See Rogue Endpoint connections in real-time

Scenario: White List is set up but you want real-time or near real-time alerts when a rogue device connects to the network.

Set up your devices to send connection-related traps to the UDT server. UDT checks the database for trap-related information at set intervals. If an endpoint connects to a UDT device, and the endpoint is not on the White List, UDT posts an alert in the Web Console.

To enable your Cisco devices to send trap messages:

1. Open a command line in config mode on your device.
2. Execute the commands from the examples, changing the IP address to match your UDT server.

   Traps (IOS)

   snmp-server host 10.110.68.33 public config

   snmp trap mac-notification change added

   snmp trap mac-notification change removed

   Traps (CatOS)

   set snmp trap 10.110.68.33 public config

   snmp trap mac-notification change added

   snmp trap mac-notification change removed

3. Open the UDT Settings on the UDT server (Settings > UDT Settings).
4. Click Advanced Settings.
5. Enter a value (in seconds) under MAC Notification Processing Inverval for the frequency with which you want UDT to check for new trap messages.
6. Click Save.