Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How do you determine the model and IOS version of a Cisco router, if you have its IP address remotely, but have no physical access. For example, I run nmap -sP and can see the router's IP, but all that's shown is "Cisco", and no information is given about its model or IOS version. Assume that we do not have a telnet client connection to the router, since we do not own the router. We just the Windows or Linux shell.

With these conditions, is there any way to get information, like as given in router advertisements, to get this detailed information about the router?

share|improve this question
see Cisco Discovery… – Shurmajee Apr 2 '13 at 8:31
up vote 3 down vote accepted

There is no sure-fire way to determine IOS and model without getting the router itself to do it. Typically this would be done using telnet or ssh and typing in "show version", which is not an elevated command. Many implementations have poor VTY passwords, so don't rule it out. Also worth trying is using SNMP to poll the router, you can use cisco's MIB browser to find the relevant OIDs. Many implementations also have poor SNMP protection including weak strings and no ACL protection on polling. You can get free net-snmp and ucd-snmp implementations for windows and unix in order to walk the OIDs.

Other than that there's good sense and guesswork which could get you close. Think about the size of the organization and its expected traffic levels in order to reduce the number of model possibilities.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.