Staring at a device and wondering what it will tell you? The snmpwalk command asks an SNMP agent for everything under a starting OID and prints each value, one line at a time.
This guide is part of our SNMP series for people who manage networks.
| Item | Value |
|---|---|
| Request type used | GETNEXT requests |
| Default starting point with no OID given | SNMPv2-SMI::mib-2 |
| Message at the end of the tree | “End of MIB” |
| Option that skips the increasing-OID check | -Cc |
| Option that ends a walk at a chosen OID | -CE |
These details come from the snmpwalk man page. Tools and options change between releases, so check the source before you rely on them.
What the snmpwalk command does
snmpwalk is a command-line tool from the Net-SNMP suite. It retrieves a subtree of management values by sending repeated GETNEXT requests. Each reply gives the next OID and its value, so the tool can step through a whole branch without you knowing every name in advance.
You give it an agent address and, optionally, an OID. All variables in the subtree below that OID are queried and shown. If you give no OID, the walk starts at the standard mib-2 subtree, which covers the common system, interface and IP data.
That makes it the quickest way to answer practical questions:
- Is the device answering SNMP at all?
- Which community string or credentials work?
- What objects does this vendor expose?
- What is the exact OID I should poll in my monitoring system?
When the walk runs past the last object in the MIB, the tool prints the message “End of MIB”.
Basic syntax and a first example
The general shape is the command, then options, then the agent, then an optional OID. A first walk of the system group looks like this:
snmpwalk -v 1 -c public zeus system
Here -v picks the protocol version, -c sets the community string, zeus is the agent’s host name or IP address, and system is the starting point. The man page shows a similar run with “snmpwalk -Os -c public -v 1 zeus system”, which returns variables such as sysDescr.0, sysUpTime.0 and sysName.0.
Each output line has the same layout: object name, equals sign, a type such as STRING or Timeticks, then the value. Reading the type is useful, because a counter and a text label can look similar at a glance.
The community string is a shared password sent in clear text with the older protocol versions. Use it only on networks you trust, and only against devices you are allowed to query.
Useful options you will reach for
Most day-to-day work needs only a handful of flags. The list below mixes common options shared by Net-SNMP tools with ones specific to snmpwalk.
- -v selects the SNMP version.
- -c supplies the community string.
- -On prints OIDs as plain numbers instead of names. This helps when you do not have the vendor MIB loaded.
- -Os shortens names to the last part, which keeps output readable.
- -CE ends the walk at a given OID rather than at the end of the subtree.
- -Cc turns off the check that returned OIDs are increasing.
The man page gives an example of -CE: “snmpwalk -Os -c public -v 1 -CE sysORTable zeus system” retrieves the scalar values but omits the sysORTable. That is handy when one table is huge and you only want the rest.
Walking a specific branch
A full walk of an enterprise router can produce a very long list of lines. Narrowing the starting OID keeps the result readable and puts less load on the device. It also makes the output far easier to scan, search and share with a colleague who is helping you diagnose a problem.
Pass either a name or a numeric OID. With a name, the tool needs the matching MIB loaded; with digits, it does not.
- Start broad with the default walk and note which subtree holds your data.
- Re-run the command with that subtree’s OID as the starting point.
- Add -On so you can copy the numeric OID straight into a monitoring tool.
- Use -CE if one noisy table gets in the way, so the walk stops where you choose.
Saving output to a file also helps, and it gives you a record of how the device looked at a given moment. Keep a baseline walk from a healthy device so you can tell later what changed.
A saved walk also helps when you ask a vendor or a teammate for help, because the raw values show exactly what the agent returned.
With two saved files you can compare two walks taken before and after a change and see exactly which values moved.
Versions, security and related tools
Community strings suit quick lab checks, but real networks usually need authentication and encryption. SNMPv3 adds both, and snmpwalk can use it through the same family of common options for user names and security levels. The Net-SNMP command-line documentation lists those options in detail.
Walking is a polling method: you ask, the device answers. Devices can also push alerts on their own, which is a different mechanism; the SNMP trap guide explains how those messages work.
For a single known object, a plain get is lighter than a walk. For large tables, the bulk variant of the tool can fetch many rows per request, though you should check the documentation for your installed version.
Troubleshooting a walk that misbehaves
Most problems fall into three groups: no response, an empty result, or a loop.
- Timeout: check the address, any firewall on the SNMP port, and whether SNMP is enabled on the device.
- Empty or “No Such Object”: the starting OID is not supported by that agent, or your community string does not have access to that view.
- Repeating output or a warning about OIDs: the agent is returning values out of order.
The last case has a documented cause. Some agents, LaserJets being the man page’s example, return OIDs out of order but can complete the walk anyway. Other agents return OIDs that are out of order and can cause snmpwalk to loop indefinitely.
By default the tool tries to detect this behaviour and warns you when it hits an agent acting illegally. Use -Cc to turn that check off, but only when the walk otherwise completes. If it never finishes, stop it and walk smaller branches instead.
Frequently asked questions
What does the snmpwalk command do?
Show answer
It sends GETNEXT requests to an SNMP agent and prints every variable in the subtree below the OID you give it.
What happens if I do not give an OID?
Show answer
The walk begins at SNMPv2-SMI::mib-2, including any MIB objects from other modules that lie within that subtree, according to the man page.
Why does snmpwalk say “End of MIB”?
Show answer
The walk tried to search beyond the end of the MIB. It is a normal finish message when you walk from the top of a tree.
When should I use -Cc?
Show answer
Use it when the agent returns OIDs out of order but still finishes the walk. Avoid it if the walk loops, since the check exists to warn you about that.
Is it safe to run on production devices?
Show answer
Large walks add load, so start with a narrow OID and only query devices you are authorised to manage.
