SNMPSNIFF(1)

NAME
snmpsniff - Promiscualy listen on a device to show passing SNMP PDU's.

SYNOPSIS
snmpsniff [-v] [-r] [-i interface] [-f filename] [-c count] [-e expression] [-l community [-l community ...]] [-t pdutype [-t pdutype ...]] [-d numericOID [-d numericOID ...]] [-p hostname]

DESCRIPTION
Snmpsniff will stand listening on a network interface (in principle, any network interface will work), decoding and showing all information inside SNMP PDU's. This version can decode any valid SNMP PDU, however it's restricted to the currently accepted SNMP authentication method -- community based SNMPv[1,2]. Because this software uses the current CMU-SNMP API (1.10), and this one conforms to the current accepted authentication mechanism (community based), receiving a party/user based PDU may result on unexpected results. You are warned.

If you run snmpsniff without any arguments, the program will try to find an appropriate interface to run (probably, the first Ethernet interface it finds), place it in promiscuous mode and listen on any SNMP packet that goes through it. The appropriate UDP ports where to listen to will be extracted from /etc/services , change this file if you need to specify a different port other than the standard 161 for SNMP requests, and 162 for traps. In practice, snmpsniff will run with a BPF filter like the following:

(udp and (dst port snmp-trap or dst port snmp or src port snmp))

If you compile snmpsniff with the libpcap capture mechanism, you can also specify an expression that will be added to this filter.

OPTIONS

-v  Turn on verbose information. With this option you can see all the information inside a PDU, not only a summary of it's contents. In verbose mode, you can see all the variable bindings inside a PDU -- including values, and type mismatches.
-r  By default, snmpsniff will *not* resolve IP addresses to FQDN's, if you turn on this option, it will do so.
-i interface
    If you specify an interface name with this option, snmpsniff will use it to capture packets, instead of trying to find one automagicaly.
-f filename
    If you specify a filename with this option, snmpsniff will use the data within it parse previously captured packets with a tool like tcpdump. You can use tcpdump with a sintax like:
     	tcpdump -s 4096 -c 500 -w filename.raw
-c count
    If you want to capture a maximum
    (count)
    number of PDU's, and then having automaticaly the program killed, you must use this option. This is useful for automated processes.
-e expression
    If you have compiled snmpsniff with libpcap, you can specify
    a BPF filter expression with this option.
    This expression will be concatenated to the internal expression.
-l community
    With this option you can filter the PDU's you want to see using
    the community string as a matching option. For example, if you
    only wanted to see PDU's with a community of "public" or "private"
    you could use:
    % snmpsniff -l public -l private
-t pdutype
    With this option you can filter out certain PDU types from beeing
    shown. For example, if you only wanted to see all PDU's except
    "get" and "getnext" you could use:
    % snmpsniff -t get -t getnext
    the avaiable PDU types are: get, getnext, response, set, trap,
    getbulk, inform, trapv2 and report.
-d numericOID
    With this option you can filter out certain PDU's that contain
    specific variable bindings. The comparison is made between
    numeric representations of the OID, so, if you specified the OID
    ".1.3.6.1.4.1.9" (the cisco sub-tree), all PDU's containing OID's
    with the form: ".1.3.6.1.4.1.9.x...." would be ignored by the
    sniffer.
    You must however consider that *all* of the PDU will be cut out,
    even if it contains other OID's that don't match.
-p hostname
    With this option you can run snmpsniff as an SNMPv1 "trap proxy",
    that is, snmpsniff will resend all the TRAP PDU's it listens to
    a certain host.
    This is useful for, e.g., running a centralized TRAP manager
    without actualy reconfiguring the agents. Some other uses might
    me possible. *NOTE*: this is very experimental.

EXAMPLES
% snmpsniff -c 10 -i eth1
will capture 10 SNMP PDU's, over the eth1 interface.
% snmpsniff -e and src host obelix and dst host asterix
will capture *all* SNMP PDU's over the automagicaly detected interface, that comes from host obelix, and goes to host asterix.

ENVIRONMENT
MIBFILE_v2: Location of the SNMP MIB.
This will usually be /etc/mib-v2.txt, /usr/local/etc/mib-v2.txt, or anything like it.

FILES
mib-v2.txt                   First MIB tried if env. var is not set
/etc/mib-v2.txt              Second MIB tried if env. var is not set
/etc/services             Internet network services list

RFCS
Related RFCs: 1065, 1066, 1067
Related SNMPv2 RFCs: 1901, 1902, 1902, 1904, 1905, 1906, 1907, 1908, 1909

SEE ALSO
pcap(3), tcpdump(1), snmp_api(3)