SNMP network discovery scripts - perl, ruby and python (scapy)

Two scripts one in perl (a very old one, I'm a bit ashamed of it) one in ruby (a bit newer, logic is much better, will not hang on huge routing tables and will not kill the device with too many queries). You could be surprised how much of your network is using the default community strings.

The logic here is first to try to read some standard OIDs with a bunch of different community strings from the "seed" device. If there is a community string that works it will be moved higher in the order in which the script test them. Once the script knows the community string it will query the routing table and ARP table via SNMP to find neighbours and then repeat the whole process on them. The hosts are being distinguished by their local IP addresses, the script generates a MD5 digest from those IPs (gathered also by SNMP) to check if it is a host that was already seen.

Actually the second script was an exercise in learning/trying out ruby. It is not complete. The main function is fully implemented the missing component is a nice way of printing/storing the data.

If you would like to brute force community strings on a specific network range or a single host then I would suggest to use scapy and something like this:

>>> snmpcomm=[comm.strip() for comm in open("wordlist-common-snmp-community-strings.txt").readlines()]


>>> send(IP(dst="1.2.3.0/24")/UDP(sport=RandShort(),dport=161)/SNMP(community=snmpcomm,version=["v2c","v1","v2"],PDU=SNMPget(varbindlist=SNMPvarbind(oid="1.3.6.1.2.1.1.1.0"))))


assuming here that 1.2.3.0/24 is your target. I use send() because I just want to send the packets and I don't want to waste time on waiting for replays. In a different session on the same machine I run:

tcpdump -n udp src port 161 and net 1.2.3.0/24

and I wait for the replays. They will include the community string that triggered them.

console automation - Expect

Today is time for some examples of Expect (extension of Tcl/Tk) scripts that I use almost daily. The most common usage scenarios are:

- automating common login (never do this unless you don't care about the passwords aka lab passwords for machine that will be wiped anyway),

- adjusting the remote environment to your needs without the modifying permanently any files on the remote machine (for example because it will be rebuild from scratch next day),

- running tests and verifying results (like running a command waiting sometime and verifying if you got the result you wanted, repeating the whole sequence 1000 times or until the result is reached),

- running some macros while in the interactive mode,

All of those things can be found combined in those two scripts (link1, link2).

All the scripts, including few a bit more specialized, can be found here.

gnuplot - plot from a pipe/stdin

EDITED TO ADD: I have no idea how I missed this, you can just use "plot '-'" as mentioned in the comments. This proves that my searching skills suck.

This is not rocket science but I couldn't find it (yeah I know my searching foo sucks) on the Internet (aka Google nowadays).


So just to make a note if I would forget about this and I would want again to create plots from some data without putting it into file:

huge_one_liner_goes_here | gnuplot -p -e 'plot "< cat /proc/$$/fd/0"'

A small script I created that adds a bit more options can be found here.

A great page with examples is here. Two nice blogs, first one has been quiet since some time, the second one looks active.