# Snmpwalk

> Use for SNMP enumeration during authorized pentests. Trigger on network device discovery, management plane review, community string validation, and understanding what device metadata is exposed over SNMP.

- Skill: `timsonner/snmpwalk` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/snmpwalk`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/snmpwalk/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Product & Planning
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/snmpwalk

---


# Snmpwalk

## Purpose

Use this skill when the current question is whether an approved device exposes useful information or weak access over SNMP.

## Phase Fit

- Primary: Discovery and Reconnaissance, Vulnerability Analysis
- Secondary: Retest and Closure

## Use When

- Need to validate whether SNMP is exposed and what metadata it returns.
- Need to review network management plane exposure.
- Need to retest whether weak SNMP access was removed.

## Avoid When

- The device or management network is out of scope.
- Community strings or credentials are not explicitly approved.

## Inputs

- Approved device IP or host
- Authorized SNMP version and credential context
- Narrow OID scope aligned to the hypothesis

## Procedure

1. Start with the narrowest OID tree that answers the question.
2. Confirm whether the device exposes material metadata.
3. Record the effective access level and version in use.
4. Correlate device findings with network inventory.
5. Preserve the exact OID scope and auth context for retest.

## Command Syntax

Replace sample targets with approved in-scope assets and authorized credentials.

```bash
# Walk system OID tree (SNMPv2c, public community)
snmpwalk -v2c -c public 10.10.10.100 1.3.6.1.2.1.1

# Walk full MIB tree
snmpwalk -v2c -c public 10.10.10.100

# Try alternate community string
snmpwalk -v2c -c private 10.10.10.100

# Get running processes
snmpwalk -v2c -c public 10.10.10.100 1.3.6.1.2.1.25.4.2.1.2

# SNMPv3 with authentication and privacy
snmpwalk -v3 -u snmpuser -l authPriv -a SHA -A '<authpass>' -x AES -X '<privpass>' 10.10.10.100

# SNMPv3 with auth only
snmpwalk -v3 -l authNoPriv -u auditor -a SHA -A '<password>' 10.10.10.100 1.3.6.1.2.1.1

# Output to file
snmpwalk -v2c -c public 10.10.10.100 > contoso-snmp.txt
```

## Evidence to Capture

- Whether SNMP is reachable and what scope of metadata is exposed
- Management plane weaknesses tied to specific devices
- Exact version and OID path used during validation

## Safety Boundaries

- Keep queries narrow and approved.
- Do not expand into write-capable operations or broader OID trees without explicit approval.