This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Show more characters on packet details fields.

0

I am having an issue in both Tshark and Wireshark. I am trying to export packet details from SNMP response packets that I receive. When viewing the packet details in both Tshark and wireshark they seem to only show a certain amount of characters for the field values I am trying to get. So this in turn makes the data incomplete. Here is an example of this:

Object Name: 1.3.6.1.4.1.1166.1.19.4.52.0 (iso.3.6.1.4.1.1166.1.19.4.52.0)                   
Value (OctetString): 0327308203233082020ba0030201020207014ceb4234d9f0...

As you can see the Value ends with "..." to signify that it continues. How can I get these full values? Preferably in TShark although if you know how in Wireshark, that can set me on the right track atleast.

Every Object's value seems to cut off as long as it exceeds a certain length of chars. I want to be able to get the full value without it cutting off.

I have tried using the field options in wireshark to display only those fields, although none of them seem to return any values except for the "snmp.value.oid" field. The full syntax I used was:

tshark -i 1 -R "snmp" -O "snmp" -T fields -e snmp.value.oid -e snmp.value.octets -V

Also here is an image of the SNMP packet details, as you can see the ones labeled Values(octetstring) which is the returned value that I am looking at grabbing ends in "..." They have been shortened significantly and I would like to grab the full value.

alt text

asked 30 Mar '14, 17:31

Joe%20Page's gravatar image

Joe Page
6335
accept rate: 0%


One Answer:

0

Please try this:

tshark -nr snmp.pcap -Y "snmp" -T fields -e frame.number -e ip.src -e ip.dst -e snmp.value.octet s -E header=y -E separator=;

If -Y does not work, please use -R instead.

Then parse the output and convert it to whatever format you need.

See also the other SNMP fields: http://www.wireshark.org/docs/dfref/s/snmp.html

Regards
Kurt

Regards
Kurt

answered 31 Mar '14, 01:35

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%