This wiki has been migrated to and is now deprecated. Please use that site instead.
Differences between revisions 23 and 25 (spanning 2 versions)
Revision 23 as of 2007-01-11 17:54:38
Size: 11396
Editor: LuisOntanon
Comment: Add information about SNMPv3 decryption
Revision 25 as of 2007-01-11 17:59:19
Size: 11545
Editor: LuisOntanon
Comment: remove obsoleted RFC 2574
Deletions are marked like this. Additions are marked like this.
Line 150: Line 150:
 * [ RFC 2274] ''User-based Security Model (USM) for version 3 of the Simple Network Management Protocol (SNMPv3)''
Line 152: Line 151:
 * [ RFC 3414] ''User-based Security Model (USM) for version 3 of the Simple Network Management Protocol (SNMPv3)''
 * [ RFC 3826] ''The Advanced Encryption Standard (AES) Cipher Algorithm in the SNMP User-based Security Model''

Simple Network Management Protocol (SNMP)

SNMP is used to monitor and manage devices on networks.


XXX - add a brief description of SNMP history

Protocol dependencies

Typically, SNMP uses ["UDP"] as its transport protocol. The well known UDP ports for SNMP traffic are 161 (SNMP) and 162 (SNMPTRAP). It can also run over ["TCP"], ["Ethernet"], ["IPX"], and other protocols. ["ATM"] uses SNMP as its ["ILMI"] (Integrated Local Management Interface) protocol.


The SNMP dissector is fully functional. If propperly configured allows to decrypt encrypted SNMPv3 packets.

MIB files

Wireshark uses the [ Net-SNMP] libraries to resolve numeric OIDs (e.g. into human readable format (e.g. IF-MIB::ifPhysAddress.1). The default installation only contains some common MIB files so Wireshark won't be able to resolve all possible OIDs.

You can configure which MIB files are loaded by using the preference setting mentioned below, the MIBS environment variable or by editing snmp.conf as described in the [ Net-SNMP Tutorial] (XXX - is this true for Win32?) (XXX - which setting takes precedence?). You can also specify "ALL" in the preferences, resulting in all MIBs being loaded.

When specifying the MIB modules to load, use a colon separator. Note that the MIB module name is not necessarily the name of the file itself. The MIB name to use may be discovered by looking for the DEFINITIONS keyword in the MIB file.

For Unix systems, the MIB files are stored in /usr/local/share/snmp/mibs. Also make sure you have installed the Net-SNMP libs, the package is usually named something like libsnmp (XXX - which version is needed?).

For Windows, the MIB files are stored e.g. in C:\Program Files\Wireshark\snmp\mibs. The Net-SNMP libs are installed by the Wireshark setup.

XXX - are all MIB files in these dirs are inspected and only the "right" files loaded?

Many network-related MIBs definitions can be downloaded from or

Which MIB's do I need?

If you see any unresolved OID's you may need to add a MIB file to the Net-SNMP libs.

The following will give an example to add the missing information to display attachment:SampleCaptures/b6300a.cap correctly.

In packet 7 you see: SNMPv2-SMI::enterprise. resp.

What's missing now is the enterprise with the id 253. [ The IANA Private Enterprise Numbers list] tells us that this is Xerox.

Get hold of the Xerox MIBs from one of the links above and place them in the mibs directory (you need the printer-MIB as well) and change the file ending from .mib to .txt.

When loading a specified MIB module failed a warning message like: Cannot find module (IP-MIB): At line 0 in (none) will be shown on the console at Wireshark startup. WIN32: To have a console window already open at that time, set the preference setting "Open a console window" to "Always", Save the Preferences and restart Wireshark. Otherwise the console will be open too late and you'll see nothing.

Preference Settings

Wireshark's SNMP protocol preferences let you control the display of the OID in the info column, desegmentation of SNMP over TCP, and which MIB modules to load (see above).

The USMuserTable file preference allows the user to choose a file with the engine-ids, usernames and passwords in order to allow decryption of encrypted packets. The file is formated as follows:

# this is an example snmp_users_file

# comments start with a # and finish at the end of line
# empty lines are ignored 

# each record has the following fileds
# engine-id username auth_pass priv_pass auth_proto priv_proto
# fileds are separated by whitespace
# engine-id, username and passwds can be either "double quoted" or hex
# double quoted strings are c-style strings and take escape chars
# a '*' as engine-id matches any any given engine-id
# auth_proto can be either MD5 or SHA1 (or just SHA). Defaults to MD5 if not given.
# priv_proto can be either DES or AES. Defaults to DES if not given.
# protocols are case-insensitive (md5 == MD5)
# first match wins (place localized entries before those for any engine)

80001F888059DC486145A26322 "pippo" "plutoxxx" "PLUTOxxx" MD5 DES

# pippo for any engine will use DES and MD5
* "pippo" "plutoxxx" "PLUTOxxx"

80001F888059DC486145A26322 "pippo2" "plutoxxx" "PLUTOxxx" SHA

80001F888059DC486145A26322 "pippo3" "plutoxxx" "PLUTOxxx" SHA AES

# MD5 + AES
80001F888059DC486145A26322 "pippo4" "plutoxxx" "PLUTOxxx" AES

Example traffic

attachment:SampleCaptures/b6300a.cap A bunch of GETs and RESPONSEs

Display Filter

A complete list of SNMP display filter fields can be found in the [ display filter reference]

  • Show only the SNMP based traffic:


Capture Filter

You cannot directly filter SNMP protocols while capturing. However, if you know the ["UDP"] ports used (see above), you can filter on that ones.

  • Capture SNMP traffic over the default ports (161 and 162):

     udp port 161 or udp port 162 

SGMP (an ancestor of SNMP):



SNMPv2 (Community based)




Is there an easy way to find out, which MIB is really needed? From the example above: do I need all Xerox MIBs? Is there an online resource to find a map between the OID and the MIB?

SNMP (last edited 2019-11-01 21:48:45 by GuyHarris)