documentation for more information.