SNMPWALK

[Harbinder Dhinsa_1]

I have been told that you can use snmpwalk to retrieve data from servers you
have no login to, if so, please can you explain how ?

If you do know can you give examples of sytax, and any requiremnets.

Thanks

ps I am not a hacker, honest

[Albert Whale]

SNMP is a communications protocol which allows you to query (or change)
information on a given computer using the MIBs which describe (and/or define)
the specifics of the device for which you want to communicate to. The
communications work the same as a telnet session would give you access to a
server for information.

Snmpwalk is a specific command which allows the user to obtain every piece of
information from the server. Other commands allow access to specific items
within the MIB which describes the device.

If you need additional info pertaining to SNMP, I would suggest that you
perform some research on the Usenet Groups, or perform a Web Search for
additional web pages.

HTH

[John_Hancock]

If you have access to NNM then you will have snmpget and snmpwalk on that host. The man pages for these utilities will give you the basic syntax. I have also discovered that different implementations of snmpwalk and snmpget vary in their syntax - which can be somewhat irritating.

NNM also comes with a GUI snmp browser. This is an excelent SNMP viewer.

In V 6 of NNM it is in the menu under Tools->SNMP MIB Browser.

The host being queried also has to have the SNMP agent running. HP servers have the base SNMP mib and the HP extensions running by default. However other vendors do not necessaraly have the SNMP daemon running or configured. Also watch the port number. I saw an instance where the SNMP agent was configured for a port other than the default (I think it is 161?)
John

[Steven Sim Kok Leong]

Hi,

1) Check that your startup values activate the required snmp daemons:

a) In /etc/rc.config.d/SnmpHpunix:
SNMP_HPUNIX_START=1 # Start the hp-unix MIB SNMP subAgent by default.

b) In /etc/rc.config.d/SnmpMaster:
SNMP_MASTER_START=1 # Start the master SNMP agent.

c) In /etc/rc.config.d/SnmpMib2:
SNMP_MIB2_START=1 # Start the MIB2 SNMP subAgent.

d) [Optional] If you need snmptrap to trigger alerts or alarms, in /etc/rc.config.d/SnmpTrpDst:
SNMP_TRAPDEST_START=1 # Start the sub agent.

2) Check that your snmp daemon running ie.
root 833 1 0 Dec 14 ? 4:04 /usr/sbin/snmpdm

3) Get hold of the metrics and their descriptions from the MIB file, eg:
a) CPU load: 1.3.6.1.4.1.11.2.3.1.1.3.0
b) Free memory: 1.3.6.1.4.1.11.2.3.1.1.7.0
c) Free swap: 1.3.6.1.4.1.11.2.3.1.1.12.0
d) Current no. of processes: 1.3.6.1.4.1.11.2.3.1.4.1.0
e) Current no. of TCP connections: 1.3.6.1.2.1.6.9.0
f) Other information including VG, LV and current process listings, network statistics, netstat listing can be retrieved from the OID values via snmp. As such, it poses a security vulnerability in the arena of information gathering. You can reduce this vulnerability window by refering to 7).

4) Use snmpget to query the OID values, eg:
$ snmpget systemABC public .1.3.6.1.2.1.6.9.0
tcp.tcpCurrEstab.0 = Gauge: 143

5) You can get free snmpquery tools such as snmpget and snmpwalk easily for Linux.

6) Note that whatever OIDs in the public community are read-only (snmpwalk, snmpget) while those in the private community can be modified (snmpset). If you only intend to query performance values, then you should use only snmpwalk and snmpget.

7) For security reasons, it is usually advisable to change your public and private community strings to a hard-to-figure-out word to eliminate attempted guess-work. If possible, limit the snmp accessibility by containing the zone of snmp trust via a firewall etc.

Hope this helps. Regards.

Steven Sim Kok Leong
Brainbench MVP for Unix Admin
http://www.brainbench.com

[Randy Singh Dhanju]

Use NMAP & Stealth in
for what you?re thinking its great.

Telnet & trace's are very nutritious eh