Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Using the following command I can capture SNMP requests to my server, is there a way I can also capture the response my SNMP agent sends?

snoop -o snmp.cap udp port 161

Thanks for any thoughts

share|improve this question
What I do is capture everything in the snoop.cap file and then use wireshark to filter. – davey May 14 '13 at 7:51

I guess what you want to do is capture traps. The standard trap port is 162, so your command likely should look like this:

snoop -o trap.cap udp port 162
share|improve this answer

Usually SNMP agents reply via 161, so it is strange that you said snoop did not capture the responses.

Is it OK that you run "snoop -o snmp.cap" to capture all packets and then filter out SNMP packets from the big capture? In that way you can see details on the SNMP replies (SNMP RESPONSE messages) and you will know whether the SNMP agent you use sends them out via port 161.

Yes, port 162 is for TRAP and NOTIFICATION messages, but I think that's not what you want to capture, right?

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.