tshark: How to capture SNMP traps (UDP port 162) that might be fragmented?

[Peter Valdemar Mørch]

We want to capture SNMP traps. The simple

tshark -f 'port 162'

Doesn't work if there are SNMP traps that are fragmented, because then we
don't get all the fragments. I understand.

Wireshark now since rev 41216 saves all dependent packets too when one
saves all packets according to the display filter [1] [2]. I've tried
wireshark's version 1.8.2 and it works as described.

I therefore expected this to work for tshark 1.8.2 too:

tshark -f udp -w alludp.pcap
# wait for it, wait for it...
tshark -r alludp.pcap -R snmp -w snmp.pcap

But it doesn't work. I only get one packet - it doesn't save all fragments.
Two questions:

1) Isn't the tshark command above the tshark equivalent of the same use
case? I expected it to work similarly (and save all fragments, just like
wireshark). Is there something wrong with my mental model / expectations?
Is there some other way to achieve this?

2) Is there some other way to capture exactly SNMP traps (UDP port 162)
including fragmented ones with tshark avoiding having to install and start
up wireshark? We're on a headless/X-less system so for us tshark + screen
is much more practical than wireshark will ever be.

1: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3315
2: http://anonsvn.wireshark.org/viewvc?revision=41216&view=revision

[Guy Harris]

Post by Peter Valdemar Mørch
We want to capture SNMP traps. The simple
tshark -f 'port 162'
Doesn't work if there are SNMP traps that are fragmented, because then we don't get all the fragments. I understand.
Wireshark now since rev 41216 saves all dependent packets too when one saves all packets according to the display filter [1] [2]. I've tried wireshark's version 1.8.2 and it works as described.
tshark -f udp -w alludp.pcap
# wait for it, wait for it...
tshark -r alludp.pcap -R snmp -w snmp.pcap
1) Isn't the tshark command above the tshark equivalent of the same use case?

No.

"-f" specifies a capture filter, not a display filter. The TShark command in question is the TShark equivalent of capturing, in Wireshark, with a *capture* filter of "udp", and then, when the capture is finished, applying a display filter of "snmp".

Post by Peter Valdemar Mørch
2) Is there some other way to capture exactly SNMP traps (UDP port 162) including fragmented ones with tshark avoiding having to install and start up wireshark?

There isn't a way to capture exactly SNMP traps, including fragmented ones, with *any* tool, using libpcap/WinPcap-style stateless filtering to filter out everything except for the SNMP traps; that includes Wireshark.

In order to filter all packets going to or from port 162, including fragments, a form of stateful filtering is necessary.

If a first fragment is seen with a UDP packet to or from port 162, the filtering mechanism would need to remember its IP ID, and check all non-first fragments for that IP ID and accept them as well. That IP ID should probably expire after some amount of time after the first fragment is received; perhaps it should be removed if all the fragments of the packet have been seen and accepted.

If a fragment is seen for which no first fragment ID has been seen, that's harder - there is no guarantee that fragments arrive in order, and, in fact, I think some versions of Linux sent out fragments in *reverse* order, so that the receiver would see the last fragment first and would thus know how big the entire packet would be, and, in that case, could pre-allocate a buffer for the reassembled fragment. For that one, you'd have to hold onto fragments for which the first fragment ID hadn't been seen, and deliver them if and when the first fragment arrives and it's accepted by the filter; doing that then either means delivering packets out of time order (which would be a bit annoying), deferring the delivery of packets that arrive following the offending non-first fragments until after they're delivered (which would be a bit annoying and would require a fair bit of buffering space - possibly in the kernel, as that's where the capture filtering is done in most OSes on which tcpdump/WinDump/*Shark run) or, at some layer after the filtering, buffering and sorting packets by their time stamps.

In the case of Wireshark, you're doing stateful filtering, but that's done *after* capturing the raw packets. What you're doing is probably capturing all packets or, at least, capturing all IP packets (depending on what *capture* filter you specified when doing the capture), and, *after* you've done the capturing, and Wireshark has read the entire file and done all the reassembly of fragmented IP datagrams, and thus built the necessary state, filtering out all but the SNMP packets and then saving the packets.

The closest equivalent in TShark would be to first do:

tshark -f {capture filter} -w unfiltered.pcap

where {capture filter} is whatever capture filter you used when doing the capture in Wireshark - if you left the capture filter blank, leave the -f flag out - and then doing

tshark -2 -r unfiltered.pcap -R snmp -w snmp.pcap

which causes TShark to read unfiltered.pcap and process all the packets, so it does a reassembly of all fragmented packets, and then read it *again*, with a read filter of "snmp", and write the matching packets to the output file.

However, I don't think that code path has been changed to support writing "related" packets, and it might also apply the read filter on the *first* pass (and thus filter out the fragments), so it might not work.

TShark could certainly be *made* to support that, with a two-pass operation, but it might not do so currently. That would involve not applying the read filter on the first pass, if we're currently doing so (that's probably something we should do unconditionally), and having -R divide packets into three categories - matched, didn't match but are part of a packet that did match, and didn't match and aren't part of a packet that did match - and have the packet-writing code path write out packets in the first two categories.
___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

[Peter Valdemar Mørch]

Thank you for your reply.

I can see that I have been a little unclear with my words. I'm fine with
capturing more than SNMP. Hard disk space is cheap and even all UDP is
manageable in size for us. I would just like to end up after
post-processing with all SNMP traps including fragmented ones, using only
TShark.

Post by Guy Harris
tshark -2 -r unfiltered.pcap -R snmp -w snmp.pcap

To which I got:
Segmentation fault (core dumped)

I've created a tiny .pcap file containing two frames - a single
two-fragment SNMP trap - that also exhibits this. It is attached. Hope the
mailing list allows attachments...

I'm just surprised it doesn't seem possible.

Again, thank you for your reply!

Peter

Post by Guy Harris
tshark -v

TShark 1.8.2

Copyright 1998-2012 Gerald Combs <gerald-IZ8446WsY0/***@public.gmane.org> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with GLib 2.34.0, with libpcap, with libz 1.2.7, with
POSIX
capabilities (Linux), with SMI 0.4.8, with c-ares 1.9.1, with Lua 5.1,
without
Python, with GnuTLS 2.12.14, with Gcrypt 1.5.0, with MIT Kerberos, with
GeoIP.

Running on Linux 3.5.0-17-generic, with locale en_US.UTF-8, with libpcap
version
1.3.0, with libz 1.2.7.

Built using gcc 4.7.2.

[Bill Meier]

Post by Peter Valdemar Mørch

Post by Guy Harris
tshark -2 -r unfiltered.pcap -R snmp -w snmp.pcap

Segmentation fault (core dumped)

At the very least, thark shouldn't crash.

Please file a bug report at bugs.wireshark.org attaching the file.

This way, the bug can be tracked. In addition, the capture file will be
available for future testing.


Thanks


___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

[Sake Blok]

In case you have only fragments with snmp traps, you might want to capture all frames to/from port 162 and all fragments that have an offset not equal to 0. The only extra packets you will have in your trace will be fragments of packets that were not snmp traps. Which might not be to much noise :-)

You can use the following BPF filter for it:

ip and udp and (port 162 or ip[6:2] & 0x1fff != 0)

Cheers,
Sake

Post by Peter Valdemar Mørch
Thank you for your reply.
I can see that I have been a little unclear with my words. I'm fine with capturing more than SNMP. Hard disk space is cheap and even all UDP is manageable in size for us. I would just like to end up after post-processing with all SNMP traps including fragmented ones, using only TShark.

Post by Guy Harris
tshark -2 -r unfiltered.pcap -R snmp -w snmp.pcap

Segmentation fault (core dumped)
I've created a tiny .pcap file containing two frames - a single two-fragment SNMP trap - that also exhibits this. It is attached. Hope the mailing list allows attachments...
I'm just surprised it doesn't seem possible.
Again, thank you for your reply!
Peter

Post by Guy Harris
tshark -v

TShark 1.8.2
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled (64-bit) with GLib 2.34.0, with libpcap, with libz 1.2.7, with POSIX
capabilities (Linux), with SMI 0.4.8, with c-ares 1.9.1, with Lua 5.1, without
Python, with GnuTLS 2.12.14, with Gcrypt 1.5.0, with MIT Kerberos, with GeoIP.
Running on Linux 3.5.0-17-generic, with locale en_US.UTF-8, with libpcap version
1.3.0, with libz 1.2.7.
Built using gcc 4.7.2.
--
Peter Valdemar Mørch
http://www.morch.com
<linkDownFragmented.pcap>___________________________________________________________________________
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users

[Guy Harris]

Post by Peter Valdemar Mørch

Post by Guy Harris
tshark -2 -r unfiltered.pcap -R snmp -w snmp.pcap

Segmentation fault (core dumped)

That's a bug.

Could you please file a report on that at http://bugs.wireshark.org so that this can be tracked, and attach your capture to it (so that it ends up in our "capture menagerie" for regression and fuzz testing)?
___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

[Peter Valdemar Mørch]

I've created https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8101

Peter

[patrick-ka/LmEL/]

Post by Peter Valdemar Mørch
Thank you for your reply.
I can see that I have been a little unclear with my words. I'm fine with
capturing more than SNMP. Hard disk space is cheap and even all UDP is
manageable in size for us. I would just like to end up after
post-processing with all SNMP traps including fragmented ones, using only
TShark.

Post by Guy Harris
tshark -2 -r unfiltered.pcap -R snmp -w snmp.pcap

Segmentation fault (core dumped)
I've created a tiny .pcap file containing two frames - a single
two-fragment SNMP trap - that also exhibits this. It is attached. Hope the
mailing list allows attachments...
I'm just surprised it doesn't seem possible.
Again, thank you for your reply!
Peter

Hi Peter,

I don't know how to do this with Wireshark and/or tshark. I know our
PacketView product can reassemble IP packets AND run filters on those
reassembled packets, but it is a Windows app, and it looks like you want
a command line app that runs on Linux?

I have been playing with libpcap on a NetBSD machine. It seems straight-
forward enough. If I were to write up a quick program to reassemble IP
fragmented packets and then save only packets for UDP port 162 to a pcap file,
would that do the job for you? Are there any other requirements you would
ask of this tool?

Regards,

Patrick
========= For LAN/WAN Protocol Analysis, check out PacketView Pro! =========
Patrick Klos Email: patrick-ka/LmEL/***@public.gmane.org
Network/Embedded Software Engineer Web: http://www.klos.com/
Klos Technologies, Inc. Phone: [phone]
============================================================================
___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe