What are those BER and SNMP_session modules? I Don't have them and can't seem to find them on CPAN, either.
The problem seems to be that this payload has multiple BER encoded data chunks concatenated together. You could decode the payload, encode back the chunk you've decoded, and strip that off the payload, lather, rinse, repeat:
#!/usr/bin/perl use Encoding::BER::SNMP; while(<DATA>) { chop; $data .= chr hex $1 while s/(..)//; } my $enc = Encoding::BER::SNMP->new(); while ($data) { my $result = $enc->decode($data); my $oid = $result->{'value'}->[0]->{'value'}; my $value = $result->{'value'}->[1]->{'value'}; print "returned pair: $oid -> $value\n"; my $back = $enc->encode($result); $data =~ s/\Q$back\E// or last; } __DATA__ 3014060e2b06010401090929010203010200040232303013060e2b060104 01090929010203010300020105301d060e2b060104010909290102030104 00040b5379736c6f67205472617030818c060e2b06010401090929010203 010500047a3130363032333a2044656e792069636d7020737263206f7574 736964653a3231362e3139362e36342e3132342064737420696e73696465 3a3230382e3130392e39302e323120287479706520382c20636f64652030 29206279206163636573732d67726f757020226f7574736964655f616363 6573735f696e223016060e2b06010401090929010203010600430473c36bf8
Output:
returned pair: 1.3.6.1.4.1.9.9.41.1.2.3.1.2.0 -> 20 returned pair: 1.3.6.1.4.1.9.9.41.1.2.3.1.3.0 -> 5 returned pair: 1.3.6.1.4.1.9.9.41.1.2.3.1.4.0 -> Syslog Trap returned pair: 1.3.6.1.4.1.9.9.41.1.2.3.1.5.0 -> 106023: Deny icmp src + outside:216.196.64.124 dst inside:208.109.90.21 (type 8, code 0) by +access-group "outside_access_in" returned pair: 1.3.6.1.4.1.9.9.41.1.2.3.1.6.0 -> 1942187000
update: removed superfluous data dump
update: changed Encoding::BER to Encoding::BER::SNMP
--shmem
_($_=" "x(1<<5)."?\n".q·/)Oo. G°\ /
/\_¯/(q /
---------------------------- \__(m.====·.(_("always off the crowd"))."·
");sub _{s./.($e="'Itrs `mnsgdq Gdbj O`qkdq")=~y/"-y/#-z/;$e.e && print}
In reply to Re: SNMP Trap Decoding issue
by shmem
in thread SNMP Trap Decoding issue
by ikkeniet
| For: | Use: | ||
| & | & | ||
| < | < | ||
| > | > | ||
| [ | [ | ||
| ] | ] |