snmpwalk is part of the Net-SNMP suite and is used to retrieve a whole subtree of management information from a device speaking SNMP (Simple Network Management Protocol) — typically routers, switches, printers, UPS units, and any managed network appliance. SNMP organizes device information in a hierarchical namespace called the MIB (Management Information Base), addressed via OIDs (Object Identifiers), e.g., 1.3.6.1.2.1.1.1.0 for the system description. snmpwalk automatically walks (iterates) through all OIDs under a given starting point and prints every value it finds, making it far more efficient for enumeration than manually querying individual OIDs with snmpget.
SNMP versions 1 and 2c rely on a community string as their only form of authentication — a shared “password” sent in plaintext with every request. Many devices ship with the notoriously weak default community strings public (read-only) and private (read-write) left unchanged, making SNMP one of the highest-value, lowest-effort enumeration targets on a network: a successful walk can reveal the full ARP/routing table, running processes, installed software, interface configurations, and — on read-write communities — even allow configuration changes.
SNMPv3 adds proper authentication (usernames, auth/priv protocols) and encryption, and snmpwalk fully supports querying it as well.
Installation
# Kali Linux (preinstalled as part of snmp package)
sudo apt update
sudo apt install snmp -y
# Verify
snmpwalk -V
which snmpwalk
Syntax
snmpwalk [options] <agent-ip> [OID]
Command-Line Options
| Option | Description |
|---|---|
| `-v {1 | 2c |
-c community | Community string (for v1/v2c) |
-u username | Security username (for v3) |
-l level | Security level for v3: noAuthNoPriv, authNoPriv, authPriv |
-a protocol | Authentication protocol for v3: MD5, SHA |
-A passphrase | Authentication passphrase for v3 |
-x protocol | Privacy (encryption) protocol for v3: DES, AES |
-X passphrase | Privacy passphrase for v3 |
-O options | Output format options, e.g., -On (numeric OIDs), -Oe (enum values), -Oq (quick, no type) |
-t timeout | Timeout in seconds per request |
-r retries | Number of retries on timeout |
-p port | UDP port (default 161) |
-Cc | Continue walking even if a non-increasing OID is returned |
-Ir | Ignore no-such-object errors and retry |
-m ALL | Load all available MIB modules for name resolution |
Common/high-value OIDs to walk:
| OID | Meaning |
|---|---|
1.3.6.1.2.1.1 | system — description, uptime, contact, name, location |
1.3.6.1.2.1.25.1.6.0 | System processes |
1.3.6.1.2.1.25.4.2.1.2 | Running processes list |
1.3.6.1.2.1.25.6.3.1.2 | Installed software |
1.3.6.1.2.1.4.21 | IP routing table |
1.3.6.1.2.1.2.2 | Network interfaces |
1.3.6.1.4.1.77.1.2.25 | Windows user accounts (via SNMP-to-Windows MIB) |
1.3.6.1.2.1.6.13.1.3 | TCP listener ports |
Basic Usage
snmpwalk -v2c -c public 192.168.56.101
Expected output:
SNMPv2-MIB::sysDescr.0 = STRING: Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686
SNMPv2-MIB::sysObjectID.0 = OID: NET-SNMP-MIB::netSnmpAgentOIDs.10
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (123456) 0:20:34.56
SNMPv2-MIB::sysContact.0 = STRING: Me <me@example.org>
SNMPv2-MIB::sysName.0 = STRING: metasploitable
Practical Examples
Example 1 — Full walk with default community string
snmpwalk -v2c -c public 192.168.56.101
SNMPv2-MIB::sysDescr.0 = STRING: Linux metasploitable 2.6.24-16-server
SNMPv2-MIB::sysUpTime.0 = Timeticks: (123456) 0:20:34.56
SNMPv2-MIB::sysName.0 = STRING: metasploitable
Example 2 — Walk only the system information subtree
snmpwalk -v2c -c public 192.168.56.101 1.3.6.1.2.1.1
SNMPv2-MIB::sysDescr.0 = STRING: Linux metasploitable 2.6.24-16-server
SNMPv2-MIB::sysContact.0 = STRING: Me <me@example.org>
SNMPv2-MIB::sysName.0 = STRING: metasploitable
SNMPv2-MIB::sysLocation.0 = STRING: Server Room
Example 3 — Enumerate running processes
snmpwalk -v2c -c public 192.168.56.101 1.3.6.1.2.1.25.4.2.1.2
HOST-RESOURCES-MIB::hrSWRunName.1 = STRING: "init"
HOST-RESOURCES-MIB::hrSWRunName.2 = STRING: "sshd"
HOST-RESOURCES-MIB::hrSWRunName.3 = STRING: "mysqld"
HOST-RESOURCES-MIB::hrSWRunName.4 = STRING: "vsftpd"
Example 4 — Enumerate installed software packages
snmpwalk -v2c -c public 192.168.56.101 1.3.6.1.2.1.25.6.3.1.2
HOST-RESOURCES-MIB::hrSWInstalledName.1 = STRING: "openssh-server"
HOST-RESOURCES-MIB::hrSWInstalledName.2 = STRING: "proftpd"
HOST-RESOURCES-MIB::hrSWInstalledName.3 = STRING: "mysql-server-5.0"
Example 5 — Enumerate TCP listening ports
snmpwalk -v2c -c public 192.168.56.101 1.3.6.1.2.1.6.13.1.3
TCP-MIB::tcpListenLocalPort.0.0.0.0.21 = INTEGER: 21
TCP-MIB::tcpListenLocalPort.0.0.0.0.22 = INTEGER: 22
TCP-MIB::tcpListenLocalPort.0.0.0.0.3306 = INTEGER: 3306
Example 6 — Enumerate the IP routing table
snmpwalk -v2c -c public 192.168.56.101 1.3.6.1.2.1.4.21.1.1
IP-MIB::ipRouteDest.0.0.0.0 = IpAddress: 0.0.0.0
IP-MIB::ipRouteDest.192.168.56.0 = IpAddress: 192.168.56.0
Example 7 — Windows user account enumeration (Windows SNMP agent)
snmpwalk -v1 -c public 192.168.10.20 1.3.6.1.4.1.77.1.2.25
SNMPv2-SMI::enterprises.77.1.2.25.1.1.1 = STRING: "Administrator"
SNMPv2-SMI::enterprises.77.1.2.25.1.1.2 = STRING: "Guest"
SNMPv2-SMI::enterprises.77.1.2.25.1.1.3 = STRING: "svc_backup"
Example 8 — Numeric OID output (no MIB name resolution)
snmpwalk -v2c -c public -On 192.168.56.101 1.3.6.1.2.1.1
.1.3.6.1.2.1.1.1.0 = STRING: Linux metasploitable 2.6.24-16-server
.1.3.6.1.2.1.1.5.0 = STRING: metasploitable
Example 9 — Loading all MIBs for friendlier output
snmpwalk -v2c -c public -m ALL 192.168.56.101 system
SNMPv2-MIB::sysDescr.0 = STRING: Linux metasploitable 2.6.24-16-server
SNMPv2-MIB::sysServices.0 = INTEGER: 72
Example 10 — SNMPv3 authenticated and encrypted walk
snmpwalk -v3 -u admin -l authPriv -a SHA -A 'AuthPass123' -x AES -X 'PrivPass123' 192.168.10.30 1.3.6.1.2.1.1
SNMPv2-MIB::sysDescr.0 = STRING: Cisco IOS Software, C3750 Software
SNMPv2-MIB::sysName.0 = STRING: core-switch-01
Common Use Cases
- Fingerprinting operating system, running services, and installed software on network devices with only a guessed/default community string
- Enumerating local Windows user accounts remotely via the Windows SNMP agent’s proprietary MIB
- Mapping network topology through routing tables and interface information on routers/switches
- Discovering additional internal hosts/subnets via ARP and routing table data not visible from the attacker’s current network position
- Identifying default/weak community strings as a reportable finding, often paired with
onesixtyonefor the discovery phase
Automation with Bash
#!/bin/bash
# snmp_full_enum.sh - Walk key MIB branches for every host with a valid community string
TARGET="$1"
COMMUNITY="${2:-public}"
OUT="snmp_${TARGET}.txt"
{
echo "=== System Info ==="
snmpwalk -v2c -c "$COMMUNITY" "$TARGET" 1.3.6.1.2.1.1
echo "=== Running Processes ==="
snmpwalk -v2c -c "$COMMUNITY" "$TARGET" 1.3.6.1.2.1.25.4.2.1.2
echo "=== Installed Software ==="
snmpwalk -v2c -c "$COMMUNITY" "$TARGET" 1.3.6.1.2.1.25.6.3.1.2
echo "=== Listening TCP Ports ==="
snmpwalk -v2c -c "$COMMUNITY" "$TARGET" 1.3.6.1.2.1.6.13.1.3
} > "$OUT" 2>&1
echo "[+] Full SNMP enumeration for $TARGET saved to $OUT"
Tips and Best Practices
- Always run
onesixtyonefirst to brute-force/discover the community string quickly before switching tosnmpwalkfor deep enumeration. - Try both
publicandprivate— a writable (private) community string on a router/switch can allow configuration changes, a critical finding. - Use
-On(numeric OIDs) when scripting/parsing output, and-m ALLwith named MIBs when doing manual, human-readable analysis. - SNMPv1 and v2c traffic (including the community string) is unencrypted — capturing it via a network sniffer on the same segment is often just as effective as guessing it.
- When targeting Windows hosts, remember the SNMP agent must be manually enabled/installed — its presence is itself worth noting as it’s often forgotten and unpatched.
Troubleshooting
| Problem | Likely Cause | Solution |
|---|---|---|
Timeout: No Response from 192.168.56.101 | Wrong community string, SNMP service down, or firewall blocking UDP/161 | Verify with onesixtyone; confirm port with nmap -sU -p161 <ip> |
| Output shows raw numeric OIDs with no names | Missing MIB definitions | Add -m ALL, or install snmp-mibs-downloader |
Reason: authorizationError | Community string valid for read but insufficient for that OID (or wrong for that branch) | Try a different/broader OID or the private community |
SNMPv3 request fails with Unknown security name | Wrong -u username or unsupported auth/priv protocol | Confirm correct protocol combination with the device documentation |
| Extremely slow full-tree walk | Large MIB tree on an enterprise switch/router | Limit to specific subtrees (e.g., 1.3.6.1.2.1.1) instead of a full walk |
References
- Net-SNMP official documentation: http://www.net-snmp.org/docs/man/snmpwalk.html
- Kali Linux tool page: https://www.kali.org/tools/snmp/
- SNMP MIB browser reference (IETF RFC 1213 – MIB-II): https://datatracker.ietf.org/doc/html/rfc1213