How do you determine the model and IOS version of a Cisco router, if you have its IP address remotely, but have no physical access. For example, I run nmap -sP and can see the router's IP, but all that's shown is "Cisco", and no information is given about its model or IOS version. Assume that we do not have a telnet client connection to the router, since we do not own the router. We just the Windows or Linux shell.

With these conditions, is there any way to get information, like as given in router advertisements, to get this detailed information about the router?


There is no sure-fire way to determine IOS and model without getting the router itself to do it. Typically this would be done using telnet or ssh and typing in "show version", which is not an elevated command. Many implementations have poor VTY passwords, so don't rule it out. Also worth trying is using SNMP to poll the router, you can use cisco's MIB browser to find the relevant OIDs. Many implementations also have poor SNMP protection including weak strings and no ACL protection on polling. You can get free net-snmp and ucd-snmp implementations for windows and unix in order to walk the OIDs.

Other than that there's good sense and guesswork which could get you close. Think about the size of the organization and its expected traffic levels in order to reduce the number of model possibilities.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.