What Is the SNMP Port and How Does It Work?

What is SNMP

Simple Network Management Protocol (SNMP) is a standard protocol to monitor and manage devices on a network, such as routers, switches, servers, printers and firewalls. It lets a central system read the status of the devices and, in some cases, change their settings.

Key components

Network Management Station (NMS)

The manager. It:

• Sends requests to the agents to read or change values.
• Receives traps (alerts) from the agents, so it learns the state of the devices.

Agent

The program on the managed device. When it receives a request from the NMS, it does the job and sends a reply. When a fault or event happens on the device, it sends a trap to the NMS on its own.

Managed object

A single piece of data on a device that can be monitored, such as CPU use, interface traffic or uptime.

Management Information Base (MIB)

A database that describes the managed objects. Each object has a unique number called an OID (for example 1.3.6.1.2.1.1.1.0 for the system description). With the MIB the NMS can:

• Learn the current status of the device.
• Set the status of the device (where writing is allowed).

SNMP versions

SNMPv1

The first version. It is simple, but it uses a community string as a password in clear text. It is not secure.

SNMPv2c

Adds new operations and 64-bit counters for fast links, but still uses community strings in clear text.

SNMPv3

Adds real security: user authentication and encryption (privacy). Use SNMPv3 whenever your devices support it.

What is an SNMP port

SNMP uses UDP ports:

Secure versions over TLS or DTLS use ports 10161 and 10162.

How the SNMP port works

1. The manager sends a request (GET, GETNEXT, GETBULK or SET) to the agent's UDP port 161.
2. The agent looks up the value in its MIB and replies to the manager.
3. When something important happens, the agent sends a trap or inform message to the manager's UDP port 162.

Open the SNMP ports in the firewall

Only allow your monitoring server:

sudo ufw allow from 203.0.113.10 to any port 161 proto udp

Test an agent

snmpwalk -v2c -c community 192.168.1.1 system

Security tips

• Do not use the default community string public.
• Use SNMPv3 with authentication and encryption.
• Limit access by IP address.
• Do not open port 161 to the whole internet; attackers use it for amplification attacks and data theft.
• Make the community read-only unless you need to change settings.

Quick recap

• UDP 161 receives requests, UDP 162 receives traps.
• Use SNMPv3 and restrict access.