This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Lua: cannot read SNMP request_id field

1

Hello WIRESHARK community!

I need your help because i mark time here with a little Lua scripting problem. My aim is to count lost SNMP transactions. Therefore i need to read out the snmp.request_id field to handle requests and responses belonging together. Unfortunately it is not working as it should. Here is my little debugging code example <snmpreqid.lua>:

snmp_reqID_extr = Field.new("snmp.request_id")
snmp = Listener.new(nil,"snmp");
function snmp.packet()
mymsgid = snmp_reqID_extr()
print(tostring(mymsgid))

Execution: tshark -X lua_script:snmpreqid.lua -r "snmptrace.pcap"

TSHARK Output:

nil
nil
nil
...

The field "snmp.request_id" is correct. I tried to filter out some SNMP V2c Packages in WIRESHARK and it works fine.

WIRESHARK Filter Expression: snmp.request_id==1959316333
WIRESHARK Package view:
4 SNMP  get-request 1.3.6.1.2.1.1.3  ID: 1959316333
5 SNMP  get-response 1.3.6.1.2.1.1.3 ID: 1959316333

A test it with the neighbor field "snmp.error_status" was successful

snmp_reqID_extr = Field.new("snmp.error_status")

TSHARK Output:

0
0
0
...

Used WIRESHARK 1.4.2, 1.4.4, 1.5 - problem persists. Read out msgID working at SNMP V3 but not feasible with SNMP V2c because its not implemented in the message header.

I would be very glad if you could help me on with this problem.

asked 04 Mar '11, 01:02

snmpmeier's gravatar image

snmpmeier
16112
accept rate: 0%