SNMPv2c Trap Packet Capture

This packet capture contains a single SNMPv2c trap. A Cisco router (192.168.12.1) shuts down its Loopback1 interface and immediately tells its SNMP manager (192.168.12.2) with a linkDown trap. One UDP packet, no reply: that’s what a trap is.

The interesting part is the list of variable bindings. Every SNMPv2c trap starts with the same two (the uptime and the trap OID), followed by the details of the event. The introduction to SNMP lesson explains managers, agents and the MIB, and SNMPv2 on Cisco IOS shows how to configure traps. For polling instead of traps, see the SNMP Get Request and Response Packet Capture. More captures are in the Packet Capture Library.

Want to open this capture in Wireshark yourself? The pcap file is free with a NetworkLessons account. Your free account also unlocks all our free lessons and every capture in the Packet Capture Library.

Create a free account to download the pcap

Already have an account? Log in and the download button appears here.

Capture overview

Packet walkthrough

The trap (packet 1)

Internet Protocol Version 4, Src: 192.168.12.1, Dst: 192.168.12.2
User Datagram Protocol, Src Port: 60109, Dst Port: 162
Simple Network Management Protocol
    version: v2c (1)
    community: public
    data: snmpV2-trap (7)
        snmpV2-trap
            request-id: 11
            error-status: noError (0)
            error-index: 0
            variable-bindings: 6 items
                1.3.6.1.2.1.1.3.0: 18449
                    Object Name: 1.3.6.1.2.1.1.3.0 (iso.3.6.1.2.1.1.3.0)
                    Value (Timeticks): 18449
                1.3.6.1.6.3.1.1.4.1.0: 1.3.6.1.6.3.1.1.5.3 (iso.3.6.1.6.3.1.1.5.3)
                    Object Name: 1.3.6.1.6.3.1.1.4.1.0 (iso.3.6.1.6.3.1.1.4.1.0)
                    Value (OID): 1.3.6.1.6.3.1.1.5.3 (iso.3.6.1.6.3.1.1.5.3)
                1.3.6.1.2.1.2.2.1.1.7: 7
                    Object Name: 1.3.6.1.2.1.2.2.1.1.7 (iso.3.6.1.2.1.2.2.1.1.7)
                    Value (Integer32): 7
                1.3.6.1.2.1.2.2.1.2.7: "Loopback1"
                    Object Name: 1.3.6.1.2.1.2.2.1.2.7 (iso.3.6.1.2.1.2.2.1.2.7)
                    Value (OctetString): "Loopback1"
                1.3.6.1.2.1.2.2.1.3.7: 24
                    Object Name: 1.3.6.1.2.1.2.2.1.3.7 (iso.3.6.1.2.1.2.2.1.3.7)
                    Value (Integer32): 24
                1.3.6.1.4.1.9.2.2.1.1.20.7: "administratively down"
                    Object Name: 1.3.6.1.4.1.9.2.2.1.1.20.7 (iso.3.6.1.4.1.9.2.2.1.1.20.7)
                    Value (OctetString): "administratively down"

There are a few things worth pointing out:

• UDP destination port 162: managers listen for traps on port 162. Polling (get, set) goes the other way, to the agent on port 161.
• community: public: SNMPv2c has no encryption or real authentication. The community string travels in clear text, so anyone who captures the trap can read it.
• snmpV2-trap (PDU type 7): the manager doesn’t answer a trap. If the packet is lost, it’s gone. An inform uses a different PDU type and does get a response.
• request-id 11: the agent numbers its messages. For a trap, the error-status and error-index fields are always 0.
• Binding 1, sysUpTime.0 (1.3.6.1.2.1.1.3.0) = 18449: how long the agent has been up, in hundredths of a second (184.49 seconds here). SNMPv2c traps always start with this binding.
• Binding 2, snmpTrapOID.0 (1.3.6.1.6.3.1.1.4.1.0) = 1.3.6.1.6.3.1.1.5.3: which trap this is. 1.3.6.1.6.3.1.1.5.3 is linkDown. linkUp is …5.4.
• Bindings 3-5, ifIndex.7, ifDescr.7 and ifType.7: the interface that went down. Its ifIndex is 7, its name is “Loopback1”, and type 24 means softwareLoopback. All three OIDs end in .7, the interface’s index.
• Binding 6, 1.3.6.1.4.1.9.2.2.1.1.20.7 = “administratively down”: an OID under 1.3.6.1.4.1.9, the Cisco enterprise branch. Cisco adds the reason the interface changed state, so the manager knows someone shut it down.