Network
Find readable SNMP with community string sprays
onesixtyone is an SNMP scanner built on the connectionless nature of the protocol, sending all requests as fast as the kernel accepts them and waiting for replies in the style of an nmap ping sweep, by default asking every host for its system description with adjustable packet pacing.
C · GPL-2.0 license
overview
What onesixtyone does
onesixtyone sprays candidate SNMP community strings across a host list over UDP and records every host that replies. Servers stay silent on a bad string, so a reply means readable SNMP for that community.
Feed hosts with -i and communities with -c. Pace sending with -w so a wide UDP sweep does not drop packets; use -p when SNMP is not on the usual port.
Run after host discovery: feed -i with hosts and -c with community strings, then pass answered hosts to deeper SNMP enumeration.
use cases
Where onesixtyone fits
Find hosts with readable SNMP
Spray a list of community strings across a host file to flag every device that answers, exposing SNMP that is open to read.
Catch default community strings
Test common strings such as public and private to surface devices left on defaults across a network range.
Pace a wide UDP sweep
Set the inter-packet wait so a large scan stays within the limits of a UDP path that drops packets under pressure.
Scope SNMP exposure across a fleet
Run onesixtyone after host discovery to map which devices in an estate expose SNMP before any deeper polling.
reference
onesixtyone inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| hosts | FILE | -i | File with target hosts to scan. |
| community-names | FILE | -c | File with community names to try. |
| port | STRING | -p | Alternate destination SNMP port. |
| wait-miliseconds | STRING | -w | Wait N milliseconds between sending packets (default 10). |
| quiet-mode | BOOLEAN | -q | Quiet mode, do not print log to stdout. |
| debug | BOOLEAN | -d | Enable debug mode. |
Showing key inputs. onesixtyone exposes 6 inputs in total.
example
Run onesixtyone
# try common communities against a host list, paced for UDP
onesixtyone -c communities.txt -i hosts.txt -w 20 -p 161Scanning 12 hosts, 6 communities
198.51.100.10 [public] Cisco IOS Software, C2960 Software
198.51.100.14 [private] Linux net-snmp 5.7.3
203.0.113.22 [public] HP JetDirect
203.0.113.40 [public] APC Web/SNMP Management Card
198.51.100.55 [private] VMware ESXi
done: 5 hosts answeredguidance
Choosing onesixtyone
Use onesixtyone when you need a fast community-string sweep across many hosts. It flags readable SNMP; it does not poll MIBs. Run a port scanner first for broader discovery, then enumerate answering hosts with an SNMP tool.
nmap
SNMP NSE plus full port scanning. onesixtyone stays on the community-string spray.
naabu
Finds open UDP and TCP ports. Run it first, then onesixtyone on hosts with SNMP open.
netexec
Multi-protocol enumeration including SNMP. onesixtyone is lighter and community-string only.
faq
onesixtyone questions
related
More Network tools
asnmap
Map an organization's network ranges from ASN data.
dnsvalidator
Validate public DNS resolvers against trusted baselines.
fping
Parallel ICMP echo sweeps for CIDR ranges and host files.
httprobe
Probe a domain list for working HTTP and HTTPS servers.
httpx
A fast and multi-purpose HTTP toolkit that runs multiple probers with reliable, high-throughput results.
mapcidr
Expand, aggregate, and slice CIDR ranges into host lists.
Run onesixtyone yourself
A host file and a community-string list feed onesixtyone, which sprays SNMP requests and writes the hosts that answered as a queryable output.
Facts on this page come from the live Trickest tool library.