This is our old Q&A Site. Please post any new questions and answers at

Hello WIRESHARK community!

I need your help because i mark time here with a little Lua scripting problem. My aim is to count lost SNMP transactions. Therefore i need to read out the snmp.request_id field to handle requests and responses belonging together. Unfortunately it is not working as it should. Here is my little debugging code example <snmpreqid.lua>:

snmp_reqID_extr ="snmp.request_id")
snmp =,"snmp");
function snmp.packet()
mymsgid = snmp_reqID_extr()

Execution: tshark -X lua_script:snmpreqid.lua -r "snmptrace.pcap"

TSHARK Output:


The field "snmp.request_id" is correct. I tried to filter out some SNMP V2c Packages in WIRESHARK and it works fine.

WIRESHARK Filter Expression: snmp.request_id==1959316333
WIRESHARK Package view:
4 SNMP  get-request  ID: 1959316333
5 SNMP  get-response ID: 1959316333

A test it with the neighbor field "snmp.error_status" was successful

snmp_reqID_extr ="snmp.error_status")

TSHARK Output:


Used WIRESHARK 1.4.2, 1.4.4, 1.5 - problem persists. Read out msgID working at SNMP V3 but not feasible with SNMP V2c because its not implemented in the message header.

I would be very glad if you could help me on with this problem.

asked 04 Mar '11, 01:02

snmpmeier's gravatar image

accept rate: 0%

Be the first one to answer this question!
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 04 Mar '11, 01:02

question was seen: 4,525 times

last updated: 04 Mar '11, 01:02

p​o​w​e​r​e​d by O​S​Q​A