linkDown SNMP trap not having the required varbinds - snmp

Question

There are 2 types of linkDown alarm
linkDown (CISCO-GENERAL-TRAPS) 1.3.6.1.2.1.11.0.2
linkDown (IF-MIB) 1.3.6.1.6.3.1.1.5.3
linkDown from CISCO-GENERAL-TRAPS mib contains the below varbinds
1.ifIndex
2.ifDescr
3.ifType
4.locIfReason
linkDown from If-MIB mib contains the below varbinds
1.ifIndex
2.ifAdminStatus
3.ifOperStatus
But the linkDown that I received from ME1200 devices has the below varbinds
1.IfIndex
2.IfDesc
3.IfType
4.lifTable
,Since the SNMP trap doesn't contain either of locIfReason and IfAdminStatus, I couldn't process this linkDown trap.
The lifTable varbind contains the Admin Status related information, but my question is why either of locIfReason and IfAdminStatus varbind is not available?. How to get the IfAdminStatus varbind from the device?

Answer 1

That OID for CISCO-GENERAL-TRAPS (actually CISCOTRAP-MIB?) linkDown does not appear to be correct. Offhand, I find an SMIv1 TRAP-TYPE definition for it, not a NOTIFICATION-TYPE, which means it was defined with an integer (not an OID), and its OID would be determined by RFC 2576 translation rules. In the SMIv1 MIB I found, their version of linkDown is defined with ENTERPRISE "snmp", which (as Andrew says above) means they're rather redefining the standard trap in that MIB; they should have instead used their own ENTERPRISE OID, which would have made it unique.
RFC 2576 conversion rules require that traps with ENTERPRISE "snmp" be mapped to one of the standard OIDs. Per those rules, 1.3.6.1.2.1.11.0.2 would not be the correct OID for CISCO-GENERAL-TRAPS:linkDown, it would be the same as the standard (1.3.6.1.6.3.1.1.5.3).
That is, if the module imported (or otherwise defined "snmp" with the standard OID), but it doesn't, so I can only assume this is a modified version of the MIB where that's been fixed. 1.3.6.1.2.1.11 is the OID of "snmp", so the 1.3.6.1.2.1.11.0.2 would be the OID if it were converted according to rules for traps other than ENTERPRISE "snmp". Somewhere along the way it's been converted incorrectly, in addition to overloading the standard trap's definition.

Answer 2

The linkDown and linkUp traps are generic. These traps are defined in standard RFC and have predefined set of variable bindings:
linkDown NOTIFICATION-TYPE
OBJECTS { ifIndex, ifAdminStatus, ifOperStatus }
STATUS current
DESCRIPTION
"A linkDown trap signifies that the SNMP entity, acting in
an agent role, has detected that the ifOperStatus object for
one of its communication links is about to enter the down
state from some other state (but not from the notPresent
state). This other state is indicated by the included value
of ifOperStatus."
::= { snmpTraps 3 }
linkUp NOTIFICATION-TYPE
OBJECTS { ifIndex, ifAdminStatus, ifOperStatus }
STATUS current
DESCRIPTION
"A linkUp trap signifies that the SNMP entity, acting in an
agent role, has detected that the ifOperStatus object for
one of its communication links left the down state and
transitioned into some other state (but not into the
notPresent state). This other state is indicated by the
included value of ifOperStatus."
::= { snmpTraps 4 }
The Cisco should not have modified these traps as it is not allowed. Instead they should have defined so called Enterprise specific traps.