Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
This is a pure-Python, open source and free implementation of v1/v2c/v3 SNMP engine distributed under 2-clause BSD license.
The PySNMP project was initially sponsored by a PSF grant. Thank you!
This version is a fork of Ilya Etingof's project etingof/pysnmp. Ilya sadly passed away on 10-Aug-2022. Announcement here. His work is still of great use to the Python community and he will be missed.
Features, specific to SNMPv3 model include:
The PySNMP software is freely available for download from PyPI and GitHub.
Just run:
$ pip install pysnmplib
To download and install PySNMP along with its dependencies:
Besides the library, command-line SNMP utilities written in pure-Python could be installed via:
$ pip install snmpclitools
and used in the very similar manner as conventional Net-SNMP tools:
$ snmpget.py -v3 -l authPriv -u usr-md5-des -A authkey1 -X privkey1 demo.snmplabs.com sysDescr.0
SNMPv2-MIB::sysDescr.0 = STRING: Linux zeus 4.8.6.5-smp #2 SMP Sun Nov 13 14:58:11 CDT 2016 i686
PySNMP is designed in a layered fashion. Top-level and easiest to use API is known as hlapi. Here's a quick example on how to SNMP GET:
from pysnmp.hlapi import *
iterator = getCmd(SnmpEngine(),
CommunityData('public'),
UdpTransportTarget(('demo.snmplabs.com', 161)),
ContextData(),
ObjectType(ObjectIdentity('SNMPv2-MIB', 'sysDescr', 0)))
errorIndication, errorStatus, errorIndex, varBinds = next(iterator)
if errorIndication: # SNMP engine errors
print(errorIndication)
else:
if errorStatus: # SNMP agent errors
print('%s at %s' % (errorStatus.prettyPrint(), varBinds[int(errorIndex)-1] if errorIndex else '?'))
else:
for varBind in varBinds: # SNMP response contents
print(' = '.join([x.prettyPrint() for x in varBind]))
This is how to send SNMP TRAP:
from pysnmp.hlapi import *
errorIndication, errorStatus, errorIndex, varBinds = next(
sendNotification(
SnmpEngine(OctetString(hexValue='8000000001020304')),
UsmUserData('usr-sha-aes128', 'authkey1', 'privkey1',
authProtocol=usmHMACSHAAuthProtocol,
privProtocol=usmAesCfb128Protocol),
UdpTransportTarget(('demo.snmplabs.com', 162)),
ContextData(),
'trap',
NotificationType(ObjectIdentity('SNMPv2-MIB', 'authenticationFailure'))
)
)
if errorIndication:
print(errorIndication)
We maintain publicly available SNMP Agent and TRAP sink at demo.snmplabs.com. You are welcome to use it while experimenting with whatever SNMP software you deal with.
:warning: This is no longer the case as the snmplabs.com site is now defunct
$ python3 examples/hlapi/asyncore/sync/manager/cmdgen/usm-sha-aes128.py
SNMPv2-MIB::sysDescr.0 = SunOS zeus.snmplabs.com 4.1.3_U1 1 sun4m
$
$ python3 examples//hlapi/asyncore/sync/agent/ntforg/v3-inform.py
SNMPv2-MIB::sysUpTime.0 = 0
SNMPv2-MIB::snmpTrapOID.0 = SNMPv2-MIB::warmStart
SNMPv2-MIB::sysName.0 = system name
Other than that, PySNMP is capable to automatically fetch and use required MIBs from HTTP, FTP sites or local directories. You could configure any MIB source available to you (including this one) for that purpose.
For more example scripts please refer to examples section
at pysnmp web site.
Library documentation and examples can be found at the pysnmp project site.
If something does not work as expected, please open an issue at GitHub or post your question on Stack Overflow or try browsing pysnmp mailing list archives.
Bug reports and PRs are appreciated! ;-)
Copyright (c) 2005-2019, Ilya Etingof. All rights reserved.
FAQs
Unknown package
We found that pysnmplib demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.