Ethereal-users: Re: [Ethereal-users] Filtering SNMP packets

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Tiago Fioreze <tfioreze@xxxxxxxxxxxx>
Date: Thu, 8 Jul 2004 10:52:04 -0300
On Wednesday 07 July 2004 17:09, Richard Urwin wrote:

	Hi Richard! Thanks for your reply.

> Two birds with one stone:
	
	Here in Brazil, we use rabbits instead of birds in this expression (hehehehe)

> Find a SET request, open it in the detail pane.
> Right click the pdu type, Prepare -> Selected
> Find a RESPONSE to a SET
> Right click the pdu type, Prepare -> Or Selected
> Click in the filter box, hit Enter

	Good tip! It will be useful to me.

> However, I don't use SNMP and don't have an example handy, but I suspect
> that this wont work. SNMP doesn't seem to differentiate between
> RESPONSE types - as you implied it didn't. So the most you can do is to
> display SETs and RESPONSEs. For what it's worth that filter appears to
> be:
> (snmp.pdutype == 0) || (snmp.pdutype == 2)
>
> It is not possible to do the matching of response ids, since the display
> filter does not save any context between packets.
>
> It probably wouldn't be impossible to alter the SNMP dissector to keep
> track of IDs and add a field snmp.replytopdutype, but it isn't there at
> the moment, (at least in version 0.10.4).

	I have found a solution for my problem. Itsn't the best one, but it works for 
me. As I have a few SET request packets and their respectives RESPONSES, I 
just select them and I click in 'Save as'. After I have done that, I choose 
the option 'Selected packet only' in 'Packet Range'. Doing that, I will save 
only the packets that interest for me. When I open this saved file, the 
summary will show the statistics concerning the selected packets.

	Thank you!

	Tiago Fioreze

-- 

Computer Science Master Student      
Federal University of Rio Grande do Sul (UFRGS)              
Porto Alegre - Rio Grande do Sul - Brasil

--

"Our greatest glory is not in never falling,
but in rising every time we fall." 

 			-- Confucius