SNMP Exposure Scanner

Passive discovery via Shodan Search API · SNMPv1/v2c/v3 posture

GHOST DEFENSE

Tool 48 · Defend Always

How this works

This is passive discovery. It does not send SNMP packets to any target — a browser can't originate UDP/161. It queries Shodan's existing scan data (which does actively probe SNMP) through the Ghost Worker, and reports what Shodan already observed: which hosts expose UDP/161, the SNMP version, and the device banner (sysDescr) where available. For active scanning of your own authorized targets, use the CLI recipes in the Reference tab.

DiscoverySourced · Shodan

By ASN / Org

By IP / CIDR

By Country / Sector

Free-form

Autonomous System Number

Finds SNMP-exposed hosts within an ASN. Combine with a version filter below. e.g. AS3356 (Lumen), AS7018 (AT&T).

IP address or CIDR netblock

Shodan net: filter. Scan only ranges you're authorized to assess.

Country code

Org / sector keyword (optional)

Country + optional org: keyword. Broad — expect large result counts; paged 100 at a time.

Raw Shodan query (port:161 auto-added if absent)

Full Shodan filter syntax. port:161 is prepended unless you already specify a port.

SNMP version (filters this page):

ANY

v2c

query → port:161

Requires the Ghost Worker with SHODAN_API_KEY set and a Shodan plan that includes the Search API.

Reference · Versions, Risk & How to Scan

SNMPv1 — deprecated, plaintext, no real auth

Authentication is a cleartext community string (often the defaults public / private). No encryption, no message integrity. Trivially sniffed or brute-forced. Any exposed v1 agent should be treated as an active finding.

NIST SC-8NIST IA-2CIS 4.6CIS 12

SNMPv2c — same community-string model as v1

Adds bulk operations and better error handling, but the "c" is community-based security — still a plaintext shared string, still no encryption. The read-only public and read-write private defaults are the classic exposure. v2c over the public internet is a misconfiguration.

NIST SC-8NIST AC-3CIS 4.6

SNMPv3 — the only version with real security

Adds the USM model: user-based authentication (MD5/SHA), privacy/encryption (DES/AES), and message integrity. Use authPriv mode. Even so, keep it off the public edge and scoped to a management VLAN.

NIST SC-8NIST SC-13NIST IA-2CIS 4.6

Hardening checklist

• Disable SNMP entirely where unused.
• Migrate v1/v2c → v3 authPriv; retire default community strings.
• Restrict UDP/161 to a management VLAN; never expose it to the internet (SC-7).
• ACL agents to specific NMS source IPs.
• Set SNMP views read-only unless write is required; disable write community entirely if possible.
• Monitor for SNMP from unexpected sources (SI-4).

Active scanning — your own authorized targets (CLI)

This tool can't send SNMP packets. To actually probe a host you control:

# Nmap — SNMP info + default-community check nmap -sU -p161 --script snmp-info,snmp-brute <target> # onesixtyone — fast community-string sweep onesixtyone -c community.txt <target> # snmpwalk — pull sysDescr with a known community (v2c) snmpwalk -v2c -c public <target> 1.3.6.1.2.1.1.1.0 # snmpwalk over v3 authPriv snmpwalk -v3 -l authPriv -u <user> -a SHA -A <authpass> -x AES -X <privpass> <target>

Full external search: Shodan port:161 · SNMP security (ref)

DEFEND ALWAYS · Passive discovery only — no packets sent to targets · Version + sysDescr are Shodan-sourced scan observations, not live probes · Exposure ≠ exploitability; a host appearing here means Shodan observed UDP/161, verify before acting · Active scanning requires authorization · Data via Shodan Search API through the Ghost Worker (SHODAN_API_KEY server-side).