Subject: [IPP] MIB construction information

From: Paul Santangelo via ipp <[email-masked]>
Date: Fri, 10 May 2019 14:06:54 -0400

Hey All:

This is probably the wrong group to be writing to, but I saw the the 
Printer MIB Project is closed and support is through this IPP workgroup.

I'm trying to develop a MIB for our printers to be used with Wireshark.  
I saw some information online, but there really is not starting place, 
examples to follow.  I'm am experienced enough to know how to read OID 
values and understand its hierarchy, but constructing the file so 
wireshark can read it, is weirding me out a bit.

Any help would be appreciated.

Thank you
-- 

Regards,

Paul Santangelo, CCNA, CNE
Escalation System Support (ESS) Integrator
Konica Minolta Business Solutions U.S.A., Inc.
101 Williams Drive Ramsey, NJ 07446
Office: 800-825-5664 <tel:800-825-5664>
Visit us: Count on Konica Minolta <http://www.countonkonicaminolta.com/>
<http://www.facebook.com/konicaminoltaus> 
<http://www.twitter.com/konicaminoltaus> 
<https://plus.google.com/u/0/101069343240482341568/about> 
<http://www.linkedin.com/companies/4830> 
<http://www.youtube.com/user/konicaminoltaus> 
<http://www.pinterest.com/konicaminoltaus>
Disclaimer 
<http://kmbs.konicaminolta.us/signature/KMBSUS-Disclaimer%20.png>

_______________________________________________
ipp mailing list
[email-masked]
https://www.pwg.org/mailman/listinfo/ipp

---

From: Paul Tykodi via ipp <[email-masked]>
Date: Fri, 10 May 2019 15:29:53 -0400

Hi Paul,

IPP protocol alerts are harmonized with MIB functionality of PWG authored MIB RFC’s. Current versions of Wireshark recognize and can properly dissect IPP.

If you decide you have to go the MIB route, the communication to printer resident MIB’s is typically SNMP based. In my career, I have reviewed Wireshark traces of SNMP v1 and SNMP v2 network flows involving MIB communications with a printer and Wireshark captured the communication correctly.

I don’t believe I have ever reviewed an SNMP v3 trace though.

Best Regards,

/Paul

Sent from my iPhone

> On May 10, 2019, at 2:06 PM, Paul Santangelo via ipp <[email-masked]> wrote:
> 
> Hey All:
> 
> This is probably the wrong group to be writing to, but I saw the the Printer MIB Project is closed and support is through this IPP workgroup.
> 
> I'm trying to develop a MIB for our printers to be used with Wireshark.  I saw some information online, but there really is not starting place, examples to follow.  I'm am experienced enough to know how to read OID values and understand its hierarchy, but constructing the file so wireshark can read it, is weirding me out a bit.
> 
> PAUL SANTANGELO, CCNA, CNE
> Office: 800-825-5664
> Visit us: Count on Konica Minolta
>            
> Disclaimer 
> 
>                       
>

---

From: Paul Santangelo via ipp <[email-masked]>
Date: Fri, 10 May 2019 15:44:53 -0400

Hey Paul:

Nice to hear from you again.  I am trying to install our Private MIB 
into WireShark to decode the OID and Values.

After I submitted the email, I found one that looked very similar to 
others in the MIB folder under wireshark.

I moved the file over and named it properly as the name in the file and 
then added the filename to the SMI Modules.

I then relaunch Wireshark and get this error:

I am going back through the MIB to see what can be causing the error, 
but without a reference, I'm not sure that I will find it.

Regards,

On 5/10/2019 3:29 PM, Paul Tykodi wrote:
> Hi Paul,
>
> IPP protocol alerts are harmonized with MIB functionality of PWG 
> authored MIB RFC’s. Current versions of Wireshark recognize and can 
> properly dissect IPP.
>
> If you decide you have to go the MIB route, the communication to 
> printer resident MIB’s is typically SNMP based. In my career, I have 
> reviewed Wireshark traces of SNMP v1 and SNMP v2 network flows 
> involving MIB communications with a printer and Wireshark captured the 
> communication correctly.
>
> On May 10, 2019, at 2:06 PM, Paul Santangelo via ipp <[email-masked] 
> <mailto:[email-masked]>> wrote:
>
>> Hey All:
>>
>> I'm trying to develop a MIB for our printers to be used with 
>> Wireshark.  I saw some information online, but there really is not 
>> starting place, examples to follow.  I'm am experienced enough to 
>> know how to read OID values and understand its hierarchy, but 
>> constructing the file so wireshark can read it, is weirding me out a bit.
>>
>> [email-masked] <mailto:[email-masked]>

---

From: wamwagner--- via ipp <[email-masked]>
Date: Sun, 12 May 2019 19:21:38 -0400

Hello Paul,

It has been a while since  I have worked with MIBs,  and network management tools have apparently advanced a great deal since then. Although, as Paul indicated, Wireshark is used for monitoring network traffic, it appears that more recent versions also include the ability to decrypt encrypted SNMPV3 packets and  a  MIB complier that  allows SNMP packets to be translated into human readable data. 

MIB compilers have typically been inconsistent in how forgiving (or understanding) they are. However, when running a separate MIB compiler, they have typically been informative in what they don’t like. It is possible that the feedback in Wireshark is not as informative.  I would suggest using a separate such as the one from MG-SOFT (although Ira may have some good suggestions for free compilers.

I do not quite understand what you did to get the error message below, but as you have probably have seen, the bug report  you received reports “shows that it tries to read may MIBS and does not find them and then crashes”.  This is quite possible since MIBs typically import other MIBs, and the whole set must be available to complete a compilation. So you must ensure that all imported MIBs (as well as those imported by the imported MIBs) are loaded.
 Hope this helps.
Bill Wagner

From: Paul Santangelo via ipp
Sent: Friday, May 10, 2019 3:45 PM
To: Paul Tykodi
Cc: [email-masked]
Subject: Re: [IPP] MIB construction information

Hey Paul:

Nice to hear from you again.  I am trying to install our Private MIB into WireShark to decode the OID and Values.

After I submitted the email, I found one that looked very similar to others in the MIB folder under wireshark.

I moved the file over and named it properly as the name in the file and then added the filename to the SMI Modules.

I am going back through the MIB to see what can be causing the error, but without a reference, I'm not sure that I will find it.

Regards,

Disclaimer 

Best Regards,

/Paul

Sent from my iPhone

Thank you
-- 

Regards,

Disclaimer

---

From: Paul Santangelo via ipp <[email-masked]>
Date: Mon, 13 May 2019 07:35:07 -0400

Thanks Bill:

I will continue to try and figure this out.

Regards,

On 5/12/2019 7:21 PM, [email-masked] wrote:
>
> Hello Paul,
>
> It has been a while since  I have worked with MIBs,  and network 
> management tools have apparently advanced a great deal since then. 
> Although, as Paul indicated, Wireshark is used for monitoring network 
> traffic, it appears that more recent versions also include the ability 
> to decrypt encrypted SNMPV3 packets and  a  MIB complier that  allows 
> SNMP packets to be translated into human readable data.
>
> MIB compilers have typically been inconsistent in how forgiving (or 
> understanding) they are. However, when running a separate MIB 
> compiler, they have typically been informative in what they don’t 
> like. It is possible that the feedback in Wireshark is not as 
> informative.  I would suggest using a separate such as the one from 
> MG-SOFT (although Ira may have some good suggestions for free compilers.
>
> I do not quite understand what you did to get the error message below, 
> but as you have probably have seen, the bug report  you received 
> reports “shows that it tries to read may MIBS and does not find them 
> and then crashes”.  This is quite possible since MIBs typically import 
> other MIBs, and the whole set must be available to complete a 
> compilation. So you must ensure that all imported MIBs (as well as 
> those imported by the imported MIBs) are loaded.
> Hope this helps.
> Bill Wagner
>
> *From: *Paul Santangelo via ipp <mailto:[email-masked]>
> *Sent: *Friday, May 10, 2019 3:45 PM
> *To: *Paul Tykodi <mailto:[email-masked]>
> *Cc: [email-masked] <mailto:[email-masked]>
> *Subject: *Re: [IPP] MIB construction information
>
> Hey Paul:
>
> I moved the file over and named it properly as the name in the file 
> and then added the filename to the SMI Modules.
>
> https://ci4.googleusercontent.com/proxy/SPUn4uANDdmNb7CIaU3MVxCL9yzHCasjuFg1Ny9WXhFrRpWDT2uFP8FXG3vwjjqr4030iknKn98hPTvWSy_Nh9F6jHJGQwBlpM0=s0-d-e1-ft#http://kmbs.konicaminolta.us/signature/blue-line.png
>
> https://ci6.googleusercontent.com/proxy/tbtHAcNTXeRMiaG137FZoFJ_UV97e25Z5sKATbavU4bDDOAI6DYHIlwTfckF_yNpQ5URR5VtuWqyxL4XRTWdtS1EK64ZP5pDKSidR5s=s0-d-e1-ft#http://kmbs.konicaminolta.us/signature/KMBSLogo75pc.png
>
> *Paul Santangelo, CCNA, CNE*
>
> *Konica Minolta Business Solutions U.S.A., Inc.*
>
> https://ci5.googleusercontent.com/proxy/707BY_vnTWJ75kgiQ3IHf8YGQv-kCjXdLN6xEBgS5wkgpKsjYVlSRA4gC_uAy-W0FWcKxO371pfr9jqGPYzTonvZ10MVUQrexA=s0-d-e1-ft#http://kmbs.konicaminolta.us/signature/Facebook.png 
> <http://www.facebook.com/konicaminoltaus>https://ci4.googleusercontent.com/proxy/hSwDHhLccilQp7Lmku10u8psS6W3vU8S2Lb7BWz-y1xsVgxDd-zf2SkJ6i9_hq7Bedq9PaUg8pJ46gTpux1FIgptvpd9ovM_=s0-d-e1-ft#http://kmbs.konicaminolta.us/signature/Twitter.png 
> <http://www.twitter.com/konicaminoltaus>https://ci3.googleusercontent.com/proxy/YLQcm40VIQKljib_udn4j8ieXd-PR65-T_QqGQ214pGnbeGRNHY9qzg4MUJf6qgvhONYuYK1_M70tSd9Rd7AQvzWF_bjxRPL=s0-d-e1-ft#http://kmbs.konicaminolta.us/signature/google+.png 
> <https://plus.google.com/u/0/101069343240482341568/about>https://ci6.googleusercontent.com/proxy/Set_KzVTzpYqv88JOwRd5TFm7zIm8mTwz1mObXuC4MuVM-CZ3uL2rwrK1wghwXzAgnUwlFCnQlRoA3I2D5rpX1yINvNWgu9PHw=s0-d-e1-ft#http://kmbs.konicaminolta.us/signature/Linkedin.png 
> <http://www.linkedin.com/companies/4830>https://ci4.googleusercontent.com/proxy/tPmZilANbK27LTGcWXc1b2rGqeoBcuZw-tKByD52Kr-iSl5CuhBGKn9eWw-JtDCWB-C5gtv-Bk1IW5TGlFyj_HlMCHCP3x3Y=s0-d-e1-ft#http://kmbs.konicaminolta.us/signature/YouTube.png 
> <http://www.youtube.com/user/konicaminoltaus>https://ci6.googleusercontent.com/proxy/4zTapCUvb8Pzl5eZO9lwBRZq6aE0Op8nHLEeAKv96k0S-1pGHzx1jJOTNQql0BzGiRB4K1N_jfbPcpwcOyRbouSlz3fL6HQzdFA=s0-d-e1-ft#http://kmbs.konicaminolta.us/signature/Pinterest.png 
> https://ci4.googleusercontent.com/proxy/SPUn4uANDdmNb7CIaU3MVxCL9yzHCasjuFg1Ny9WXhFrRpWDT2uFP8FXG3vwjjqr4030iknKn98hPTvWSy_Nh9F6jHJGQwBlpM0=s0-d-e1-ft#http://kmbs.konicaminolta.us/signature/blue-line.png
>
>     authored MIB RFC’s. Current versions of Wireshark recognize and
>     can properly dissect IPP.
>
>     printer resident MIB’s is typically SNMP based. In my career, I
>     have reviewed Wireshark traces of SNMP v1 and SNMP v2 network
>     flows involving MIB communications with a printer and Wireshark
>     captured the communication correctly.
>
>         This is probably the wrong group to be writing to, but I saw
>         the the Printer MIB Project is closed and support is through
>         this IPP workgroup.
>
>         Wireshark.  I saw some information online, but there really is
>         not starting place, examples to follow.  I'm am experienced
>         enough to know how to read OID values and understand its
>         hierarchy, but constructing the file so wireshark can read it,
>         is weirding me out a bit.
>
>         https://ci4.googleusercontent.com/proxy/SPUn4uANDdmNb7CIaU3MVxCL9yzHCasjuFg1Ny9WXhFrRpWDT2uFP8FXG3vwjjqr4030iknKn98hPTvWSy_Nh9F6jHJGQwBlpM0=s0-d-e1-ft#http://kmbs.konicaminolta.us/signature/blue-line.png
>
>         https://ci6.googleusercontent.com/proxy/tbtHAcNTXeRMiaG137FZoFJ_UV97e25Z5sKATbavU4bDDOAI6DYHIlwTfckF_yNpQ5URR5VtuWqyxL4XRTWdtS1EK64ZP5pDKSidR5s=s0-d-e1-ft#http://kmbs.konicaminolta.us/signature/KMBSLogo75pc.png
>
>         *Paul Santangelo, CCNA, CNE*
>
>         *Konica Minolta Business Solutions U.S.A., Inc.*
>
>         <http://www.countonkonicaminolta.com/>
>
>         https://ci5.googleusercontent.com/proxy/707BY_vnTWJ75kgiQ3IHf8YGQv-kCjXdLN6xEBgS5wkgpKsjYVlSRA4gC_uAy-W0FWcKxO371pfr9jqGPYzTonvZ10MVUQrexA=s0-d-e1-ft#http://kmbs.konicaminolta.us/signature/Facebook.png
>         <http://www.facebook.com/konicaminoltaus>https://ci4.googleusercontent.com/proxy/hSwDHhLccilQp7Lmku10u8psS6W3vU8S2Lb7BWz-y1xsVgxDd-zf2SkJ6i9_hq7Bedq9PaUg8pJ46gTpux1FIgptvpd9ovM_=s0-d-e1-ft#http://kmbs.konicaminolta.us/signature/Twitter.png
>         <http://www.twitter.com/konicaminoltaus>https://ci3.googleusercontent.com/proxy/YLQcm40VIQKljib_udn4j8ieXd-PR65-T_QqGQ214pGnbeGRNHY9qzg4MUJf6qgvhONYuYK1_M70tSd9Rd7AQvzWF_bjxRPL=s0-d-e1-ft#http://kmbs.konicaminolta.us/signature/google+.png
>         <https://plus.google.com/u/0/101069343240482341568/about>https://ci6.googleusercontent.com/proxy/Set_KzVTzpYqv88JOwRd5TFm7zIm8mTwz1mObXuC4MuVM-CZ3uL2rwrK1wghwXzAgnUwlFCnQlRoA3I2D5rpX1yINvNWgu9PHw=s0-d-e1-ft#http://kmbs.konicaminolta.us/signature/Linkedin.png
>         <http://www.linkedin.com/companies/4830>https://ci4.googleusercontent.com/proxy/tPmZilANbK27LTGcWXc1b2rGqeoBcuZw-tKByD52Kr-iSl5CuhBGKn9eWw-JtDCWB-C5gtv-Bk1IW5TGlFyj_HlMCHCP3x3Y=s0-d-e1-ft#http://kmbs.konicaminolta.us/signature/YouTube.png
>         <http://www.youtube.com/user/konicaminoltaus>https://ci6.googleusercontent.com/proxy/4zTapCUvb8Pzl5eZO9lwBRZq6aE0Op8nHLEeAKv96k0S-1pGHzx1jJOTNQql0BzGiRB4K1N_jfbPcpwcOyRbouSlz3fL6HQzdFA=s0-d-e1-ft#http://kmbs.konicaminolta.us/signature/Pinterest.png
>         https://ci4.googleusercontent.com/proxy/SPUn4uANDdmNb7CIaU3MVxCL9yzHCasjuFg1Ny9WXhFrRpWDT2uFP8FXG3vwjjqr4030iknKn98hPTvWSy_Nh9F6jHJGQwBlpM0=s0-d-e1-ft#http://kmbs.konicaminolta.us/signature/blue-line.png
>