1SNMPCMD(1) Net-SNMP SNMPCMD(1)
2
6 snmpcmd - options and behaviour common to most of the Net-SNMP command-
7 line tools
8
10 snmpcmd [OPTIONS] AGENT [PARAMETERS]
11
13 This manual page describes the common options for the SNMP commands:
14 snmpbulkget, snmpbulkwalk, snmpdelta, snmpget, snmpgetnext, snmpnet‐
15 stat, snmpset, snmpstatus, snmptable, snmptest, snmptrap, snmpdf, snm‐
16 pusm , snmpwalk . The command line applications use the SNMP protocol
17 to communicate with an SNMP capable network entity, an agent. Individ‐
18 ual applications typically (but not necessarily) take additional param‐
19 eters that are given after the agent specification. These parameters
20 are documented in the manual pages for each application.
21
24 -3[MmKk] 0xHEXKEY
25 Sets the keys to be used for SNMPv3 transactions. These options
26 allow you to set the master authentication and encryption keys
27 (-3m and -3M respectively) or set the localized authentication
28 and encryption keys (-3k and -3K respectively). SNMPv3 keys can
29 be either passed in by hand using these flags, or by the use of
30 keys generated from passwords using the -A and -X flags dis‐
31 cussed below. For further details on SNMPv3 and its usage of
32 keying information, see the Net-SNMP tutorial web site (
33 http://www.Net-SNMP.org/tutorial-5/commands/ ). Overrides the
34 defAuthMasterKey (-3m), defPrivMasterKey (-3M), defAuthLocal‐
35 izedKey (-3k) or defPrivLocalizedKey (-3K) tokens, respectively,
36 in the snmp.conf file, see snmp.conf(5).
37 -a authProtocol
39 Set the authentication protocol (MD5 or SHA) used for authenti‐
40 cated SNMPv3 messages. Overrides the defAuthType token in the
41 snmp.conf file.
42 -A authPassword
44 Set the authentication pass phrase used for authenticated SNMPv3
45 messages. Overrides the defAuthPassphrase token in the
46 snmp.conf file. It is insecure to specify pass phrases on the
47 command line, see snmp.conf(5).
48 -c community
50 Set the community string for SNMPv1/v2c transactions. Overrides
51 the defCommunity token in the snmp.conf file.
52 -d Dump (in hexadecimal) the raw SNMP packets sent and received.
54 -D TOKEN[,...]
56 Turn on debugging output for the given TOKEN(s). Try ALL for
57 extremely verbose output.
58 -e engineID
60 Set the authoritative (security) engineID used for SNMPv3
61 REQUEST messages. It is typically not necessary to specify
62 this, as it will usually be discovered automatically.
63 -E engineID
65 Set the context engineID used for SNMPv3 REQUEST messages scope‐
66 dPdu. If not specified, this will default to the authoritative
67 engineID.
68 -h, --help
70 Display a brief usage message and then exit.
71 -H Display a list of configuration file directives understood by
73 the command and then exit.
74 -I [brRhu]
76 Specifies input parsing options. See INPUT OPTIONS below.
77 -l secLevel
79 Set the securityLevel used for SNMPv3 messages (noAuthNo‐
80 Priv|authNoPriv|authPriv). Appropriate pass phrase(s) must pro‐
81 vided when using any level higher than noAuthNoPriv. Overrides
82 the defSecurityLevel token in the snmp.conf file.
83 -L [eEfFoOsS]
85 Specifies output logging options. See LOGGING OPTIONS below.
86 -m MIBLIST
88 Specifies a colon separated list of MIB modules (not files) to
89 load for this application. This overrides (or augments) the
90 environment variable MIBS, the snmp.conf directive mibs, and the
91 list of MIBs hardcoded into the Net-SNMP library.
92 If MIBLIST has a leading '-' or '+' character, then the MIB mod‐
94 ules listed are loaded in addition to the default list, coming
95 before or after this list respectively. Otherwise, the speci‐
96 fied MIBs are loaded instead of this default list.
97 The special keyword ALL is used to load all MIB modules in the
99 MIB directory search list. Every file whose name does not begin
100 with "." will be parsed as if it were a MIB file.
101 -M DIRLIST
103 Specifies a colon separated list of directories to search for
104 MIBs. This overrides (or augments) the environment variable
105 MIBDIRS, the snmp.conf directive mibdirs, and the default direc‐
106 tory hardcoded into the Net-SNMP library (/usr/share/snmp/mibs).
107 If DIRLIST has a leading '-' or '+' character, then the given
109 directories are added to the default list, being searched before
110 or after the directories on this list respectively. Otherwise,
111 the specified directories are searched instead of this default
112 list.
113 Note that the directories appearing later in the list have have
115 precedence over earlier ones. To avoid searching any MIB direc‐
116 tories, set the MIBDIRS environment variable to the empty string
117 ("").
118 Note that MIBs specified using the -m option or the mibs config‐
120 uration directive will be loaded from one of the directories
121 listed by the -M option (or equivalents). The mibfile directive
122 takes a full path to the specified MIB file, so this does not
123 need to be in the MIB directory search list.
124 -n contextName
126 Set the contextName used for SNMPv3 messages. The default con‐
127 textName is the empty string "". Overrides the defContext token
128 in the snmp.conf file.
129 -O [abeEfnqQsStTuUvxX]
131 Specifies output printing options. See OUTPUT OPTIONS below.
132 -P [cdeRuwW]
134 Specifies MIB parsing options. See MIB PARSING OPTIONS below.
135 -r retries
137 Specifies the number of retries to be used in the requests. The
138 default is 5.
139 -t timeout
141 Specifies the timeout in seconds between retries. The default is
142 1. Floating point numbers can be used to specify fractions of
143 seconds.
144 -u secName
146 Set the securityName used for authenticated SNMPv3 messages.
147 Overrides the defSecurityName token in the snmp.conf file.
148 -v 1 | 2c | 3
150 Specifies the protocol version to use: 1 (RFCs 1155-1157), 2c
151 (RFCs 1901-1908), or 3 (RFCs 2571-2574). The default is typi‐
152 cally version 3. Overrides the defVersion token in the
153 snmp.conf file.
154 -V, --version
156 Display version information for the application and then exit.
157 -x privProtocol
159 Set the privacy protocol (DES or AES) used for encrypted SNMPv3
160 messages. Overrides the defPrivType token in the snmp.conf
161 file. This option is only valid if the Net-SNMP software was
162 build to use OpenSSL.
163 -X privPassword
165 Set the privacy pass phrase used for encrypted SNMPv3 messages.
166 Overrides the defPrivPassphrase token in the snmp.conf file. It
167 is insecure to specify pass phrases on the command line, see
168 snmp.conf(5).
169 -Z boots,time
171 Set the engineBoots and engineTime used for authenticated SNMPv3
172 messages. This will initialize the local notion of the agents
173 boots/time with an authenticated value stored in the LCD. It is
174 typically not necessary to specify this option, as these values
175 will usually be discovered automatically.
176 -Yname="value"
178 --name="value"
180 Allows to specify any token ("name") supported in the snmp.conf
181 file and sets its value to "value". Overrides the corresponding
182 token in the snmp.conf file. See snmp.conf(5) for the full list
183 of tokens.
184
187 The string AGENT in the SYNOPSIS above specifies the remote SNMP entity
188 with which to communicate. This specification takes the form:
189 [<transport-specifier>:]<transport-address>
191 At its simplest, the AGENT specification may consist of a hostname, or
193 an IPv4 address in the standard "dotted quad" notation. In this case,
194 communication will be attempted using UDP/IPv4 to port 161 of the given
195 host. Otherwise, the <transport-address> part of the specification is
196 parsed according to the following table:
197 <transport-specifier> <transport-address> format
199 udp hostname[:port] or IPv4-address[:port]
201 tcp hostname[:port] or IPv4-address[:port]
203 unix pathname
205 ipx [network]:node[/port]
207 aal5pvc or pvc [interface.][VPI.]VCI
209 udp6 or udpv6 or udpipv6 hostname[:port] or IPv6-address:port or
211 '['IPv6-address']'[:port]
212 tcp6 or tcpv6 or tcpipv6 hostname[:port] or IPv6-address:port or
214 '['IPv6-address']'[:port]
215 Note that <transport-specifier> strings are case-insensitive so that,
217 for example, "tcp" and "TCP" are equivalent. Here are some examples,
218 along with their interpretation:
219 hostname:161 perform query using UDP/IPv4 datagrams to host‐
221 name on port 161. The ":161" is redundant here
222 since that is the default SNMP port in any
223 case.
224 udp:hostname identical to the previous specification. The
226 "udp:" is redundant here since UDP/IPv4 is the
227 default transport.
228 TCP:hostname:1161 connect to hostname on port 1161 using TCP/IPv4
230 and perform query over that connection.
231 ipx::00D0B7AAE308 perform query using IPX datagrams to node num‐
233 ber 00D0B7AAE308 on the default network, and
234 using the default IPX port of 36879 (900F hexa‐
235 decimal), as suggested in RFC 1906.
236 ipx:0AE43409:00D0B721C6C0/1161
238 perform query using IPX datagrams to port 1161
239 on node number 00D0B721C6C0 on network number
240 0AE43409.
241 unix:/tmp/local-agent connect to the Unix domain socket /tmp/local-
243 agent, and perform the query over that connec‐
244 tion.
245 /tmp/local-agent identical to the previous specification, since
247 the Unix domain is the default transport iff
248 the first character of the <transport-address>
249 is a '/'.
250 alias:myname perform a connection to the myname alias which
252 needs to be defined in the snmp.conf file using
253 a line like " alias myname udp:127.0.0.1:9161
254 ". Any type of transport definition can be
255 used as the alias expansion parameter. Aliases
256 are particularly useful for using repeated com‐
257 plex transport strings.
258 AAL5PVC:100 perform the query using AAL5 PDUs sent on the
260 permanent virtual circuit with VPI=0 and
261 VCI=100 (decimal) on the first ATM adapter in
262 the machine.
263 PVC:1.10.32 perform the query using AAL5 PDUs sent on the
265 permanent virtual circuit with VPI=10 (decimal)
266 and VCI=32 (decimal) on the second ATM adapter
267 in the machine. Note that "PVC" is a synonym
268 for "AAL5PVC".
269 udp6:hostname:10161 perform the query using UDP/IPv6 datagrams to
271 port 10161 on hostname (which will be looked up
272 as an AAAA record).
273 UDP6:[fe80::2d0:b7ff:fe21:c6c0]
275 perform the query using UDP/IPv6 datagrams to
276 port 161 at address fe80::2d0:b7ff:fe21:c6c0.
277 tcpipv6:[::1]:1611 connect to port 1611 on the local host (::1 in
279 IPv6 parlance) using TCP/IPv6 and perform query
280 over that connection.
281 dtlsudp:hostname:9161 Connects using SNMP over DTLS/UDP as documented
283 by the ISMS working group (RFCs not yet pub‐
284 lished as of this date). This will require
285 that the TSM security model is in use (--defSe‐
286 curityModel=tsm) and that the
287 defX509ServerCerts, defX509ClientPriv, and
288 defX509ClientPub configuration tokens have been
289 set.
290 ssh:hostname:22 Connects using SNMP over SSH as documented by
292 the ISMS working group (RFCs not yet published
293 as of this date). This will require that the
294 TSM security model is in use (--defSecurity‐
295 Model=tsm).
296 Note that not all the transport domains listed above will always be
298 available; for instance, hosts with no IPv6 support will not be able to
299 use udp6 transport addresses, and attempts to do so will result in the
300 error "Unknown host". Likewise, since AAL5 PVC support is only cur‐
301 rently available on Linux, it will fail with the same error on other
302 platforms.
303
305 The Net-SNMP MIB parser mostly adheres to the Structure of Management
306 Information (SMI). As that specification has changed through time, and
307 in recognition of the (ahem) diversity in compliance expressed in MIB
308 files, additional options provide more flexibility in reading MIB
309 files.
310 -Pc Toggles whether ASN.1 comments should extend to the end of the
312 MIB source line. Strictly speaking, a second appearance of "--"
313 should terminate the comment, but this breaks some MIB files.
314 The default behaviour (to interpret comments correctly) can also
315 be set with the configuration token commentToEOL.
316 -Pd Disables the loading of MIB object DESCRIPTIONs when parsing MIB
318 files. This reduces the amount of memory used by the running
319 application.
320 -Pe Toggles whether to show errors encountered when parsing MIB
322 files. These include references to IMPORTed modules and MIB
323 objects that cannot be located in the MIB directory search list.
324 The default behaviour can also be set with the configuration
325 token showMibErrors.
326 -PR If the same MIB object (parent name and sub-identifier) appears
328 multiple times in the list of MIB definitions loaded, use the
329 last version to be read in. By default, the first version will
330 be used, and any duplicates discarded. This behaviour can also
331 be set with the configuration token mibReplaceWithLatest.
332 Such ordering is normally only relevant if there are two MIB
334 files with conflicting object definitions for the same OID (or
335 different revisions of the same basic MIB object).
336 -Pu Toggles whether to allow the underline character in MIB object
338 names and other symbols. Strictly speaking, this is not valid
339 SMI syntax, but some vendor MIB files define such names. The
340 default behaviour can also be set with the configuration token
341 mibAllowUnderline.
342 -Pw Show various warning messages in parsing MIB files and building
344 the overall OID tree. This can also be set with the configura‐
345 tion directive mibWarningLevel 1
346 -PW Show some additional warning messages, mostly relating to pars‐
348 ing individual MIB objects. This can also be set with the con‐
349 figuration directive mibWarningLevel 2
350
353 The format of the output from SNMP commands can be controlled using
354 various parameters of the -O flag. The effects of these sub-options
355 can be seen by comparison with the following default output (unless
356 otherwise specified):
357 $ snmpget -c public -v 1 localhost sysUpTime.0
358 SNMPv2-MIB::sysUpTime.0 = Timeticks: (14096763) 1 day, 15:09:27.63
359 -Oa Display string values as ASCII strings (unless there is a DIS‐
362 PLAY-HINT defined for the corresponding MIB object). By
363 default, the library attempts to determine whether the value is
364 a printable or binary string, and displays it accordingly.
365 This option does not affect objects that do have a Display Hint.
367 -Ob Display table indexes numerically, rather than trying to inter‐
369 pret the instance subidentifiers as string or OID values:
370 $ snmpgetnext -c public -v 1 localhost vacmSecurityModel
371 SNMP-VIEW-BASED-ACM-MIB::vacmSecurityModel.0."wes" = xxx
372 $ snmpgetnext -c public -v 1 -Ob localhost vacmSecurityModel
373 SNMP-VIEW-BASED-ACM-MIB::vacmSecurityModel.0.3.119.101.115 = xxx
374 -Oe Removes the symbolic labels from enumeration values:
376 $ snmpget -c public -v 1 localhost ipForwarding.0
377 IP-MIB::ipForwarding.0 = INTEGER: forwarding(1)
378 $ snmpget -c public -v 1 -Oe localhost ipForwarding.0
379 IP-MIB::ipForwarding.0 = INTEGER: 1
380 -OE Modifies index strings to escape the quote characters:
382 $ snmpgetnext -c public -v 1 localhost vacmSecurityModel
383 SNMP-VIEW-BASED-ACM-MIB::vacmSecurityModel.0."wes" = xxx
384 $ snmpgetnext -c public -v 1 -OE localhost vacmSecurityModel
385 SNMP-VIEW-BASED-ACM-MIB::vacmSecurityModel.0.\"wes\" = xxx
386 This allows the output to be reused in shell commands.
388 -Of Include the full list of MIB objects when displaying an OID:
390 .iso.org.dod.internet.mgmt.mib-2.system.sysUpTime.0 =
391 Timeticks: (14096763) 1 day, 15:09:27.63
392 -On Displays the OID numerically:
394 .1.3.6.1.2.1.1.3.0 = Timeticks: (14096763) 1 day,
395 15:09:27.63
396 -Oq Removes the equal sign and type information when displaying
398 varbind values:
399 SNMPv2-MIB::sysUpTime.0 1:15:09:27.63
400 -OQ Removes the type information when displaying varbind values:
402 SNMPv2-MIB::sysUpTime.0 = 1:15:09:27.63
403 -Os Display the MIB object name (plus any instance or other subiden‐
405 tifiers):
406 sysUpTime.0 = Timeticks: (14096763) 1 day, 15:09:27.63
407 -OS Display the name of the MIB, as well as the object name:
409 SNMPv2-MIB::sysUpTime.0 = Timeticks: (14096763) 1 day,
410 15:09:27.63
411 This is the default OID output format.
413 -Ot Display TimeTicks values as raw numbers:
415 SNMPv2-MIB::sysUpTime.0 = 14096763
416 -OT If values are printed as Hex strings, display a printable ver‐
418 sion as well.
419 -Ou Display the OID in the traditional UCD-style (inherited from the
421 original CMU code). That means removing a series of "standard"
422 prefixes from the OID, and displaying the remaining list of MIB
423 object names (plus any other subidentifiers):
424 system.sysUpTime.0 = Timeticks: (14096763) 1 day,
425 15:09:27.63
426 -OU Do not print the UNITS suffix at the end of the value.
428 -Ov Display the varbind value only, not the OID:
430 $ snmpget -c public -v 1 -Oe localhost ipForwarding.0
431 INTEGER: forwarding(1)
432 -Ox Display string values as Hex strings (unless there is a DISPLAY-
434 HINT defined for the corresponding MIB object). By default, the
435 library attempts to determine whether the value is a printable
436 or binary string, and displays it accordingly.
437 This option does not affect objects that do have a Display Hint.
439 -OX Display table indexes in a more "program like" output, imitating
441 a traditional array-style index format:
442 $ snmpgetnext -c public -v 1 localhost ipv6RouteTable
443 IPv6-MIB::ipv6RouteIfIndex.63.254.1.0.255.0.0.0.0.0.0.0.0.0.0.0.64.1 = INTEGER: 2
444 $ snmpgetnext -c public -v 1 -OE localhost ipv6RouteTable
445 IPv6-MIB::ipv6RouteIfIndex[3ffe:100:ff00:0:0:0:0:0][64][1] = INTEGER: 2
446 Most of these options can also be configured via configuration tokens.
448 See the snmp.conf(5) manual page for details.
449
452 The mechanism and destination to use for logging of warning and error
453 messages can be controlled by passing various parameters to the -L
454 flag.
455 -Le Log messages to the standard error stream.
457 -Lf FILE
459 Log messages to the specified file.
460 -Lo Log messages to the standard output stream.
462 -Ls FACILITY
464 Log messages via syslog, using the specified facility ('d' for
465 LOG_DAEMON, 'u' for LOG_USER, or '0'-'7' for LOG_LOCAL0 through
466 LOG_LOCAL7).
467 There are also "upper case" versions of each of these options, which
469 allow the corresponding logging mechanism to be restricted to certain
470 priorities of message. Using standard error logging as an example:
471 -LE pri
473 will log messages of priority 'pri' and above to standard error.
474 -LE p1-p2
476 will log messages with priority between 'p1' and 'p2' (inclu‐
477 sive) to standard error.
478 For -LF and -LS the priority specification comes before the file or
480 facility token. The priorities recognised are:
481 0 or ! for LOG_EMERG,
483 1 or a for LOG_ALERT,
484 2 or c for LOG_CRIT,
485 3 or e for LOG_ERR,
486 4 or w for LOG_WARNING,
487 5 or n for LOG_NOTICE,
488 6 or i for LOG_INFO, and
489 7 or d for LOG_DEBUG.
490 Normal output is (or will be!) logged at a priority level of LOG_NOTICE
492
495 The interpretation of input object names and the values to be assigned
496 can be controlled using various parameters of the -I flag. The default
497 behaviour will be described at the end of this section.
498 -Ib specifies that the given name should be regarded as a regular
500 expression, to match (case-insensitively) against object names
501 in the MIB tree. The "best" match will be used - calculated as
502 the one that matches the closest to the beginning of the node
503 name and the highest in the tree. For example, the MIB object
504 vacmSecurityModel could be matched by the expression vacmsecuri‐
505 tymodel (full name, but different case), or vacm.*model (regexp
506 pattern).
507 Note that '.' is a special character in regular expression pat‐
509 terns, so the expression cannot specify instance subidentifiers
510 or more than one object name. A "best match" expression will
511 only be applied against single MIB object names. For example,
512 the expression sys*ontact.0 would not match the instance sysCon‐
513 tact.0 (although sys*ontact would match sysContact). Similarly,
514 specifying a MIB module name will not succeed (so
515 SNMPv2-MIB::sys.*ontact would not match either).
516 -Ih disables the use of DISPLAY-HINT information when assigning val‐
518 ues. This would then require providing the raw value:
519 snmpset ... HOST-RESOURCES-MIB::hrSystemDate.0
520 x "07 D2 0C 0A 02 04 06 08"
521 instead of a formatted version:
522 snmpset ... HOST-RESOURCES-MIB::hrSystemDate.0
523 = 2002-12-10,2:4:6.8
524 -Ir disables checking table indexes and the value to be assigned
526 against the relevant MIB definitions. This will (hopefully)
527 result in the remote agent reporting an invalid request, rather
528 than checking (and rejecting) this before it is sent to the
529 remote agent.
530 Local checks are more efficient (and the diagnostics provided
532 also tend to be more precise), but disabling this behaviour is
533 particularly useful when testing the remote agent.
534 -IR enables "random access" lookup of MIB names. Rather than pro‐
536 viding a full OID path to the desired MIB object (or qualifying
537 this object with an explicit MIB module name), the MIB tree will
538 be searched for the matching object name. Thus
539 .iso.org.dod.internet.mib-2.system.sysDescr.0 (or
540 SNMPv2-MIB::sysDescr.0) can be specified simply as sysDescr.0.
541 Warning:
543 Since MIB object names are not globally unique, this
544 approach may return a different MIB object depending on
545 which MIB files have been loaded.
546 The MIB-MODULE::objectName syntax has the advantage of uniquely
548 identifying a particular MIB object, as well as being slightly
549 more efficient (and automatically loading the necessary MIB file
550 if necessary).
551 -Is SUFFIX
553 adds the specified suffix to each textual OID given on the com‐
554 mand line. This can be used to retrieve multiple objects from
555 the same row of a table, by specifying a common index value.
556 -IS PREFIX
558 adds the specified prefix to each textual OID given on the com‐
559 mand line. This can be used to specify an explicit MIB module
560 name for all objects being retrieved (or for incurably lazy typ‐
561 ists).
562 -Iu enables the traditional UCD-style approach to interpreting input
564 OIDs. This assumes that OIDs are rooted at the 'mib-2' point in
565 the tree (unless they start with an explicit '.' or include a
566 MIB module name). So the sysDescr instance above would be ref‐
567 erenced as system.sysDescr.0.
568 Object names specified with a leading '.' are always interpreted as
571 "fully qualified" OIDs, listing the sequence of MIB objects from the
572 root of the MIB tree. Such objects and those qualified by an explicit
573 MIB module name are unaffected by the -Ib, -IR and -Iu flags.
574 Otherwise, if none of the above input options are specified, the
576 default behaviour for a "relative" OID is to try and interpret it as an
577 (implicitly) fully qualified OID, then apply "random access" lookup
578 (-IR), followed by "best match" pattern matching (-Ib).
579
582 PREFIX The standard prefix for object identifiers (when using UCD-style
583 output). Defaults to .iso.org.dod.internet.mgmt.mib-2
584 MIBS The list of MIBs to load. Defaults to SNMPv2-TC:SNMPv2-MIB:IF-
586 MIB:IP-MIB:TCP-MIB:UDP-MIB:SNMP-VACM-MIB. Overridden by the -m
587 option.
588 MIBDIRS
590 The list of directories to search for MIBs. Defaults to
591 /usr/share/snmp/mibs. Overridden by the -M option.
592
595 /etc/snmp/snmpd.conf
596 Agent configuration file. See snmpd.conf(5).
597 /etc/snmp/snmp.conf
599 ~/.snmp/snmp.conf
601 Application configuration files. See snmp.conf(5).
602
605 snmpget(1), snmpgetnext(1), snmpset(1), snmpbulkget(1), snmpbulk‐
606 walk(1), snmpwalk(1), snmptable(1), snmpnetstat(1), snmpdelta(1),
607 snmptrap(1), snmpinform(1), snmpusm(1), snmpstatus(1), snmptest(1),
608 snmp.conf(5).
6094th Berkeley Distribution 29 Jun 2005 SNMPCMD(1)