0

On redhat linux box, I am trying to trace the snmp traps coming from IP a.b.c.d, as shown below:

sudo /usr/sbin/tcpdump src host 142.125.248.36 and udp dst port 162 -w /home/user1/troubleshoot.pcap

and store the traces in /home/user1/troubleshoot.pcap.

Can this syntax go better to get more details about those snmp traps?

3

You should use this packet type and filter rule:

-s 0 -T snmp "(dst port 162) or (src port 161) or (dst port 161) and (host 142.125.248.36)"

-s 0                grub entire packets content
-T type             packet type
"filter_rules"      filter rules

SNMP also uses port 161.

More at tcpdump(8) man page.

  • The -s0 option is important too: it makes tcpdump grab the whole package and not just the protocol headers at the beginning of each package. – telcoM Apr 4 '18 at 19:25
  • Thanks! I hurried with answer but I know about it. I will fixed it in answer. – Yurij Goncharuk Apr 4 '18 at 19:34
  • I want to take/see that trap command(to reproduce) literally from wireshark trace. Can I see that with -s0? – overexchange Apr 4 '18 at 21:41
  • With -s0 you will see all trace from wireshark. If you want to trace from Wireshark directly, you may use this filter on chosen interface: snmp and ((udp.dstport==162) or (udp.srcport==161) or (udp.dstport==161)) and (ip.addr==142.125.248.36). – Yurij Goncharuk Apr 4 '18 at 21:59
  • Problem is, trap generated from device is not working but my validation trap with those varbinds, is working. Can the traces help me rebuild the exact snmp-trap command that device sends? – overexchange Apr 5 '18 at 1:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.