Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

tshark command to decode snmpv3 packets / traps

I am running the below command where I can see SNMP v3 tarps getting received at the receiver end. But the problem is I am not able to decode and see the snmp trap details / description.

[vagrant@osboxes ~]$ sudo tshark -f "udp port 162" [sudo] password for vagrant: Running as user "root" and group "root". This could be dangerous. Capturing on 'eth0' 1 0.000000000 10.191.245.253 -> 10.75.234.94 SNMP 550 encryptedPDU: privKey Unknown 2 299.985368217 10.191.245.253 -> 10.75.234.94 SNMP 550 encryptedPDU: privKey Unknown 3 496.713126083 10.196.28.26 -> 10.75.234.94 SNMP 550 encryptedPDU: privKey Unknown 4 599.961958035 10.191.245.253 -> 10.75.234.94 SNMP 550 encryptedPDU: privKey Unknown 5 899.955601562 10.191.245.253 -> 10.75.234.94 SNMP 550 encryptedPDU: privKey Unknown 6 1199.988740264 10.191.245.253 -> 10.75.234.94 SNMP 550 encryptedPDU: privKey Unknown

please help me in getting the tshark command to decode snmpv3 packets / traps .

tshark command to decode snmpv3 packets / traps

I am running the below command where I can see SNMP v3 tarps getting received at the receiver end. But the problem is I am not able to decode and see the snmp trap details / description.

[vagrant@osboxes ~]$ sudo tshark -f "udp port 162"
[sudo] password for vagrant:
Running as user "root" and group "root". This could be dangerous.
Capturing on 'eth0'
  1 0.000000000 10.191.245.253 -> 10.75.234.94 SNMP 550 encryptedPDU: privKey Unknown
  2 299.985368217 10.191.245.253 -> 10.75.234.94 SNMP 550 encryptedPDU: privKey Unknown
  3 496.713126083 10.196.28.26 -> 10.75.234.94 SNMP 550 encryptedPDU: privKey Unknown
  4 599.961958035 10.191.245.253 -> 10.75.234.94 SNMP 550 encryptedPDU: privKey Unknown
  5 899.955601562 10.191.245.253 -> 10.75.234.94 SNMP 550 encryptedPDU: privKey Unknown
  6 1199.988740264 10.191.245.253 -> 10.75.234.94 SNMP 550 encryptedPDU: privKey Unknown

Unknown

please help me in getting the tshark command to decode snmpv3 packets / traps .