161
Summary
- // if you see it open
- SNMPv1/v2c community strings ('public'/'private') are sent in cleartext, so exposed agents leak topology, interface counters, ARP and routing tables. Open UDP/161 devices are abused as DDoS amplifiers (GetBulk responses can amplify ~1,700x). ISC SANS honeypot data recorded sustained attacker scanning, primarily SNMPv2c GetBulkRequest. Mitigations: SNMPv3 (auth + privacy), ACL to known NMS ranges, block UDP/161 at the perimeter.
- // analyst note
- an exposed 161 (almost always UDP) is a recon and amplification risk — treat default community strings and internet exposure as findings; recommend SNMPv3 + ACLs + perimeter block.
About port 161/tcp.
Port 161 is registered with IANA as snmp with the description "SNMP," dual-registered on both TCP and UDP, and with a blank reference field in the IANA CSV (all optional columns — Assignee, Contact, Registration Date, Modification Date, Reference — are empty). In practice SNMP is the management plane of the internet: a manager (NMS) sends Get, GetNext, GetBulk, and Set request PDUs to agents running on network devices, and the agent answers on the same port; trap and notification messages use the separate port 162. The protocol's foundational specification, RFC 1157 (SNMPv1, May 1990), explicitly calls for UDP and states that only an unreliable datagram service is required, which is why nearly all real-world SNMP runs over UDP/161. The TCP registration exists because RFC 3430 (December 2002, Experimental) defines an optional SNMP-over-TCP transport mapping using the same port 161, intended for high-reliability or firewall-traversal scenarios — but that mapping is rarely deployed, so a "161/tcp" listing in scanners and port databases reflects the IANA dual registration rather than widespread TCP usage. For an analyst, port 161 is a high-value finding regardless of transport. SNMPv1/v2c community strings ("public"/"private") travel in cleartext, so an exposed agent leaks topology, interface counters, ARP, and routing tables; open UDP/161 devices are also abused as DDoS amplifiers (GetBulk responses can amplify traffic roughly 1,700×). ISC SANS honeypot data recorded sustained attacker scanning of the port, primarily SNMPv2c GetBulkRequest probing. The standing mitigations are to move to SNMPv3 (authentication plus privacy/encryption), restrict access by ACL to known NMS ranges, and block UDP/161 at the perimeter.
- IANA assignment
snmp— "SNMP"; reference (blank — no RFC cited in IANA registry); dual-registered 161/tcp + 161/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry; the IANA Service Name and Transport Protocol Port Number Registry rows 399 (tcp) / 400 (udp)- Range class
- well-known (0–1023) [Confirmed]
- Related ports
- 162 (SNMP traps/notifications); contrast NETCONF (830), management-plane neighbors
Primary use
SNMP manager-to-agent port — Get/GetNext/GetBulk/Set PDUs to agents; responses on the same port; traps/notifications use 162 separately
Common software
agent-side — Net-SNMP (snmpd), Cisco IOS/NX-OS, Juniper JunOS, Aruba/HPE, pfSense/OPNsense, Windows SNMP Service; manager-side — PRTG, Zabbix, Nagios/Icinga, SolarWinds NPM, LibreNMS, Domotz
Security implications
SNMPv1/v2c cleartext community strings (default "public"/"private") leak topology, interface stats, ARP and routing data; UDP/161 abused for DDoS amplification (~1,700× via GetBulk); sustained attacker scanning observed
Typically seen on
routers, switches, printers, IoT/network appliances exposing the management plane; often unintentionally internet-reachable
- TCP vs UDP
- primary transport is UDP per RFC 1157 (datagram service); TCP/161 is the optional RFC 3430 (Experimental, 2002) mapping, rarely deployed [Confirmed] — RFC 1157, RFC 3430
- RFC references
- RFC 1157 (SNMPv1, 1990, UDP/161); RFC 3430 (Experimental, 2002, SNMP over TCP on 161/162); SNMPv3 RFCs 3411–3415 do not change the port [Confirmed] — datatracker.ietf.org
- Analyst note
- an exposed 161 (almost always UDP) is a recon and amplification risk — treat default community strings and internet exposure as findings; recommend SNMPv3 + ACLs + perimeter block.
About port 161/udp.
Port 161/udp is the query/polling port of the Simple Network Management Protocol, the protocol network management stations use to monitor and configure routers, switches, servers, printers, UPSes, and other infrastructure — and one of the most commonly open UDP ports on managed networks. SNMP follows a manager/agent model: the manager polls agents on UDP/161 using GET, GETNEXT, GETBULK, and SET operations against object identifiers (OIDs) organized into MIBs. SNMPv1 (RFC 1157, STD 15) and SNMPv2c (community wrapper RFC 1901; protocol operations RFC 3416) authenticate only with cleartext community strings, while SNMPv3 (STD 62, RFC 3411–3418) adds the User-based Security Model for authentication and encryption and the View-based Access Control Model for authorization. The security problems are long-standing: default and weak community strings ("public" for read, "private" for read-write) are extremely common and frequently never changed, and because v1/v2c send them in cleartext they are easy to sniff and enable information disclosure of device internals via MIB walking. SNMP is also a recognized UDP amplification/reflection DDoS vector — US-CERT alert TA14-017A lists SNMPv2 with a bandwidth amplification factor of 6.3 via the GETBULK request. The IANA registry lists snmp with a blank Reference field and no assignee at all; RFC 1157 is the governing v1 spec but is not the IANA-cited reference. For an analyst, an open 161/udp marks a manageable device or host: test for default community strings and SNMP version, and flag any v1/v2c exposure to untrusted networks as both an info-disclosure and a DDoS-reflection risk. Use SNMPv3 authPriv and restrict 161 to management networks.
- IANA assignment
snmp— "SNMP"; reference (blank — no RFC cited in IANA registry); assignee (blank) and contact (blank) in the registry; governing protocol RFC 1157 (SNMPv1, not the IANA-cited reference) [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023)
- Prevalence
- one of the most common open UDP ports on managed networks (Nmap groups it with DNS/DHCP among top UDP services); precise open-frequency not published comparably to TCP [Well-established] — nmap-services file
- Related ports
- 162 (SNMPTRAP, notifications); 10161/10162 (SNMP over TLS/DTLS); 514 syslog as a monitoring sibling
Primary use
network monitoring/management polling (GET/GETNEXT/GETBULK/SET on OIDs in MIBs)
Other/unofficial uses
bulk telemetry collection; some appliances expose status only via SNMP [Well-established]
Security implications
default/weak community strings ("public"/"private"); v1/v2c send community strings in cleartext (sniffing, MIB-walk info disclosure); UDP amplification/reflection — US-CERT TA14-017A lists SNMPv2 GETBULK at amplification factor 6.3; v3 adds auth+encryption
Typically seen on
routers/switches, servers, printers, UPSes, environmental sensors, most manageable infrastructure
- Analyst note
- Open 161/udp marks a manageable network device or host. Test for default community strings and SNMP version, and flag any v1/v2c exposure to untrusted networks as both an info-disclosure and a DDoS-reflection risk.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| snmp | UDP | Simple Net Mgmt Proto | 43.35% |
| snmp | TCP | — | 0.08% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.