Ethereal-users: [Ethereal-users] Question about Malformed packet when issuing snmpwalk command
Dear ethereal-user
I have a question about the message of Malformed packet.
I issued "snmpwalk" command to Cisco's LoadBalancer that is called CSS.
Ethereal indicates the response packet of IF-MIB::ifspecific is malformed
packet.
I issued "snmpwalk" to Catalyst4003 and Extreme's switch too.
There is no message.
Attached capture file.
CSS - css_ifspecific.cap
Catalyst4003 - cat4003_ifspecific.cap
Extreme - extreme_ifspecific.cap
The following is a part of packet of CSS.
Ethereal indicates this packet is malformed packet.
172.21.118.48 is snmp manager , 172.21.197.70 is CSS.
--
[root@RHES3-1 root]# tethereal -x -r css_ifspecific.cap | less
1 0.000000 172.21.118.70 -> 172.21.197.48 SNMP RESPONSE
IF-MIB::ifSpecific.1
[Malformed Packet]
0000 00 d0 59 37 2c a7 00 11 93 e5 74 46 08 00 45 00 ..Y7,.....tF..E.
0010 00 4a d6 bc 00 00 3f 11 11 45 ac 15 76 46 ac 15 .J....?..E..vF..
0020 c5 30 00 a1 04 02 00 36 43 fb 30 2c 02 01 01 04 .0.....6C.0,....
0030 07 68 61 74 74 6f 72 69 a2 1e 02 04 21 1c 26 e5 .hattori....!.&.
0040 02 01 00 02 01 00 30 10 30 0e 06 0a 2b 06 01 02 ......0.0...+...
0050 01 02 02 01 16 01 06 00
--
The following is a part of packet of Catalyst4003.
There are no message. (Malformed packet)
172.21.118.48 is snmp manager , 172.21.197.141 is Catalyst4003.
--
[root@RHES3-1 root]# tethereal -x -r cat4003_ifspecific.cap | less
1 0.000000 172.21.118.141 -> 172.21.197.48 SNMP RESPONSE
IF-MIB::ifSpecific.
1
0000 00 d0 59 37 2c a7 00 11 93 e5 74 46 08 00 45 00 ..Y7,.....tF..E.
0010 00 4b 21 3d 00 00 fe 11 07 7c ac 15 76 8d ac 15 .K!=.....|..v...
0020 c5 30 00 a1 04 02 00 37 4c c2 30 2d 02 01 01 04 .0.....7L.0-....
0030 07 68 61 74 74 6f 72 69 a2 1f 02 04 41 73 fd 78 .hattori....As.x
0040 02 01 00 02 01 00 30 11 30 0f 06 0a 2b 06 01 02 ......0.0...+...
0050 01 02 02 01 16 01 06 01 00 .........
--
I think the difference between two packets is last 3 bytes.
- CSS
0050 01 02 02 01 16 01 06 00
^^^^^^^
06 - ASN.1 type OID
00 - encoded length is 0 byte
- Catalyst
0050 01 02 02 01 16 01 06 01 00
^^^^^^^^^^
06 - ASN.1 type OID
01 - encoded length is 1 byte
00 - the OID value
I'm confused whether "encoded length is 0 byte" is violation of RFC(?)
format or not.
Because Ethereal indicates CSS's packet is malformed , however Error status
indicates NO ERROR.
- packet of CSS
0040 02 01 00 02 01 00 - Error Status: NO ERROR(0) , Error Index:0
- packet of Catalyst
0040 02 01 00 02 01 00 - Error Status: NO ERROR(0) , Error Index:0
Is it Okay "encoded length is 0 byte" ?
The following describes "the value should be set to the OBJECT IDENTIFIER
{ 0 0 }."
# snmptranslate -Ib -Td ifSpecific
IF-MIB::ifSpecific
ifSpecific OBJECT-TYPE
-- FROM IF-MIB, RFC1213-MIB
SYNTAX OBJECT IDENTIFIER
MAX-ACCESS read-only
STATUS deprecated
DESCRIPTION "A reference to MIB definitions specific to the particular
media being used to realize the interface. It is
recommended that this value point to an instance of a MIB
object in the media-specific MIB, i.e., that this object
have the semantics associated with the InstancePointer
textual convention defined in RFC 2579. In fact, it is
recommended that the media-specific MIB specify what value
ifSpecific should/can take for values of ifType. If no MIB
definitions specific to the particular media are available,
the value should be set to the OBJECT IDENTIFIER { 0 0 }."
::= { iso(1) org(3) dod(6) internet(1) mgmt(2) mib-2(1) interfaces(2)
ifTable(2) ifEntry(1) 22 }
#
Sincerely yours,
Hattori, Shigehiro / Sumisho Computer Systems Corp.
TEL 03-5217-5310
Attachment:
cat4003_ifspecific.cap
Description: Binary data
Attachment:
css_ifspecific.cap
Description: Binary data
Attachment:
extreme_ifspecific.cap
Description: Binary data
