Common attacks and weaknesses
- Spoofed traps polluting monitoring.
- Information disclosure with SNMPv1/v2c.
Port 162: SNMP trap
Receives SNMP traps (alerts) sent by devices.
162
How SNMP trap works
Monitoring & loggingThe monitoring server collects metrics, alerts or logs from devices over port 162. It travels in clear text: anyone on the path can read it.
- Transport
- UDP · TCP
- Exposure risk
- 4/10 moderate if reachable from the Internet
- Encryption
- Clear textreadable on the network
- IANA status
- Assigned1 registered service
- Range
- Well-known (0-1023)
- Category
- Monitoring & logging
Is port 162 dangerous?
How to secure it
- Accept traps only from known devices.
- Use SNMPv3.
IANA registry entries for port 162
| Service | Port | Transport | Description | Reference | Updated |
|---|---|---|---|---|---|
| snmptrap | 162 | TCP, UDP | SNMPTRAP | - | - |
// source: IANA service name and port number registry
Which program uses port 162, and is it reachable?
Linux
sudo ss -ltnup 'sport = :162' # process listening on 162
sudo lsof -nP -i :162macOS
sudo lsof -nP -i :162
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 162 -State Listen | Select LocalAddress, OwningProcess Get-NetUDPEndpoint -LocalPort 162 netstat -ano | findstr :162
From another machine
nmap -p 162 -sV <host> sudo nmap -sU -p 162 <host> nc -zv <host> 162
Block it in the firewall
sudo ufw deny 162/tcp # Linux (ufw) New-NetFirewallRule -DisplayName "Block 162" -Direction Inbound -LocalPort 162 -Protocol TCP -Action Block # Windows
What is port 162 used for?
Receives SNMP traps (alerts) sent by devices.
Is port 162 TCP or UDP?
Port 162 is registered for UDP and TCP. In practice the service mostly uses UDP.
Is it safe to open port 162?
It is rated 4/10 (moderate) when exposed to the Internet. Spoofed traps polluting monitoring. Accept traps only from known devices.
How do I check if port 162 is open?
On Linux run "ss -ltnup 'sport = :162'", on macOS "lsof -nP -i :162", and on Windows "netstat -ano | findstr :162" to see the local process. From another machine, "nmap -p 162 <host>" shows whether it is reachable.
Other monitoring & logging ports
:161 SNMP udp · tcp · high risk :9090 Prometheus / admin consoles tcp · udp · high risk :514 Syslog udp · tcp · moderate risk :6514 Syslog over TLS tcp · udp · dccp · low risk :5601 Kibana tcp · udp · high risk :391 SynOptics SNMP Relay Port tcp · udp :412 Trap Convention Port tcp · udp :561 tcp · udp