Lion Cipher Lab
Monitor a host with SNMPv3 — and watch why SNMP v1/v2c community strings leak everything
- Cyber / Security Engineer
- Intermediate
- ~50 min
- Free · no account required
Why it matters
Almost every switch, router, firewall, printer, UPS and server in a real network is monitored over SNMP — the Simple Network Management Protocol — so your dashboards can graph CPU, memory, interface traffic and uptime. For decades that monitoring used SNMP v1 and v2c, which 'authenticate' with a single shared password called a community string, sent in cleartext with every request. Anyone who can see the traffic reads that string and the data along with it, and the factory-default community names 'public' (read) and 'private' (write) are the first thing internet scanners try — a leaked write…
What you'll learn
- what SNMP is and how devices are polled for health
- configuring net-snmp (snmpd) and querying with snmpwalk/snmpget
- capturing and reading SNMP traffic with tcpdump
- seeing why v1/v2c community strings are cleartext and unsafe
- configuring SNMPv3 authPriv with SHA authentication and AES privacy
- least-privilege monitoring: security levels, restricted views, mgmt-only exposure
Steps in this lab
- What SNMP actually is (and the words you'll keep hearing)
- Stand up a disposable practice host
- Configure the old way: an SNMP v2c community string
- The lesson: capture the traffic and watch the password leak
- The fix: create an SNMPv3 user with SHA auth and AES privacy
- Query with SNMPv3 authPriv and prove it's encrypted now
- The judgment layer: levels, least privilege, and when NOT to use SNMP
- What you did, and why it matters