snmpwalk: Complete Guide to SNMP Enumeration and Network Device Information Gathering Using Kali Linux

snmpwalk is part of the Net-SNMP suite and is used to retrieve a whole subtree of management information from a device speaking SNMP (Simple Network Management Protocol) — typically routers, switches, printers, UPS units, and any managed network appliance. SNMP organizes device information in a hierarchical namespace called the MIB (Management Information Base), addressed via OIDs (Object Identifiers), e.g., 1.3.6.1.2.1.1.1.0 for the system description. snmpwalk automatically walks (iterates) through all OIDs under a given starting point and prints every value it finds, making it far more efficient for enumeration than manually querying individual OIDs with snmpget.

SNMP versions 1 and 2c rely on a community string as their only form of authentication — a shared “password” sent in plaintext with every request. Many devices ship with the notoriously weak default community strings public (read-only) and private (read-write) left unchanged, making SNMP one of the highest-value, lowest-effort enumeration targets on a network: a successful walk can reveal the full ARP/routing table, running processes, installed software, interface configurations, and — on read-write communities — even allow configuration changes.

SNMPv3 adds proper authentication (usernames, auth/priv protocols) and encryption, and snmpwalk fully supports querying it as well.

Installation

# Kali Linux (preinstalled as part of snmp package)
sudo apt update
sudo apt install snmp -y

# Verify
snmpwalk -V
which snmpwalk

Syntax

snmpwalk [options] <agent-ip> [OID]

Command-Line Options

Common/high-value OIDs to walk:

Basic Usage

snmpwalk -v2c -c public 192.168.56.101

Expected output:

SNMPv2-MIB::sysDescr.0 = STRING: Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686
SNMPv2-MIB::sysObjectID.0 = OID: NET-SNMP-MIB::netSnmpAgentOIDs.10
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (123456) 0:20:34.56
SNMPv2-MIB::sysContact.0 = STRING: Me <me@example.org>
SNMPv2-MIB::sysName.0 = STRING: metasploitable

Practical Examples

Example 1 — Full walk with default community string

snmpwalk -v2c -c public 192.168.56.101

SNMPv2-MIB::sysDescr.0 = STRING: Linux metasploitable 2.6.24-16-server
SNMPv2-MIB::sysUpTime.0 = Timeticks: (123456) 0:20:34.56
SNMPv2-MIB::sysName.0 = STRING: metasploitable

Example 2 — Walk only the system information subtree

snmpwalk -v2c -c public 192.168.56.101 1.3.6.1.2.1.1

SNMPv2-MIB::sysDescr.0 = STRING: Linux metasploitable 2.6.24-16-server
SNMPv2-MIB::sysContact.0 = STRING: Me <me@example.org>
SNMPv2-MIB::sysName.0 = STRING: metasploitable
SNMPv2-MIB::sysLocation.0 = STRING: Server Room

Example 3 — Enumerate running processes

snmpwalk -v2c -c public 192.168.56.101 1.3.6.1.2.1.25.4.2.1.2

HOST-RESOURCES-MIB::hrSWRunName.1 = STRING: "init"
HOST-RESOURCES-MIB::hrSWRunName.2 = STRING: "sshd"
HOST-RESOURCES-MIB::hrSWRunName.3 = STRING: "mysqld"
HOST-RESOURCES-MIB::hrSWRunName.4 = STRING: "vsftpd"

Example 4 — Enumerate installed software packages

snmpwalk -v2c -c public 192.168.56.101 1.3.6.1.2.1.25.6.3.1.2

HOST-RESOURCES-MIB::hrSWInstalledName.1 = STRING: "openssh-server"
HOST-RESOURCES-MIB::hrSWInstalledName.2 = STRING: "proftpd"
HOST-RESOURCES-MIB::hrSWInstalledName.3 = STRING: "mysql-server-5.0"

Example 5 — Enumerate TCP listening ports

snmpwalk -v2c -c public 192.168.56.101 1.3.6.1.2.1.6.13.1.3

TCP-MIB::tcpListenLocalPort.0.0.0.0.21 = INTEGER: 21
TCP-MIB::tcpListenLocalPort.0.0.0.0.22 = INTEGER: 22
TCP-MIB::tcpListenLocalPort.0.0.0.0.3306 = INTEGER: 3306

Example 6 — Enumerate the IP routing table

snmpwalk -v2c -c public 192.168.56.101 1.3.6.1.2.1.4.21.1.1

IP-MIB::ipRouteDest.0.0.0.0 = IpAddress: 0.0.0.0
IP-MIB::ipRouteDest.192.168.56.0 = IpAddress: 192.168.56.0

Example 7 — Windows user account enumeration (Windows SNMP agent)

snmpwalk -v1 -c public 192.168.10.20 1.3.6.1.4.1.77.1.2.25

SNMPv2-SMI::enterprises.77.1.2.25.1.1.1 = STRING: "Administrator"
SNMPv2-SMI::enterprises.77.1.2.25.1.1.2 = STRING: "Guest"
SNMPv2-SMI::enterprises.77.1.2.25.1.1.3 = STRING: "svc_backup"

Example 8 — Numeric OID output (no MIB name resolution)

snmpwalk -v2c -c public -On 192.168.56.101 1.3.6.1.2.1.1

.1.3.6.1.2.1.1.1.0 = STRING: Linux metasploitable 2.6.24-16-server
.1.3.6.1.2.1.1.5.0 = STRING: metasploitable

Example 9 — Loading all MIBs for friendlier output

snmpwalk -v2c -c public -m ALL 192.168.56.101 system

SNMPv2-MIB::sysDescr.0 = STRING: Linux metasploitable 2.6.24-16-server
SNMPv2-MIB::sysServices.0 = INTEGER: 72

Example 10 — SNMPv3 authenticated and encrypted walk

snmpwalk -v3 -u admin -l authPriv -a SHA -A 'AuthPass123' -x AES -X 'PrivPass123' 192.168.10.30 1.3.6.1.2.1.1

SNMPv2-MIB::sysDescr.0 = STRING: Cisco IOS Software, C3750 Software
SNMPv2-MIB::sysName.0 = STRING: core-switch-01

Common Use Cases

• Fingerprinting operating system, running services, and installed software on network devices with only a guessed/default community string
• Enumerating local Windows user accounts remotely via the Windows SNMP agent’s proprietary MIB
• Mapping network topology through routing tables and interface information on routers/switches
• Discovering additional internal hosts/subnets via ARP and routing table data not visible from the attacker’s current network position
• Identifying default/weak community strings as a reportable finding, often paired with onesixtyone for the discovery phase

Automation with Bash

#!/bin/bash
# snmp_full_enum.sh - Walk key MIB branches for every host with a valid community string
TARGET="$1"
COMMUNITY="${2:-public}"
OUT="snmp_${TARGET}.txt"

{
  echo "=== System Info ==="
  snmpwalk -v2c -c "$COMMUNITY" "$TARGET" 1.3.6.1.2.1.1

  echo "=== Running Processes ==="
  snmpwalk -v2c -c "$COMMUNITY" "$TARGET" 1.3.6.1.2.1.25.4.2.1.2

  echo "=== Installed Software ==="
  snmpwalk -v2c -c "$COMMUNITY" "$TARGET" 1.3.6.1.2.1.25.6.3.1.2

  echo "=== Listening TCP Ports ==="
  snmpwalk -v2c -c "$COMMUNITY" "$TARGET" 1.3.6.1.2.1.6.13.1.3
} > "$OUT" 2>&1

echo "[+] Full SNMP enumeration for $TARGET saved to $OUT"

Tips and Best Practices

• Always run onesixtyone first to brute-force/discover the community string quickly before switching to snmpwalk for deep enumeration.
• Try both public and private — a writable (private) community string on a router/switch can allow configuration changes, a critical finding.
• Use -On (numeric OIDs) when scripting/parsing output, and -m ALL with named MIBs when doing manual, human-readable analysis.
• SNMPv1 and v2c traffic (including the community string) is unencrypted — capturing it via a network sniffer on the same segment is often just as effective as guessing it.
• When targeting Windows hosts, remember the SNMP agent must be manually enabled/installed — its presence is itself worth noting as it’s often forgotten and unpatched.

Troubleshooting

References

• Net-SNMP official documentation: http://www.net-snmp.org/docs/man/snmpwalk.html
• Kali Linux tool page: https://www.kali.org/tools/snmp/
• SNMP MIB browser reference (IETF RFC 1213 – MIB-II): https://datatracker.ietf.org/doc/html/rfc1213