SNMP BER/OID Decoder
Decode SNMP and ASN.1 BER hexadecimal data, inspect TLV structures and convert BER-encoded OBJECT IDENTIFIER values into dotted-decimal OIDs.
—
—
—
What Is an SNMP BER Decoder?
An SNMP BER decoder interprets the ASN.1 Basic Encoding Rules used to serialize SNMP messages. BER represents data as a sequence of tag, length and value fields, commonly called TLV encoding.
This decoder can inspect individual BER values as well as nested structures such as an SNMP message, PDU and VarBind list.
ASN.1 BER Tag-Length-Value Format
06 08 2B 06 01 02 01 01 01 00
06
Tag = OBJECT IDENTIFIER
08
Length = 8 bytes
2B 06 01 02 01 01 01 00
Value = 1.3.6.1.2.1.1.1.0Common BER Tags Used by SNMP
| Tag | ASN.1 Type | Purpose |
|---|---|---|
| 0x02 | INTEGER | Signed integer value |
| 0x04 | OCTET STRING | Text or arbitrary octets |
| 0x05 | NULL | Null value |
| 0x06 | OBJECT IDENTIFIER | OID value |
| 0x30 | SEQUENCE | Constructed sequence |
| 0x40 | IpAddress | IPv4 address in SNMP |
| 0x41 | Counter32 | 32-bit counter |
| 0x42 | Gauge32 / Unsigned32 | Unsigned gauge |
| 0x43 | TimeTicks | Hundredths of a second |
| 0x46 | Counter64 | 64-bit counter |
How BER Length Encoding Works
For lengths below 128 bytes, BER normally uses one length byte. If bit 7 of the first length byte is set, the lower seven bits specify how many subsequent bytes contain the actual length.
04 05 48 65 6C 6C 6F
04 = OCTET STRING
05 = length 5
48 65 6C 6C 6F = "Hello"How SNMP OID BER Encoding Works
An OBJECT IDENTIFIER is a sequence of integer arcs such as 1.3.6.1.2.1.1.1.0. BER combines the first two arcs and encodes later subidentifiers using base-128 groups.
OID:
1.3.6.1.2.1.1.1.0
BER value:
2B 06 01 02 01 01 01 00
2B = 43
43 = (1 × 40) + 3SNMP PDU Tags
| Tag | PDU |
|---|---|
| 0xA0 | GetRequest-PDU |
| 0xA1 | GetNextRequest-PDU |
| 0xA2 | Response-PDU |
| 0xA3 | SetRequest-PDU |
| 0xA4 | Trap-PDU (SNMPv1) |
| 0xA5 | GetBulkRequest-PDU |
| 0xA6 | InformRequest-PDU |
| 0xA7 | SNMPv2-Trap-PDU |
| 0xA8 | Report-PDU |
SNMP Message Structure
SEQUENCE
├── version
├── community
└── PDU
├── request-id
├── error-status
├── error-index
└── VarBindList
└── VarBind
├── OBJECT IDENTIFIER
└── valueSNMPv1 and SNMPv2c messages commonly contain a version INTEGER, community OCTET STRING and context-specific PDU inside the outer SEQUENCE.
TimeTicks Conversion
SNMP TimeTicks represent hundredths of a second. A raw value of 12345 therefore represents 123.45 seconds.
TimeTicks = 12345
Seconds:
12345 / 100 = 123.45
Approximate duration:
2 minutes 3.45 seconds