Wireshark · Ethereal-dev: Re: [ethereal-dev] Question on remote snooping.

[Bert Driehuis <bert_driehuis@xxxxxxxxxxxxxxxx>]

Guy Harris wrote:

> The RMON stuff in SNMP also provides such a mechanism, although, as I
> remember, the data doesn't come back as the capture proceeds - you do
> SNMP GETs to fetch the captured data.  (It also has a pretty feeble
> filtering mechanism; I'm curious whether anybody's ever proposed adding
> support for BPF code to RMON.)

Not to my knowledge, and given the nature of SNMP even if someone adds
it now to the RFC's, it'll take years for it to be implemented.

In the back of my mind is a small project to translate a subset of
tcpdump syntax into RMON, and poll devices spitting out a dump in pcap
format. However, this isn't gonna happen soon if it waits on me (the
small project gets bigger each time I look at the RMON docs).

If I do anything in this area, it's going to be porting the Beholder
code to UCD SNMP first. If someone wants to try a quick hack, start with
the Beholder.

Cheers,

				-- Bert

-- 
Bert Driehuis, MIS -- bert_driehuis@xxxxxxxxxxxxxxxx -- +31-20-3116119
Hi! I'm a signature virus! Copy me to your .signature and help me
spread!