Shulou(Shulou.com)06/01 Report--

Wireshark parses messages one point according to

Problem: encountered a problem, net-snmp sent a trap, through wireshark packet capture found that only well-known port 162 can send alarm messages.

The process is as follows:

Check the code: net-snmp does not have any restrictions on ports after code troubleshooting. Packet capture: After packet capture, UDP packets are sent. Filter the message with "snmp." It is found that only when the port is 162, there is a message marked as snmp message, and when the port is not 162, there is no snmp message after filtering. Through re-parsing udp message, it is found that the data part of udp message is snmp message content.

Reason for analysis:

SNMP protocol uses UDP messages to interact. SNMP messages are UDP messages.

When wireshark parses messages, it analyzes them by well-known ports. Because 162 is a well-known port for SNMP protocol trap alarms, the message is parsed into SNMP messages. With other custom ports, wireshark can only parse messages to the udp level.

Conclusion:

When Wireshark parses messages, it will perform in-depth parsing based on well-known ports. If you are unsure what type of message this is, the parsing will degrade.

If the message needs to be decoded. Messages can be viewed by doing the following

Select Message → Right-click → Select Decoding → Current drop-down menu → Select Protocol SNMP→OK. Wireshark parses the message according to the chosen protocol.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.