Your switches are already telling you when something breaks. TrapWatch is what listens.

No device registry to keep up to date

Most trap collectors want you to declare every device before they will listen to it. That sounds tidy until the one box nobody documented is the one that fails — and its trap is discarded because it was not on the list.

TrapWatch accepts a trap from any address that can reach the port. The new device appears in the table the moment it speaks. If you want to restrict who is accepted, set community strings; traps that do not match are counted as rejected rather than silently dropped, so “why am I not seeing anything?” has an answer on screen instead of a shrug.

It says what the trap means

A raw trap is an OID and a list of numbered variables. TrapWatch decodes the standard ones — linkDown, linkUp, coldStart, warmStart, authenticationFailure — into a sentence, pulls the interface name out of the varbinds, and assigns a severity so a link drop does not sit at the same weight as a routine restart.

Vendor-specific traps are shown by their OID, exactly as received. TrapWatch does not invent a description for a trap it does not know. A plausible-sounding guess would send you looking in the wrong place, which is worse than an OID you can paste into a vendor search.

What the detection actually does

Three things, all running inside the application, on the machine you installed it on. No trap, address or community string is sent anywhere.

Flapping. A link that goes down and up repeatedly. It counts direction changes, not trap count — five linkUp traps in a row is a chatty device, not a flapping link, and calling it flapping would train you to ignore the alert.

Trap storms. It keeps a running average of how often each device sends each kind of trap, and reports when the rate departs from it. The comparison is against that device's own history, not a number someone guessed.

First sightings. A device that has never sent a trap before, or a trap OID never seen from anywhere. Often the most useful signal on the screen — and the reason it waits: it stays silent until it has a baseline, about half an hour, because on the first run everything is new.

Rules for what you already know

Detection covers what you do not know to look for. Rules cover what you do: alert on linkDown from these three core switches, at this severity or above, and do not repeat within five minutes.

The repeat suppression is keyed to the rule and the device. One noisy switch cannot bury the same event happening on a different one — a mistake that makes a quiet dashboard look like a working one.

Port 162 needs root. TrapWatch does not.

162 is the standard trap port and it is below 1024, so binding it requires administrator rights. TrapWatch listens on 1162 by default and starts without them. Point your devices at 1162, or grant the privilege and use 162 where the devices cannot be changed — the port is a setting, and the app tells you plainly when it cannot bind one.

Everything stays where you put it

Traps are written to the machine that received them, one file per day, and are never deleted to enforce a plan. The retention setting is yours to set — zero means keep everything. Export to CSV whenever you need to hand something to someone else.

There is no telemetry and no licensing callback. The licence key is verified against a public key built into the application, so activation works on a network with no outbound access at all.

It fits with the rest

TrapWatch works on its own. Connected to your own MeshWatch Central server, its alerts join whatever SyslogWatch, DeviceWatch, TrafficWatch, CertWatch and ConfigWatch are reporting, so a link that flapped and a config that changed on the same switch arrive as one incident rather than two unrelated lines.

What goes to Central is the severity, the source address and a one-line summary. Never the varbinds — a device can put anything in those — and never the community string, which is effectively a password.

Four languages

The interface is English, Japanese, Korean and Simplified Chinese, switchable while it runs. What a device sent — its address, the trap OID, the interface name — is never translated. Rewriting what arrived on the wire is not something a monitoring tool should do.