onesixtyone: SNMP scanner for network devices

onesixtyone is a fast SNMP community string scanner written by Solar Designer and Portcullis Labs. Its name references SNMP’s default UDP port, 161. Where snmpwalk is designed to deeply enumerate a known-good community string against a single host, onesixtyone solves the earlier problem: efficiently discovering which community string (out of a wordlist) works, and which hosts (across an entire subnet) respond to SNMP at all. It achieves high speed by sending SNMP GET requests for sysDescr asynchronously/in bulk, rather than waiting for a full request/response cycle per host-community combination — allowing it to test thousands of host/community combinations per second.

onesixtyone is typically the first tool run in any SNMP-focused enumeration workflow, immediately followed by snmpwalk (or snmp-check) once a valid community string is found.

Installation

# Kali Linux (preinstalled)
sudo apt update
sudo apt install onesixtyone -y

# Verify
onesixtyone 2>&1 | head -5
which onesixtyone

Kali also ships a default community-string wordlist at /usr/share/wordlists/dirb/others/names.txt-style locations; a purpose-built SNMP community list is commonly available via SecLists at /usr/share/seclists/Discovery/SNMP/common-snmp-community-strings.txt.

Syntax

onesixtyone [options] <host> [community]
onesixtyone [options] -c <community-file> -i <host-file>

Command-Line Options

Option	Description
-c community-file	File containing a list of community strings to try
-i input-file	File containing a list of target IP addresses
-o output-file	Log results to a file
-d	Debug mode — show verbose packet-level information
-w ms	Wait time in milliseconds between sending each packet (throttle, default 10ms)
-p port	Destination UDP port (default 161)
-s src-ip	Source IP address to send requests from
-q	Quiet mode — only display community strings found, no banner
-b	Enable broadcast mode (send to broadcast address)
-h	Display help

Basic Usage

onesixtyone -c /usr/share/seclists/Discovery/SNMP/common-snmp-community-strings.txt 192.168.56.101

Expected output:

Scanning 1 hosts, 20 communities
192.168.56.101 [public] Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686

Practical Examples

Example 1 — Single host, single guessed community string

onesixtyone 192.168.56.101 public

Scanning 1 hosts, 1 communities
192.168.56.101 [public] Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686

Example 2 — Single host against a wordlist of community strings

onesixtyone -c /usr/share/seclists/Discovery/SNMP/common-snmp-community-strings.txt 192.168.56.101

Scanning 1 hosts, 20 communities
192.168.56.101 [public] Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686

Example 3 — Multiple hosts from a file, single community string

cat hosts.txt
# 192.168.56.101
# 192.168.56.102
# 192.168.56.103

onesixtyone -i hosts.txt public

Scanning 3 hosts, 1 communities
192.168.56.101 [public] Linux metasploitable 2.6.24-16-server
192.168.56.103 [public] Cisco IOS Software, C2960 Software

Example 4 — Full sweep: many hosts x many community strings

onesixtyone -c community_strings.txt -i hosts.txt -o results.txt

Scanning 3 hosts, 20 communities
192.168.56.101 [public] Linux metasploitable 2.6.24-16-server
192.168.56.103 [private] Cisco IOS Software, C2960 Software

Example 5 — Quiet mode for clean script parsing

onesixtyone -q -c community_strings.txt -i hosts.txt

192.168.56.101 [public] Linux metasploitable 2.6.24-16-server
192.168.56.103 [private] Cisco IOS Software, C2960 Software

Example 6 — Throttled scan to avoid flooding a sensitive network

onesixtyone -w 100 -c community_strings.txt -i hosts.txt

Scanning 3 hosts, 20 communities

[scan proceeds more slowly, one packet every 100ms]

192.168.56.101 [public] Linux metasploitable 2.6.24-16-server

Example 7 — Debug mode to inspect raw packet exchange

onesixtyone -d 192.168.56.101 public

Scanning 1 hosts, 1 communities
sending v1 GET packet to 192.168.56.101 for community public
received response from 192.168.56.101: sysDescr = Linux metasploitable...
192.168.56.101 [public] Linux metasploitable 2.6.24-16-server

Example 8 — Generating a target host file from an nmap UDP scan

nmap -sU -p161 --open -oG - 192.168.56.0/24 | awk '/161\/open/{print $2}' > snmp_hosts.txt
onesixtyone -c community_strings.txt -i snmp_hosts.txt

Scanning 4 hosts, 20 communities
192.168.56.101 [public] Linux metasploitable 2.6.24-16-server
192.168.56.150 [public] HP LaserJet 4250 Printer

Example 9 — Custom port scan (non-default SNMP port)

onesixtyone -p 1161 192.168.56.101 public

Scanning 1 hosts, 1 communities
192.168.56.101 [public] Linux metasploitable (SNMP relocated to 1161)

Example 10 — Saving results directly to a log file for reporting

onesixtyone -c community_strings.txt -i hosts.txt -o snmp_findings.log
cat snmp_findings.log

192.168.56.101 [public] Linux metasploitable 2.6.24-16-server
192.168.56.103 [private] Cisco IOS Software, C2960 Software

Common Use Cases

• Rapidly identifying valid (often default) SNMP community strings across an entire subnet before deep enumeration with snmpwalk
• Discovering SNMP-enabled devices (printers, switches, routers, UPS units) that responded to a UDP/161 port scan but whose community string is unknown
• Flagging read-write (private-style) community strings as high-severity findings — these often allow configuration changes or reboots
• Building a target list for automated SNMP enumeration pipelines that feed into snmpwalk/snmp-check
• Validating remediation after a previous assessment flagged default community strings, by re-running against the same host list

Automation with Bash

#!/bin/bash
# snmp_discover_and_walk.sh - Find valid community strings, then auto-run snmpwalk against each hit
HOSTS="hosts.txt"
COMMUNITIES="/usr/share/seclists/Discovery/SNMP/common-snmp-community-strings.txt"
FOUND="onesixtyone_hits.txt"

echo "[*] Discovering valid SNMP community strings..."
onesixtyone -q -c "$COMMUNITIES" -i "$HOSTS" > "$FOUND"
cat "$FOUND"

echo "[*] Running full snmpwalk against each discovered host/community pair..."
while read -r line; do
    ip=$(echo "$line" | awk '{print $1}')
    community=$(echo "$line" | grep -oP '(?<=\[)[^\]]+')
    echo "[*] Walking $ip with community '$community'"
    snmpwalk -v2c -c "$community" "$ip" > "snmpwalk_${ip}.txt" 2>&1
done < "$FOUND"

echo "[+] Done. See snmpwalk_*.txt for full results."

Tips and Best Practices

• Always pair onesixtyone (discovery) with snmpwalk (deep enumeration) — onesixtyone intentionally only pulls sysDescr, not the full MIB tree.
• Use a proven community-string wordlist (e.g., SecLists’ common-snmp-community-strings.txt) rather than only public/private; many vendors ship additional defaults (cisco, snmp, admin, manager).
• Throttle with -w on production or sensitive networks — SNMP scanning at full speed can occasionally trigger IDS/IPS alerts or overwhelm low-power embedded devices (printers, IoT).
• Run an nmap -sU -p161 sweep first to build a target list of hosts actually listening on SNMP, rather than scanning every host in the subnet blindly.
• Treat any discovered private/read-write community string as a critical finding — verify (carefully, non-destructively) whether it permits snmpset write operations.

Troubleshooting

Problem	Likely Cause	Solution
No results despite hosts being alive	UDP/161 filtered by firewall, or SNMP service not running	Confirm with nmap -sU -p161 <ip> --open
Very slow scan on a large subnet	Default per-packet wait plus UDP packet loss/retransmission	Reduce -w value cautiously (but see best-practice throttling note above)
False negatives on devices that ARE running SNMP	Community string not present in your wordlist	Add vendor-specific default strings (e.g., printer/router documentation)
-i file not read correctly	Wrong file format (extra whitespace/CRLF line endings)	Run dos2unix hosts.txt before scanning
Results show garbled/truncated sysDescr strings	Very long UDP responses fragmented/truncated	Cross-verify with a direct snmpwalk request instead

References

• Kali Linux tool page: https://www.kali.org/tools/onesixtyone/
• Source repository: https://github.com/trailofbits/onesixtyone
• SecLists SNMP community wordlists: https://github.com/danielmiessler/SecLists/tree/master/Discovery/SNMP