Using the following command I can capture SNMP requests to my server, is there a way I can also capture the response my SNMP agent sends?
snoop -o snmp.cap udp port 161
Thanks for any thoughts
I guess what you want to do is capture traps. The standard trap port is 162, so your command likely should look like this:
Usually SNMP agents reply via 161, so it is strange that you said snoop did not capture the responses.
Is it OK that you run "snoop -o snmp.cap" to capture all packets and then filter out SNMP packets from the big capture? In that way you can see details on the SNMP replies (SNMP RESPONSE messages) and you will know whether the SNMP agent you use sends them out via port 161.
Yes, port 162 is for TRAP and NOTIFICATION messages, but I think that's not what you want to capture, right?