Port 162 – SNMP Trap

UDP

Port 162 is the SNMP trap receiver port where management stations listen for unsolicited notifications from devices. Traps are asynchronous – devices push alerts for link-down events, threshold breaches, and hardware failures without being polled. SNMPv2c traps are unacknowledged; use INFORM for guaranteed delivery.

Port Number

162

Protocol

UDP

Service

SNMP Trap Receiver

Range

IANA Well-Known (0–1023)

Description

SNMP traps on UDP port 162 enable push-based monitoring. Devices send traps when events occur – interface failures, CPU threshold breaches, authentication failures, or hardware errors. The management station runs a trap receiver daemon on port 162. SNMPv1 traps are fire-and-forget over UDP – the sender gets no confirmation of receipt. SNMPv2c introduced INFORM requests which require acknowledgment, solving the silent-drop problem. Most NMS platforms (Nagios, Zabbix, PRTG, LibreNMS) run trap receivers on port 162.

Security risks

1Trap spoofing: SNMPv1/v2c traps carry no cryptographic authentication – any host can send a fake trap to port 162 with a spoofed source, triggering false alerts or hiding real ones
2Alert fatigue attack: flooding port 162 with thousands of fake traps overwhelms the NMS, causing operators to miss genuine critical alerts buried in noise
3Community string in cleartext: trap community strings ('public' is common) travel in plaintext UDP – sniffed community strings grant access to the agent on port 161
4Information leakage in trap payloads: traps contain OIDs with device state, configuration changes, authentication failures (with usernames), and interface details
5Receiver as pivot: compromising the trap receiver (NMS) often gives access to credentials for all managed devices (stored for polling on port 161)

Firewall guidance

Restrict inbound UDP 162 to known network device management IPs. In large networks, use an SNMP trap relay/proxy that validates source IPs before forwarding to the NMS. For SNMPv3 informs (acknowledged traps): configure the NMS to reject non-v3 traps. Consider syslog (UDP 514) or streaming telemetry as more secure alert alternatives.

Diagnosis commands

Run trap receiver in foreground to debug incoming traps

shell

snmptrapd -f -Lo -c /etc/snmp/snmptrapd.conf

Send a test trap to verify receiver is working

shell

snmptrap -v 2c -c public localhost '' 1.3.6.1.4.1.8072.2.3.0.1

Check which process is bound to trap port 162

shell

ss -ulnp | grep 162

Watch incoming traps in real-time (verify expected sources)

shell

tail -f /var/log/snmptrapd.log

Usage examples

Port 162 – SNMP Trap

shell

snmptrapd -Lo -f
snmptrap -v 2c -c public manager '' 1.3.6.1.4.1.8072.2.3.0.1
tcpdump -i eth0 udp port 162

Common services on this port

Zabbix SNMP TrapperNagios/Icinga snmptrapdLibreNMS Trap HandlerSolarWinds Trap ServicePRTG Trap Receiver

Related ports

161

SNMP agent (polling port)

162

SNMP Trap (this port)

10162

SNMP Trap over DTLS (secure)

History

SNMP Traps were part of the original SNMPv1 specification (RFC 1157, 1990). Unlike polling (port 161, NMS→device), traps are pushed from device→NMS on port 162. SNMPv2c added 'inform' (acknowledged trap – device retransmits until NMS confirms). SNMPv3 added authentication and encryption to traps/informs. Despite alternatives (syslog, streaming telemetry), SNMP traps remain the universal alerting mechanism for network equipment.

FAQ

SNMP Trap vs Inform – which should I use?

Traps (v1/v2c): fire-and-forget UDP, no delivery guarantee, device doesn't know if NMS received it. Informs (v2c/v3): acknowledged – device retransmits until NMS confirms receipt, guaranteeing delivery. Use informs for critical alerts (link-down, fan-failure) where losing the alert has consequences. Traps are fine for high-volume informational events where occasional loss is acceptable.

How do I secure SNMP trap reception?

1. Use SNMPv3 informs (authenticated + encrypted): snmptrapd.conf: createUser -e ENGINE_ID trapuser SHA authpass AES privpass, authUser execute trapuser. 2. Restrict source IPs at firewall. 3. Run snmptrapd with -a to reject unauthenticated traps. 4. Log all traps with timestamps for audit. 5. Rate-limit trap processing to prevent DoS.

Specification

RFC 3411 – Port 162 specification →