Wireshark: SNMP - UNSIGNED32

Question

I have a question about SNMP encoding of UNSIGNED32. I tried to implemet a stack to process SNMP requests, and I would like to use UNSIGNED32 type. But when I use a Wireshark to dump the net traffic, it shows, that the type is GAUGE32 (which is ok, according to SNMPv2) but it shows value "-1" (I sent data 0xFFFFFFFF). The value is encoded via ASN.1 as 0x42 0x04 0xFF 0xFF 0xFF 0xFF, and I think it should show 4294967295. So my question is -> Is that value encoded in a wrong way and there should be leading zero () or Wireshark decode it poorly?

Answer 1

ASN.1 is very strict in saying that all integer representations use two's complement. The key to understand is that the definition of UNSIGNED32 or GAUGE32 is part of the SNMPv2-SMI , which is a higher abstraction layer than the ASN.1 specification. Even though it's perfectly obvious at the SNMP level that a number is unsigned, based on the MIB definition, it's still technically wrong to leave the leading 0 bit off of an unsigned integer.

For fun, here's a link to a (somewhat condescending) answer to basically the same question.