Skip to content

Commit

Permalink
update README with coverity badge and backslash escape of an asterisk
Browse files Browse the repository at this point in the history
  • Loading branch information
japesinator committed Nov 22, 2016
1 parent 0d081a6 commit 9a5910d
Showing 1 changed file with 2 additions and 1 deletion.
3 changes: 2 additions & 1 deletion README.md
Expand Up @@ -2,6 +2,7 @@ onesixtyone
===========

[![Build Status](https://travis-ci.org/trailofbits/onesixtyone.svg)](https://travis-ci.org/trailofbits/onesixtyone)
[![Coverity Scan Build Status](https://scan.coverity.com/projects/10906/badge.svg)](https://scan.coverity.com/projects/onesixtyone)

The SNMP protocol is a stateless, datagram oriented protocol. An SNMP scanner is a program that sends SNMP requests to multiple IP addresses, trying different community strings and waiting for a reply. Unfortunately SNMP servers don't respond to requests with invalid community strings and the underlying UDP protocol does not reliably report closed UDP ports. This means that 'no response' from the probed IP address can mean either of the following:

Expand All @@ -10,7 +11,7 @@ The SNMP protocol is a stateless, datagram oriented protocol. An SNMP scanner is
* invalid community string
* the response datagram has not yet arrived

The approach taken by most SNMP scanners is to send the request, wait for n seconds and assume that the community string is invalid. If only 1 of every hundred scanned IP addresses responds to the SNMP request, the scanner will spend 99*n seconds waiting for replies that will never come. This makes traditional SNMP scanners very inefficient.
The approach taken by most SNMP scanners is to send the request, wait for n seconds and assume that the community string is invalid. If only 1 of every hundred scanned IP addresses responds to the SNMP request, the scanner will spend 99\*n seconds waiting for replies that will never come. This makes traditional SNMP scanners very inefficient.

onesixtyone takes a different approach to SNMP scanning. It takes advantage of the fact that SNMP is a connectionless protocol and sends all SNMP requests as fast as it can. Then the scanner waits for responses to come back and logs them, in a fashion similar to Nmap ping sweeps. By default onesixtyone waits for 10 milliseconds between sending packets, which is adequate for 100MBs switched networks. The user can adjust this value via the -w command line option. If set to 0, the scanner will send packets as fast as the kernel would accept them, which may lead to packet drop.

Expand Down

0 comments on commit 9a5910d

Please sign in to comment.