> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/enum/snmp-discovery/snmp-check.md).
# snmp-check
## Enumeration
### Standard enumeration
```bash
snmp-check $TARGET_IP
```
Example run
```bash
┌──(kali㉿kali)-[/mnt/…/OffSec_PG/PG_Practice/Easy/ClamAV]
└─$ snmp-check $TARGET_IP
snmp-check v1.9 - SNMP enumerator
Copyright (c) 2005-2015 by Matteo Cantoni (www.nothink.org)
[+] Try to connect to 192.168.146.42:161 using SNMPv1 and community 'public'
[*] System information:
Host IP address : 192.168.146.42
Hostname : 0xbabe.local
Description : Linux 0xbabe.local 2.6.8-4-386 #1 Wed Feb 20 06:15:54 UTC 2008 i686
Contact : Root (configure /etc/snmp/snmpd.local.conf)
Location : Unknown (configure /etc/snmp/snmpd.local.conf)
Uptime snmp : 01:32:51.84
Uptime system : 01:32:14.44
System date : 2026-4-1 13:55:21.0
[*] Network information:
IP forwarding enabled : no
Default TTL : 64
TCP segments received : 990781
TCP segments sent : 986181
TCP segments retrans : 1066
Input datagrams : 997490
Delivered datagrams : 994041
Output datagrams : 988057
[*] Network interfaces:
Interface : [ up ] lo
Id : 1
Mac Address : :::::
Type : softwareLoopback
Speed : 10 Mbps
MTU : 16436
In octets : 0
Out octets : 0
Interface : [ up ] eth0
Id : 2
Mac Address : 00:50:56:9e:32:f7
Type : ethernet-csmacd
Speed : 100 Mbps
MTU : 1500
In octets : 159140288
Out octets : 476990059
Interface : [ down ] sit0
Id : 3
Mac Address : 00:00:00:00:32:f7
Type : unknown
Speed : 0 Mbps
MTU : 1480
In octets : 0
Out octets : 0
[*] Network IP:
Id IP Address Netmask Broadcast
1 127.0.0.1 255.0.0.0 0
2 192.168.146.42 255.255.255.0 1
[*] Routing information:
Destination Next hop Mask Metric
0.0.0.0 192.168.146.254 0.0.0.0 1
192.168.146.0 0.0.0.0 255.255.255.0 0
[*] TCP connections and listening ports:
Local address Local port Remote address Remote port State
0.0.0.0 25 0.0.0.0 0 listen
0.0.0.0 80 0.0.0.0 0 listen
0.0.0.0 139 0.0.0.0 0 listen
0.0.0.0 199 0.0.0.0 0 listen
0.0.0.0 445 0.0.0.0 0 listen
0.0.0.0 31337 0.0.0.0 0 listen
[*] Listening UDP ports:
Local address Local port
0.0.0.0 137
0.0.0.0 138
0.0.0.0 161
192.168.146.42 137
192.168.146.42 138
[*] Processes:
Id Status Name Path Parameters
1 runnable init init [2]
2 runnable ksoftirqd/0 ksoftirqd/0
3 runnable events/0 events/0
4 runnable khelper khelper
5 runnable kacpid kacpid
99 runnable kblockd/0 kblockd/0
109 runnable pdflush pdflush
110 runnable pdflush pdflush
111 runnable kswapd0 kswapd0
112 runnable aio/0 aio/0
255 runnable kseriod kseriod
276 runnable scsi_eh_0 scsi_eh_0
284 runnable khubd khubd
348 runnable shpchpd_event shpchpd_event
380 runnable kjournald kjournald
935 runnable vmmemctl vmmemctl
1177 runnable vmtoolsd /usr/sbin/vmtoolsd
3767 running syslogd /sbin/syslogd
3770 runnable klogd /sbin/klogd
3775 runnable clamd /usr/local/sbin/clamd
3778 runnable clamav-milter /usr/local/sbin/clamav-milter --black-hole-mode -l -o -q /var/run/clamav/clamav-milter.ctl
3791 runnable nmbd /usr/sbin/nmbd -D
3793 runnable smbd /usr/sbin/smbd -D
3796 runnable smbd /usr/sbin/smbd -D
3798 running snmpd /usr/sbin/snmpd -Lsd -Lf /dev/null -p /var/run/snmpd.pid
3804 runnable sshd /usr/sbin/sshd
3882 runnable sendmail-mta sendmail: MTA: accepting connections
3899 runnable atd /usr/sbin/atd
3902 runnable cron /usr/sbin/cron
3909 runnable apache /usr/sbin/apache
3930 runnable getty /sbin/getty 38400 tty1
3936 runnable getty /sbin/getty 38400 tty2
3937 runnable getty /sbin/getty 38400 tty3
3938 runnable getty /sbin/getty 38400 tty4
3939 runnable getty /sbin/getty 38400 tty5
3940 runnable getty /sbin/getty 38400 tty6
4368 runnable apache /usr/sbin/apache
4372 runnable apache /usr/sbin/apache
4384 runnable apache /usr/sbin/apache
4385 runnable apache /usr/sbin/apache
4386 runnable apache /usr/sbin/apache
4393 runnable apache /usr/sbin/apache
4396 runnable apache /usr/sbin/apache
4399 runnable apache /usr/sbin/apache
4400 runnable apache /usr/sbin/apache
4401 runnable apache /usr/sbin/apache
4677 runnable inetd /usr/sbin/inetd
[*] Storage information:
Description : ["Real Memory"]
Device id : [#]
Filesystem type : ["unknown"]
Device unit : [#]
Memory size : 250.82 MB
Memory used : 245.82 MB
Description : ["Swap Space"]
Device id : [#]
Filesystem type : ["unknown"]
Device unit : [#]
Memory size : 203.91 MB
Memory used : 0 bytes
Description : ["/"]
Device id : [#]
Filesystem type : ["unknown"]
Device unit : [#]
Memory size : 3.74 GB
Memory used : 941.27 MB
Description : ["/sys"]
Device id : [#]
Filesystem type : ["unknown"]
Device unit : [#]
Memory size : 0 bytes
Memory used : 0 bytes
[*] File system information:
Index : 1
Mount point : /
Remote mount point : -
Access : 1
Bootable : 1
[*] Device information:
Id Type Status Descr
768 unknown unknown AuthenticAMD: AMD EPYC 7413 24-Core Processor
1025 unknown running network interface lo
1026 unknown running network interface eth0
1027 unknown down network interface sit0
1536 unknown unknown VMware Virtual IDE CDROM Drive
1552 unknown unknown SCSI disk (/dev/sda)
3072 unknown unknown Guessing that there's a floating point co-processor
```
## Usage information
snmp-check -h
```bash
┌──(kali㉿kali)-[~]
└─$ snmp-check -h
snmp-check v1.9 - SNMP enumerator
Copyright (c) 2005-2015 by Matteo Cantoni (www.nothink.org)
Usage: snmp-check [OPTIONS]
-p --port : SNMP port. Default port is 161;
-c --community : SNMP community. Default is public;
-v --version : SNMP version (1,2c). Default is 1;
-w --write : detect write access (separate action by enumeration);
-d --disable_tcp : disable TCP connections enumeration!
-t --timeout : timeout in seconds. Default is 5;
-r --retries : request retries. Default is 1;
-i --info : show script version;
-h --help : show help menu;
```
## Resources
Snmpcheck - Homepage:
snmp-check - Kali Tools: