What are those BER and SNMP_session modules? I Don't have them and can't seem to find them on CPAN, either.

The problem seems to be that this payload has multiple BER encoded data chunks concatenated together. You could decode the payload, encode back the chunk you've decoded, and strip that off the payload, lather, rinse, repeat:

#!/usr/bin/perl use Encoding::BER::SNMP; while(<DATA>) { chop; $data .= chr hex $1 while s/(..)//; } my $enc = Encoding::BER::SNMP->new(); while ($data) { my $result = $enc->decode($data); my $oid = $result->{'value'}->[0]->{'value'}; my $value = $result->{'value'}->[1]->{'value'}; print "returned pair: $oid -> $value\n"; my $back = $enc->encode($result); $data =~ s/\Q$back\E// or last; } __DATA__ 3014060e2b06010401090929010203010200040232303013060e2b060104 01090929010203010300020105301d060e2b060104010909290102030104 00040b5379736c6f67205472617030818c060e2b06010401090929010203 010500047a3130363032333a2044656e792069636d7020737263206f7574 736964653a3231362e3139362e36342e3132342064737420696e73696465 3a3230382e3130392e39302e323120287479706520382c20636f64652030 29206279206163636573732d67726f757020226f7574736964655f616363 6573735f696e223016060e2b06010401090929010203010600430473c36bf8

Output:

returned pair: 1.3.6.1.4.1.9.9.41.1.2.3.1.2.0 -> 20 returned pair: 1.3.6.1.4.1.9.9.41.1.2.3.1.3.0 -> 5 returned pair: 1.3.6.1.4.1.9.9.41.1.2.3.1.4.0 -> Syslog Trap returned pair: 1.3.6.1.4.1.9.9.41.1.2.3.1.5.0 -> 106023: Deny icmp src + outside:216.196.64.124 dst inside:208.109.90.21 (type 8, code 0) by +access-group "outside_access_in" returned pair: 1.3.6.1.4.1.9.9.41.1.2.3.1.6.0 -> 1942187000

update: removed superfluous data dump
update: changed Encoding::BER to Encoding::BER::SNMP

--shmem

_($_=" "x(1<<5)."?\n".q·/)Oo.  G°\        /
                              /\_¯/(q    /
----------------------------  \__(m.====·.(_("always off the crowd"))."·
");sub _{s./.($e="'Itrs `mnsgdq Gdbj O`qkdq")=~y/"-y/#-z/;$e.e && print}

In reply to Re: SNMP Trap Decoding issue by shmem
in thread SNMP Trap Decoding issue by ikkeniet

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":



  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.