i'm receiving SNMP traps from network device (switchs), but how can i identify that this trap is coming from which device (switch)

Question

I'm receiving SNMP traps from network device (switches), but how can I identify that this trap is coming from which device (switch).

because trap containing only system uptime Notification type and actual data like (link up or down)

Received PDU...
Trap Type = -89
Variable Bindings = [1.3.6.1.2.1.1.3.0 = 0:01:35.00, 1.3.6.1.6.3.1.1.4.1.0 = 1.3.6.1.6.3.1.1.5.4, 1.3.6.1.2.1.2.2.1.1 = 1001, 1.3.6.1.2.1.2.2.1.7 = 1, 1.3.6.1.2.1.2.2.1.8 = 1]

Received PDU...
Trap Type = -89
Variable Bindings = [1.3.6.1.2.1.1.3.0 = 0:01:39.00, 1.3.6.1.6.3.1.1.4.1.0 = 1.3.6.1.6.3.1.1.5.4, 1.3.6.1.2.1.2.2.1.1 = 1009, 1.3.6.1.2.1.2.2.1.7 = 1, 1.3.6.1.2.1.2.2.1.8 = 1]

Received PDU...
Trap Type = -89
Variable Bindings = [1.3.6.1.2.1.1.3.0 = 0:01:35.01, 1.3.6.1.6.3.1.1.4.1.0 = 1.3.6.1.6.3.1.1.5.4, 1.3.6.1.2.1.2.2.1.1 = 1007, 1.3.6.1.2.1.2.2.1.7 = 1, 1.3.6.1.2.1.2.2.1.8 = 1]

     public static void main(String[] args)
   {
    TrapReceiver snmp4jTrapReceiver = new TrapReceiver();

    try
    {
      snmp4jTrapReceiver.listen(new UdpAddress("192.168.29.111/162"));
    }

    catch (IOException e)
    {
      System.err.println("Error in Listening for Trap");
      System.err.println("Exception Message = " + e.getMessage());
    }
  }

    public synchronized void listen(TransportIpAddress address) throws IOException
  {

    AbstractTransportMapping transport;

    if (address instanceof TcpAddress)
    {
      transport = new DefaultTcpTransportMapping((TcpAddress) address);
    }
    else
    {
      transport = new DefaultUdpTransportMapping((UdpAddress) address);
    }

    ThreadPool threadPool = ThreadPool.create("DispatcherPool", 10);
    MessageDispatcher mtDispatcher = new MultiThreadedMessageDispatcher(threadPool, new MessageDispatcherImpl());

    // add message processing models
    mtDispatcher.addMessageProcessingModel(new MPv2c());
    mtDispatcher.addMessageProcessingModel(new MPv1());
    
    SecurityProtocols.getInstance().addDefaultProtocols();
    SecurityProtocols.getInstance().addPrivacyProtocol(new Priv3DES());

    //Create Target
    CommunityTarget target = new CommunityTarget();
    target.setCommunity( new OctetString("snmpcom"));

    Snmp snmp = new Snmp(mtDispatcher, transport);
    snmp.addCommandResponder(this);

    transport.listen();
    System.out.println("Listening on " + address);

    try
    {
      this.wait();
    }
    catch (InterruptedException ex)
    {
      Thread.currentThread().interrupt();
    }
  }

    public synchronized void processPdu(CommandResponderEvent cmdRespEvent)
  {

    System.out.println("Received PDU...");
    PDU pdu = cmdRespEvent.getPDU();
    if (pdu != null)
    {

      System.out.println("Trap Type = " + pdu.getType());
      System.out.println("Variable Bindings = " + pdu.getVariableBindings());
      int pduType = pdu.getType();
      if ((pduType != PDU.TRAP) && (pduType != PDU.V1TRAP) && (pduType != PDU.REPORT)
      && (pduType != PDU.RESPONSE))
      {
        pdu.setErrorIndex(0);
        pdu.setErrorStatus(0);
        pdu.setType(PDU.RESPONSE);
        StatusInformation statusInformation = new StatusInformation();
        StateReference ref = cmdRespEvent.getStateReference();
        try
        {
          System.out.println(cmdRespEvent.getPDU());
          cmdRespEvent.getMessageDispatcher().returnResponsePdu(cmdRespEvent.getMessageProcessingModel(),
          cmdRespEvent.getSecurityModel(), cmdRespEvent.getSecurityName(), cmdRespEvent.getSecurityLevel(),
          pdu, cmdRespEvent.getMaxSizeResponsePDU(), ref, statusInformation);
        }
        catch (MessageException ex)
        {
          System.err.println("Error while sending response: " + ex.getMessage());
          LogFactory.getLogger(SnmpRequest.class).error(ex);
        }
      }
    }
  }

Answer 1

I'm not familiar to snmp4j but after taking a look on documentation looks like you could get switch ip address from CommandResponderEvent.

Now, as per shared outputs what you're seeing are all linkUPs traps

1.3.6.1.6.3.1.1.4.1.0 = 1.3.6.1.6.3.1.1.5.4

For three different ports / ifIndex: 1001, 1009 and 1007

1.3.6.1.2.1.2.2.1.1 = 1009

The correspondence between these numbers and the actual switch ports could be defined in device documentation.

Also, in all cases both ifOperStatus and ifAdminStatus are set to 1 (Up).

1.3.6.1.2.1.2.2.1.7 = 1 , 1.3.6.1.2.1.2.2.1.8 = 1

I hope this could give you an idea what to look for.

BR!