Wireshark · Ethereal-users: [Ethereal-users] Re: [Ethereal-dev] Re: SNMP Capture Data inquiry

[Guy Harris <gharris@xxxxxxxxx>]

Jose Vicente Quinto wrote:

> Can anyone explain to me what are the purpose of the initial values before 
> the actual ObjectID (before '2b 06 01 ... 01 05 00')?
>
> Is it correct that "43" in the first 2 bytes -- '30 43', the '43' (decimal 67)
> is the length of the whole SNMP data received that must be decoded, parsed
> then encoded again for the sending of the RESPONSE PDU?

If I remember correctly, yes.

If you want to understand the way SNMP packets are encoded, you first 
need to understand Abstract Syntax Notation One, a/k/a "ASN.1", as 
defined in ITU-T Recommendations X.680, X.681, X.682, and X.683.  You'd 
then need to understand the Basic Encoding Rules for ASN.1, as defined 
in ITU-T Recommendation X.691.

You'd then need to read the RFCs that define SNMP, such as RFC 1157, RFC 
1901, RFC 1905, RFC 1906, and RFCs 2570-2576.

Those documents might be more than you need.  You might want to Google for

	asn.1 tutorial

or look at pages such as

	http://www.et.put.poznan.pl/snmp/main/mainmenu.html