Ethereal-users: Re: [ethereal-users] Question about SNMP decoder with regard to response port

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxxxxx>
Date: Sat, 21 Oct 2000 11:53:54 -0700
On Thu, Jul 13, 2000 at 04:10:02PM -0500, Ron Flory wrote:
>  welllll, the agent is allowed to reply on any port he chooses, it just
> so happens that many SNMP implementations are quite simplistic, and just
> reply using the contact port #.
> 
>  I have access to several SNMP systems here, and half of them reply on
> port 161 whereas the other half replies on the next unused port > 1024.
> 
> > I'll look into providing better support for that hack, so we can use it
> > for other datagram-transport-layer request/response protocols.

Jeff Foster provided support for "half-conversations" with wildcard
addresses or ports on one side of the conversation; I've made TFTP use
that rather than special-casing it in the UDP dissector, and have also
made SNMP use it, so that...

> > Do you have a capture on which I can test any changes I make?
> 
>  attached file contains this session:

...it now dissects the SNMP reply in your capture as SNMP.