Bug#479312: ITP: onesixtyone -- An efficient SNMP scanner
Package: wnpp
Severity: wishlist
Owner: Sebastian Castillo Builes <castillobuiles@gmail.com>
* Package name : onesixtyone
* URL : http://www.phreedom.org/solar/onesixtyone/
* License : GPLv2+
Programming Lang : C
Description : An efficient SNMP scanner
The approach taken by most SNMP scanners is to send the request, wait for n seconds and assume that the community string is invalid. If only 1 of every hundred scanned IP addresses responds to the SNMP request,
the scanner will spend 99*n seconds waiting for replies that will never come.
This makes traditional SNMP scanners very inefficient.
Onesixtyone takes a different approach to SNMP scanning. It takes advantage of the fact that SNMP is a connectionless protocol and sends all SNMP requests as fast as it can. Then the scanner waits for responses
to come back and logs them, in a fashion similar to Nmap ping sweeps. By default onesixtyone waits for 10 milliseconds between sending packets, which is adequate for 100Mbs switched networks. The user can adjust
this value via the -w command line option. If set to 0, the scanner will send packets as fast as the kernel would accept them, which may lead to packet drop.
Running onesixtyone on a class B network (switched 100Mbs with 1Gbs backbone) with -w 10 gives us a performance of 3 seconds per class C, with no dropped packets. All 65536 IP addresses were scanned in less than
13 minutes.
--
Sebastián Castillo Builes
Ingeniero de proyectos
Fluidsignal Group S.A.
Where security meets business
http://www.fuidsignal.com/
ISO 9001:2000
ISO/IEC 27001:2005
Teléfono: +57 (4) 3522627
Móvil: +57 3008242145
Reply to: