According to the ASN.1 documents, OIDs of the form 2.100.3 are correctly encoded as 0x0603813403. tcpdump fails to properly decode them - it displays the value 4.20.3 instead of 2.100.3. The patch below fixes this problem.
/js --- print-snmp.c.~1.50.~ Tue Sep 18 00:16:53 2001 +++ print-snmp.c Mon May 6 11:24:14 2002 @@ -688,13 +688,17 @@ /* * first subitem encodes two items with 1st*OIDMUX+2nd + * (see X.690:1997 clause 8.19 for the details) */ if (first < 0) { + int s; if (!nflag) objp = mibroot; first = 0; - OBJ_PRINT(o/OIDMUX, first); - o %= OIDMUX; + s = o / OIDMUX; + if (s > 2) s = 2; + OBJ_PRINT(s, first); + o -= s * OIDMUX; } OBJ_PRINT(o, first); if (--first < 0) @@ -875,16 +879,19 @@ /* * first subitem encodes two items with 1st*OIDMUX+2nd + * (see X.690:1997 clause 8.19 for the details) */ if (first < 0) { first = 0; if (*oidlen < oidsize) { - oid[(*oidlen)++] = o/OIDMUX; + oid[*oidlen] = o / OIDMUX; + if (oid[*oidlen] > 2) oid[*oidlen] = 2; } - o %= OIDMUX; + o -= oid[*oidlen] * OIDMUX; + if (*oidlen < oidsize) (*oidlen)++; } if (*oidlen < oidsize) { - oid[(*oidlen)++] = o; + oid[(*oidlen)++] = o; } o = 0; } - This is the TCPDUMP workers list. It is archived at http://www.tcpdump.org/lists/workers/index.html To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe