["Hattori, Shigehiro" <s.hattori@xxxxxxxxx>]

Dear ethereal-user

I have a question about the message of Malformed packet.

I issued "snmpwalk" command to Cisco's LoadBalancer that is called CSS.
Ethereal indicates the response packet of IF-MIB::ifspecific is malformed 
packet.

I issued "snmpwalk" to Catalyst4003 and Extreme's switch too.
There is no message.

Attached capture file.

CSS - css_ifspecific.cap
Catalyst4003 - cat4003_ifspecific.cap
Extreme - extreme_ifspecific.cap

The following is a part of packet of CSS.
Ethereal indicates this packet is malformed packet.
172.21.118.48 is snmp manager , 172.21.197.70 is CSS.

--
[root@RHES3-1 root]# tethereal -x -r css_ifspecific.cap | less
 1   0.000000 172.21.118.70 -> 172.21.197.48 SNMP RESPONSE 
IF-MIB::ifSpecific.1
[Malformed Packet]

0000  00 d0 59 37 2c a7 00 11 93 e5 74 46 08 00 45 00   ..Y7,.....tF..E.
0010  00 4a d6 bc 00 00 3f 11 11 45 ac 15 76 46 ac 15   .J....?..E..vF..
0020  c5 30 00 a1 04 02 00 36 43 fb 30 2c 02 01 01 04   .0.....6C.0,....
0030  07 68 61 74 74 6f 72 69 a2 1e 02 04 21 1c 26 e5   .hattori....!.&.
0040  02 01 00 02 01 00 30 10 30 0e 06 0a 2b 06 01 02   ......0.0...+...
0050  01 02 02 01 16 01 06 00
--

The following is a part of packet of Catalyst4003.
There are no message. (Malformed packet)
172.21.118.48 is snmp manager , 172.21.197.141 is Catalyst4003.

--
[root@RHES3-1 root]# tethereal -x -r cat4003_ifspecific.cap | less
 1   0.000000 172.21.118.141 -> 172.21.197.48 SNMP RESPONSE 
IF-MIB::ifSpecific.
1

0000  00 d0 59 37 2c a7 00 11 93 e5 74 46 08 00 45 00   ..Y7,.....tF..E.
0010  00 4b 21 3d 00 00 fe 11 07 7c ac 15 76 8d ac 15   .K!=.....|..v...
0020  c5 30 00 a1 04 02 00 37 4c c2 30 2d 02 01 01 04   .0.....7L.0-....
0030  07 68 61 74 74 6f 72 69 a2 1f 02 04 41 73 fd 78   .hattori....As.x
0040  02 01 00 02 01 00 30 11 30 0f 06 0a 2b 06 01 02   ......0.0...+...
0050  01 02 02 01 16 01 06 01 00                      .........
--

I think the difference between two packets is last 3 bytes.

- CSS

0050  01 02 02 01 16 01 06 00
                                   ^^^^^^^
06 - ASN.1 type OID
00 - encoded length is 0 byte

- Catalyst

0050  01 02 02 01 16 01 06 01 00
                                   ^^^^^^^^^^
06 - ASN.1 type OID
01 - encoded length is 1 byte
00 - the OID value

I'm confused whether "encoded length is 0 byte" is violation of RFC(?) 
format or not.
Because Ethereal indicates CSS's packet is malformed , however Error status 
indicates NO ERROR.

- packet of CSS

0040  02 01 00 02 01 00 - Error Status: NO ERROR(0) , Error Index:0

- packet of Catalyst

0040  02 01 00 02 01 00 - Error Status: NO ERROR(0) , Error Index:0

Is it Okay "encoded length is 0 byte" ?

The following describes "the value should be set to the OBJECT IDENTIFIER 
{ 0 0 }."

# snmptranslate -Ib -Td ifSpecific
IF-MIB::ifSpecific
ifSpecific OBJECT-TYPE
 -- FROM       IF-MIB, RFC1213-MIB
 SYNTAX        OBJECT IDENTIFIER
 MAX-ACCESS    read-only
 STATUS        deprecated
 DESCRIPTION   "A reference to MIB definitions specific to the particular
           media being used to realize the interface.  It is

           recommended that this value point to an instance of a MIB
           object in the media-specific MIB, i.e., that this object
           have the semantics associated with the InstancePointer
           textual convention defined in RFC 2579.  In fact, it is
           recommended that the media-specific MIB specify what value
           ifSpecific should/can take for values of ifType.  If no MIB
           definitions specific to the particular media are available,
           the value should be set to the OBJECT IDENTIFIER { 0 0 }."
::= { iso(1) org(3) dod(6) internet(1) mgmt(2) mib-2(1) interfaces(2) 
ifTable(2) ifEntry(1) 22 }
#

Sincerely yours,

Hattori, Shigehiro / Sumisho Computer Systems Corp.
TEL 03-5217-5310

Attachment: cat4003_ifspecific.cap
Description: Binary data

Attachment: css_ifspecific.cap
Description: Binary data

Attachment: extreme_ifspecific.cap
Description: Binary data