Home / server / Questions / 301255
In Process
hoofa
Asked: 2011-08-16 08:19:05 +0800 CST

How to capture SNMP request and response using snoop

  • 772

Using the following command I can capture SNMP requests to my server, is there a way I can also capture the response my SNMP agent sends?

snoop -o snmp.cap udp port 161

Thanks for any thoughts

snmp snoop

2 Answers

  1. I guess what you want to do is capture traps. The standard trap port is 162, so your command likely should look like this: 

    snoop -o trap.cap udp port 162
    • 1

  2. Usually SNMP agents reply via 161, so it is strange that you said snoop did not capture the responses.

    Is it OK that you run "snoop -o snmp.cap" to capture all packets and then filter out SNMP packets from the big capture? In that way you can see details on the SNMP replies (SNMP RESPONSE messages) and you will know whether the SNMP agent you use sends them out via port 161.

    Yes, port 162 is for TRAP and NOTIFICATION messages, but I think that's not what you want to capture, right?

    • 0