Documentation
¶
Overview ¶
Package snmp decodes SNMP v1, v2c, and v3 packets — the dominant network-management protocol on enterprise networks, found on every router / switch / firewall / printer / UPS / PDU / managed AP / managed VM-host since the late '80s.
Wrap-vs-native judgement ¶
Native. SNMP is defined by RFC 1157 (v1), RFC 1905 / 3416 (v2c PDU formats), and RFC 3411-3418 (v3 framework + USM + VACM). Every packet is ASN.1 BER-encoded with a small, well-bounded set of types (INTEGER, OCTET STRING, NULL, OBJECT IDENTIFIER, IpAddress, Counter32, Gauge32, TimeTicks, Counter64, plus the constructed SEQUENCE and the SNMP- specific PDU tags 0xA0..0xA8). A hand-rolled BER walker is ~200 lines and avoids dragging in encoding/asn1's stricter DER expectations. Pasting a hex blob from Wireshark / tshark / a tcpdump-of-161/162 / a community-string scan tool is enough — no SNMP agent, no MIB compilation.
What this package covers ¶
- SNMP envelope decode: outer SEQUENCE, version (v1=0, v2c=1, v3=3), community string (v1/v2c) or msgGlobalData
- msgSecurityParameters (v3, labeled with raw payload).
- PDU dispatch with the 9 documented PDU types:
- 0xA0 GetRequest
- 0xA1 GetNextRequest
- 0xA2 Response (a.k.a. GetResponse in v1 parlance)
- 0xA3 SetRequest
- 0xA4 Trap-PDU (SNMPv1 only — different shape from v2c traps)
- 0xA5 GetBulkRequest (v2c+)
- 0xA6 InformRequest (v2c+)
- 0xA7 SNMPv2-Trap (v2c+)
- 0xA8 Report (v3)
- PDU body fields: request-id, error-status (named NoError / TooBig / NoSuchName / BadValue / ReadOnly / GenErr / NoAccess / WrongType / WrongLength / WrongEncoding / WrongValue / NoCreation / InconsistentValue / ResourceUnavailable / CommitFailed / UndoFailed / AuthorizationError / NotWritable / InconsistentName), error-index.
- GetBulkRequest non-repeaters + max-repetitions (different from error-status / error-index).
- SNMPv1 Trap PDU: enterprise OID, agent-addr (IP), generic-trap (named: ColdStart / WarmStart / LinkDown / LinkUp / AuthenticationFailure / EGPNeighborLoss / enterpriseSpecific), specific-trap, time-stamp.
- VarBindList walker: OID + tagged value where the value is one of NULL (no-such-instance / pending / etc.), INTEGER, OCTET STRING (rendered as ASCII if printable else hex), OID, IpAddress (4-byte IPv4), Counter32, Gauge32, TimeTicks (centiseconds, rendered as a duration string), Counter64, noSuchObject, noSuchInstance, endOfMibView.
- OID decoding: first byte = 40 * arc1 + arc2 (special- cased per X.690 §8.19), subsequent arcs as base-128 with high bit = continuation.
What this package does NOT cover (deliberately out of scope) ¶
- SNMPv3 USM authentication (HMAC-MD5 / HMAC-SHA-*) and privacy (DES-CBC / AES-128 / AES-256 / 3DES) — these require the agent's auth/priv keys; the v3 envelope is decoded but the encrypted scopedPDU body is surfaced as raw hex.
- VACM (View-based Access Control Model) — runtime authorization decision; not relevant to packet decode.
- MIB compilation / OID-to-name lookup beyond the well- known OIDs (sysDescr, sysObjectID, sysUpTime, etc.) — full MIB compilation is a separate ~1500-line effort.
- SNMP over TLS / DTLS / SSH transport — operators feed the inner SNMP message after stripping the transport.
- AgentX (RFC 2741) — separate protocol, separate spec.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type PDU ¶
type PDU struct {
Tag int `json:"tag"`
TypeName string `json:"type_name"`
RequestID int `json:"request_id"`
ErrorStatus int `json:"error_status,omitempty"`
ErrorStatusName string `json:"error_status_name,omitempty"`
ErrorIndex int `json:"error_index,omitempty"`
NonRepeaters int `json:"non_repeaters,omitempty"`
MaxRepetitions int `json:"max_repetitions,omitempty"`
VarBinds []VarBind `json:"var_binds,omitempty"`
}
PDU is the decoded PDU body (for v1/v2c GetRequest / GetNextRequest / Response / SetRequest / GetBulkRequest / InformRequest / TrapV2 / Report). Trap-PDU (v1, tag 0xA4) uses TrapV1Body instead.
type Packet ¶
type Packet struct {
HexInput string `json:"hex_input"`
Version int `json:"version"`
VersionStr string `json:"version_str"`
Community string `json:"community,omitempty"`
V3Header *V3Header `json:"v3_header,omitempty"`
V3RawBody string `json:"v3_raw_body_hex,omitempty"`
PDU *PDU `json:"pdu,omitempty"`
TrapV1 *TrapV1Body `json:"trap_v1,omitempty"`
}
Packet is the decoded SNMP message view.
func DecodeBytes ¶
DecodeBytes parses a raw SNMP packet.
type TimeTicksValue ¶
type TimeTicksValue struct {
Centiseconds uint32 `json:"centiseconds"`
Pretty string `json:"pretty"`
}
TimeTicksValue is the centisecond-resolution duration used by SNMP timeticks values (RFC 1155 §6).
type TrapV1Body ¶
type TrapV1Body struct {
EnterpriseOID string `json:"enterprise_oid"`
AgentAddrIPv4 string `json:"agent_address_ipv4"`
GenericTrap int `json:"generic_trap"`
GenericTrapName string `json:"generic_trap_name"`
SpecificTrap int `json:"specific_trap"`
TimestampTicks uint64 `json:"timestamp_ticks"`
VarBinds []VarBind `json:"var_binds,omitempty"`
}
TrapV1Body is the SNMPv1 Trap-PDU (tag 0xA4) — a different shape from every other PDU.
type V3Header ¶
type V3Header struct {
MsgIDHex string `json:"msg_id_hex"`
MaxSizeHex string `json:"max_size_hex"`
FlagsHex string `json:"flags_hex"`
FlagAuth bool `json:"flag_auth"`
FlagPriv bool `json:"flag_priv"`
FlagReportable bool `json:"flag_reportable"`
SecurityModel int `json:"security_model"`
SecurityParamsHex string `json:"security_params_hex"`
}
V3Header is the SNMPv3 envelope before the encrypted/ scoped PDU body.
type VarBind ¶
type VarBind struct {
OID string `json:"oid"`
OIDName string `json:"oid_name,omitempty"`
ValueTag int `json:"value_tag"`
ValueType string `json:"value_type"`
StringValue string `json:"string_value,omitempty"`
IntValue int64 `json:"int_value,omitempty"`
UintValue uint64 `json:"uint_value,omitempty"`
OIDValue string `json:"oid_value,omitempty"`
IPValue string `json:"ip_value,omitempty"`
TimeTicks *TimeTicksValue `json:"time_ticks,omitempty"`
RawHex string `json:"raw_hex,omitempty"`
}
VarBind is one (OID, value) pair from a VarBindList.
Source Files