snmpwalk

Information Gathering

Intermediatemedium risk

snmpwalk is an SNMP application that uses SNMP GETNEXT requests to query a network entity for a tree of information, allowing deep network profile mapping.

Installation

sudo apt install snmp

Basic Syntax

snmpwalk -v <version> -c <community_string> <target>

Quick Facts

Full Name

SNMPwalk

License

BSD

Author

Net-SNMP Project

Written In

C

Platforms

Linux, macOS, Windows

Category

SNMP Enumeration

SNMP Versions

v1, v2c, v3

Tool Overview

SNMPwalk is a command-line tool for querying SNMP-enabled devices and walking the MIB (Management Information Base) tree. It extracts configuration data, network statistics, user accounts, and system information from routers, switches, servers, and other SNMP-enabled devices.

SNMP (Simple Network Management Protocol) is widely used for network device management. When community strings are weak or default, SNMPwalk can enumerate extensive device information, revealing network architecture, user accounts, and configuration details.

The tool is essential for network security assessments. It helps identify misconfigured SNMP services, weak community strings, and exposed device information that could be leveraged in a penetration test.

Common Commands

snmpwalk -v 2c -c public 192.168.1.1Enumerate MIB tree - Dump configuration details from the target using standard string inputs

snmpwalk -v2c -c public 192.168.1.1Walk with public community

snmpwalk -v2c -c public 192.168.1.1 1.3.6.1.2.1.1System info only

snmpwalk -v2c -c public 192.168.1.1 1.3.6.1.4.1.77.1.2.25Windows users

snmpwalk -v2c -c public 192.168.1.1 1.3.6.1.2.1.25.4.2.1.2Running processes

onesixtyone -c community.txt 192.168.1.0/24Brute force community strings

snmpwalk -v2c -c public 192.168.1.1Walk all SNMP objects

snmpwalk -v2c -c public 192.168.1.1 1.3.6.1.2.1.1Walk system group

snmpwalk -v2c -c public 192.168.1.1 1.3.6.1.2.1.25.4Walk running processes

snmpwalk -v2c -c public 192.168.1.1 1.3.6.1.2.1.4.20Walk IP addresses

snmpwalk -v2c -c public 192.168.1.1 1.3.6.1.2.1.2.2Walk network interfaces

snmpwalk -v2c -c public 192.168.1.1 1.3.6.1.4.1.77.1.2.25Walk Windows user accounts

snmpwalk -v2c -c public 192.168.1.1 -OnNumeric OID output

snmpwalk -v2c -c public 192.168.1.1 -ObPrint full OIDs

snmpwalk -v2c -c public 192.168.1.1 -t 1010-second timeout

Step-by-Step Guide

1Begin by testing the standard default string, typically 'public'
2Dump the entire Management Information Base hierarchy from the device
3Filter the output to isolate specific Object Identifiers of value
4Look for user accounts, installed software, and routing tables in the output
5Record these details for further network mapping efforts

Use Cases

Device Information Gathering

Extract system info, interfaces, routes, and configurations from SNMP devices.

Community String Testing

Test for default or weak SNMP community strings.

Network Mapping

Discover network topology through router and switch SNMP data.

User Enumeration

Extract user accounts from SNMP-enabled devices.

Key Features

MIB Walking: Walk entire or partial MIB trees on SNMP devices.
Multiple SNMP Versions: Support for SNMPv1, v2c, and v3.
Community String Testing: Test for default and weak community strings.
Specific OID Queries: Target specific device information OIDs.
Bulk Requests: Efficient bulk SNMP queries for faster enumeration.

Related Tools

Nmap

Information Gathering

Discover SNMP-enabled devices through port scanning.

Frequently Asked Questions

What is SNMPwalk used for?

SNMPwalk is used for querying SNMP-enabled devices to extract configuration data, network statistics, user accounts, and system information. It walks the MIB tree to enumerate all available OIDs on a device.

What is a community string?

A community string is like a password for SNMP access. 'public' is the default read-only string. If a device uses default community strings, SNMPwalk can access all SNMP data.

What SNMP versions does SNMPwalk support?

SNMPwalk supports SNMPv1, SNMPv2c, and SNMPv3. v3 adds encryption and authentication but is more complex to configure.

Is SNMPwalk legal?

SNMPwalk is legal when used on networks you own or have authorization to test. Unauthorized SNMP enumeration can violate computer misuse laws.

How do I install SNMPwalk?

Install SNMPwalk using: sudo apt install snmp on Kali Linux. On other systems, install the net-snmp package via your package manager.

How do I use SNMPwalk to enumerate a device?

Run snmpwalk -v2c -c public target to walk the entire MIB tree. Use specific OIDs to target system info (1.3.6.1.2.1.1) or interfaces (1.3.6.1.2.1.2).

What are common SNMP community strings?

Common community strings include: public, private, manager, admin, snmp, and test. Always test these defaults first when assessing SNMP security.

How do I test SNMPv3 with SNMPwalk?

Use snmpwalk -v3 -l authPriv -u username -A authpass -X privpass target for SNMPv3 with authentication and encryption.

What information can SNMPwalk reveal?

SNMPwalk can reveal system info, network interfaces, running processes, installed software, user accounts, routing tables, and device configurations depending on accessible OIDs.

How does SNMPwalk compare to snmp-check?

SNMPwalk provides raw MIB tree output with full flexibility. snmp-check formats output for easier reading. Use SNMPwalk for comprehensive enumeration; snmp-check for quick device info.

What is the -c flag in SNMPwalk?

The -c flag specifies the community string for SNMPv1/v2c authentication. Use -c public for read-only access or -c private for read-write access.

What is the -v flag in SNMPwalk?

The -v flag specifies the SNMP version: -v1, -v2c, or -v3. Version 2c is most common for community string authentication; version 3 adds security features.

Why is SNMPwalk not returning results?

The target may not have SNMP enabled, use a different community string, or restrict SNMP access. Try different community strings and verify SNMP is running on port 161/udp.

What is a MIB in SNMP?

MIB (Management Information Base) is a hierarchical database of OIDs (Object Identifiers) that define manageable objects on a network device. SNMPwalk traverses this tree to extract data.

How do I enumerate Windows users with SNMPwalk?

Use snmpwalk -v2c -c public target 1.3.6.1.4.1.77.1.2.25 to enumerate Windows user accounts through SNMP.

What is the difference between SNMPwalk and snmpget?

snmpwalk retrieves an entire subtree of OIDs using GETNEXT requests. snmpget retrieves a single specific OID value. Use snmpwalk for enumeration; snmpget for targeted queries.

How do I brute-force SNMP community strings?

Use tools like onesixtyone: onesixtyone -c community.txt target to test multiple community strings against SNMP-enabled devices.

What ports does SNMP use?

SNMP uses UDP ports 161 (agent) and 162 (manager/traps). Ensure these ports are accessible when using SNMPwalk.

How long does an SNMPwalk scan take?

A basic SNMPwalk scan completes in 5-30 seconds. Walking the entire MIB tree takes longer but provides comprehensive device information.