$ sudo tshark -i ppp0 -s 1500 -n -R telnet -O telnet
tshark: Lua: Error during loading:
 [string "/usr/share/wireshark/init.lua"]:45: dofile has been disabled
Running as user "root" and group "root". This could be dangerous.
Capturing on ppp0
Frame 4: 71 bytes on wire (568 bits), 71 bytes captured (568 bits) on interface 0
Linux cooked capture
Internet Protocol Version 4, Src: 10.90.90.75 (10.90.90.75), Dst: 10.90.90.250 (10.90.90.250)
Transmission Control Protocol, Src Port: 23 (23), Dst Port: 60536 (60536), Seq: 1, Ack: 1, Len: 3
Telnet
    Command: Do Suppress Go Ahead

Frame 6: 71 bytes on wire (568 bits), 71 bytes captured (568 bits) on interface 0
Linux cooked capture
Internet Protocol Version 4, Src: 10.90.90.250 (10.90.90.250), Dst: 10.90.90.75 (10.90.90.75)
Transmission Control Protocol, Src Port: 60536 (60536), Dst Port: 23 (23), Seq: 1, Ack: 4, Len: 3
Telnet
    Command: Won't Suppress Go Ahead

Frame 7: 180 bytes on wire (1440 bits), 180 bytes captured (1440 bits) on interface 0
Linux cooked capture
Internet Protocol Version 4, Src: 10.90.90.75 (10.90.90.75), Dst: 10.90.90.250 (10.90.90.250)
Transmission Control Protocol, Src Port: 23 (23), Dst Port: 60536 (60536), Seq: 4, Ack: 1, Len: 112
Telnet
    Command: Will Suppress Go Ahead
    Command: Will Echo
    Data: \033[0m\033[2J\033[1;1H\033[2J\rD\r           \n
    Data: \r                        DES-3200-10 Fast Ethernet Switch\n
    Data: \r             

Frame 9: 246 bytes on wire (1968 bits), 246 bytes captured (1968 bits) on interface 0
Linux cooked capture
Internet Protocol Version 4, Src: 10.90.90.75 (10.90.90.75), Dst: 10.90.90.250 (10.90.90.250)
Transmission Control Protocol, Src Port: 23 (23), Dst Port: 60536 (60536), Seq: 116, Ack: 4, Len: 178
Telnet
    Data:                Command Line Interface\n
    Data: \r\n
    Data: \r                            Firmware: Build 1.28.009\n
    Data: \r           Copyright(C) 2011 D-Link Corporation. All rights reserved.\n
    Data: \rUserName:
    Command: Don't Suppress Go Ahead

Frame 10: 74 bytes on wire (592 bits), 74 bytes captured (592 bits) on interface 0
Linux cooked capture
Internet Protocol Version 4, Src: 10.90.90.250 (10.90.90.250), Dst: 10.90.90.75 (10.90.90.75)
Transmission Control Protocol, Src Port: 60536 (60536), Dst Port: 23 (23), Seq: 4, Ack: 294, Len: 6
Telnet
    Command: Don't Suppress Go Ahead
    Command: Don't Echo

Frame 11: 71 bytes on wire (568 bits), 71 bytes captured (568 bits) on interface 0
Linux cooked capture
Internet Protocol Version 4, Src: 10.90.90.75 (10.90.90.75), Dst: 10.90.90.250 (10.90.90.250)
Transmission Control Protocol, Src Port: 23 (23), Dst Port: 60536 (60536), Seq: 294, Ack: 10, Len: 3
Telnet
    Command: Won't Suppress Go Ahead

Frame 12: 78 bytes on wire (624 bits), 78 bytes captured (624 bits) on interface 0
Linux cooked capture
Internet Protocol Version 4, Src: 10.90.90.250 (10.90.90.250), Dst: 10.90.90.75 (10.90.90.75)
Transmission Control Protocol, Src Port: 60536 (60536), Dst Port: 23 (23), Seq: 10, Ack: 297, Len: 10
Telnet
    Command: Won't Suppress Go Ahead
    Data: admin\r\n

Frame 13: 71 bytes on wire (568 bits), 71 bytes captured (568 bits) on interface 0
Linux cooked capture
Internet Protocol Version 4, Src: 10.90.90.75 (10.90.90.75), Dst: 10.90.90.250 (10.90.90.250)
Transmission Control Protocol, Src Port: 23 (23), Dst Port: 60536 (60536), Seq: 297, Ack: 20, Len: 3
Telnet
    Command: Won't Echo

Frame 14: 71 bytes on wire (568 bits), 71 bytes captured (568 bits) on interface 0
Linux cooked capture
Internet Protocol Version 4, Src: 10.90.90.250 (10.90.90.250), Dst: 10.90.90.75 (10.90.90.75)
Transmission Control Protocol, Src Port: 60536 (60536), Dst Port: 23 (23), Seq: 20, Ack: 300, Len: 3
Telnet
    Command: Don't Suppress Go Ahead

Frame 15: 84 bytes on wire (672 bits), 84 bytes captured (672 bits) on interface 0
Linux cooked capture
Internet Protocol Version 4, Src: 10.90.90.75 (10.90.90.75), Dst: 10.90.90.250 (10.90.90.250)
Transmission Control Protocol, Src Port: 23 (23), Dst Port: 60536 (60536), Seq: 300, Ack: 23, Len: 16
Telnet
    Data: admin\n
    Data: \rPassWord:

Frame 16: 71 bytes on wire (568 bits), 71 bytes captured (568 bits) on interface 0
Linux cooked capture
Internet Protocol Version 4, Src: 10.90.90.250 (10.90.90.250), Dst: 10.90.90.75 (10.90.90.75)
Transmission Control Protocol, Src Port: 60536 (60536), Dst Port: 23 (23), Seq: 23, Ack: 316, Len: 3
Telnet
    Command: Don't Echo

Frame 17: 69 bytes on wire (552 bits), 69 bytes captured (552 bits) on interface 0
Linux cooked capture
Internet Protocol Version 4, Src: 10.90.90.75 (10.90.90.75), Dst: 10.90.90.250 (10.90.90.250)
Transmission Control Protocol, Src Port: 23 (23), Dst Port: 60536 (60536), Seq: 316, Ack: 26, Len: 1
Telnet
    Data: *

Frame 18: 78 bytes on wire (624 bits), 78 bytes captured (624 bits) on interface 0
Linux cooked capture
Internet Protocol Version 4, Src: 10.90.90.250 (10.90.90.250), Dst: 10.90.90.75 (10.90.90.75)
Transmission Control Protocol, Src Port: 60536 (60536), Dst Port: 23 (23), Seq: 26, Ack: 317, Len: 10
Telnet
    Data: wa12gzs2\r\n

Frame 19: 69 bytes on wire (552 bits), 69 bytes captured (552 bits) on interface 0
Linux cooked capture
Internet Protocol Version 4, Src: 10.90.90.75 (10.90.90.75), Dst: 10.90.90.250 (10.90.90.250)
Transmission Control Protocol, Src Port: 23 (23), Dst Port: 60536 (60536), Seq: 317, Ack: 36, Len: 1
Telnet
    Data: *

Frame 21: 94 bytes on wire (752 bits), 94 bytes captured (752 bits) on interface 0
Linux cooked capture
Internet Protocol Version 4, Src: 10.90.90.75 (10.90.90.75), Dst: 10.90.90.250 (10.90.90.250)
Transmission Control Protocol, Src Port: 23 (23), Dst Port: 60536 (60536), Seq: 318, Ack: 36, Len: 26
Telnet
    Data: ********\n
    Data: \rFail!\n
    Data: \rUserName:

printf "admin
parol
sh snmp host
exit
logout
" | nc -4n ip.add.re.ss 23

#! /usr/bin/python

import telnetlib

def check_model(string):
   if "DGS-3120" in string:
      return "DGS-3120"
   elif "DES-1228" in string:
      return "DES-1228"
   elif "DES-3010" in string:
      return "DES-3010"
   elif "DES-3200" in string:
      return "DES-3200"
   else:
      return None

def save_config(ipaddr, user, password):
   try:
      tn = telnetlib.Telnet(ipaddr, timeout=2)
   except:
      print "Timeout exceeded on IP %s" % ipaddr
      return None
   model = check_model(tn.read_until("UserName:", timeout=3))
   if not model:
      print "Unknown model on IP: %s\n" % ipaddr
      tn.close()
      return None
   tn.write("%s\r\n" % user)
   tn.read_until("PassWord:", timeout=1)
   tn.write("%s\r\n" % password)
   tn.read_until("#", timeout=3)
   if model == "DES-1228":
      tn.write("upload cfg_toTFTP 10.90.90.1 /tmp/%s.conf\r\n" % ipaddr)
   elif model == "DES-3010":
      tn.write("upload configuration 10.90.90.1 /tmp/%s.conf\r\n" % ipaddr)
   elif model == "DGS-3120":
      tn.write("upload cfg_toTFTP 10.90.90.1 dest_file /tmp/%s.conf\r\n" % ipaddr)
   elif model == "DES-3200":
      tn.write("upload cfg_toTFTP 10.90.90.1 /tmp/%s.conf\r\n" % ipaddr)
   else:
      print "Unknown model on IP: %s\n" % ipaddr
      tn.close()
      return None

   fin = tn.read_until("#", timeout=10)
   tn.close()
   if "Done" in fin:
      print "Done on IP: %s" % ipaddr
   else:
      print "Unknown Error IP: %s ,model: %s" % (ipaddr, model)
   return fin

for a in range(7,254):
   save_config("10.90.90.%d" % a, "admin", "passwd")