TCP Port 161 – SNMP (Simple Network Management Protocol)
Port 161 is the standard port for SNMP, the Simple Network Management Protocol that network monitoring systems use to query and manage network-attached devices. SNMP is the workhorse protocol for “is this router still working, is this switch port up, is this printer low on toner” types of questions. Almost every enterprise-grade router, switch, firewall, server, printer, and uninterruptible power supply supports SNMP, and almost every network monitoring product (PRTG, Nagios, SolarWinds, LibreNMS, Zabbix, and many others) speaks it. The protocol uses UDP for normal queries because most operations are short request-response exchanges that benefit from UDP’s lower overhead. TCP support exists in the IANA registry but is rarely used in practice.
SNMP exists in three protocol versions, and the differences between them are central to understanding the port. SNMPv1 was published in 1988 and authenticates clients with a “community string,” a plaintext password sent with each query. SNMPv2c, published in 1993, kept the same community-string authentication but added new operations and data types. SNMPv3, published in 1998, replaced the community-string model with a proper authentication and encryption framework. Despite SNMPv3 being available for over twenty-five years, SNMPv1 and SNMPv2c remain widely deployed, particularly on older network equipment that has never been reconfigured.
SNMP responses on port 162 (the SNMP trap port) are sent asynchronously by devices to monitoring systems when something noteworthy happens; ports 161 and 162 thus form a common pair in monitoring deployments.
Inbound port 161 from the public internet is unusual in 2026 and is generally treated as a configuration mistake. Outbound port 161 from end-user devices is uncommon, since SNMP is typically a server-to-device protocol rather than a client application activity.
About TCP Port 161
Port 161 carries the IANA assignment for snmp. The IANA description reads: ‘SNMP’.
Security Considerations
SNMP has a long-standing reputation as a reconnaissance and information-disclosure target, primarily because of the way its older versions handle authentication and the way devices are typically configured.
SNMPv1 and SNMPv2c authenticate clients using a community string, which is functionally a plaintext password sent with every query. The convention since the protocol’s introduction has been to use “public” as the default read-only community string and “private” as the default read-write string. These were intended as placeholder values that administrators would change before deployment, but a significant fraction of devices have shipped, been deployed, and remained in production with these strings unchanged. An attacker who can reach SNMP on a target with a default community string can read detailed system information (interface lists, routing tables, ARP caches, system identifiers, sometimes user account names) and, if the read-write string is also default, modify device configuration.
Our data shows 17 IDS rules referencing port 161, dominated by attempted-recon and misc-attack classtypes. Sample rules detect probes using “public” and “private” as community strings on both UDP and TCP, broadcast SNMP discovery queries, and historical buffer overflow attempts in SNMP community string handling that affected various network devices in the early 2000s. The rules also include a Bay/Nortel Nautica Marlin denial of service signature (a 1990s-era network gear vulnerability) and detection for SNMP-based Windows NT user enumeration techniques.
Beyond the default-community-string issue, SNMP has also been used as a DDoS amplification vector, with attackers spoofing victim addresses and sending small queries to misconfigured public-facing SNMP servers, which return much larger responses to the spoofed victim.
Common practice today is to disable SNMPv1 and SNMPv2c entirely where the equipment supports v3, change all default community strings on devices that must continue to use earlier versions, restrict SNMP access to specific monitoring-system IP addresses through firewall rules and per-device access control lists, and never expose SNMP directly to the public internet. Where v3 is in use, the authentication and encryption features should be configured rather than left at the no-auth, no-priv defaults that some devices ship with.
Inbound port 161 from the public internet to any device is a strong signal that something is misconfigured and warrants immediate investigation.
IDS Rule References
3 IDS / security rules reference TCP port 161. Presence in IDS rules does not mean traffic on this port is malicious. These are patterns security tools monitor.
Rule categories (top 1): attempted-recon (3).
Sample rule descriptions for TCP port 161:
- PROTOCOL-SNMP public access tcp
- PROTOCOL-SNMP private access tcp
- PROTOCOL-SNMP request tcp
Data Sources
This information is compiled from: IANA Service Name and Transport Protocol Port Number Registry, Emerging Threats Open Ruleset (BSD 2-Clause / GPLv2 per SID range), and Snort Community Rules (GPLv2).