When dtrapd daemon receives a SNMP-Trap message, it checks whether an IP address of a sender is on the list with accepted addresses, if such list exists. When the IP address is not on this list, the message is rejected. When such list is empty, dtrapd checks whether the IP address is on the list with unaccepted addresses. If yes, the message is rejected. Messages which are not rejected in such way, are processed in the same way regarding community field in the message.

For non-rejected messages specified programs are run according to the configuration of dtrapd. If dtrapd is run without --extended-distribution option and an IP address of a sender of the message matches a regular expression of a given line of the configuration file, a program specified in this line is run and data included in the message are passed to that program as its input parameters. If dtrapd is run with --extended-distribution option and a number of the message or an identifier of the enterprise, or variables included in the packet match a regular expression of a given line of the configuration file, a program specified in this line is run and data included in the message are passed to that program as its input parameters.

So, if you want to run a program only for the first matched line, you must run dtrapd daemon with -o option.