This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Incorrect error reported by Wireshark’s SNMP dissector

0

In the MIB extract below, SNMP variable radarName, used as INDEX, is defined as DisplayString (SIZE (4)) in the OBJECT-TYPE definition. DisplayString is imported from SNMPv2-TC and defined as OCTET STRING (SIZE(0..255)). In the ASN1 SEQUENCE radarName is defined with SYNTAX DisplayString and this is where the trouble starts. According to the ASN SEQUENCE definition the radarName will be encoded as variable string, so 1 length bytes and "length" databytes. According to the OBJECT TYPE definition, specializing the type, radarName will be encoded as a fixed string of 4 bytes.

Send over the wire is indeed a fixed 4 byte string, which is correctly interpreted by our management station using SNMP++ and libsmi. However wireshark is reporting a problem because it expects a variable length string and puts an error message "index string should not be longer than remaining oid size" on the screen. It interprets the first string byte as length. To my opinion wireshark's implementation is incorrect. The SNMP dissector (epan/dissectors/packet-snmp.c) is generated automatically by the ASN.1 to Wireshark dissector compiler and so misses the specialization to a fixed string variable as defined in the OBJECT-TYPE. I have checked the MIB on the internet with the libsmi online checker, which does not report an error on the used constructs. Does someone agree with me that the wireshark's implementation is incorrect ?

radarEntry OBJECT-TYPE SYNTAX RadarEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "A radar managed by ART-DACO. " INDEX { radarName } ::= { radarTable 1 }

RadarEntry ::= SEQUENCE { radarName DisplayString, radarActConfStatus RadConfType, radarIntConfStatus RadConfType, radarActOperationalPath PathIdType, radarIntOperationalPath PathIdType, sensorPsrStatus SensorRadStatusType, sensorSsrStatus SensorRadStatusType, sensorMdsStatus SensorRadStatusType, sensorRadarOverload RadOverloadType, sensorRadarError RadErrorType, artasRadarSiteStatus ArtasRadStatusType, artasRadarOverload RadOverloadType, artasRadarSsrRangeGain Integer32, artasRadarSsrRangeBias Integer32, artasRadarSsrAzimuthBias Integer32, artasRadarPsrRangeGain Integer32, artasRadarPsrRangeBias Integer32, artasRadarPsrAzimuthBias Integer32, artasRadarTimeBias Integer32, radarNbScan Integer32, radarOutGlobalTotalSnd Integer32, radarOutGlobalNbSndAst001 Integer32, radarOutGlobalNbSndAst002 Integer32, radarOutGlobalNbSndAst034 Integer32, radarOutGlobalNbSndAst048 Integer32, radarOutGlobalNbScanMarkerMsg Integer32, radarOutGlobalNbSectorMsg Integer32, radarOutGlobalNbPsrTarget Integer32, radarOutGlobalNbSsrTarget Integer32, radarOutGlobalNbMdsTarget Integer32, radarOutGlobalNbPsrSsrTarget Integer32, radarOutGlobalNbPsrMdsTarget Integer32, radarOutGlobalNbCancelMsg Integer32, radarOutScanTotalSnd Integer32, radarOutScanNbSndAst001 Integer32, radarOutScanNbSndAst002 Integer32, radarOutScanNbSndAst034 Integer32, radarOutScanNbSndAst048 Integer32, radarOutScanNbScanMarkerMsg Integer32, radarOutScanNbSectorMsg Integer32, radarOutScanNbPsrTarget Integer32, radarOutScanNbSsrTarget Integer32, radarOutScanNbMdsTarget Integer32, radarOutScanNbPsrSsrTarget Integer32, radarOutScanNbPsrMdsTarget Integer32, radarOutScanNbCancelMsg Integer32, radarOutScanCmbRate Integer32, radarBiasStartTime DisplayString, radarBiasNumSamples Integer32, radarBiasRangeMean DisplayString, radarBiasRangeConfidenceStart DisplayString, radarBiasRangeConfidenceEnd DisplayString, radarBiasAzimuthMean DisplayString, radarBiasAzimuthConfidenceStart DisplayString, radarBiasAzimuthConfidenceEnd DisplayString, radarAlarm AlarmSeverityType, radarAlarmSummary AlarmSummaryType, radarAlarmDetails AlarmDetailsType }

radarName OBJECT-TYPE SYNTAX DisplayString (SIZE (4)) MAX-ACCESS read-only STATUS current DESCRIPTION "Name of this radar. This variable is used as an index for the radarTable. " ::= { radarEntry 1 }

asked 21 Jul '11, 09:18

MommersMHA's gravatar image

MommersMHA
1111
accept rate: 0%