1

Implementing a SNMP v1 decoder and working with some Wireshark captures, I can see that sometimes length field of a BER if coded with one byte and other times with two bytes.

Reading BER rules, if more significative bit is setted to 1, then the length value must be extended with next byte to represent values bigger than 255.

So, if firt byte is 0x81, and next byte is 0x9F, then the extended Length field should take the 0x9F value... OK

My question is: If second byte is 0x9F, the more significative bit is 1 again.

Wireshark only takes two bytes for this length.

Why in this case size of Length is only two bytes?

Length fields are restricted to 2 bytes?

Thanks.

Cesar Ortiz
  • 884
  • 1
  • 8
  • 25

3 Answers3

4

According to the BER rule, the length field can be multiple bytes (much more than 2),

http://en.wikipedia.org/wiki/KLV

Length Field

Following the bytes for the Key are bytes for the Length field which will tell you how many bytes follow the length field and make up the Value portion. There are four kinds of encoding for the Length field: 1-byte, 2-byte, 4-byte and Basic Encoding Rules (BER). The 1-, 2-, and 4-byte variants are pretty straightforward: make an unsigned integer out of the bytes, and that integer is the number of bytes that follow.

BER length encoding is a bit more complicated but the most flexible. If the first byte in the length field does not have the high bit set (0x80), then that single byte represents an integer between 0 and 127 and indicates the number of Value bytes that immediately follows. If the high bit is set, then the lower seven bits indicate how many bytes follow that themselves make up a length field.

For example if the first byte of a BER length field is binary 10000010, that would indicate that the next two bytes make up an integer that then indicates how many Value bytes follow. Therefore a total of three bytes were taken up to specify a length.

"If second byte is 0x9F, the more significative bit is 1 again." Is that a question? Only the first byte in the bytes determines how many following bytes are used to determine the length. So you never need to care about the most significant bit of the second byte. Never.

How Wireshark represents the bytes is not very critical. Unless Wireshark shows you a wrong value for length, you should not pay much attention to it.

Lex Li
  • 60,503
  • 9
  • 116
  • 147
  • Thanks for your answer. I was using http://www.rane.com/note161.html as reference to implement my decoder. That page talks about a diferent way to get the length value, so I'm a little bit confused now. I'm going to make more test to get the "right" way to get Length. – Cesar Ortiz Jun 18 '13 at 08:02
1

In ASN.1 BER Length Encoding Rules:

a) If the number of content octets <= 127 then length octet encodes number of content octets.

b) Else the most signicant bit of the rst length octet is set to 1 and other 7 bits describe number of length octets following.

c) The following length octets encode the length of content octets in Big Endian byte order.

Example:
Length 126: 01111110
Length 127: 01111111
Length 128: 10000001 10000000
Length 1031: 10000010 00000100 00000111

Number | MSB of 1st Byte | Bytes to represent the Number | BE Binary
128       |              1              |       0000001 (=1)       | 10000000 (=128+0+0+0+0+0+0+0)
1031     |              1              |       0000010 (=2)       | 00000100 00000111 (=1024+0+0+0+0+0+0+4+2+1)

AVA
  • 2,474
  • 2
  • 26
  • 41
0

I'd add that SNMP (usually) uses UDP datagram for transport, which are limited to 65535 bytes, that is 0xffff. Exactly 2 bytes are needed at most to encode the length.

Community
  • 1
  • 1
Matthieu
  • 2,736
  • 4
  • 57
  • 87