SNMP Get Request and Response Packet Capture

This packet capture shows the simplest SNMP exchange there is: a manager asks a Cisco router for one value, and the router answers. The manager sends a get-request for sysName.0, the device hostname, and gets back a get-response with “R2”.

Two packets, but they show how every SNMP poll works: same request-id in both directions, the OID in a variable binding, and an empty (Null) value in the request that the agent fills in. The introduction to SNMP lesson covers the MIB and OIDs, and the SNMPv2c Trap Packet Capture shows the opposite direction: a message the agent sends on its own. More captures are in the Packet Capture Library.

Want to open this capture in Wireshark yourself? The pcap file is free with a NetworkLessons account. Your free account also unlocks all our free lessons and every capture in the Packet Capture Library.

Create a free account to download the pcap

Already have an account? Log in and the download button appears here.

Capture overview

File	snmp-get-request-response.pcapng
Packets	2
Protocol	SNMPv2c (RFC 3416), get-request and get-response PDUs
Transport	UDP, manager port 58835 → agent port 161
Devices	Manager 192.168.12.1, Cisco IOS router R2 192.168.12.2 (agent)
Wireshark filter	snmp or udp.port == 161

Packets in this capture

No.  Time      Source        Destination   Protocol  Info
1    0.000000  192.168.12.1  192.168.12.2  SNMP      get-request 1.3.6.1.2.1.1.5.0
2    0.000657  192.168.12.2  192.168.12.1  SNMP      get-response 1.3.6.1.2.1.1.5.0

Packet walkthrough

Get request (packet 1)

Internet Protocol Version 4, Src: 192.168.12.1, Dst: 192.168.12.2
User Datagram Protocol, Src Port: 58835, Dst Port: 161
Simple Network Management Protocol
    version: v2c (1)
    community: public
    data: get-request (0)
        get-request
            request-id: 1
            error-status: noError (0)
            error-index: 0
            variable-bindings: 1 item
                1.3.6.1.2.1.1.5.0: Value (Null)
                    Object Name: 1.3.6.1.2.1.1.5.0 (iso.3.6.1.2.1.1.5.0)
                    Value (Null)

There are a few things worth pointing out:

• UDP destination port 161: the agent on the router listens on 161. The manager picks a random source port, and the response comes back to it.
• community: public: the read-only community, in clear text. The agent only answers if it matches its configuration.
• get-request (PDU type 0) for one OID: 1.3.6.1.2.1.1.5.0, which is sysName.0 from the SNMPv2-MIB. The trailing .0 means “the single instance of this object”.
• Value: Null: a request has no value to send, so each variable binding carries the OID with an empty value. The agent fills it in.

Get response (packet 2)

Simple Network Management Protocol
    version: v2c (1)
    community: public
    data: get-response (2)
        get-response
            request-id: 1
            error-status: noError (0)
            error-index: 0
            variable-bindings: 1 item
                1.3.6.1.2.1.1.5.0: "R2"
                    Object Name: 1.3.6.1.2.1.1.5.0 (iso.3.6.1.2.1.1.5.0)
                    Value (OctetString): "R2"
                        Variable-binding-string: R2

This is what the fields in red mean:

• get-response (PDU type 2) with the same request-id 1: that’s how the manager matches the answer to its question. SNMP runs over UDP, so the manager retries if no response with this request-id arrives in time.
• error-status: noError: the agent found the OID. A wrong OID in SNMPv2c doesn’t give an error here. Instead the value becomes noSuchObject or noSuchInstance.
• Value (OctetString): “R2”: the router’s hostname, the same variable binding as in the request, now with a value.