Port 161 – SNMP

UDP

Port 161 is the SNMP agent port where managed devices (routers, switches, servers) listen for queries. SNMPv1 and v2c transmit community strings in cleartext – attackers who sniff these gain full read/write access to device configs. Use SNMPv3 with authentication and encryption for production monitoring.

Port Number

161

Protocol

UDP

Service

Simple Network Management Protocol

Range

IANA Well-Known (0–1023)

Description

SNMP agents listen on UDP port 161 for GET, SET, and WALK requests from management stations. The agent responds with OID values from its MIB tree. SNMPv2c is still dominant in production despite transmitting community strings (effectively passwords) in plaintext. SNMP SET operations on port 161 can reconfigure devices remotely – changing routing tables, disabling interfaces, or modifying ACLs. Restrict port 161 to management VLANs and use SNMPv3 AuthPriv mode (SHA auth + AES encryption) for any network segment that could be sniffed.

Security risks

1CVE-2017-6742: Cisco IOS SNMP RCE – specially crafted SNMP packets to port 161 allow remote code execution on Cisco routers/switches (CVSS 8.8, actively exploited)
2Community string = password in cleartext: SNMPv1/v2c sends the community string ('public', 'private') in plaintext UDP – anyone sniffing the network reads it and gains full device access
3Default community strings: 'public' (read) and 'private' (read-write) are still used on millions of devices. Write access via 'private' allows changing router configs, disabling interfaces, and modifying ACLs
4DDoS amplification: SNMP GetBulk requests on UDP 161 amplify responses 6-10x. Exposed SNMP agents are used in reflection attacks
5MIB information disclosure: even read-only SNMP access reveals system description, uptime, interface list, ARP tables, routing tables, and running processes – complete reconnaissance of network infrastructure

Firewall guidance

Never expose UDP 161 to the internet. Restrict to monitoring server IPs only (specific /32 addresses in ACLs). On devices: use SNMPv3 with authPriv (SHA-256 auth + AES-256 encryption). Change community strings from 'public'/'private' to long random values. On Linux: configure /etc/snmp/snmpd.conf with 'agentaddress udp:127.0.0.1:161' if only local monitoring.

Diagnosis commands

Test if default 'public' community string works (should fail if secured)

shell

snmpwalk -v2c -c public target 1.3.6.1.2.1.1

SNMPv3 authenticated+encrypted query

shell

snmpget -v3 -u monitor -l authPriv -a SHA -A 'authpass' -x AES -X 'privpass' target sysUpTime.0

Brute-force SNMP community strings (security audit)

shell

nmap -sU -p 161 --script snmp-brute target

List running processes via SNMP (if this works, the device is dangerously exposed)

shell

snmpwalk -v2c -c public target 1.3.6.1.2.1.25.4.2.1.2

Usage examples

Port 161 – SNMP

shell

snmpwalk -v2c -c public 192.168.1.1 sysDescr
snmpget -v3 -u admin -l authPriv -a SHA -A pass -x AES -X key host 1.3.6.1.2.1.1.1.0
snmpbulkwalk -v2c -c public host ifTable

Common services on this port

Net-SNMP (Linux)Cisco IOS SNMPWindows SNMP ServiceSNMP on printers/UPS/PDUObservium/LibreNMS/Zabbix polling

Related ports

162

SNMP Trap (device-to-manager alerts)

161

SNMP agent (this port)

10161

SNMP over DTLS (secure transport)

History

SNMP was created in 1988 (RFC 1067) as a simple network management protocol for routers. SNMPv1 had no security (cleartext community strings). SNMPv2c (1996) added GetBulk but kept the same weak authentication. SNMPv3 (2002, RFC 3414) finally added authentication (HMAC-SHA) and encryption (AES). Despite being 20+ years old, SNMPv3 adoption remains under 50% because device vendors and network teams resist the complexity of USM credentials.

FAQ

How do I migrate from SNMPv2c to SNMPv3?

On the device: create a SNMPv3 user with auth+priv (e.g., Cisco: snmp-server user monitor grp-ro v3 auth sha AuthPass priv aes 128 PrivPass). On the NMS (Zabbix/LibreNMS): update host config to use SNMPv3 credentials. Test: snmpget -v3 -u monitor -l authPriv -a SHA -A 'AuthPass' -x AES -X 'PrivPass' device sysUpTime.0. Then disable v2c: no snmp-server community public.

Is SNMP still relevant in 2024+ with modern monitoring?

Yes for network devices (switches, routers, firewalls, UPS, PDUs) – SNMP is the only universal protocol they all speak. No for servers – use Prometheus node_exporter, Datadog agent, or OpenTelemetry. Streaming telemetry (gNMI/gRPC) is replacing SNMP polling on modern Cisco/Arista/Juniper gear but adoption is early. Plan: SNMPv3 for legacy devices, streaming telemetry for new deployments.

Specification

RFC 3411 – Port 161 specification →