snmp-check: Enumerating SNMP Devices and Extracting Configuration Data

SNMP is one of those protocols that quietly runs on an enormous number of network devices — routers, switches, printers, UPS units — and is still, remarkably often, left with the default public community string. When I find UDP 161 open during a scan, snmp-check is the tool I use to see exactly how much information that misconfiguration is leaking: system details, network interfaces, running processes, installed software, routing tables, and sometimes even user account information.

This article walks through what snmp-check does, how SNMP enumeration works under the hood, installation, syntax, real command output, and how I use it across internal pentests and network audits.

What snmp-check Does

snmp-check is a Perl-based SNMP enumeration tool that queries a device across a wide range of standard and vendor-specific MIB (Management Information Base) branches to pull:

• System information (hostname, description, uptime, contact, location)
• Network interfaces and their IP addresses
• Routing table entries
• TCP/UDP listening ports
• Running processes and installed software (on Windows targets, notably)
• Storage information
• User accounts (on some device types)
• SNMP service configuration details

Architecture and Internal Working

SNMP (Simple Network Management Protocol) works on a request/response model over UDP, typically port 161 for queries and 162 for traps. Devices expose data organized into a tree-structured MIB, where each data point is addressed by an OID (Object Identifier), like 1.3.6.1.2.1.1.1.0 for system description.

snmp-check‘s internal logic:

1. Authenticates using a community string (SNMPv1/v2c) or a username/auth credentials (SNMPv3).
2. Issues a series of GET and GETNEXT/GETBULK requests walking through well-known OID branches (system MIB, interfaces MIB, host resources MIB, etc.).
3. Parses returned values and formats them into human-readable sections rather than raw OID/value pairs, which is the main value-add over using raw snmpwalk directly.
4. Detects the device type where possible (Windows host, Cisco device, printer, etc.) based on the returned system description string, and adjusts which additional vendor-specific OIDs it attempts to query.

Installation

Debian/Kali:

sudo apt update
sudo apt install snmp-check -y

From source (CPAN dependency: Net-SNMP Perl bindings):

sudo apt install libnet-snmp-perl
git clone https://github.com/SECFORCE/SNMP-Check.git
cd SNMP-Check
chmod +x snmp-check.pl

Verify:

snmp-check --help

Basic Syntax

snmp-check [options] target

Command Examples

1. Basic enumeration with default community string (“public”)

snmp-check 192.168.1.10

Sample output:

snmp-check v1.9 - SNMP enumerator
Copyright (c) 2005-2021 by Matteo Cantoni (www.nothink.org)

[+] Try to connect to 192.168.1.10:161 using SNMPv1 and community 'public'

[*] System information:

Host IP address              : 192.168.1.10
Hostname                     : SWITCH-CORE-01
Description                  : Cisco IOS Software, C2960 Software
Contact                      : netadmin@example.com
Location                     : Server Room B
Uptime snmp                  : 145 days, 03:22:10
System date                  : 2026-7-30 09:14:02.0

[*] Network information:

IP forwarding                : disabled
Default TTL                  : 255

[*] Network interfaces:

Interface   Vlan1
  IP address                 : 192.168.1.10
  Type                       : ethernetCsmacd
  Speed                      : 100 Mbps
  MAC address                : 00:1a:2b:3c:4d:5e

2. Specifying a custom community string

snmp-check -c mycommunity 192.168.1.10

3. Using SNMPv2c explicitly

snmp-check -p 161 -c public 192.168.1.10

4. Enumerating a Windows host (processes, software, users)

snmp-check -c public 192.168.1.20

Output includes sections like:

[*] User accounts:

Index    Name
1        Administrator
2        Guest
3        svc_backup

[*] Software components:

Name                                Version
Microsoft .NET Framework 4.8        4.8.03761
7-Zip 21.07 (x64)                   21.07.00.0

5. Writing output to a file

snmp-check -c public 192.168.1.10 -w output.txt

6. Scanning across a specific port other than default

snmp-check -p 1161 -c public 192.168.1.10

Configuration Options

Flag	Purpose
-c <community>	Community string to use (default: public)
-p <port>	SNMP port (default: 161)
-v <version>	SNMP version (1 or 2c; SNMPv3 typically needs a different tool/flags depending on build)
-w <file>	Write output to a file
-t <timeout>	Set request timeout
-r <retries>	Number of retries per request

Real-World Use Cases

Internal network pentest — community string sweep: Discovering SNMP-enabled devices still using public/private community strings is one of the most common and highest-value findings on internal assessments, since it often exposes full network topology and, on Windows hosts, installed software and user accounts.

Network device inventory: Using snmp-check across a subnet builds a fast inventory of device types, firmware versions, and interface configurations without needing device credentials.

Vulnerability correlation: Cross-referencing the exact IOS or firmware version reported by snmp-check against known CVEs gives quick wins for identifying unpatched network infrastructure.

Incident response — asset discovery: During IR engagements on a compromised internal network, SNMP enumeration helps quickly map devices and their configurations without needing local admin access everywhere.

Workflow and Tool Integration

# Step 1: find hosts with SNMP open
nmap -sU -p 161 --open 192.168.1.0/24 -oG snmp_hosts.txt

# Step 2: extract live SNMP hosts
grep "161/open" snmp_hosts.txt | awk '{print $2}' > snmp_targets.txt

# Step 3: run snmp-check against each with common community strings
for host in $(cat snmp_targets.txt); do
  for community in public private manager; do
    echo "== $host ($community) ==" >> snmp_results.txt
    snmp-check -c "$community" "$host" >> snmp_results.txt
  done
done

I’ll often pair this with onesixtyone for a fast initial community string brute-force sweep, then use snmp-check for the detailed enumeration once a working string is confirmed.

Performance Optimization

• Run onesixtyone first to quickly identify valid community strings across a large range, then use snmp-check only against confirmed-live targets — running snmp-check itself against every host in a subnet with every possible community string is much slower.
• Reduce -t (timeout) and -r (retries) when scanning large internal ranges with generally responsive infrastructure.
• Redirect output per-host to separate files for very large scans, rather than one massive combined file that’s hard to grep through.

Troubleshooting

• No response / timeout — confirm the device actually has SNMP enabled and that the community string is correct; also check host-based firewalls that may restrict SNMP to specific management subnets.
• Partial data returned (e.g., no processes/software) — some MIB branches are vendor-specific or disabled by policy; this is normal and doesn’t indicate a tool failure.
• “No SNMP response” despite UDP 161 showing open in a TCP-based tool — SNMP is UDP-based, so confirm your initial discovery scan used -sU, not a TCP scan showing a false positive.

Best Practices and Common Mistakes

• Always test default and commonly-used community strings (public, private, manager, community) as part of a documented internal assessment methodology.
• Don’t assume SNMPv2c community strings are equally weak across every device — some organizations properly lock down SNMP ACLs to specific management stations, which should be verified and reported as a positive control.
• Recommend SNMPv3 with authentication and encryption in every report where SNMPv1/v2c with weak community strings is found — it’s a straightforward, well-understood remediation.

FAQ

Does snmp-check work against SNMPv3? Its core strength is SNMPv1/v2c enumeration; for SNMPv3 (which requires authentication and optional encryption), you’ll typically get more reliable results from snmpwalk with the appropriate -u, -a, -A, -x, -X flags.

Is finding an open SNMP service with a default community string a critical finding? It depends on what’s exposed — on network infrastructure it’s often high-severity due to topology/configuration disclosure; on a lone printer it may be lower risk, though still worth remediating.

Can snmp-check modify device configuration? No — it’s a read-only enumeration tool using SNMP GET operations, not SET operations.

Lab Example

In a lab, configure a Cisco IOS device (or a virtual router image) with SNMPv2c enabled and community string public, then run:

snmp-check -c public 192.168.56.50

Review the interface and routing table output, then reconfigure the device with SNMPv3 and an ACL restricting SNMP access to a single management IP, and confirm snmp-check from an unauthorized host now fails to return data.

Summary

snmp-check turns a protocol most people forget is even running into a rich source of network intelligence — often more than enough to build a full topology map or spot a serious information disclosure issue. Pairing it with a fast community-string sweep tool like onesixtyone gives a reliable, efficient two-step SNMP enumeration workflow for any internal assessment.

References

• Official project page: https://www.nothink.org/perl/snmpcheck/
• GitHub mirror: https://github.com/SECFORCE/SNMP-Check
• Man page: man snmp-check