Decoding SNMP trap OIDs and values

Many thanks: just realised they're custom, so no surprise )

Just tried linking all 3 MIBs (BROADHOP-MIB, BROADHOP-NOTIFICATION-MIB, BROADHOP-QNS-MIB) as explained w/o any luck:

"in the the "Preferences" dialog opened by the "Edit ==> Preferences" menu item, under the topic "Name resolution", you will find a button "SMI (MIB amd PIB) Modules" which opens an editing window where you can add/remove modules. The name of the file you add to the "mibs" directory mentioned above must be the same as the module name itself (found in the MIB itself at the start, just before "DEFINITIONS ::=BEGIN")."

I cannot see my OIDs in any of the MIBs though. Should they show up there exactly as they are, e.g. 1.3.6.1.4.1.26878.100.1.1.7?

MIBs are usually part of a hierarchy, so at the top of the MIB there will be an IMPORTS section that imports definitions from other mibs, then there will be definitions that add on to those imports.

So the OID 1.3.6.1.4.1 is enterprises from RFC1155-SMI, which also defines iso, org, dod, internet, private which is the 1.3.6.1.4 part, 26878 is the organisation (BROADHOP), probably in the BROADHOP-MIB, and then the 100.1.1.7 will be defined in parts in the series of BROADHOP MIB's.

There are various MIB explorer tools that will show the OID's in a GUI or you can parse the MIB files by hand. Wireshark will require all MIB files in the chain to resolve a specific OID.

Thank you - I think I can decode them manually now:

BROADHOP-MIB file starts with this, referring to SNMPv2-SMI as you mentioned:

BROADHOP-MIB DEFINITIONS ::= BEGIN

IMPORTS MODULE-IDENTITY, OBJECT-TYPE, NOTIFICATION-TYPE, enterprises, Integer32 FROM SNMPv2-SMI DisplayString FROM SNMPv2-TC;

Further down I can see 26878 defined:

broadhop MODULE-IDENTITY

...<removed>...

::= { enterprises 26878 }

and then the next 3 positions:

broadhopCommon OBJECT IDENTIFIER ::= { broadhop 100 }

broadhopCommonNotificationsGroup OBJECT IDENTIFIER ::= { broadhopCommon 1 }

broadhopNotificationParameters OBJECT IDENTIFIER ::= { broadhopCommonNotificationsGroup 1 }

and finally individual parameters, e.g. 7 is broadhopComponentName, 8 is broadhopComponentTime and so on.

Now wondering why Wireshark cannot do the same automatically...

The library used to resolve the OID to name is very strict about MIB conformance to the standard. I've seen many MIBs that violate one or another rule, thereby rejected by libsmi. Wireshark can be tuned to suppress these errors, so may have this problem too. Using smilint (or visiting simpleweb) allows you to test the MIBs conformance. Oh, one more thing, have you ticked 'enable OID resolution', and restarted Wireshark?