TLDR: How can I find IP addresses that is communicated via SNMP in the
data =>variable-bindings field ?
I am using wireshark to view my pcap and I use the snmp filter. But I would like to go further by searching for IP addresses that is communicated via SNMP in the
data =>variable-bindings field.
Here is an SNMP record example from Wireshark:
data get-response variable-bindings: 20 items 188.8.131.52.184.108.40.206.220.127.116.11.9.178: 1 18.104.22.168.22.214.171.124.126.96.36.199.40.7: 40 188.8.131.52.184.108.40.206.220.127.116.11.39.17: 255.255.255.0 ...
I would like to find every addresses under the OID 18.104.22.168.22.214.171.124.1.* or search for specific IP that is in variable-bindings value.
I have already tried these filters:
snmp.variable_bindings == 10.50.9.178 snmp.data == 10.50.9.178 // Won't work because it search for integer values
Note: I do not want to search for the source and destination IPs
OID: - 126.96.36.199.188.8.131.52.1 - ipAddrEntry
OID descriptions : http://www.alvestrand.no/objectid/184.108.40.206.220.127.116.11.1.html