Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: [Wireshark-dev] itu-t .0 oid dissector

From: Adrian Daniel Simionov <xsimio@xxxxxxxxx>
Date: Tue, 3 Feb 2015 22:45:55 +0100
If you look at the second packet of the attached capture, Wireshark considers this a malformed packet.

As per RFC 1155 Section 3.1

   The root node itself is unlabeled, but has at least three children
   directly under it:  one node is administered by the International
   Organization for Standardization, with label iso(1); another is
   administrated by the International Telegraph and Telephone
   Consultative Committee, with label ccitt(0); and the third is jointly
   administered by the ISO and the CCITT, joint-iso-ccitt(2).

This means that .0 is a valid OID and should be dissected correctly.

net-snmp implemented this in a different way. For them .0 is a valid OID.

#snmpwalk -On -v 2c -c public 10.125.224.111 1.3.6.1.2.1.47.1.1.1.1.3.1
.1.3.6.1.2.1.47.1.1.1.1.3.1 = OID: .0

Can someone provide some input on this?

Attachment: wrong_length_varbind.pcapng
Description: application/pcapng