RE: Viewing 64bit counters in an ethereal capture

I installed Wireshark 0.99.1pre1 and tried opening my old packet capture.

The values there came up garbled such as follows :

    Object identifier 6: 1.3.6.1.2.1.31.1.1.1.6.86 (IF-MIB::ifHCInOctets.86)
    Value : 0x2578d9103013060b2b060102011f0101010756460400b87a543010060b2b060102011f01010108564601003010060b2b060102011f01010109564601003014060b2b060102011f0101010a564605787de4595c3014060b2b060102011f0101010b564605025130b2f33010060b2b060102011

However, I ran a new capture session using Wireshark and the 64bit results look fine now, and match what's returned by the snmp tool.  

    Object identifier 1: 1.3.6.1.2.1.31.1.1.1.6.86 (IF-MIB::ifHCInOctets.86)
    Value: 34461959

Thanks for your help! :)

Vip 

-----Original Message-----
From: ronnie sahlberg [mailto:[email protected]] 
Sent: Wednesday, June 28, 2006 4:32 PM
To: Ethereal user support
Cc: [email protected]
Subject: Re: Viewing 64bit counters in an ethereal capture

please try the latest version of wireshark.

there has been fixes in wireshark for 64 bit integers/counters.



On 6/28/06, Dhanak, Vipul (Vip) <[email protected]> wrote:
> I'm currently using Ethereal 0.10.14 to try and  capture some SNMP traffic
> from a Cisco 7x00 switch for analysis.  I'm primarily interested in the
> stats reported in the ifXentry table (1.3.6.1.2.1.31.1.1.1) table which
> contains 64bit counters.
>
> The capture appears to happen as expected but the results I see in the
> output of the snmpget command is different than the value shown in Ethereal.
>  For example, during one of the polls the value shown from snmpget was
> (counter64) 2934035119 whereas Ethereal shows Value: Counter64:
> 15195617933287765935.
>
> Subsequent snmpget's of the counter show increasing values in my snmpget
> tool whereas the values seen within Ethereal don't seem to show this
> pattern, and often go down before going up during the next poll.
>
> Is this the expected behavior ?  i.e. do I need to do some conversion to the
> value shown in Ethereal in order to get the correct result ?  I've tried
> reverting back to older versions of Ethereal but the results remain the
> same.
>
> Any help with troubleshooting (or explaining this behavior) would be much
> appreciated.
>
> Regards.
>
> Vip.