Re: SNMP dump

[Jan Allman <ian_yeovil () yahoo co uk>]

Guy, 
   
  Your response was most helpful. Thank you. 
   
  Ian
   
  

Guy Harris <guy () alum mit edu> wrote:
  Jan Allman wrote:

> I'm using Ethereal and am confused about the SNMP dump. The field
> sizes don't match the specification (RFC 1157). 

Where in RFC 1157 does it specify what the field sizes should be?

For example:

> E.g. 
> The 'Version' field should be 4 bytes but its dump is 3 bytes: 02 01 00

my copy of RFC 1157 says, of the Version field:

version -- version-1 for this RFC
INTEGER {
version-1(0)
},

> The 'PDU Type' field should 4 bytes but its dump is 2 bytes: a4 1c 

and doesn't indicate that there's a "PDU Type" field at all, it just 
gives the PDU types as:

PDUs ::=
CHOICE {
get-request
GetRequest-PDU,

get-next-request
GetNextRequest-PDU,

get-response
GetResponse-PDU,

set-request
SetRequest-PDU,

trap
Trap-PDU
}

The RFC also says:

Management information communicated by operation of the SNMP is
represented according to the subset of the ASN.1 language [9] that is
specified for the definition of non-aggregate types in the SMI.

The SGMP adopted the convention of using a well-defined subset of the
ASN.1 language [9]. The SNMP continues and extends this tradition by
utilizing a moderately more complex subset of ASN.1 for describing
managed objects and for describing the protocol data units used for
managing those objects. In addition, the desire to ease eventual
transition to OSI-based network management protocols led to the
definition in the ASN.1 language of an Internet-standard Structure of
Management Information (SMI) [5] and Management Information Base
(MIB) [6]. The use of the ASN.1 language, was, in part, encouraged
by the successful use of ASN.1 in earlier efforts, in particular, the
SGMP. The restrictions on the use of ASN.1 that are part of the SMI
contribute to the simplicity espoused and validated by experience
with the SGMP.

Also for the sake of simplicity, the SNMP uses only a subset of the
basic encoding rules of ASN.1 [10]. Namely, all encodings use the
definite-length form. Further, whenever permissible, non-constructor
encodings are used rather than constructor encodings. This
restriction applies to all aspects of ASN.1 encoding, both for the
top-level protocol data units and the data objects they contain.

and the ASN.1 Basic Encoding Rules don't specify, for example, that an 
INTEGER field is 4 bytes long - the encoding is variable-length. 
("Definite-length" doesn't imply "fixed-length", it just implies that 
there's a length field preceding the value.)

> However, Ethereal reports the correct values. 
> Version: 1 (0)
> PDU type: TRAP-V1 (4) 

That's because Ethereal understands the ASN.1 Basic Encoding Rules (BER) 
and decodes them in the SNMP dissector.

Recent versions of Wireshark have replaced the old SNMP dissector with a 
new one that uses the newer ASN.1 BER dissector; you can set a 
preference for the BER dissector to have it show you the "internal BER 
encapsulation tokens", i.e. to dissect not only the value of an item in 
a BER-encoded packet, but to dissect the type and length fields for that 
item as well. If I look at an SNMP packet with that version of 
Wireshark, I see:

00.. .... = Class: UNIVERSAL (0)
..0. .... = P/C: Primitive Encoding
...0 0010 = Tag: INTEGER (2)
Length: 1
version: version-1 (0)
00.. .... = Class: UNIVERSAL (0)
..0. .... = P/C: Primitive Encoding
...0 0100 = Tag: OCTET STRING (4)

reported for the version field; that has a 1-byte type field (the one 
with "Class", "P/C", and "Tag"), a 1-byte length field, and a 1-byte 
value (because the length field is 1).

I.e., the version field is encoded as a 1-byte value, which requires 2 
bytes of ASN.1 BER overhead for the type and length fields, giving a 
total of 3 bytes. Those are the 3 bytes that you were seeing with Ethereal.

> I'm assuming that tcpdump is capturing the packets correctly from the wire.

If it weren't, it probably wouldn't be doing something as subtle as 
making small changes to the way SNMP is encoded.

BTW, tcpdump also dissects SNMP, although, with no GUI, it doesn't let 
you select a field and see how many bytes it takes to encode it.

> Where should I look for how SNMP is encoded for transmission and
> decoded for display in Ethereal? 

Look in:

1) RFC 1157;

2) the appropriate MIB RFCs or other specification;

3) ITU-T Recommendation X.680, "Abstract Syntax Notation One (ASN.1): 
Specification of basic notation";

4) ITU-T Recommendation X.690, "ASN.1 encoding rules: Specification of 
Basic Encoding Rules (BER), Canonical Encoding Rules (CER) and 
Distinguished Encoding Rules (DER)";

as you will need 3) and 4) to understand what the specifications in RFC 
1157 and in the MIB RFCs mean and how they cause SNMP PDUs to be encoded 
on the wire.

The ITU-T Recommendations are available from the International 
Telecommunications Union:

http://www.itu.int/

from their Electronic Bookstore; however, as the "store" part implies, 
you won't necessarily be able to get them for free. At least at one 
point, they offered the ability to download a small number of 
specifications for free, both in the sense that they had a small number 
of specifications that you could download for free and that they let you 
sign up and get to download somewhere around 5 specifications other than 
specifications for that set for free.

See also, for example:

http://asn1.elibel.tm.fr/

for more information on ASN.1.

-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.


 Send instant messages to your online friends http://uk.messenger.yahoo.com -
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.