Bad Trap Packet received in SolarWinds Platform Legacy Traps/OLV

The following error message appears within the Traps Service:
 

Trap Service Failed to receive Traps

Traps Viewer will not show the Traps from the Node

ERROR TrapService.TrapService – Bad trap packet received from Node with IP xxx.xxx.x.x. Error description – Unknown user and engine. Packet discarded
 

We receive such events when the node is sending the traps to the SolarWinds Platform. The SNMP v3 trap packet is verified against the SNMP authentication for the node in order to translate the encrypted trap information.

The SNMP information sent by the Node within Trap does not match with the Node in the SolarWinds Platform database.

Make sure that the node is sending traps with the same SNMP user account that is used in the SolarWinds Platform when adding the node. The trap packet will only be recognized if it sent with the correct SNMP user account.
 

1. Edit the node in the SolarWinds Platform and note down the SNMPv3 username. SolarWinds Platform Web Console > Go to the Node > Edit Node. 

Note: The username is also shown in the nodes table in the SolarWinds Platform database.

2. Run Wireshark on the SolarWinds server to filter the traffic for traps sent by the node.
3. The username that was previously should match the trap is received.

Start > All Programs > SolarWinds Platform > Database Manager> Add Default Server > 

Right Click on the Orion DB > New Query > Type the below Query: 

-- Scripts are not supported under any SolarWinds support program or service.
-- Scripts are provided AS IS without warranty of any kind. SolarWinds further
-- disclaims all warranties including, without limitation, any implied warranties
-- of merchantability or of fitness for a particular purpose. The risk arising
-- out of the use or performance of the scripts and documentation stays with you.
-- In no event shall SolarWinds or anyone else involved in the creation,
-- production, or delivery of the scripts be liable for any damages whatsoever
-- (including, without limitation, damages for loss of business profits, business
-- interruption, loss of business information, or other pecuniary loss) arising
-- out of the use of or inability to use the scripts or documentation.

SELECT * FROM  [dbo].[Nodes] where ip_address = 'Type_your_Node_IP_here'  

You will need to Run the Wireshark on the SolarWinds server. Filter the traffic for Traps sent by the Node and verify the User name should be matching when receiving the Trap. In the below packet capture example where the Trap is sent by the device (ie. 192.168.1.1 with user ABC) which caused the above Event that should be correct in the Node.
 

Following example included where the correct SNMP user is been sent by the node within Trap information

We have seen Aruba-specific cases where SNMPv3 trap packets reach SolarWinds but are malformed in a way that prevents decryption/processing. In those cases, disabling SNMPv3 Inform on the Aruba device resolved the issue. As general guidance, please also verify the node is monitored via SNMPv3, the trap source IP matches the node polling IP, the SNMPv3 credentials match exactly, and UDP 162 is open.