0

I'm not really sure where to ask this question. I have been searching for an answer so I will try asking here.

We have an application that communicates with our devices via SNMP. Our GET messages are triggering IPS/IDS system alerts because of value 0x04 in the Varbind value.

I am being told by development that 0x04 means empty but I can't find anything to say this is true. In a Wireshark trace this shows up as being Invalid.

Now when I had them test switching the value to 0x05 in the GETs the IPS/IDS systems stop throwing alerts since 0x05 is a NULL.

I would like to find valid martial I can reference for this.

Tsukasa
  • 6,342
  • 16
  • 64
  • 96
  • I don't know why this was put on hold, and I don't agree that this question is about "recommend or find a tool, library or favorite off-site resource". It's a valid technical question. – Jolta Jun 09 '14 at 11:05
  • @Jolta Yes I'm not sure either but after some days I finally found my answer. – Tsukasa Jun 09 '14 at 12:55

2 Answers2

2

I have found the answer to my search

0x04 = Octet String 0x00 = Length

This is in fact valid as empty but not in GetRequest.

RFC 3416 Protocol Operations for SNMP

PDU Processing “In the elements of procedure below, any field of a PDU which is not referenced by the relevant procedure is ignored by the receiving SNMP entity. However, all components of a PDU, including those whose values are ignored by the receiving SNMP entity, must have valid ASN.1 syntax and encoding. For example, some PDUs (e.g., the GetRequest-PDU) are concerned only with the name of a variable and not its value. In this case, the value portion of the variable binding is ignored by the receiving SNMP entity. The unSpecified value is defined for use as the value portion of such bindings.”

The unSpecified value is defined for use as the value portion in PDUs (e.g., the GetRequest-PDU) which are concerned only with the name of a variable and not its value. The name is the OID. The value is the field that contains 0x04 0x00. GetRequest-PDU must use 0x05 0x00 (NULL, the definition of unSpecified)

Tsukasa
  • 6,342
  • 16
  • 64
  • 96
0

Did you check out the RFC for SNMP

http://www.ietf.org/rfc/rfc1157.txt

Michael Hammer
  • 1
  • 1