UDP port scanner is missing SNMP ports

Describe the bug

Rustscan cannot find an open SNMP port, while it can be found using NMAP and snmpget.

To Reproduce

1. Confirm that the public SNMP test service responds using SNMPv1 and community public:

   bash复制

   snmpget -v1 -c public -t 3 -r 1 \
     demo.pysnmp.com 1.3.6.1.2.1.1.1.0

   Observed:

   复制

   SNMPv2-MIB::sysDescr.0 = STRING: #SNMP Agent on .NET Standard

2. Scan UDP port 161 using Nmap:

   bash复制

   sudo nmap -sU -Pn -n -p 161 --reason \
     --max-retries 1 --host-timeout 20s demo.pysnmp.com

   Observed with Nmap 7.95:

   复制

   PORT    STATE SERVICE REASON
   161/udp open  snmp    udp-response ttl 63

3. Scan the same port using an affected RustScan build:

   bash复制

   rustscan --no-config --udp -a demo.pysnmp.com -p 161 \
     --timeout 3000 --tries 2 --scripts none --accessible

   Observed with the affected RustScan 2.4.1 lab build:

   复制

   Looks like I didn't find any open ports for 128.203.82.143.

Expected behavior

RustScan should generate a valid SNMP payload containing the community string public and detect UDP port 161 when the agent responds.

More generally, payload decoding should preserve literal text, decode escape sequences, and concatenate quoted strings without adding separator whitespace.

Screenshots

Not applicable;

Desktop (please complete the following information):

• OS: Linux/aarch64 for the containerized comparison; macOS/Apple Silicon for an additional host check.
• Browser: Not applicable.
• Version: RustScan 2.4.1 in downstream lab builds; installed host RustScan 2.3.0 also missed the port.
• Nmap: 7.95 for the comparison.

Smartphone (please complete the following information):

• Device: Not applicable.
• OS: Not applicable.
• Browser: Not applicable.
• Version: Not applicable.

Additional context

According to our friend

The missing detection appears to be caused by a malformed SNMP payload. The server does not respond to that payload, so RustScan reports no open ports. The parser in build.rs keeps only ASCII hexadecimal digits: if char == '\' && payload.chars().nth(idx + 1) == Some('x') { continue; } else if char.is_ascii_hexdigit() { tmp_str.push(char); // Converts each pair of retained hex digits into a byte. } However, the bundled SNMP probe contains the literal community string public. The parser retains only b and c, converting the six-character string into the single byte 0xbc. This produces a 28-byte probe instead of the expected 33 bytes, while its BER header still declares 31 bytes after the two-byte header. A local build with corrected payload decoding detected port 161 on the same server. The faulty parser is also present in upstream master at the time of reporting. Other probes containing literal text, including NetBIOS, LDAP, SSDP, memcached, and service location, may be affected as well.