Ask Your Question
0

Wireshark packet result display as ASCII after 4.x version

asked 2023-01-02 01:37:50 +0000

Morty gravatar image

updated 2023-01-02 06:53:28 +0000

Jaap gravatar image

Hi Wireshark experts

I use SNMP walk for capture some mac address and find after 4.x version some mac address will auto display as ASCII but before 4.x it display normal. Is there some code change ?

edit retag flag offensive close merge delete

Comments

Can you show a snippet of text of what you refer to?

Jaap gravatar imageJaap ( 2023-01-02 12:28:10 +0000 )edit

if i use 3.x wireshark open the SNMP output for mac is as 38 7c 76 4a 21 20 if use 4.x will display as ASCII output 8|vJ!

Morty gravatar imageMorty ( 2023-01-02 12:34:57 +0000 )edit

What does the MIB define as syntax for this object? Probably OCTET STRING.
Then this is probably a consequence of issue 16900

Jaap gravatar imageJaap ( 2023-01-02 15:10:04 +0000 )edit

What is the OID (mib variable) you're looking at?

Chuckc gravatar imageChuckc ( 2023-01-02 23:12:14 +0000 )edit

Not Mib checking only OID output result display is different

Morty gravatar imageMorty ( 2023-01-03 08:00:23 +0000 )edit

1 Answer

Sort by » oldest newest most voted
0

answered 2023-01-04 07:08:25 +0000

Jaap gravatar image

There was a code change to address issue 16900 which was included in Wireshark version 3.4.0 and later. This change results in an OCTET STRING being presented as an ASCII string only when all octets contain printable ASCII values. This heuristic does sometimes give a false positive, e.g., when it so happens that all the octets of a MAC address happen to be all printable ASCII values, as the question shows.

An issue could be raised to request to show OCTET STRINGs as bytes always, and as an ASCII string only in addition to it, when the heuristic suggests it is an ASCII string.

edit flag offensive delete link more

Comments

In this case ifPhysAddress -> PhysAddress -> OCTET STRING so working as coded.
Could there be a SNMP preference setting to display OIDs of type PhysAddress as hex?
There is code in epan/oids.c handle MAC address OIDs:
{"MacAddress",SMI_BASETYPE_UNKNOWN,&ether_type},

rfc1573:

   ifPhysAddress OBJECT-TYPE
       SYNTAX      PhysAddress


rfc1443:

          PhysAddress ::= TEXTUAL-CONVENTION
              DISPLAY-HINT "1x:"
              STATUS       current
              DESCRIPTION
                      "Represents media- or physical-level addresses."
              SYNTAX       OCTET STRING
Chuckc gravatar imageChuckc ( 2023-01-04 16:10:18 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

Stats

Asked: 2023-01-02 01:36:18 +0000

Seen: 65 times

Last updated: Jan 04