Nmap scanning network for SNMP enabled devices:

sudo nmap -sU -p 161 --script default,snmp-sysdescr

I'm trying figure out how make that nmap return only devices that have specific entries in snmp-sysdescr object:

snmp-sysdescr: "Target device name"

Is that possible?

  • The nmap docs (for 7.40) are light on mentioning any sort of SNMP support. Is piping positive hits over to snmpwalk or something ok? – thrig Jan 26 '17 at 17:59
  • I just wanted to find is it possible make that nmap filter out the target devices only. – triwo Jan 26 '17 at 18:12

Nmap doesn't contain much in the way of output filtering options: --open will limit output to hosts containing open ports (any open ports). -v0 will prevent any output to the screen.

Instead, the best way to accomplish this is to save the XML output of the scan (using the -oX or -oA output options), which will contain all the information gathered by the scan in an easy-to-parse XML format. Then you can filter that with XML parsing tools to include the information you want.

One command-line XML parser is xmlstarlet. You can use this command to filter out only IP addresses for targets that have sysdescr containing the string "example":

xmlstarlet sel -t -m "//port/script[@id='snmpsysdescr' and contains(@output,'example')]/../../../address[@addrtype='ipv4']" -v @addr -n output.xml

You can also do this with Ndiff, which is a tool and Python 2 library distributed with Nmap:

#!/usr/bin/env python

import ndiff

def sysdescr_contains (value, host):
  for port in host.ports:
    for script in filter(lambda x: x.id == u"snmp-sysdescr", port.script_results):
      if value in script.output:
        return True
  return False

def usage ():
  print """Look for <substring> in snmp-sysdescr output and print matching hosts.
Usage: {} <filename.xml> <substring>"""

if __name__ == "__main__":
  import sys
  if len(sys.argv) < 3:

  scan = ndiff.Scan()

  for host in filter(lambda x: sysdescr_contains(sys.argv[2], x), scan.hosts):
    print host.format_name()

Other Nmap-output parsing libraries are available in most common programming languages.

  • Yes, parsing the xml output will be a preferable way to do it. Thank you. – triwo Jan 27 '17 at 11:41

we can use nmap with following command nmap -p 161 ip, nmap -p 162 ip

if the port is open on host or device there are exploits available in open market which leads to writable SNMP information

if the port is closed then there is no chance of vulnerability

I hope this info works

  • SNMP is UDP so the command is: sudo nmap -sU -p 161 <ip> – Christopher Gray Apr 10 '19 at 18:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.