This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I need to examine snmp session that are longer that 30 seconds

I`m using this mate.config

Pdu snmp_pdu Proto snmp Transport udp/ip {
    Extract addr From ip.addr;
    Extract port From udp.port;
    Extract oid From snmp.name;
    Extract snmp_data From snmp.data;
};
Gop snmp_ses On snmp_pdu Match (addr, addr, port, port){
    Start();
    Stop(never);
};
Done;

So in one Gop i have all packets with same addr and ports. But after awhile (2-3 minutes) i have another snmp packets with sames ports, so them got to one Gop and i can`t use mate.snmp_ses.Duration>30 filter. What conditions i need to group snmp sessions?

asked 04 Mar '14, 06:38

Fullmetal8ender's gravatar image

Fullmetal8ender
11112
accept rate: 0%


So you're saying the first group of packets had an end and a new group started (or at least you want them in different GoPs)?

In that case you'll need some kind of Stop() condition other than "never". I don't know enough about SNMP to know what, if anything, you could use to do that.

(BTW I don't think you need to say "addr, addr" and "port, port" in the GoP match; just "addr, port" would be sufficient.)

permanent link

answered 12 Mar '14, 17:45

JeffMorriss's gravatar image

JeffMorriss ♦
6.2k572
accept rate: 27%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×1,620
×27
×12

question asked: 04 Mar '14, 06:38

question was seen: 1,580 times

last updated: 12 Mar '14, 17:45

p​o​w​e​r​e​d by O​S​Q​A