PORTv1/v2c unencryptedIANA assigned
Ports 161 and 162SNMP
Port 161 is the UDP port on which SNMP agents (routers, switches, printers, servers) answer monitoring queries. Port 162 is where management systems receive unsolicited traps and informs. SNMPv1 and v2c use plaintext community strings; SNMPv3 adds authentication and encryption and should be used wherever supported.
What ports 161 and 162 are used for
SNMP lets a monitoring system read (and sometimes write) values on network devices: interface counters, CPU load, temperature, printer toner, UPS battery level. Two flows use two ports:
| Port | Direction | Purpose |
|---|---|---|
| UDP 161 | Manager → device | GET, GETNEXT, GETBULK, SET requests; the device replies from 161 |
| UDP 162 | Device → manager | Traps and informs the device sends when something happens (link down, high temperature) |
Versions
- SNMPv1 / v2c — authentication by community string in plain text. Widely deployed, easy, insecure.
- SNMPv3 — per-user authentication (HMAC) and optional encryption (AES). The only version appropriate outside an isolated management network.
Security considerations
- Default community strings expose device configuration. With
public, an attacker can map the network; withprivate, they can change it. Change both or disable v1/v2c. - SNMP on the internet is a finding. Devices answering on 161 from public addresses are routinely enumerated. Bind the agent to the management interface and firewall it.
- Amplification. GETBULK responses are much larger than requests, making open agents useful to attackers for reflected floods.
- Read-only where possible. Monitoring rarely needs write access; give it a read-only user or community.
Checking SNMP
A Windows host with the SNMP Service installed listens on UDP 161:
netstat -ano -p udp | findstr :161To query a device you need an SNMP client such as snmpwalk (Net-SNMP, available for Windows) or a monitoring tool's test function; there is no built-in Windows SNMP query command.
Firewall considerations
Allow inbound UDP 161 on devices only from the monitoring servers' addresses. Allow inbound UDP 162 only on the monitoring server. Block both at the internet edge.
On Windows, inbound rules live in Windows Defender Firewall with Advanced Security (wf.msc). A rule allowing port 161 only takes effect on the profile (Domain, Private, Public) it is assigned to. The command-line equivalent is netsh advfirewall firewall add rule; see the netsh record.
Frequently asked questions
What is a community string?
The password used by SNMPv1 and v2c, sent in clear text with every packet. The defaults public (read) and private (write) are still found on many devices and should always be changed or, better, replaced by SNMPv3 users.
Is SNMP still relevant?
Yes. Almost every switch, router, firewall, printer and UPS exposes counters over SNMP, and tools such as PRTG, Zabbix, LibreNMS and SolarWinds poll port 161 to graph them.
Does Windows have an SNMP agent?
Windows 10/11 and Server include an SNMP Service as an optional feature. Microsoft deprecated it in favour of CIM/WMI, but it still installs and listens on 161 when enabled.