Wireshark · Ethereal-users: Re: [Ethereal-users] Decoding Cisco VSA

[Guy Harris <gharris@xxxxxxxxx>]

Deepa Gandhavalli Ramaniah -X (dgandhav - HCL at Cisco) wrote:

> Many thanks for your reply.
>
>  
>
> Could you also help me in decoding the following attribute values?

	http://www.cisco.com/en/US/products/hw/iad/ps4349/products_installation_guide_chapter09186a008007e511.html

> 1. T:Vendor Specific(26) l:21, vendor:Cisco(9)
>
>       T:Cisco Command Info(252) l:15, *value:01333830353538323533383930*
>
>  
>
> I believe this is account-logon for the username 380558253890. Please 
> correct me if I am wrong.

The Cisco page in question agrees.  "\001" is 0x01, so that's Account Logon.

> 2.  T:Vendor Specific(26) l:21, vendor:Cisco(9)
>
>        T:Cisco Command Info(252) l:15, *value:042026*
>
> * *
>
> I believe this is account-ping. Please correct me if I am wrong.

The Cisco page agrees - "\004" is 0x04.

> 3. T:Vendor Specific(26) l:21, vendor:Cisco(9)
>
>        T:Cisco Command Info(252) l:15, *value:0B4F30313030305F4B425333*
>
> * *
>
> I believe this is service-logon for the service name O00100_KBS3. Please 
> correct me if I am wrong.

The Cisco page agrees - "\013" is 0x0B.