Information Gatheringsnmpscannermassquerynetwork

Braa

Braa is a mass SNMP scanner capable of querying dozens or hundreds of hosts simultaneously in a single process. It consumes very few system resources and performs scanning very fast.

Description

Braa is designed for making SNMP queries across multiple targets efficiently, unlike traditional tools like snmpget or snmpwalk from net-snmp which handle one host at a time. It supports GET, WALK, and SET operations on SNMP trees using numerical OID values, as it lacks an ASN.1 parser and requires users to specify OIDs numerically (e.g., .1.3.6.1.2.1.1.5.0).

Use cases include rapid reconnaissance of SNMP-enabled devices on a network, such as walking entire OID trees on multiple hosts to gather system information like hostnames, descriptions, and uptime. It is particularly useful for large-scale scans where speed is critical, querying IP ranges in parallel.

The tool implements its own SNMP stack without relying on external libraries like net-snmp, supporting only basic data types for high performance. SET queries allow modifying SNMP values with type specifiers for integers, IP addresses, octet strings, and object identifiers.

How It Works

Braa implements a custom, lightweight SNMP stack that does not depend on libraries like net-snmp, enabling parallel queries to multiple hosts in a single process. It supports SNMP GET, WALK (.1.3.6.* format), and SET operations using numerical OIDs only, with optional community strings, ports, and instance IDs. Responses include timings and values, shown in formats like 'host:ms:OID:value'. Delays, retries, and passes can be tuned for network conditions.

Installation

bash
sudo apt install braa

Flags

-hShow this help.
-2Claim to be a SNMP2C agent.
-vShow short summary after doing all queries.
-xHexdump octet-strings
-t <s>Wait <s> seconds for responses.
-d <s>Wait <s> microseconds after sending each packet.
-p <s>Wait <s> milliseconds between subsequent passes.
-f <file>Load queries from file <file> (one by line).

Examples

Walk the SNMP tree on 192.168.1.215 using the community string of public, querying all OIDs under .1.3.6.
braa public@192.168.1.215:.1.3.6.*
Perform SNMP walk on IP range 10.253.101.1-255 at port 161 using public community.
public@10.253.101.1-10.253.101.255:161:.1.3.6.*
SET the OID .1.3.6.1.2.1.1.4.0 to string 'sme' across IP range.
10.253.101.1-10.253.101.255:.1.3.6.1.2.1.1.4.0=sme
GET the OID .1.3.6.1.2.1.1.1.0 with instance ID 'description' on single host.
10.253.101.1:.1.3.6.1.2.1.1.1.0/description
SET .1.3.6.1.2.1.1.4.0 to 'sme' then walk starting from .1.3.6 across IP range.
10.253.101.1-10.253.101.255:.1.3.6.1.2.1.1.4.0=sme,.1.3.6.*
Example SNMP query result showing host response with OID and value.
braa public@192.168.1.215:143ms:.1.3.6.1.2.1.1.5.0:redhat.biz.local
Load multiple queries from a file, one per line.
braa -f queries.txt
Updated 2026-04-16kali.org ↗