Common attacks and weaknesses
- Default communities (public, private) giving read or write access.
- Leaks of configurations, routing tables and sometimes passwords.
- DDoS amplification.
Port 161: SNMP
Network device monitoring and management (161 for queries, 162 for traps).
161
How SNMP works
Monitoring & loggingThe monitoring server collects metrics, alerts or logs from devices over port 161. It travels in clear text: anyone on the path can read it.
- Transport
- UDP · TCP
- Exposure risk
- 7/10 high if reachable from the Internet
- Encryption
- Clear textreadable on the network
- IANA status
- Assigned1 registered service
- Range
- Well-known (0-1023)
- Category
- Monitoring & logging
Is port 161 dangerous?
How to secure it
- Use SNMPv3 with authentication and encryption.
- Remove default communities.
- Restrict to the monitoring server's IP.
IANA registry entries for port 161
| Service | Port | Transport | Description | Reference | Updated |
|---|---|---|---|---|---|
| snmp | 161 | TCP, UDP | SNMP | - | - |
// source: IANA service name and port number registry
Which program uses port 161, and is it reachable?
Linux
sudo ss -ltnup 'sport = :161' # process listening on 161
sudo lsof -nP -i :161macOS
sudo lsof -nP -i :161
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 161 -State Listen | Select LocalAddress, OwningProcess Get-NetUDPEndpoint -LocalPort 161 netstat -ano | findstr :161
From another machine
nmap -p 161 -sV <host> sudo nmap -sU -p 161 <host> nc -zv <host> 161
Block it in the firewall
sudo ufw deny 161/tcp # Linux (ufw) New-NetFirewallRule -DisplayName "Block 161" -Direction Inbound -LocalPort 161 -Protocol TCP -Action Block # Windows
What is port 161 used for?
Network device monitoring and management (161 for queries, 162 for traps).
Is port 161 TCP or UDP?
Port 161 is registered for UDP and TCP. In practice the service mostly uses UDP.
Is it safe to open port 161?
It is rated 7/10 (high) when exposed to the Internet. Default communities (public, private) giving read or write access. Use SNMPv3 with authentication and encryption.
How do I check if port 161 is open?
On Linux run "ss -ltnup 'sport = :161'", on macOS "lsof -nP -i :161", and on Windows "netstat -ano | findstr :161" to see the local process. From another machine, "nmap -p 161 <host>" shows whether it is reachable.
Other monitoring & logging ports
:162 SNMP trap udp · tcp · moderate risk :9090 Prometheus / admin consoles tcp · udp · high risk :514 Syslog udp · tcp · moderate risk :6514 Syslog over TLS tcp · udp · dccp · low risk :5601 Kibana tcp · udp · high risk :391 SynOptics SNMP Relay Port tcp · udp :412 Trap Convention Port tcp · udp :561 tcp · udp