Port reference
Port 161 (UDP) – SNMP
Simple Network Management Protocol — monitors and manages network devices via OID polling.
Default state
Open on routers, switches, printers, and servers with an SNMP agent enabled, frequently with default community strings.
Common attacks
- Default community strings (public/private) granting read/write access
- Information disclosure of configs, routes, ARP/interface tables
- Cleartext interception of SNMP v1/v2c traffic
- SNMP reflection/amplification DDoS via GetBulk
Hardening
- Use SNMPv3 with authentication and encryption (authPriv)
- Remove default public/private community strings
- Disable SNMP write access unless strictly required
- Restrict the agent to a management VLAN and IP allowlist
- Firewall UDP 161 from untrusted networks and the internet
nmap snippet
nmap -sU -p161 --script snmp-info,snmp-brute,snmp-sysdescr <target>Replace <target> with the host or range you're authorized to scan.
What runs on port 161?
Port 161 hosts the SNMP (Simple Network Management Protocol) agent, which lets monitoring systems poll devices for status and metrics by reading and writing OIDs in a MIB. It is enabled on routers, switches, firewalls, printers, UPSes, and servers to report interface counters, CPU, temperature, and configuration. Traps and notifications go the other way on port 162.
Why it matters for security
SNMP is a rich source of internal detail, and the older versions protect it
poorly. SNMP v1 and v2c authenticate only with a plaintext community
string and send everything in cleartext, so anyone who can sniff or guess
the community reads a device's full configuration — interface tables, routes, ARP
entries, even running configs. With a write community, that access becomes
control over the device. Devices shipped with default public/private strings
are an easy win for attackers.
How it's attacked
Attackers scan UDP 161 and try default community strings (public, private)
and short wordlists to gain read or write access. Read access yields information
disclosure of network topology and credentials; write access reconfigures the
device. v1/v2c traffic is intercepted in cleartext, and GetBulk requests
are abused for reflection/amplification DDoS against third parties.
Hardening checklist
Move to SNMPv3 with authPriv so polling is authenticated and encrypted, and
remove the default public/private communities. Disable write access
unless it is genuinely needed, bind the agent to a management VLAN with an IP
allowlist, and firewall UDP 161 from untrusted networks and the internet. The
nmap snippet above probes community strings and system info on devices you are
authorized to test.
Related ports
Frequently asked questions
- Is SNMP v2c secure?
- No. SNMP v1 and v2c send community strings and data in cleartext and have no real authentication. Use SNMPv3 with authPriv for authentication and encryption.
- What is the default SNMP community string?
- Most devices ship with 'public' for read access and 'private' for read/write. Leaving these in place lets anyone who reaches port 161 read or change device settings.