SNMP Community Strings – Complete Guide

1. What Is an SNMP Community String?

An SNMP Community String acts like a shared password in SNMPv1 and SNMPv2c. It is embedded in every SNMP message exchanged between an SNMP Manager (e.g., PRTG, Zabbix, SolarWinds) and an SNMP Agent running on a managed device (e.g., a Cisco router, switch, or Linux server). The agent validates the string before responding to any request or permitting any configuration change.

Community strings determine the permission level granted to the manager — whether it can only read device data (read-only) or can also write configuration values (read-write).

  SNMP Manager                              SNMP Agent
  (SolarWinds, PRTG, Zabbix)               (Router, Switch, Server)
        |                                         |
        |-- GET  sysDescr.0 [community: public] -->|
        |<-- sysDescr = "Cisco IOS XE 17.06.01a" -|
        |                                         |
        |-- SET sysName.0 [community: private] --->|  <- RW required
        |<-- SET Response OK ----------------------|

2. Types of Community Strings

There are two functional types, each granting a different level of access to the device's Management Information Base (MIB).

Type	Access Level	Default Example	Typical Use Case	Risk Level
Read-Only (RO)	Retrieve (GET) data only — cannot modify anything	`public`	Monitoring tools: PRTG, SolarWinds, Zabbix, Nagios	Medium — exposes device stats if intercepted
Read-Write (RW)	Retrieve and modify (SET) configuration values	`private`	Automated provisioning tools (Ansible), network automation scripts	High — unauthorised use can reconfigure devices

⚠️ Critical Security Warning: The default strings public (RO) and private (RW) are universally known and actively scanned for by attackers. Change them immediately in any production environment.

3. How SNMP Community Strings Work

When an SNMP manager issues a GET or SET request, the community string is embedded in the SNMP packet header in plaintext. The agent compares the received string against its locally configured strings. Matching an RO string grants read access; matching an RW string grants full read-write access. If there is no match, the request is silently discarded.

Example — Linux SNMP query using snmpget:

snmpget -v 2c -c public 192.168.1.1 sysDescr.0

-v 2c — Use SNMP version 2c
-c public — Community string (the "password")
192.168.1.1 — Target SNMP agent IP
sysDescr.0 — OID for the system description

Expected response:

sysDescr.0 = STRING: Cisco IOS XE Software, Version 17.06.01a

Because the community string travels in plaintext, any device on the path can capture it with a packet sniffer such as Wireshark. This is the fundamental security weakness of SNMPv1/v2c that SNMPv3 was designed to address.

4. Configuring Community Strings on Cisco IOS

Step 1 — Enable the SNMP Agent and Define Strings

Router(config)# snmp-server community MyROString RO
Router(config)# snmp-server community MyRWString RW

Step 2 — Restrict Access by Source IP Using an ACL (Recommended)

Without an ACL, any host that knows the community string can query the device. Binding the string to an ACL limits queries to authorised management stations only.

Router(config)# access-list 10 permit 192.168.1.100
Router(config)# snmp-server community MyROString RO 10

Only the host 192.168.1.100 may now query using MyROString. All other sources are implicitly denied.

Step 3 — Verify the Configuration

Router# show snmp community

Expected output:

Community name: MyROString
Storage type: nonvolatile
Access: Read-only
IP ACL: 10

Community name: MyRWString
Storage type: nonvolatile
Access: Read-write

Optional — Set Device Contact and Location

Router(config)# snmp-server contact [email protected]
Router(config)# snmp-server location "Server Room 1, Rack 4"

5. Security Risks and Best Practices

⚠️ Key Risks

Risk	Impact
Default strings (`public`/`private`)	Attackers immediately enumerate or alter device configurations
Community strings sent in plaintext	Captured by any on-path packet sniffer — credentials exposed in one capture
RW strings used for monitoring	Monitoring needs only RO — unnecessary RW access greatly expands the attack surface
No ACL restricting SNMP source	Any host that guesses the string gains unrestricted access to the device MIB

✅ Best Practices

Use long, complex, unique community strings — e.g., N3tM0n!t0r_2025$Sec
Apply ACLs to every community string to restrict which managers can query the device
Assign RO strings to monitoring tools; reserve RW only for automation that genuinely requires write access
Disable SNMP entirely on devices that do not require monitoring: no snmp-server
Migrate to SNMPv3 with authPriv for all production systems
Rotate community strings periodically and whenever staff with access departs

6. Testing Community Strings

Using snmpget — Query a Single OID (Linux)

snmpget -v 2c -c MyROString 192.168.1.1 sysDescr.0
snmpget -v 2c -c MyROString 192.168.1.1 sysUpTime.0

Using snmpwalk — Walk the Entire MIB Tree

snmpwalk -v 2c -c MyROString 192.168.1.1

snmpwalk recursively queries every OID reachable with that string — useful for discovering all data a device exposes. May take several seconds on large devices.

Verifying SNMP Status on the Cisco Device

Router# show snmp
Router# show snmp community
Router# show snmp host

7. Community Strings vs SNMPv3

SNMPv3 replaces community strings with a proper user-based security model (USM), delivering authentication and optional encryption that community strings fundamentally cannot provide.

Feature	SNMPv1 / SNMPv2c	SNMPv3
Authentication	Community string (plaintext)	Username + HMAC-MD5 or HMAC-SHA
Encryption	None — all data in plaintext	DES or AES-128 (configured per user)
Access Control	RO / RW per community string	Role-based views via VACM
Replay Protection	None	Engine ID + timestamp anti-replay
Security Level	Low	High (`authPriv` = auth + encryption)
Recommended for	Legacy or isolated lab environments only	All modern production networks

8. Advanced: SNMP Views — Restricting MIB Visibility

Even with a correctly configured community string, you may want to limit which portions of the MIB a manager can access. SNMP views let you include or exclude specific OID subtrees from a community string's scope.

Router(config)# snmp-server view MyInterfaceView ifEntry included
Router(config)# snmp-server community MonitorOnly view MyInterfaceView RO 10

The community string MonitorOnly can now only retrieve interface statistics (ifEntry subtree). CPU, memory, routing table, and all other MIB objects are invisible to that string — minimising exposure.

9. Common Misconfigurations and Troubleshooting

Problem	Symptom / Risk	Fix
Default strings (`public`/`private`)	Immediate unauthorised access risk	Replace with complex, unique strings immediately
No ACL on community string	Any host can query the device	Bind with: `snmp-server community <str> RO <acl>`
RW string used for monitoring	Over-privileged; unnecessary attack surface	Create a dedicated RO string for monitoring tools
SNMP queries timing out	No response from agent	Verify `show snmp`, check UDP port 161 is not blocked by firewall or ACL

10. Summary

Community Strings = Shared passwords for SNMPv1/v2c access control
RO = Read device data only | RW = Read and modify configurations
Never use default values (public/private) in production
Always bind ACLs to community strings to restrict authorised managers by IP
Migrate to SNMPv3 (authPriv) for encrypted, authenticated management in production
Verify with show snmp community; test from Linux with snmpget / snmpwalk

SNMP Community Strings Quiz

1. What is the primary purpose of an SNMP Community String?

A. Encrypt SNMP traffic between manager and agent B. Manage IP address allocation on network devices C. Route SNMP packets across subnets D. Authenticate SNMP communication between manager and agent

Correct answer is D. SNMP community strings act like passwords embedded in every SNMPv1/v2c packet. The agent validates the string before returning data or permitting changes. They do not encrypt traffic — that is SNMPv3's role.

2. Which SNMP versions use community strings for authentication?

A. SNMPv1 and SNMPv2c only B. SNMPv3 only C. All versions including SNMPv3 D. None — SNMP uses certificates, not strings

Correct answer is A. SNMPv1 and v2c rely on community strings. SNMPv3 replaces them entirely with the User-Based Security Model (USM) — providing proper HMAC-MD5/SHA authentication and optional AES/DES encryption.

3. What permission does a Read-Only (RO) community string provide?

A. Modify device configurations via SET operations B. Full administrative root-level access C. View device statistics only — GET operations, no SET D. Disable the SNMP service on the device

Correct answer is C. An RO string allows only SNMP GET operations — retrieving values like CPU usage, interface stats, and uptime. It blocks any SET operations that would modify the device configuration.

4. Why are the default community strings "public" and "private" a security risk?

A. They expire automatically after 30 days B. They are universally known and actively scanned for by attackers C. They encrypt traffic with a weak cipher D. They block legitimate monitoring tools

Correct answer is B. "public" and "private" are factory defaults on virtually every SNMP-capable device — documented in every vendor manual. Automated network scanners try these strings first. An attacker who finds an unprotected device gains immediate read (or read-write) access to its entire MIB tree.

5. What is the recommended best practice for SNMP community strings?

A. Use complex unique strings and restrict access by IP via ACL B. Reuse the default strings for consistency across devices C. Disable ACLs to allow all management stations to query freely D. Use short plaintext passwords without IP restrictions

Correct answer is A. Complex strings reduce guessability, while ACLs ensure that even if an attacker captures the string via packet sniffing, they cannot use it from an unauthorised IP address — two complementary layers of defence.

6. Which SNMP version provides username/password authentication and AES encryption?

A. SNMPv1 B. SNMPv2c C. SNMPv2u D. SNMPv3

Correct answer is D. SNMPv3 introduces the User-Based Security Model (USM) with HMAC-MD5 or HMAC-SHA authentication and optional AES or DES encryption — security features completely absent from SNMPv1 and v2c.

7. What Cisco IOS command displays the current SNMP community string configuration?

A. show snmp users B. show ip nat translations C. show snmp community D. show access-lists

Correct answer is C. show snmp community lists all configured community strings, their RO/RW access level, storage type, and any ACL bound to them. Use show snmp for general SNMP statistics like packets sent and received.

8. What is a typical use case for a Read-Write (RW) community string?

A. Viewing device CPU usage and interface counters B. Automated modification of device configurations via Ansible or network scripts C. Encrypting SNMP traffic between manager and agent D. Blocking unauthorised access to SNMP ports

Correct answer is B. RW strings allow SNMP SET operations — used by network automation tools (Ansible, Python SNMP scripts) to write configuration changes. Standard monitoring tools need only RO strings. Always restrict RW access with an ACL.

9. Which Linux command-line tool queries a single SNMP OID using a community string?

A. snmpget B. ping C. traceroute D. netstat

Correct answer is A. snmpget -v 2c -c <community> <ip> <OID> retrieves a specific object from an SNMP agent. Use snmpwalk to traverse the entire MIB tree. Both are part of the net-snmp package available on most Linux distributions.

10. An engineer binds "MyROString" to ACL 10 which permits only 10.0.0.50. A monitoring server at 10.0.0.99 queries the device with the correct string — what happens?

A. The query succeeds because the community string is correct B. The query succeeds because both are on the same subnet C. The device returns an SNMP error response D. The query is silently discarded — ACL 10 does not permit 10.0.0.99

Correct answer is D. When a community string is bound to an ACL, the SNMP agent checks the source IP before evaluating the community string value. Since 10.0.0.99 is not permitted in ACL 10, the packet is silently dropped with no response sent — this prevents attackers from learning that the device even runs SNMP.

← Back to Home