Network
Find readable SNMP with community string sprays
SNMP community-string scanner for host lists.
overview
What onesixtyone does
onesixtyone sprays candidate SNMP community strings across a host list over UDP and records every host that replies. Servers stay silent on a bad string, so a reply means readable SNMP for that community.
Feed hosts with -i and communities with -c. Pace sending with -w so a wide UDP sweep does not drop packets; use -p when SNMP is not on the usual port.
Run after host discovery: feed -i with hosts and -c with community strings, then pass answered hosts to deeper SNMP enumeration.
use cases
Where onesixtyone fits
Find hosts with readable SNMP
Spray a list of community strings across a host file to flag every device that answers, exposing SNMP that is open to read.
Catch default community strings
Test common strings such as public and private to surface devices left on defaults across a network range.
Pace a wide UDP sweep
Set the inter-packet wait so a large scan stays within the limits of a UDP path that drops packets under pressure.
Scope SNMP exposure across a fleet
Run onesixtyone after host discovery to map which devices in an estate expose SNMP before any deeper polling.
reference
onesixtyone inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| hosts | FILE | -i | File with target hosts to scan. |
| community-names | FILE | -c | File with community names to try. |
| port | STRING | -p | Alternate destination SNMP port. |
| wait-miliseconds | STRING | -w | Wait N milliseconds between sending packets (default 10). |
| quiet-mode | BOOLEAN | -q | Quiet mode, do not print log to stdout. |
| debug | BOOLEAN | -d | Enable debug mode. |
Showing key inputs. onesixtyone exposes 6 inputs in total.
example
Run onesixtyone
# try common communities against a host list, paced for UDPonesixtyone -c communities.txt -i hosts.txt -w 20 -p 161Scanning 12 hosts, 6 communities198.51.100.10 [public] Cisco IOS Software, C2960 Software198.51.100.14 [private] Linux net-snmp 5.7.3203.0.113.22 [public] HP JetDirect203.0.113.40 [public] APC Web/SNMP Management Card198.51.100.55 [private] VMware ESXidone: 5 hosts answeredguidance
Choosing onesixtyone
Use onesixtyone when you need a fast community-string sweep across many hosts. It flags readable SNMP; it does not poll MIBs. Run a port scanner first for broader discovery, then enumerate answering hosts with an SNMP tool.
nmap
SNMP NSE plus full port scanning. onesixtyone stays on the community-string spray.
naabu
Finds open UDP and TCP ports. Run it first, then onesixtyone on hosts with SNMP open.
netexec
Multi-protocol enumeration including SNMP. onesixtyone is lighter and community-string only.
faq
onesixtyone questions
related
More Network tools
asnmap
Map an organization's network ranges from ASN data.
dnsvalidator
Validate public DNS resolvers against trusted baselines.
fping
Parallel ICMP echo sweeps for CIDR ranges and host files.
httprobe
Probe a domain list for working HTTP and HTTPS servers.
httpx
A fast and multi-purpose HTTP toolkit that runs multiple probers with reliable, high-throughput results.
mapcidr
Expand, aggregate, and slice CIDR ranges into host lists.
Run onesixtyone yourself
A host file and a community-string list feed onesixtyone, which sprays SNMP requests and writes the hosts that answered as a queryable output.
Facts on this page come from the live Trickest tool library.