On redhat linux box, I am trying to trace the snmp traps coming from IP a.b.c.d, as shown below:

sudo /usr/sbin/tcpdump src host and udp dst port 162 -w /home/user1/troubleshoot.pcap

and store the traces in /home/user1/troubleshoot.pcap.

Can this syntax go better to get more details about those snmp traps?

1 Answer 1


You should use this packet type and filter rule:

-s 0 -T snmp "(dst port 162) or (src port 161) or (dst port 161) and (host"

-s 0                grub entire packets content
-T type             packet type
"filter_rules"      filter rules

SNMP also uses port 161.

More at tcpdump(8) man page.

  • The -s0 option is important too: it makes tcpdump grab the whole package and not just the protocol headers at the beginning of each package.
    – telcoM
    Apr 4, 2018 at 19:25
  • Thanks! I hurried with answer but I know about it. I will fixed it in answer. Apr 4, 2018 at 19:34
  • I want to take/see that trap command(to reproduce) literally from wireshark trace. Can I see that with -s0? Apr 4, 2018 at 21:41
  • With -s0 you will see all trace from wireshark. If you want to trace from Wireshark directly, you may use this filter on chosen interface: snmp and ((udp.dstport==162) or (udp.srcport==161) or (udp.dstport==161)) and (ip.addr== Apr 4, 2018 at 21:59
  • Problem is, trap generated from device is not working but my validation trap with those varbinds, is working. Can the traces help me rebuild the exact snmp-trap command that device sends? Apr 5, 2018 at 1:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.