BRAA(1)

💖 BRAA — like, the mass SNMP scanner, bestie 💖

okay so first things first: this is a page from the General Commands Manual, section 1, and the tool is called braa. and no, it's not "bra" like the underwear, it's braa, okay? anyway. let's GO. 🦋

---

✨ NAME ✨

braa — Mass SNMP scanner 👑

✨ SYNOPSIS ✨

braa [-h] [-2] [-v] [-t <s>] [-f <file] [-a <time>] [-r <retries>] [-d
<delay>] [querylist1] [querylist2] [...]

✨ DESCRIPTION ✨

so. braa is a mass snmp scanner. the whole point of a tool like this is obviously making SNMP queries, but here's the thing — unlike snmpget or snmpwalk from net-snmp, it can query dozens or hundreds of hosts simultaneously, all in a single process. so it eats like almost no system resources and does the scanning VERY fast. it's giving efficiency icon. 💅

and the tea on this one: braa implements its OWN snmp stack, so it does NOT need any SNMP libraries like net-snmp. no cap. the implementation is, and I quote, very dirty 🙈, it supports only several data types, and in any case cannot be stated 'standard-conforming'! it was designed to be fast, and it is fast. for this reason (well, and also because of the author's laziness ;), there is no ASN.1 parser in braa — you HAVE to know the numerical values of OID's. like .1.3.6.1.2.1.1.5.0 instead of system.sysName.0. that's the vibe. iykyk. 😭

✨ OPTIONS ✨

• -h — show help. bestie behaviour fr fr.
• -2 — claim to be a SNMP2C agent. fake it till you make it ✨
• -v — show a short summary after doing all the queries. receipts at the end 💖
• -x — hexdump octet-strings. raw bytes, no filter 💀
• -t <s> — wait <s> seconds for responses. patience, babe 🧚
• -d <s> — wait <s> microseconds after sending each packet. micro-nap 🍓
• -p <s> — wait <s> milliseconds between subsequent passes.
• -f <file> — load queries from file <file> (one by line). so organized 💅
• -a <time> — quit after <time> seconds, independent on what happens. main character exit 🚪✨
• -r <rc> — retry count (default: 3). three strikes and we're out 👑

✨ QUERY FORMATS ✨

so these are the three formats, and yes you have to get them exactly right:

GET: [community@]iprange[:port]:oid[/id]

WALK: [community@]iprange[:port]:oid.*[/id]

SET: [community@]iprange[:port]:oid=value[/id]

✨ EXAMPLES ✨

okay these are the moments where it all comes together, obsessed:

$ braa public@10.253.101.1:161:.1.3.6.*

walk the SNMP tree of host 10.253.101.1 with public string querying all OIDs under .1.3.6: 🌸

$ braa 10.253.101.1-10.253.101.254:.1.3.6.1.2.1.1.6.0

query the whole subnet 10.53.101/24 of for system.sysLocation.0 — yes, the whole subnet, she's doing the MOST 🦋

$ braa private@10.253.101.1:.1.3.6.1.2.1.1.6.0=sMy network

tries to set the value of system.sysLocation.0 to "My network" at host 10.253.101.1 💜

✨ BUGS AND LIMITATIONS ✨

bestie. read this part. seriously. 🙈

• the only supported datatypes are: integer (gauge, counter, timeticks, etc.), counter64, string, ipaddress, OID. of course you are free to modify braaasn.c/braaasn.h to support more types... but that's on you 💀
• braa will never send more than 1500 bytes (or a single packet) to a host in a single try. thus the number of queries that might be sent to a single host is limited. additionally, if you reach the limit by specifying too many queries, braa will terminate the whole scanning process... and no, the author can't tell what the limit exactly is, it just depends on many factors (mainly, the length of OIDs), anyway, 15 queries per hosts sounds dangerous, and better try not to exceed this number. so like, don't be greedy 🫶
• it is impossible to specify FQDN hostnames — you always have to give IP addresses of hosts... well, the author thinks it'll be corrected in future versions, if there will be ones. (there will be ones? there will be ones. 🌈)

---

okay and for the little sign-off: this whole thing lives in the General Commands Manual as BRAA(1) — like, manual section 1, commands, the classic — and the page literally just ends with BRAA(1) down at the bottom, no version number, no date, nothing. so mysterious of it. 💖✨💅