{ "content": [ { "type": "text", "text": "# SNMPCMD (man)\n\n## NAME\n\nsnmpcmd - options and behaviour common to most of the Net-SNMP command-line tools\n\n## SYNOPSIS\n\nsnmpcmd [OPTIONS] AGENT [PARAMETERS]\n\n## DESCRIPTION\n\nThis manual page describes the common options for the SNMP commands: snmpbulkget, snmpbulk‐‐\nwalk, snmpdelta, snmpget, snmpgetnext, snmpnetstat, snmpset, snmpstatus, snmptable, snmptest,\nsnmptrap, snmpdf, snmpusm , snmpwalk . The command line applications use the SNMP protocol\nto communicate with an SNMP capable network entity, an agent. Individual applications typi‐\ncally (but not necessarily) take additional parameters that are given after the agent speci‐\nfication. These parameters are documented in the manual pages for each application.\n\n## Sections\n\n- **NAME**\n- **SYNOPSIS**\n- **DESCRIPTION**\n- **COMMAND-LINE CONFIG OPTIONS** (35 subsections)\n- **AGENT SPECIFICATION**\n- **MIB PARSING OPTIONS** (7 subsections)\n- **OUTPUT OPTIONS** (19 subsections)\n- **LOGGING OPTIONS** (7 subsections)\n- **INPUT OPTIONS** (7 subsections)\n- **ENVIRONMENT VARIABLES**\n- **FILES**\n- **SEE ALSO**\n\nUse structuredContent.sections for detailed options, examples, and full documentation.\n" } ], "structuredContent": { "command": "SNMPCMD", "section": "", "mode": "man", "summary": "snmpcmd - options and behaviour common to most of the Net-SNMP command-line tools", "synopsis": "snmpcmd [OPTIONS] AGENT [PARAMETERS]", "tldr_summary": null, "tldr_examples": [], "tldr_source": null, "flags": [ { "flag": "-d", "long": null, "arg": null, "description": "" }, { "flag": "-D", "long": null, "arg": null, "description": "Turn on debugging output for the given TOKEN(s). Try ALL for extremely verbose out‐ put." }, { "flag": "-h", "long": "--help", "arg": null, "description": "Display a brief usage message and then exit." }, { "flag": "-H", "long": null, "arg": null, "description": "exit." }, { "flag": "-I", "long": null, "arg": null, "description": "Specifies input parsing options. See INPUT OPTIONS below." }, { "flag": "-L", "long": null, "arg": null, "description": "Specifies output logging options. See LOGGING OPTIONS below." }, { "flag": "-m", "long": null, "arg": null, "description": "Specifies a colon separated list of MIB modules (not files) to load for this applica‐ tion. This overrides (or augments) the environment variable MIBS, the snmp.conf di‐ rective mibs, and the list of MIBs hardcoded into the Net-SNMP library. If MIBLIST has a leading '-' or '+' character, then the MIB modules listed are loaded in addition to the default list, coming before or after this list respectively. Oth‐ erwise, the specified MIBs are loaded instead of this default list. The special keyword ALL is used to load all MIB modules in the MIB directory search list. Every file whose name does not begin with \".\" will be parsed as if it were a MIB file." }, { "flag": "-M", "long": null, "arg": null, "description": "Specifies a colon separated list of directories to search for MIBs. This overrides (or augments) the environment variable MIBDIRS, the snmp.conf directive mibdirs, and the default directory hardcoded into the Net-SNMP library (/usr/share/snmp/mibs). If DIRLIST has a leading '-' or '+' character, then the given directories are added to the default list, being searched before or after the directories on this list respec‐ tively. Otherwise, the specified directories are searched instead of this default list. Note that the directories appearing later in the list have have precedence over ear‐ lier ones. To avoid searching any MIB directories, set the MIBDIRS environment vari‐ able to the empty string (\"\"). Note that MIBs specified using the -m option or the mibs configuration directive will be loaded from one of the directories listed by the -M option (or equivalents). The mibfile directive takes a full path to the specified MIB file, so this does not need to be in the MIB directory search list." }, { "flag": "-v", "long": null, "arg": null, "description": "Specifies the protocol version to use: 1 (RFCs 1155-1157), 2c (RFCs 1901-1908), or 3 (RFCs 2571-2574). The default is typically version 3. Overrides the defVersion token in the snmp.conf file. -O [abeEfnqQsStTuUvxX] Specifies output printing options. See OUTPUT OPTIONS below." }, { "flag": "-P", "long": null, "arg": null, "description": "Specifies MIB parsing options. See MIB PARSING OPTIONS below." }, { "flag": "-r", "long": null, "arg": null, "description": "Specifies the number of retries to be used in the requests. The default is 5." }, { "flag": "-t", "long": null, "arg": null, "description": "Specifies the timeout in seconds between retries. The default is 1. Floating point numbers can be used to specify fractions of seconds." }, { "flag": "-V", "long": "--version", "arg": null, "description": "Display version information for the application and then exit." }, { "flag": "-Y", "long": null, "arg": null, "description": "--name=\"value\" Allows one to specify any token (\"name\") supported in the snmp.conf file and sets its value to \"value\". Overrides the corresponding token in the snmp.conf file. See snmp.conf(5) for the full list of tokens." }, { "flag": "-l", "long": null, "arg": null, "description": "Set the securityLevel used for SNMPv3 messages (noAuthNoPriv|authNoPriv|authPriv). Appropriate pass phrase(s) must provided when using any level higher than noAuthNo‐ Priv. Overrides the defSecurityLevel token in the snmp.conf file." }, { "flag": "-n", "long": null, "arg": null, "description": "Set the contextName used for SNMPv3 messages. The default contextName is the empty string \"\". Overrides the defContext token in the snmp.conf file." }, { "flag": "-T", "long": null, "arg": null, "description": "Indicates to the transport which key should be used to initiate (D)TLS client connec‐ tions. This would typically be a certificate found using the certificate fingerprint, the application name (eg snmpd, snmptrapd, perl, python) or genericized name \"snmpapp\" if using one of the generic applications (snmpget, snmpwalk, etc). This can also be set using the localCert specifier in a snmp.conf configuration file." }, { "flag": "-T", "long": null, "arg": null, "description": "If you expect a particular certificate to be presented by the other side then you can use this specifier to indicate the certificate it should present. If it fails to present the expected certificate the client will refuse to open the connection (be‐ cause doing otherwise could lead to man-in-the-middle attacks). This can also be set using the peerCert specifier in a snmp.conf configuration file." }, { "flag": "-T", "long": null, "arg": null, "description": "If you have a trusted CA certificate you wish to anchor trust with, you can use this flag to load a given certificate as a trust anchor. A copy of the certificate must exist within the Net-SNMP certificate storage system or this must point to a complete path name. Also see the \"trustCert\" snmp.conf configuration token." }, { "flag": "-T", "long": null, "arg": null, "description": "If the server's presented certificate can be validating using a trust anchor then their hostname will be checked to ensure their presented hostname matches one that is expected (you don't want to connect to goodhost.example.com and accept a certificate presented by badhost.example.com do you?). This token can specify the exact host name expected to be presented by the remote side, either in a subjectAltName field or in the CommonName field of the server's X.509 certificate." }, { "flag": "-a", "long": null, "arg": null, "description": "Set the authentication protocol (MD5|SHA|SHA-512|SHA-384|SHA-256|SHA-224) used for au‐ thenticated SNMPv3 messages. Overrides the defAuthType token in the snmp.conf file." }, { "flag": "-A", "long": null, "arg": null, "description": "Set the authentication pass phrase used for authenticated SNMPv3 messages. Overrides the defAuthPassphrase token in the snmp.conf file. It is insecure to specify pass phrases on the command line, see snmp.conf(5)." }, { "flag": "-e", "long": null, "arg": null, "description": "Set the authoritative (security) engineID used for SNMPv3 REQUEST messages, given as a hexadecimal string (optionally prefixed by \"0x\"). It is typically not necessary to specify this engine ID, as it will usually be discovered automatically." }, { "flag": "-E", "long": null, "arg": null, "description": "Set the context engineID used for SNMPv3 REQUEST messages scopedPdu, given as a hexa‐ decimal string. If not specified, this will default to the authoritative engineID." }, { "flag": "-u", "long": null, "arg": null, "description": "Set the securityName used for authenticated SNMPv3 messages. Overrides the defSecuri‐ tyName token in the snmp.conf file." }, { "flag": "-x", "long": null, "arg": null, "description": "Set the privacy protocol (DES or AES) used for encrypted SNMPv3 messages. Overrides the defPrivType token in the snmp.conf file. This option is only valid if the Net-SNMP software was build to use OpenSSL." }, { "flag": "-X", "long": null, "arg": null, "description": "Set the privacy pass phrase used for encrypted SNMPv3 messages. Overrides the def‐ PrivPassphrase token in the snmp.conf file. It is insecure to specify pass phrases on the command line, see snmp.conf(5)." }, { "flag": "-Z", "long": null, "arg": null, "description": "Set the engineBoots and engineTime used for authenticated SNMPv3 messages. This will initialize the local notion of the agents boots/time with an authenticated value stored in the LCD. It is typically not necessary to specify this option, as these values will usually be discovered automatically." }, { "flag": "-c", "long": null, "arg": null, "description": "Set the community string for SNMPv1/v2c transactions. Overrides the defCommunity to‐ ken in the snmp.conf file." }, { "flag": "-O", "long": null, "arg": null, "description": "fault output (unless otherwise specified): $ snmpget -c public -v 1 localhost sysUpTime.0 SNMPv2-MIB::sysUpTime.0 = Timeticks: (14096763) 1 day, 15:09:27.63" } ], "examples": [], "see_also": [ { "name": "snmpget", "section": "1", "url": "https://www.chedong.com/phpMan.php/man/snmpget/1/json" }, { "name": "snmpgetnext", "section": "1", "url": "https://www.chedong.com/phpMan.php/man/snmpgetnext/1/json" }, { "name": "snmpset", "section": "1", "url": "https://www.chedong.com/phpMan.php/man/snmpset/1/json" }, { "name": "snmpbulkget", "section": "1", "url": "https://www.chedong.com/phpMan.php/man/snmpbulkget/1/json" }, { "name": "snmpbulkwalk", "section": "1", "url": "https://www.chedong.com/phpMan.php/man/snmpbulkwalk/1/json" }, { "name": "snmpwalk", "section": "1", "url": "https://www.chedong.com/phpMan.php/man/snmpwalk/1/json" }, { "name": "able", "section": "1", "url": "https://www.chedong.com/phpMan.php/man/able/1/json" }, { "name": "snmpnetstat", "section": "1", "url": "https://www.chedong.com/phpMan.php/man/snmpnetstat/1/json" }, { "name": "snmpdelta", "section": "1", "url": "https://www.chedong.com/phpMan.php/man/snmpdelta/1/json" }, { "name": "snmptrap", "section": "1", "url": "https://www.chedong.com/phpMan.php/man/snmptrap/1/json" }, { "name": "snmpinform", "section": "1", "url": "https://www.chedong.com/phpMan.php/man/snmpinform/1/json" }, { "name": "snmpusm", "section": "1", "url": "https://www.chedong.com/phpMan.php/man/snmpusm/1/json" }, { "name": "snmpstatus", "section": "1", "url": "https://www.chedong.com/phpMan.php/man/snmpstatus/1/json" }, { "name": "snmptest", "section": "1", "url": "https://www.chedong.com/phpMan.php/man/snmptest/1/json" }, { "name": "snmp.conf", "section": "5", "url": "https://www.chedong.com/phpMan.php/man/snmp.conf/5/json" } ], "section_outline": [ { "name": "NAME", "lines": 2, "subsections": [] }, { "name": "SYNOPSIS", "lines": 2, "subsections": [] }, { "name": "DESCRIPTION", "lines": 7, "subsections": [] }, { "name": "COMMAND-LINE CONFIG OPTIONS", "lines": 10, "subsections": [ { "name": "Generic Options", "lines": 4 }, { "name": "-d", "lines": 1, "flag": "-d" }, { "name": "-D", "lines": 4, "flag": "-D" }, { "name": "-h, --help", "lines": 2, "flag": "-h", "long": "--help" }, { "name": "-H", "lines": 2, "flag": "-H" }, { "name": "-I", "lines": 2, "flag": "-I" }, { "name": "-L", "lines": 2, "flag": "-L" }, { "name": "-m", "lines": 12, "flag": "-m" }, { "name": "-M", "lines": 18, "flag": "-M" }, { "name": "-v", "lines": 5, "flag": "-v" }, { "name": "-P", "lines": 2, "flag": "-P" }, { "name": "-r", "lines": 2, "flag": "-r" }, { "name": "-t", "lines": 3, "flag": "-t" }, { "name": "-V, --version", "lines": 2, "flag": "-V", "long": "--version" }, { "name": "-Y", "lines": 7, "flag": "-Y" }, { "name": "SNMPv3 Options", "lines": 4 }, { "name": "-l", "lines": 4, "flag": "-l" }, { "name": "-n", "lines": 4, "flag": "-n" }, { "name": "SNMPv3 over TLS Options", "lines": 14 }, { "name": "-T localCert=", "lines": 6, "flag": "-T" }, { "name": "-T peerCert=", "lines": 6, "flag": "-T" }, { "name": "-T", "lines": 5, "flag": "-T" }, { "name": "-T", "lines": 7, "flag": "-T" }, { "name": "SNMPv3 with USM Options", "lines": 2 }, { "name": "-3[MmKk] 0xHEXKEY", "lines": 10 }, { "name": "-a", "lines": 3, "flag": "-a" }, { "name": "-A", "lines": 4, "flag": "-A" }, { "name": "-e", "lines": 4, "flag": "-e" }, { "name": "-E", "lines": 3, "flag": "-E" }, { "name": "-u", "lines": 3, "flag": "-u" }, { "name": "-x", "lines": 4, "flag": "-x" }, { "name": "-X", "lines": 4, "flag": "-X" }, { "name": "-Z", "lines": 7, "flag": "-Z" }, { "name": "SNMPv1 and SNMPv2c Options", "lines": 1 }, { "name": "-c", "lines": 4, "flag": "-c" } ] }, { "name": "AGENT SPECIFICATION", "lines": 96, "subsections": [] }, { "name": "MIB PARSING OPTIONS", "lines": 5, "subsections": [ { "name": "-Pc", "lines": 4 }, { "name": "-Pd", "lines": 2 }, { "name": "-Pe", "lines": 4 }, { "name": "-PR", "lines": 8 }, { "name": "-Pu", "lines": 4 }, { "name": "-Pw", "lines": 2 }, { "name": "-PW", "lines": 3 } ] }, { "name": "OUTPUT OPTIONS", "lines": 1, "subsections": [ { "name": "-O", "lines": 5, "flag": "-O" }, { "name": "-Oa", "lines": 5 }, { "name": "-Ob", "lines": 6 }, { "name": "-Oe", "lines": 5 }, { "name": "-OE", "lines": 7 }, { "name": "-Of", "lines": 3 }, { "name": "-On", "lines": 2 }, { "name": "-Op PRECISION", "lines": 9 }, { "name": "-Oq", "lines": 2 }, { "name": "-OQ", "lines": 2 }, { "name": "-Os", "lines": 2 }, { "name": "-OS", "lines": 4 }, { "name": "-Ot", "lines": 2 }, { "name": "-OT", "lines": 1 }, { "name": "-Ou", "lines": 4 }, { "name": "-OU", "lines": 1 }, { "name": "-Ov", "lines": 3 }, { "name": "-Ox", "lines": 5 }, { "name": "-OX", "lines": 10 } ] }, { "name": "LOGGING OPTIONS", "lines": 3, "subsections": [ { "name": "-Ln", "lines": 1 }, { "name": "-Le", "lines": 1 }, { "name": "-Lf FILE", "lines": 2 }, { "name": "-Lo", "lines": 1 }, { "name": "-Ls FACILITY", "lines": 7 }, { "name": "-LE pri", "lines": 3 }, { "name": "-LE pri1-pri2", "lines": 19 } ] }, { "name": "INPUT OPTIONS", "lines": 4, "subsections": [ { "name": "-Ib", "lines": 13 }, { "name": "-Ih", "lines": 7 }, { "name": "-Ir", "lines": 8 }, { "name": "-IR", "lines": 13 }, { "name": "-Is SUFFIX", "lines": 4 }, { "name": "-IS PREFIX", "lines": 4 }, { "name": "-Iu", "lines": 14 } ] }, { "name": "ENVIRONMENT VARIABLES", "lines": 12, "subsections": [] }, { "name": "FILES", "lines": 9, "subsections": [] }, { "name": "SEE ALSO", "lines": 8, "subsections": [] } ], "sections": { "NAME": { "content": "snmpcmd - options and behaviour common to most of the Net-SNMP command-line tools\n", "subsections": [] }, "SYNOPSIS": { "content": "snmpcmd [OPTIONS] AGENT [PARAMETERS]\n", "subsections": [] }, "DESCRIPTION": { "content": "This manual page describes the common options for the SNMP commands: snmpbulkget, snmpbulk‐‐\nwalk, snmpdelta, snmpget, snmpgetnext, snmpnetstat, snmpset, snmpstatus, snmptable, snmptest,\nsnmptrap, snmpdf, snmpusm , snmpwalk . The command line applications use the SNMP protocol\nto communicate with an SNMP capable network entity, an agent. Individual applications typi‐\ncally (but not necessarily) take additional parameters that are given after the agent speci‐\nfication. These parameters are documented in the manual pages for each application.\n", "subsections": [] }, "COMMAND-LINE CONFIG OPTIONS": { "content": "In addition to the options described in this manual page, all of the tokens described in the\nsnmp.conf and other .conf manual pages can be used on the command line of Net-SNMP applica‐\ntions as well by prefixing them with \"--\". EG, specifying --dontLoadHostConfig=true on the\ncommand line will turn off loading of the host specific configuration files.\n\nThe snmp.conf file settings and the double-dash arguments over-ride the single-dash argu‐\nments. So it's important to note that if single-dash arguments aren't working because you\nhave settings in the snmp.conf file that conflict with them then you'll need to use the\nlonger-form double-dash arguments to successfully trump the snmp.conf file settings.\n", "subsections": [ { "name": "Generic Options", "content": "These options control how the Net-SNMP commands behave regardless of what version of SNMP you\nare using. See further below for options that control specific versions or sub-modules of\nthe SNMP protocol.\n" }, { "name": "-d", "content": "", "flag": "-d" }, { "name": "-D", "content": "Turn on debugging output for the given TOKEN(s). Try ALL for extremely verbose out‐\nput.\n\n", "flag": "-D" }, { "name": "-h, --help", "content": "Display a brief usage message and then exit.\n", "flag": "-h", "long": "--help" }, { "name": "-H", "content": "exit.\n", "flag": "-H" }, { "name": "-I", "content": "Specifies input parsing options. See INPUT OPTIONS below.\n", "flag": "-I" }, { "name": "-L", "content": "Specifies output logging options. See LOGGING OPTIONS below.\n", "flag": "-L" }, { "name": "-m", "content": "Specifies a colon separated list of MIB modules (not files) to load for this applica‐\ntion. This overrides (or augments) the environment variable MIBS, the snmp.conf di‐\nrective mibs, and the list of MIBs hardcoded into the Net-SNMP library.\n\nIf MIBLIST has a leading '-' or '+' character, then the MIB modules listed are loaded\nin addition to the default list, coming before or after this list respectively. Oth‐\nerwise, the specified MIBs are loaded instead of this default list.\n\nThe special keyword ALL is used to load all MIB modules in the MIB directory search\nlist. Every file whose name does not begin with \".\" will be parsed as if it were a\nMIB file.\n", "flag": "-m" }, { "name": "-M", "content": "Specifies a colon separated list of directories to search for MIBs. This overrides\n(or augments) the environment variable MIBDIRS, the snmp.conf directive mibdirs, and\nthe default directory hardcoded into the Net-SNMP library (/usr/share/snmp/mibs).\n\nIf DIRLIST has a leading '-' or '+' character, then the given directories are added to\nthe default list, being searched before or after the directories on this list respec‐\ntively. Otherwise, the specified directories are searched instead of this default\nlist.\n\nNote that the directories appearing later in the list have have precedence over ear‐\nlier ones. To avoid searching any MIB directories, set the MIBDIRS environment vari‐\nable to the empty string (\"\").\n\nNote that MIBs specified using the -m option or the mibs configuration directive will\nbe loaded from one of the directories listed by the -M option (or equivalents). The\nmibfile directive takes a full path to the specified MIB file, so this does not need\nto be in the MIB directory search list.\n", "flag": "-M" }, { "name": "-v", "content": "Specifies the protocol version to use: 1 (RFCs 1155-1157), 2c (RFCs 1901-1908), or 3\n(RFCs 2571-2574). The default is typically version 3. Overrides the defVersion token\nin the snmp.conf file. -O [abeEfnqQsStTuUvxX] Specifies output printing options. See\nOUTPUT OPTIONS below.\n", "flag": "-v" }, { "name": "-P", "content": "Specifies MIB parsing options. See MIB PARSING OPTIONS below.\n", "flag": "-P" }, { "name": "-r", "content": "Specifies the number of retries to be used in the requests. The default is 5.\n", "flag": "-r" }, { "name": "-t", "content": "Specifies the timeout in seconds between retries. The default is 1. Floating point\nnumbers can be used to specify fractions of seconds.\n", "flag": "-t" }, { "name": "-V, --version", "content": "Display version information for the application and then exit.\n", "flag": "-V", "long": "--version" }, { "name": "-Y", "content": "--name=\"value\"\nAllows one to specify any token (\"name\") supported in the snmp.conf file and sets its\nvalue to \"value\". Overrides the corresponding token in the snmp.conf file. See\nsnmp.conf(5) for the full list of tokens.\n\n\n", "flag": "-Y" }, { "name": "SNMPv3 Options", "content": "The following options are generic to all forms of SNMPv3, regardless of whether it's the\noriginal SNMPv3 with USM or the newer SNMPv3 over (D)TLS support.\n\n" }, { "name": "-l", "content": "Set the securityLevel used for SNMPv3 messages (noAuthNoPriv|authNoPriv|authPriv).\nAppropriate pass phrase(s) must provided when using any level higher than noAuthNo‐\nPriv. Overrides the defSecurityLevel token in the snmp.conf file.\n", "flag": "-l" }, { "name": "-n", "content": "Set the contextName used for SNMPv3 messages. The default contextName is the empty\nstring \"\". Overrides the defContext token in the snmp.conf file.\n\n", "flag": "-n" }, { "name": "SNMPv3 over TLS Options", "content": "These options pass transport-specific parameters to the TLS layer. If you're using SNMP over\nTLS or DTLS you'll need to pass a combination of these either through these command line op‐\ntions or through snmp.conf configuration tokens.\n\nA note about s : Net-SNMP looks for X.509 certificates in each of the\nnormal SNMP configuration directory search paths under a \"tls\" subdirectory. IE, it will\nlook in ~/.snmp/tls and in /usr/local/share/snmp/tls for certificates. The certificate com‐\nponents (eg, the public and private halves) are stored in sub-directories underneath this\nroot set of directories. See the net-snmp-cert tool for help in importing, creating and man‐\naging Net-SNMP certificates. s can reference either a fingerprint of\nthe certificate to use (the net-snmp-cert tool can help you figure out the certificates) or\nthe filename's prefix can be used. For example, if you had a \"snmpd.crt\" certificate file\nthen you could simply refer to the certificate via the \"snmpd\" specifier.\n" }, { "name": "-T localCert=", "content": "Indicates to the transport which key should be used to initiate (D)TLS client connec‐\ntions. This would typically be a certificate found using the certificate fingerprint,\nthe application name (eg snmpd, snmptrapd, perl, python) or genericized name \"snmpapp\"\nif using one of the generic applications (snmpget, snmpwalk, etc). This can also be\nset using the localCert specifier in a snmp.conf configuration file.\n", "flag": "-T" }, { "name": "-T peerCert=", "content": "If you expect a particular certificate to be presented by the other side then you can\nuse this specifier to indicate the certificate it should present. If it fails to\npresent the expected certificate the client will refuse to open the connection (be‐\ncause doing otherwise could lead to man-in-the-middle attacks). This can also be set\nusing the peerCert specifier in a snmp.conf configuration file.\n", "flag": "-T" }, { "name": "-T", "content": "If you have a trusted CA certificate you wish to anchor trust with, you can use this\nflag to load a given certificate as a trust anchor. A copy of the certificate must\nexist within the Net-SNMP certificate storage system or this must point to a complete\npath name. Also see the \"trustCert\" snmp.conf configuration token.\n", "flag": "-T" }, { "name": "-T", "content": "If the server's presented certificate can be validating using a trust anchor then\ntheir hostname will be checked to ensure their presented hostname matches one that is\nexpected (you don't want to connect to goodhost.example.com and accept a certificate\npresented by badhost.example.com do you?). This token can specify the exact host name\nexpected to be presented by the remote side, either in a subjectAltName field or in\nthe CommonName field of the server's X.509 certificate.\n", "flag": "-T" }, { "name": "SNMPv3 with USM Options", "content": "These options are specific to using SNMPv3 with the original User-based Security Model (USM).\n" }, { "name": "-3[MmKk] 0xHEXKEY", "content": "Sets the keys to be used for SNMPv3 transactions. These options allow you to set the\nmaster authentication and encryption keys (-3m and -3M respectively) or set the local‐\nized authentication and encryption keys (-3k and -3K respectively). SNMPv3 keys can\nbe either passed in by hand using these flags, or by the use of keys generated from\npasswords using the -A and -X flags discussed below. For further details on SNMPv3\nand its usage of keying information, see the Net-SNMP tutorial web site (\nhttp://www.Net-SNMP.org/tutorial-5/commands/ ). Overrides the defAuthMasterKey (-3m),\ndefPrivMasterKey (-3M), defAuthLocalizedKey (-3k) or defPrivLocalizedKey (-3K) tokens,\nrespectively, in the snmp.conf file, see snmp.conf(5).\n" }, { "name": "-a", "content": "Set the authentication protocol (MD5|SHA|SHA-512|SHA-384|SHA-256|SHA-224) used for au‐\nthenticated SNMPv3 messages. Overrides the defAuthType token in the snmp.conf file.\n", "flag": "-a" }, { "name": "-A", "content": "Set the authentication pass phrase used for authenticated SNMPv3 messages. Overrides\nthe defAuthPassphrase token in the snmp.conf file. It is insecure to specify pass\nphrases on the command line, see snmp.conf(5).\n", "flag": "-A" }, { "name": "-e", "content": "Set the authoritative (security) engineID used for SNMPv3 REQUEST messages, given as a\nhexadecimal string (optionally prefixed by \"0x\"). It is typically not necessary to\nspecify this engine ID, as it will usually be discovered automatically.\n", "flag": "-e" }, { "name": "-E", "content": "Set the context engineID used for SNMPv3 REQUEST messages scopedPdu, given as a hexa‐\ndecimal string. If not specified, this will default to the authoritative engineID.\n", "flag": "-E" }, { "name": "-u", "content": "Set the securityName used for authenticated SNMPv3 messages. Overrides the defSecuri‐\ntyName token in the snmp.conf file.\n", "flag": "-u" }, { "name": "-x", "content": "Set the privacy protocol (DES or AES) used for encrypted SNMPv3 messages. Overrides\nthe defPrivType token in the snmp.conf file. This option is only valid if the Net-SNMP\nsoftware was build to use OpenSSL.\n", "flag": "-x" }, { "name": "-X", "content": "Set the privacy pass phrase used for encrypted SNMPv3 messages. Overrides the def‐\nPrivPassphrase token in the snmp.conf file. It is insecure to specify pass phrases on\nthe command line, see snmp.conf(5).\n", "flag": "-X" }, { "name": "-Z", "content": "Set the engineBoots and engineTime used for authenticated SNMPv3 messages. This will\ninitialize the local notion of the agents boots/time with an authenticated value\nstored in the LCD. It is typically not necessary to specify this option, as these\nvalues will usually be discovered automatically.\n\n\n", "flag": "-Z" }, { "name": "SNMPv1 and SNMPv2c Options", "content": "" }, { "name": "-c", "content": "Set the community string for SNMPv1/v2c transactions. Overrides the defCommunity to‐\nken in the snmp.conf file.\n\n", "flag": "-c" } ] }, "AGENT SPECIFICATION": { "content": "The string AGENT in the SYNOPSIS above specifies the remote SNMP entity with which to commu‐\nnicate. This specification takes the form:\n\n[:]\n\nAt its simplest, the AGENT specification may consist of a hostname, or an IPv4 address in the\nstandard \"dotted quad\" notation. In this case, communication will be attempted using\nUDP/IPv4 to port 161 of the given host. Otherwise, the part of the spec‐\nification is parsed according to the following table:\n\n format\n\nudp hostname[:port] or IPv4-address[:port]\n\ntcp hostname[:port] or IPv4-address[:port]\n\nunix pathname\n\nipx [network]:node[/port]\n\naal5pvc or pvc [interface.][VPI.]VCI\n\nudp6 or udpv6 or udpipv6 hostname[:port] or IPv6-address:port or\n'['IPv6-address']'[:port]\n\ntcp6 or tcpv6 or tcpipv6 hostname[:port] or IPv6-address:port or\n'['IPv6-address']'[:port]\n\nNote that strings are case-insensitive so that, for example, \"tcp\" and\n\"TCP\" are equivalent. Here are some examples, along with their interpretation:\n\nhostname:161 perform query using UDP/IPv4 datagrams to hostname on port 161. The\n\":161\" is redundant here since that is the default SNMP port in any\ncase.\n\nudp:hostname identical to the previous specification. The \"udp:\" is redundant\nhere since UDP/IPv4 is the default transport.\n\nTCP:hostname:1161 connect to hostname on port 1161 using TCP/IPv4 and perform query\nover that connection. udp6:hostname:10161 perform the query using\nUDP/IPv6 datagrams to port 10161 on hostname (which will be looked up\nas an AAAA record).\n\nUDP6:[fe80::2d0:b7ff:fe21:c6c0]\nperform the query using UDP/IPv6 datagrams to port 161 at address\nfe80::2d0:b7ff:fe21:c6c0.\n\ntcpipv6:[::1]:1611 connect to port 1611 on the local host (::1 in IPv6 parlance) using\nTCP/IPv6 and perform query over that connection.\n\ntls:hostname:10161\n\ndtls:hostname:10161 Connects using SNMP over DTLS or TLS as documented by the ISMS work‐\ning group (RFCs not yet published as of this date). This will re‐\nquire (and automatically ensures) that the TSM security model is in\nuse. You'll also need to set up trust paths for the certificates\npresented by the server (see above for descriptions of this).\n\nssh:hostname:22 Connects using SNMP over SSH as documented by the ISMS working group\n(RFCs not yet published as of this date). This will require that the\nTSM security model is in use (--defSecurityModel=tsm).\n\nipx::00D0B7AAE308 perform query using IPX datagrams to node number 00D0B7AAE308 on the\ndefault network, and using the default IPX port of 36879 (900F hexa‐\ndecimal), as suggested in RFC 1906.\n\nipx:0AE43409:00D0B721C6C0/1161\nperform query using IPX datagrams to port 1161 on node number\n00D0B721C6C0 on network number 0AE43409.\n\nunix:/tmp/local-agent connect to the Unix domain socket /tmp/local-agent, and perform the\nquery over that connection.\n\n/tmp/local-agent identical to the previous specification, since the Unix domain is the\ndefault transport iff the first character of the \nis a '/'.\n\nalias:myname perform a connection to the myname alias which needs to be defined in\nthe snmp.conf file using a line like \" alias myname\nudp:127.0.0.1:9161 \". Any type of transport definition can be used\nas the alias expansion parameter. Aliases are particularly useful\nfor using repeated complex transport strings.\n\nAAL5PVC:100 perform the query using AAL5 PDUs sent on the permanent virtual cir‐\ncuit with VPI=0 and VCI=100 (decimal) on the first ATM adapter in the\nmachine.\n\nPVC:1.10.32 perform the query using AAL5 PDUs sent on the permanent virtual cir‐\ncuit with VPI=10 (decimal) and VCI=32 (decimal) on the second ATM\nadapter in the machine. Note that \"PVC\" is a synonym for \"AAL5PVC\".\n\nNote that not all the transport domains listed above will always be available; for instance,\nhosts with no IPv6 support will not be able to use udp6 transport addresses, and attempts to\ndo so will result in the error \"Unknown host\". Likewise, since AAL5 PVC support is only cur‐\nrently available on Linux, it will fail with the same error on other platforms.\n", "subsections": [] }, "MIB PARSING OPTIONS": { "content": "The Net-SNMP MIB parser mostly adheres to the Structure of Management Information (SMI). As\nthat specification has changed through time, and in recognition of the (ahem) diversity in\ncompliance expressed in MIB files, additional options provide more flexibility in reading MIB\nfiles.\n", "subsections": [ { "name": "-Pc", "content": "Strictly speaking, a second appearance of \"--\" should terminate the comment, but this\nbreaks some MIB files. The default behaviour (to interpret comments correctly) can\nalso be set with the configuration token commentToEOL.\n" }, { "name": "-Pd", "content": "the amount of memory used by the running application.\n" }, { "name": "-Pe", "content": "erences to IMPORTed modules and MIB objects that cannot be located in the MIB direc‐\ntory search list. The default behaviour can also be set with the configuration token\nshowMibErrors.\n" }, { "name": "-PR", "content": "list of MIB definitions loaded, use the last version to be read in. By default, the\nfirst version will be used, and any duplicates discarded. This behaviour can also be\nset with the configuration token mibReplaceWithLatest.\n\nSuch ordering is normally only relevant if there are two MIB files with conflicting\nobject definitions for the same OID (or different revisions of the same basic MIB ob‐\nject).\n" }, { "name": "-Pu", "content": "bols. Strictly speaking, this is not valid SMI syntax, but some vendor MIB files de‐\nfine such names. The default behaviour can also be set with the configuration token\nmibAllowUnderline.\n" }, { "name": "-Pw", "content": "This can also be set with the configuration directive mibWarningLevel 1\n" }, { "name": "-PW", "content": "jects. This can also be set with the configuration directive mibWarningLevel 2\n\n" } ] }, "OUTPUT OPTIONS": { "content": "The format of the output from SNMP commands can be controlled using various parameters of the", "subsections": [ { "name": "-O", "content": "fault output (unless otherwise specified):\n$ snmpget -c public -v 1 localhost sysUpTime.0\nSNMPv2-MIB::sysUpTime.0 = Timeticks: (14096763) 1 day, 15:09:27.63\n\n", "flag": "-O" }, { "name": "-Oa", "content": "corresponding MIB object). By default, the library attempts to determine whether the\nvalue is a printable or binary string, and displays it accordingly.\n\nThis option does not affect objects that do have a Display Hint.\n" }, { "name": "-Ob", "content": "subidentifiers as string or OID values:\n$ snmpgetnext -c public -v 1 localhost vacmSecurityModel\nSNMP-VIEW-BASED-ACM-MIB::vacmSecurityModel.0.\"wes\" = xxx\n$ snmpgetnext -c public -v 1 -Ob localhost vacmSecurityModel\nSNMP-VIEW-BASED-ACM-MIB::vacmSecurityModel.0.3.119.101.115 = xxx\n" }, { "name": "-Oe", "content": "$ snmpget -c public -v 1 localhost ipForwarding.0\nIP-MIB::ipForwarding.0 = INTEGER: forwarding(1)\n$ snmpget -c public -v 1 -Oe localhost ipForwarding.0\nIP-MIB::ipForwarding.0 = INTEGER: 1\n" }, { "name": "-OE", "content": "$ snmpgetnext -c public -v 1 localhost vacmSecurityModel\nSNMP-VIEW-BASED-ACM-MIB::vacmSecurityModel.0.\"wes\" = xxx\n$ snmpgetnext -c public -v 1 -OE localhost vacmSecurityModel\nSNMP-VIEW-BASED-ACM-MIB::vacmSecurityModel.0.\\\"wes\\\" = xxx\n\nThis allows the output to be reused in shell commands.\n" }, { "name": "-Of", "content": ".iso.org.dod.internet.mgmt.mib-2.system.sysUpTime.0 =\nTimeticks: (14096763) 1 day, 15:09:27.63\n" }, { "name": "-On", "content": ".1.3.6.1.2.1.1.3.0 = Timeticks: (14096763) 1 day, 15:09:27.63\n" }, { "name": "-Op PRECISION", "content": "Uses the PRECISION string to allow modification of the value output format. This is\nused with OPAQUE float/double at the moment, but might be usabe for other types in the\nfuture. Allowed PRECISION strings are compatible to the flag/field with/precision part\nof the printf(3) function:\n$ snmpget localhost outputVoltage.1\nWIENER-CRATE-MIB::outputVoltage.u0 = Opaque: Float: 0.000000 V\n$ snmpget -Op +020.12 localhost outputVoltage.1\nWIENER-CRATE-MIB::outputVoltage.u0 = Opaque: Float: +000000.000000000000 V\n" }, { "name": "-Oq", "content": "SNMPv2-MIB::sysUpTime.0 1:15:09:27.63\n" }, { "name": "-OQ", "content": "SNMPv2-MIB::sysUpTime.0 = 1:15:09:27.63\n" }, { "name": "-Os", "content": "sysUpTime.0 = Timeticks: (14096763) 1 day, 15:09:27.63\n" }, { "name": "-OS", "content": "SNMPv2-MIB::sysUpTime.0 = Timeticks: (14096763) 1 day, 15:09:27.63\n\nThis is the default OID output format.\n" }, { "name": "-Ot", "content": "SNMPv2-MIB::sysUpTime.0 = 14096763\n" }, { "name": "-OT", "content": "" }, { "name": "-Ou", "content": "That means removing a series of \"standard\" prefixes from the OID, and displaying the\nremaining list of MIB object names (plus any other subidentifiers):\nsystem.sysUpTime.0 = Timeticks: (14096763) 1 day, 15:09:27.63\n" }, { "name": "-OU", "content": "" }, { "name": "-Ov", "content": "$ snmpget -c public -v 1 -Ov localhost ipForwarding.0\nINTEGER: forwarding(1)\n" }, { "name": "-Ox", "content": "corresponding MIB object). By default, the library attempts to determine whether the\nvalue is a printable or binary string, and displays it accordingly.\n\nThis option does not affect objects that do have a Display Hint.\n" }, { "name": "-OX", "content": "style index format:\n$ snmpgetnext -c public -v 1 localhost ipv6RouteTable\nIPv6-MIB::ipv6RouteIfIndex.63.254.1.0.255.0.0.0.0.0.0.0.0.0.0.0.64.1 = INTEGER: 2\n$ snmpgetnext -c public -v 1 -OX localhost ipv6RouteTable\nIPv6-MIB::ipv6RouteIfIndex[3ffe:100:ff00:0:0:0:0:0][64][1] = INTEGER: 2\n\nMost of these options can also be configured via configuration tokens. See the snmp.conf(5)\nmanual page for details.\n\n" } ] }, "LOGGING OPTIONS": { "content": "The mechanism and destination to use for logging of warning and error messages can be con‐\ntrolled by passing various parameters to the -L flag.\n", "subsections": [ { "name": "-Ln", "content": "" }, { "name": "-Le", "content": "" }, { "name": "-Lf FILE", "content": "Log messages to the specified file.\n" }, { "name": "-Lo", "content": "" }, { "name": "-Ls FACILITY", "content": "Log messages via syslog, using the specified facility ('d' for LOGDAEMON, 'u' for\nLOGUSER, or '0'-'7' for LOGLOCAL0 through LOGLOCAL7).\n\nThere are also \"upper case\" versions of each of these options, which allow the corresponding\nlogging mechanism to be restricted to certain priorities of message. Using standard error\nlogging as an example:\n" }, { "name": "-LE pri", "content": "will log messages of priority 'pri' and above to standard error. See below for possi‐\nble 'pri' values-\n" }, { "name": "-LE pri1-pri2", "content": "will log messages with priority between 'pri1' and 'pri2' (inclusive) to standard er‐\nror.\n\nFor -LF and -LS the priority specification comes before the file or facility token.\n\nThe priorities recognised are:\n\n0 or ! for LOGEMERG,\n1 or a for LOGALERT,\n2 or c for LOGCRIT,\n3 or e for LOGERR,\n4 or w for LOGWARNING,\n5 or n for LOGNOTICE,\n6 or i for LOGINFO, and\n7 or d for LOGDEBUG.\n\nNormal output is (or will be!) logged at a priority level of LOGNOTICE\n\n" } ] }, "INPUT OPTIONS": { "content": "The interpretation of input object names and the values to be assigned can be controlled us‐\ning various parameters of the -I flag. The default behaviour will be described at the end of\nthis section.\n", "subsections": [ { "name": "-Ib", "content": "(case-insensitively) against object names in the MIB tree. The \"best\" match will be\nused - calculated as the one that matches the closest to the beginning of the node\nname and the highest in the tree. For example, the MIB object vacmSecurityModel could\nbe matched by the expression vacmsecuritymodel (full name, but different case), or\nvacm.*model (regexp pattern).\n\nNote that '.' is a special character in regular expression patterns, so the expression\ncannot specify instance subidentifiers or more than one object name. A \"best match\"\nexpression will only be applied against single MIB object names. For example, the ex‐\npression sys*ontact.0 would not match the instance sysContact.0 (although sys*ontact\nwould match sysContact). Similarly, specifying a MIB module name will not succeed (so\nSNMPv2-MIB::sys.*ontact would not match either).\n" }, { "name": "-Ih", "content": "require providing the raw value:\nsnmpset ... HOST-RESOURCES-MIB::hrSystemDate.0\nx \"07 D2 0C 0A 02 04 06 08\"\ninstead of a formatted version:\nsnmpset ... HOST-RESOURCES-MIB::hrSystemDate.0\n= 2002-12-10,2:4:6.8\n" }, { "name": "-Ir", "content": "definitions. This will (hopefully) result in the remote agent reporting an invalid\nrequest, rather than checking (and rejecting) this before it is sent to the remote\nagent.\n\nLocal checks are more efficient (and the diagnostics provided also tend to be more\nprecise), but disabling this behaviour is particularly useful when testing the remote\nagent.\n" }, { "name": "-IR", "content": "the desired MIB object (or qualifying this object with an explicit MIB module name),\nthe MIB tree will be searched for the matching object name. Thus .iso.org.dod.inter‐\nnet.mib-2.system.sysDescr.0 (or SNMPv2-MIB::sysDescr.0) can be specified simply as\nsysDescr.0.\n\nWarning:\nSince MIB object names are not globally unique, this approach may return a dif‐\nferent MIB object depending on which MIB files have been loaded.\n\nThe MIB-MODULE::objectName syntax has the advantage of uniquely identifying a particu‐\nlar MIB object, as well as being slightly more efficient (and automatically loading\nthe necessary MIB file if necessary).\n" }, { "name": "-Is SUFFIX", "content": "adds the specified suffix to each textual OID given on the command line. This can be\nused to retrieve multiple objects from the same row of a table, by specifying a common\nindex value.\n" }, { "name": "-IS PREFIX", "content": "adds the specified prefix to each textual OID given on the command line. This can be\nused to specify an explicit MIB module name for all objects being retrieved (or for\nincurably lazy typists).\n" }, { "name": "-Iu", "content": "that OIDs are rooted at the 'mib-2' point in the tree (unless they start with an ex‐\nplicit '.' or include a MIB module name). So the sysDescr instance above would be\nreferenced as system.sysDescr.0.\n\n\nObject names specified with a leading '.' are always interpreted as \"fully qualified\" OIDs,\nlisting the sequence of MIB objects from the root of the MIB tree. Such objects and those\nqualified by an explicit MIB module name are unaffected by the -Ib, -IR and -Iu flags.\n\nOtherwise, if none of the above input options are specified, the default behaviour for a\n\"relative\" OID is to try and interpret it as an (implicitly) fully qualified OID, then apply\n\"random access\" lookup (-IR), followed by \"best match\" pattern matching (-Ib).\n\n" } ] }, "ENVIRONMENT VARIABLES": { "content": "PREFIX The standard prefix for object identifiers (when using UCD-style output). Defaults to\n.iso.org.dod.internet.mgmt.mib-2\n\nMIBS The list of MIBs to load. Defaults to SNMPv2-TC:SNMPv2-MIB:IF-MIB:IP-MIB:TCP-MIB:\nUDP-MIB:SNMP-VACM-MIB.\nOverridden by the -m option.\n\nMIBDIRS\nThe list of directories to search for MIBs. Defaults to /usr/share/snmp/mibs. Over‐\nridden by the -M option.\n\n", "subsections": [] }, "FILES": { "content": "/etc/snmp/snmpd.conf\nAgent configuration file. See snmpd.conf(5).\n\n/etc/snmp/snmp.conf\n\n~/.snmp/snmp.conf\nApplication configuration files. See snmp.conf(5).\n\n", "subsections": [] }, "SEE ALSO": { "content": "snmpget(1), snmpgetnext(1), snmpset(1), snmpbulkget(1), snmpbulkwalk(1), snmpwalk(1), snmpt‐\nable(1), snmpnetstat(1), snmpdelta(1), snmptrap(1), snmpinform(1), snmpusm(1), snmpstatus(1),\nsnmptest(1), snmp.conf(5).\n\n\n\n\nV5.9.1 20 Jul 2010 SNMPCMD(1)", "subsections": [] } } } }