This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I am seeing SNMP traffic on my local network

0

I am not too sure if this should be happening but I don't think SNMP on a home network is the type of network traffic one should be seeing on their Local LAN.

A lot of Get requests seem to be made from what I am seeing an epson device. Correct me if I'm wrong. Is this a cause for concern to see SNMP. I know that typically speaking it's not a UDP protocol I want to see since SNMP is not even configured on my network.

alt text

asked 12 Oct '14, 10:57

Beldum's gravatar image

Beldum
49111116
accept rate: 0%


One Answer:

1

Have you any Epson devices in your network? Printer, Router, scanner etc. SNMP is used by pretty much anything on your network to communicate its preferences (I may have translated that badly..) Epsonnet Setup manager springs to mind

Basically if you have ANY epson devices, then no, it is nothing to worry about.

Oh, and for FJHADS sake Admins, get rid of this captcha.. I can't read it half the time..

answered 12 Oct '14, 11:19

DarrenWright's gravatar image

DarrenWright
216141520
accept rate: 26%

Thank you, I understood what you were saying clearly. What do all the get next request messages mean?

(12 Oct '14, 11:21) Beldum
Oh, and for FJHADS sake Admins, get rid of this captcha.. I can't read it half the time..

Unfortunately all the bottom-feeding scammers that like to post here make that impossible at this time, sorry for the inconvenience.

(12 Oct '14, 11:25) grahamb ♦

In that case, I need new glasses :/

ähm.. Think of snmp data as a kind of XML file. A get-next-request basically means, thanks, got that one , now tell me the next line. It is pretty innefficient (my personal belief), I assume it can, but I have never seen an address lookup, just a tree search with get-next.

Or the technical explanation: get-next-request is just like get-request, except it returns the item in the MIB just after the specified item (the “first lexicographic successor” in RFC terms). This operation comes into play most often when you are attempting to find all of the items in a logical table object. For instance, you might send a set of repeated get-next-requests to query for each line of a workstation’s ARP table. We’ll see an example of this in practice in a moment.

Quoted from: http://oreilly.com/perl/excerpts/system-admin-with-perl/twenty-minute-snmp-tutorial.html

(16 Oct '14, 12:02) DarrenWright