Setting up read-only SNMP so you can map devices to switch ports

Switch port mapping answers “which port is that device on” by reading the switch’s own forwarding table. It needs SNMP enabled and a credential. Here is how to set that up without making the network less safe than you found it.

Why ScanWRX asks you instead of guessing

Plenty of tools try public first, then private, then a list of manufacturer defaults. It is convenient and it is credential guessing.

Three reasons that is the wrong behaviour for a tool on your laptop:

• Anything monitoring the network logs it as an authentication attack, because that is what it looks like. You then get to explain it.
• It can lock accounts or trip rate limits on equipment that was working fine before you arrived.
• If it succeeds, you have just accessed a device using a credential you were not given. The fact that the credential was weak is not a defence.

So ScanWRX asks. It never tries a value you did not supply, and the value you supply goes to Windows Credential Manager rather than into the scan database or any export.

Which version to use

SNMPv2c authenticates with a community string, in clear text, which is effectively a shared password visible to anyone who can see the traffic. It is everywhere, it is simple, and it is only appropriate on a management network you trust.

SNMPv3 has real users, real authentication and optional encryption. Use it if the switch supports it and you are configuring this for the long term.

SNMPv1 is obsolete. If a switch only offers v1, that is worth mentioning in your report.

Configuring it

Whatever the platform, four things matter:

1. Read-only. Never configure a read-write community for discovery. There is no reason a scanner needs to write, and ScanWRX has no code path that does.
2. Not the default string. public is not a credential; it is a convention. Use something random.
3. Restrict by source address if the switch supports it, so only the management subnet can query it.
4. Write down that you enabled it, so the next person knows it is there and can turn it off if it should not be.

The VLAN complication

On many older Cisco switches the bridge forwarding table is indexed by VLAN through community string indexing: to read VLAN 20 you query with community@20 rather than plain community. If you query without it you get VLAN 1 only, and quietly miss everything else.

This is a genuine trap because it fails silently — you get results, they are just incomplete. ScanWRX handles the indexed form where the switch supports it, and says plainly where it could not.

Reading the result properly

The forwarding table maps hardware addresses to ports. A port carrying one or two addresses is an endpoint port and the answer you wanted. A port carrying forty is an uplink to another switch, and every device beyond it appears there.

A tool that reports that naively tells you forty devices are all on port 24 — true and useless — or worse, picks one and names the wrong port confidently. Count the addresses per port and treat the busy ones as topology rather than as answers.