This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hello WIRESHARK community!

I need your help because i mark time here with a little Lua scripting problem. My aim is to count lost SNMP transactions. Therefore i need to read out the snmp.request_id field to handle requests and responses belonging together. Unfortunately it is not working as it should. Here is my little debugging code example <snmpreqid.lua>:

snmp_reqID_extr = Field.new("snmp.request_id")
snmp = Listener.new(nil,"snmp");
function snmp.packet()
mymsgid = snmp_reqID_extr()
print(tostring(mymsgid))

Execution: tshark -X lua_script:snmpreqid.lua -r "snmptrace.pcap"

TSHARK Output:

nil
nil
nil
...

The field "snmp.request_id" is correct. I tried to filter out some SNMP V2c Packages in WIRESHARK and it works fine.

WIRESHARK Filter Expression: snmp.request_id==1959316333
WIRESHARK Package view:
4 SNMP  get-request 1.3.6.1.2.1.1.3  ID: 1959316333
5 SNMP  get-response 1.3.6.1.2.1.1.3 ID: 1959316333

A test it with the neighbor field "snmp.error_status" was successful

snmp_reqID_extr = Field.new("snmp.error_status")

TSHARK Output:

0
0
0
...

Used WIRESHARK 1.4.2, 1.4.4, 1.5 - problem persists. Read out msgID working at SNMP V3 but not feasible with SNMP V2c because its not implemented in the message header.

I would be very glad if you could help me on with this problem.

asked 04 Mar '11, 01:02

snmpmeier's gravatar image

snmpmeier
16112
accept rate: 0%

Be the first one to answer this question!
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×832
×637
×431

question asked: 04 Mar '11, 01:02

question was seen: 4,346 times

last updated: 04 Mar '11, 01:02

p​o​w​e​r​e​d by O​S​Q​A