Wireshark · Wireshark-users: Re: [Wireshark-users] OID Spec in Display Filter

[j.snelders@xxxxxxxxxx]

Hi Chuck,

Does snmp.name do the job?

$ tshark -r 20080512161200.pcap -T fields -e snmp.name | sort | uniq
1.3.6.1.4.1.6247.4.8.5.13.0
1.3.6.1.4.1.6247.4.9.2.1.16.2
1.3.6.1.4.1.6247.4.9.2.1.16.3

$ tshark -r 20080512161200.pcap -R "snmp.name == 1.3.6.1.4.1.6247.4.8.5.13.0"
-T fields -e snmp.name | sort | uniq
1.3.6.1.4.1.6247.4.8.5.13.0

Thanks
Joan

On Mon, 20 Jul 2009 18:57:16 -0400 Chuck Bland wrote:
>
>I have captured a trace that contains a request and response for a
>certain IOD, 1.3.6.1.2.1.4.2.0, which is ipDefaultTTL from RFC1213.
>
>The MIB is loaded because I can see WS decode the IOD and display the
>name.
>
>If I enter the display filter "snmp.value.oid==1.3.6.1.2.1.4.2.0", I get
>a green filter background, but not packets displayed.
>
>I want to filter to packets referencing this OID.
>
>What am I doing wrong?
>
>Chuck Bland