Port reference
Port 161 (UDP) – SNMP
Simple Network Management Protocol — monitors and manages network devices via OID polling.
Quick facts
- Transport
- udp
- Category
- Well-known
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on routers, switches, printers, and servers with an SNMP agent enabled, frequently with default community strings.
What is port 161 used for?
Port 161 runs the SNMP (Simple Network Management Protocol) agent, which lets monitoring tools poll a device for status and metrics like CPU, temperature, bandwidth, and uptime. It's enabled on routers, switches, firewalls, printers, UPSes, and servers, and is read by dashboards such as Zabbix, PRTG, LibreNMS, and Nagios. Alerts (traps) flow the other direction on port 162.
When would you open it?
Open port 161 on a device when a monitoring server needs to poll it for health and performance data. Keep that access on a management network between the monitored devices and the monitoring system — there's no reason to expose SNMP to the internet.
Is it safe to open?
Older SNMP (v1/v2c) uses cleartext "community strings" that often ship as default
public/private, so use SNMPv3 with encryption, change defaults, and restrict it
to a management network. See the security notes below.
How to check if this port is open
ss -tulpn | grep :161
nmap -sU -p 161 <target>netstat -ano | findstr :161
Test-NetConnection <host> -Port 161 # TCP onlylsof -i :161
nmap -sU -p 161 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 161 to your device's local IP, internal port 161, protocol UDP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 161/udpsudo firewall-cmd --permanent --add-port=161/udp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p udp --dport 161 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 161" -Direction Inbound -Protocol UDP -LocalPort 161 -Action AllowSecurity & risks
Common attacks
- Default community strings (public/private) granting read/write access
- Information disclosure of configs, routes, ARP/interface tables
- Cleartext interception of SNMP v1/v2c traffic
- SNMP reflection/amplification DDoS via GetBulk
Hardening
- Use SNMPv3 with authentication and encryption (authPriv)
- Remove default public/private community strings
- Disable SNMP write access unless strictly required
- Restrict the agent to a management VLAN and IP allowlist
- Firewall UDP 161 from untrusted networks and the internet
How to block this port
sudo ufw deny 161/udpsudo firewall-cmd --permanent --remove-port=161/udp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p udp --dport 161 -j DROPNew-NetFirewallRule -DisplayName "Block 161" -Direction Inbound -Protocol UDP -LocalPort 161 -Action Blocknmap snippet
nmap -sU -p161 --script snmp-info,snmp-brute,snmp-sysdescr <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Is SNMP v2c secure?
- No. SNMP v1 and v2c send community strings and data in cleartext and have no real authentication. Use SNMPv3 with authPriv for authentication and encryption.
- What is the default SNMP community string?
- Most devices ship with 'public' for read access and 'private' for read/write. Leaving these in place lets anyone who reaches port 161 read or change device settings.