Re: [tcpdump-workers] large packets parsing using TcpDump

2010-12-01 Thread Mali Shternhell
0x0050: 1107 0104 0201 0301 8119 4202 0099 14:55:32.881113 IP 172.30.9.40.snmp > 172.30.9.16.47686: [len1468mailto:g...@alum.mit.edu] Sent: Tuesday, November 30, 2010 8:27 PM To: tcpdump-workers@lists.tcpdump.org Cc: Mali Shternhell Subject: Re: [tcpdump-workers] large packets parsing using

Re: [tcpdump-workers] large packets parsing using TcpDump

2010-12-01 Thread Guy Harris
On Nov 30, 2010, at 10:35 PM, Mali Shternhell wrote: > Hi, Thanks for the response. > my question is why tcpdump doesn't parse the large snmp response packet > as it does for the typical response packet. Because the SNMP printer routine that parses an ASN.1 BER item will quit if the length of t

Re: [tcpdump-workers] large packets parsing using TcpDump

2010-11-30 Thread Guy Harris
On Nov 29, 2010, at 10:24 PM, Mali Shternhell wrote: > I'm using TcpDump in order to capture snmp request-response messages. > > When the response packet is larger than 1468 TcpDump fail to capture the > packet What do you mean by "fail to capture the packet"? If you mean that the packet isn

[tcpdump-workers] large packets parsing using TcpDump

2010-11-30 Thread Mali Shternhell
Hi, I'm using TcpDump in order to capture snmp request-response messages. When the response packet is larger than 1468 TcpDump fail to capture the packet (capture below, failed lines are in red) I'm using the command: tcpdump -s 200 -xxni eth0 port 161 Can you please assist? 08:00:26.768