MATE snmp session

Question

I need to examine snmp session that are longer that 30 seconds

I`m using this mate.config

Pdu snmp_pdu Proto snmp Transport udp/ip {
    Extract addr From ip.addr;
    Extract port From udp.port;
    Extract oid From snmp.name;
    Extract snmp_data From snmp.data;
};
Gop snmp_ses On snmp_pdu Match (addr, addr, port, port){
    Start();
    Stop(never);
};
Done;

So in one Gop i have all packets with same addr and ports. But after awhile (2-3 minutes) i have another snmp packets with sames ports, so them got to one Gop and i can`t use mate.snmp_ses.Duration>30 filter. What conditions i need to group snmp sessions?

Answer 1

So you're saying the first group of packets had an end and a new group started (or at least you want them in different GoPs)?

In that case you'll need some kind of Stop() condition other than "never". I don't know enough about SNMP to know what, if anything, you could use to do that.

(BTW I don't think you need to say "addr, addr" and "port, port" in the GoP match; just "addr, port" would be sufficient.)