This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I am having an issue in both Tshark and Wireshark. I am trying to export packet details from SNMP response packets that I receive. When viewing the packet details in both Tshark and wireshark they seem to only show a certain amount of characters for the field values I am trying to get. So this in turn makes the data incomplete. Here is an example of this:

Object Name: 1.3.6.1.4.1.1166.1.19.4.52.0 (iso.3.6.1.4.1.1166.1.19.4.52.0)                   
Value (OctetString): 0327308203233082020ba0030201020207014ceb4234d9f0...

As you can see the Value ends with "..." to signify that it continues. How can I get these full values? Preferably in TShark although if you know how in Wireshark, that can set me on the right track atleast.

Every Object's value seems to cut off as long as it exceeds a certain length of chars. I want to be able to get the full value without it cutting off.

I have tried using the field options in wireshark to display only those fields, although none of them seem to return any values except for the "snmp.value.oid" field. The full syntax I used was:

tshark -i 1 -R "snmp" -O "snmp" -T fields -e snmp.value.oid -e snmp.value.octets -V

Also here is an image of the SNMP packet details, as you can see the ones labeled Values(octetstring) which is the returned value that I am looking at grabbing ends in "..." They have been shortened significantly and I would like to grab the full value.

alt text

asked 30 Mar '14, 17:31

Joe%20Page's gravatar image

Joe Page
6335
accept rate: 0%


Please try this:

tshark -nr snmp.pcap -Y "snmp" -T fields -e frame.number -e ip.src -e ip.dst -e snmp.value.octet s -E header=y -E separator=;

If -Y does not work, please use -R instead.

Then parse the output and convert it to whatever format you need.

See also the other SNMP fields: http://www.wireshark.org/docs/dfref/s/snmp.html

Regards
Kurt

Regards
Kurt

permanent link

answered 31 Mar '14, 01:35

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×832
×166
×89
×43
×20

question asked: 30 Mar '14, 17:31

question was seen: 3,301 times

last updated: 31 Mar '14, 01:35

p​o​w​e​r​e​d by O​S​Q​A