Describe the bug
Rustscan cannot find an open SNMP port, while it can be found using NMAP and snmpget.
To Reproduce
-
Confirm that the public SNMP test service responds using SNMPv1 and community public:
snmpget -v1 -c public -t 3 -r 1 \
demo.pysnmp.com 1.3.6.1.2.1.1.1.0
Observed:
SNMPv2-MIB::sysDescr.0 = STRING: #SNMP Agent on .NET Standard
-
Scan UDP port 161 using Nmap:
sudo nmap -sU -Pn -n -p 161 --reason \
--max-retries 1 --host-timeout 20s demo.pysnmp.com
Observed with Nmap 7.95:
PORT STATE SERVICE REASON
161/udp open snmp udp-response ttl 63
-
Scan the same port using an affected RustScan build:
rustscan --no-config --udp -a demo.pysnmp.com -p 161 \
--timeout 3000 --tries 2 --scripts none --accessible
Observed with the affected RustScan 2.4.1 lab build:
Looks like I didn't find any open ports for 128.203.82.143.
Expected behavior
RustScan should generate a valid SNMP payload containing the community string public and detect UDP port 161 when the agent responds.
More generally, payload decoding should preserve literal text, decode escape sequences, and concatenate quoted strings without adding separator whitespace.
Screenshots
Not applicable;
Desktop (please complete the following information):
- OS: Linux/aarch64 for the containerized comparison; macOS/Apple Silicon for an additional host check.
- Browser: Not applicable.
- Version: RustScan 2.4.1 in downstream lab builds; installed host RustScan 2.3.0 also missed the port.
- Nmap: 7.95 for the comparison.
Smartphone (please complete the following information):
- Device: Not applicable.
- OS: Not applicable.
- Browser: Not applicable.
- Version: Not applicable.
Additional context
According to our friend 🤖
The missing detection appears to be caused by a malformed SNMP payload. The server does not respond to that payload, so RustScan reports no open ports.
The parser in build.rs keeps only ASCII hexadecimal digits:
if char == '\' && payload.chars().nth(idx + 1) == Some('x') {
continue;
} else if char.is_ascii_hexdigit() {
tmp_str.push(char);
// Converts each pair of retained hex digits into a byte.
}
However, the bundled SNMP probe contains the literal community string public. The parser retains only b and c, converting the six-character string into the single byte 0xbc.
This produces a 28-byte probe instead of the expected 33 bytes, while its BER header still declares 31 bytes after the two-byte header.
A local build with corrected payload decoding detected port 161 on the same server. The faulty parser is also present in upstream master at the time of reporting.
Other probes containing literal text, including NetBIOS, LDAP, SSDP, memcached, and service location, may be affected as well.
Describe the bug
Rustscan cannot find an open SNMP port, while it can be found using NMAP and snmpget.
To Reproduce
Confirm that the public SNMP test service responds using SNMPv1 and community
public:Observed:
Scan UDP port 161 using Nmap:
Observed with Nmap 7.95:
Scan the same port using an affected RustScan build:
Observed with the affected RustScan 2.4.1 lab build:
Expected behavior
RustScan should generate a valid SNMP payload containing the community string
publicand detect UDP port 161 when the agent responds.More generally, payload decoding should preserve literal text, decode escape sequences, and concatenate quoted strings without adding separator whitespace.
Screenshots
Not applicable;
Desktop (please complete the following information):
Smartphone (please complete the following information):
Additional context
According to our friend 🤖