Wireshark not detecting udp snmptrap/162 port

Question

Hi

Can someone please advise how I can trace udp snmptrap/162 port on a Windows 7 PRO system using wireshark as I never see anything, using udp.port==162 filter or no filter (capturing everything).

Using Windows sysinternals process monitor I can see the following when monitoring SNMP trap snmptrap.exe service:

Date: 27/02/2014 16:28:58 Thread: 0 Class: Network Operation: UDP Receive Result: SUCCESS Path: FQDN:snmptrap -> FQDN:49589 Duration: 0.000000

Length: 43 seqnum: 0 connid: 0

Any ideas please,

I can see the trap using snmputil.exe from windows resource kit:

Incoming Trap:
generic    = 6
specific   = 1
enterprise = .iso.org.dod.internet.private.enterprises.2854
agent      = 192.168.154.114
source IP  = 192.168.154.114
community  = public

Thank you,

Best Regards - Colin

Answer 1

As you did not say where and how you captured the traffic, I'll have to assume several things, which is not good. It would have been better, if you had added that information in the first place ;-)

Case #1: You captured on the SNMP client
In this case, you're not seeing outgoing traffic (SNMP trap sender -> SNMP trap receiver). This has been reported in many other cases. Very often the problem has been some interfering software like AV, IDS, VPN client, Firewall, Endpoint Security (especially Symantec). If there is any security software running on the capturing system, try to disable or uninstall that software and then repeat your tests. If disabling/uninstalling is not an option, you need a different system (without that software) to capture traffic, like a bootable Linux CDROM or USB flash drive (see Kali Linux).

See also: http://ask.wireshark.org/tags/outgoing/

Case #2: You captured on the SNMP server, aka SNMP trap receiver
In this case, you're not seeing incoming traffic (SNMP traps coming in). Well, it could be interfering software as well, so see case #1. But more often the problem is that the traffic is simply not reaching the target system. Please double check that everything is setup correctly.

Case #3: You captured on a system where you sent SNMP traps to the same system (localhost) for testing.
In this case, you cannot see that traffic in Wireshark, as WinPcap is unable to capture localhost traffic. What you need is RawCap.

If none of the above cases apply, please add more details about your environment.

Regards
Kurt