This wiki has been migrated to https://gitlab.com/wireshark/wireshark/-/wikis/home and is now deprecated. Please use that site instead.
Differences between revisions 9 and 10
Revision 9 as of 2006-03-11 10:36:59
Size: 6556
Editor: UlfLamping
Comment: clarify ports used
Revision 10 as of 2006-03-11 13:19:54
Size: 7842
Editor: UlfLamping
Comment: start explanation how to add a MIB file
Deletions are marked like this. Additions are marked like this.
Line 22: Line 22:
== MIB files ==

Ethereal uses the [http://www.net-snmp.org/ Net-SNMP] or UCD SNMP libraries to resolve numeric OIDs (e.g. 1.3.6.1.2.1.2.2.1.6.1) into human readable format (e.g. IF-MIB::ifPhysAddress.1). The default installation only contains some common MIB files so Ethereal won't be able to resolve all possible OIDs.

You can configure which MIB files are loaded by using the preference setting mentioned below, the MIBS environment variable or by editing snmp.conf as described in the [http://www.net-snmp.org/tutorial/tutorial-5/commands/mib-options.html Net-SNMP Tutorial] (XXX - is this true for Win32?) (XXX - which setting takes precedence?).

When specifying the MIB modules to load, use a colon separator. Note that the MIB module name is not necessarily the name of the file itself. The MIB name to use may be discovered by looking for the DEFINITIONS keyword in the MIB file.

For Unix systems, the MIB files are stored in /usr/local/share/snmp/mibs. Also make sure you have installed the Net-SNMP libs, the package is usually named something like libsnmp (XXX - which version is needed?).

For Windows, the MIB files are stored e.g. in C:\Program Files\Ethereal\snmp\mibs. The Net-SNMP libs are installed by the Ethereal setup.

XXX - are all MIB files in these dirs are inspected and only the "right" files loaded?

Many network-related MIBs definitions can be downloaded from http://bytesphere.com/mibs/detail.html or http://www.mibdepot.com.

=== Which MIB's do I need? ===

If you see any unresolved oid's you may need to add a MIB file to the Net-SNMP libs.

The following will give an example to add the missing information to display attachment:SampleCaptures/b6300a.cap correctly.

In packet 7 you see: SNMPv2-SMI::enterprise.253.8.64.4.2.1.5.10.14150900 resp. 1.3.6.1.4.1.253.8.64.4.2.1.5.10.14150900.

What's missing now is the enterprise with the id 253. The assigned numbers [http://www.ietf.org/rfc/rfc1700.txt RFC 1700] tells us (in the section "PRIVATE ENTERPRISE NUMBERS"), this is Xerox.

XXX - How to continue then?
Line 24: Line 52:
Ethereal's SNMP protocol preferences let you control the display of the OID in the info column, desegmentation of SNMP over TCP, and which MIB modules to load. Ethereal uses the [http://www.net-snmp.org/ Net-SNMP] or UCD SNMP libraries to resolve OIDs, so you can also configure this behavior using the MIBS environment variable or by editing snmp.conf as described in the [http://www.net-snmp.org/tutorial/tutorial-5/commands/mib-options.html Net-SNMP Tutorial].

For Unix systems, the MIB files are stored in /usr/local/share/snmp/mibs. For Windows, use C:\Program Files\Ethereal\snmp\mibs.

When specifying the MIB modules to load, use a colon separator for Unix and a semi-colon for Windows. The MIB name to use may be discovered by looking for the DEFINITIONS keyword in the MIB file. Note that the MIB name is not necessarily the name of the file itself.

Many network-related MIBs definitions can be downloaded from http://bytesphere.com/mibs/detail.html.
Ethereal's SNMP protocol preferences let you control the display of the OID in the info column, desegmentation of SNMP over TCP, and which MIB modules to load (see above).

Simple Network Management Protocol (SNMP)

SNMP is used to monitor and manage devices on a network.

History

XXX - add a brief description of SNMP history

Protocol dependencies

Typically, SNMP uses ["UDP"] as its transport protocol. The well known UDP ports for SNMP traffic are 161 (SNMP) and 162 (SNMPTRAP). It can also run over ["TCP"], ["Ethernet"], ["IPX"], and other protocols. ["ATM"] uses SNMP as its ["ILMI"] (Integrated Local Management Interface) protocol.

Example traffic

attachment:SampleCaptures/b6300a.cap A bunch of GETs and RESPONSEs

Ethereal

The SNMP dissector is fully functional.

MIB files

Ethereal uses the [http://www.net-snmp.org/ Net-SNMP] or UCD SNMP libraries to resolve numeric OIDs (e.g. 1.3.6.1.2.1.2.2.1.6.1) into human readable format (e.g. IF-MIB::ifPhysAddress.1). The default installation only contains some common MIB files so Ethereal won't be able to resolve all possible OIDs.

You can configure which MIB files are loaded by using the preference setting mentioned below, the MIBS environment variable or by editing snmp.conf as described in the [http://www.net-snmp.org/tutorial/tutorial-5/commands/mib-options.html Net-SNMP Tutorial] (XXX - is this true for Win32?) (XXX - which setting takes precedence?).

When specifying the MIB modules to load, use a colon separator. Note that the MIB module name is not necessarily the name of the file itself. The MIB name to use may be discovered by looking for the DEFINITIONS keyword in the MIB file.

For Unix systems, the MIB files are stored in /usr/local/share/snmp/mibs. Also make sure you have installed the Net-SNMP libs, the package is usually named something like libsnmp (XXX - which version is needed?).

For Windows, the MIB files are stored e.g. in C:\Program Files\Ethereal\snmp\mibs. The Net-SNMP libs are installed by the Ethereal setup.

XXX - are all MIB files in these dirs are inspected and only the "right" files loaded?

Many network-related MIBs definitions can be downloaded from http://bytesphere.com/mibs/detail.html or http://www.mibdepot.com.

Which MIB's do I need?

If you see any unresolved oid's you may need to add a MIB file to the Net-SNMP libs.

The following will give an example to add the missing information to display attachment:SampleCaptures/b6300a.cap correctly.

In packet 7 you see: SNMPv2-SMI::enterprise.253.8.64.4.2.1.5.10.14150900 resp. 1.3.6.1.4.1.253.8.64.4.2.1.5.10.14150900.

What's missing now is the enterprise with the id 253. The assigned numbers [http://www.ietf.org/rfc/rfc1700.txt RFC 1700] tells us (in the section "PRIVATE ENTERPRISE NUMBERS"), this is Xerox.

XXX - How to continue then?

Preference Settings

Ethereal's SNMP protocol preferences let you control the display of the OID in the info column, desegmentation of SNMP over TCP, and which MIB modules to load (see above).

Example capture file

XXX - Add a simple example capture file to the SampleCaptures page and link from here. Keep it short, it's also a good idea to gzip it to make it even smaller, as Ethereal can open gzipped files automatically.

Display Filter

A complete list of SNMP display filter fields can be found in the [http://www.ethereal.com/docs/dfref/s/snmp.html display filter reference]

  • Show only the SNMP based traffic:

     snmp 

Capture Filter

You cannot directly filter SNMP protocols while capturing. However, if you know the ["UDP"] ports used (see above), you can filter on that ones.

  • Capture SNMP traffic over the default ports (161 and 162):

     udp port 161 or udp port 162 

SGMP (an ancestor of SNMP):

SNMPv1

SNMPv2

SNMPv2 (Community based)

SNMPv3

Discussion

SNMP (last edited 2019-11-01 21:48:45 by GuyHarris)