Simple Network Management Protocol (SNMP) is a widely used network monitoring and management protocol.
It allows you to keep track of the status and performance of the devices on your network, like routers, switches, servers, and printers. A key component of SNMP are the ports used for communication between the SNMP manager (the monitoring system) and SNMP agents (software on the monitored devices).
In this guide, we’ll explore what exactly an SNMP port is, how the main SNMP ports work, best practices for using them, and how to troubleshoot issues.
What is an SNMP port?
An SNMP port acts as an endpoint for sending and receiving SNMP messages.
As you monitor your network devices with SNMP, the management software (SNMP manager) and the monitored devices (SNMP agents) need to communicate constantly. They exchange data requests, device responses, configuration commands, and critical alerts by transmitting messages between specific ports that are listening for this SNMP information.
SNMP relies on the UDP transport protocol for communication between managers and agents. Unlike TCP which guarantees delivery through acknowledgements, UDP prioritizes speed over reliability.
This makes UDP much faster and better suited for SNMP’s needs.
Common SNMP ports explained
There are two core SNMP UDP ports that are used in almost every implementation for communication between your SNMP managers and agents.
1. Port 161
This is the main port your SNMP manager uses to send GET requests to agents when it needs to retrieve performance data like CPU usage, bandwidth utilization, open file handles, or other metrics.
The agent receives the GET request packet from your manager via UDP port 161. The agent then processes the request, gathers the required data, and sends the response message with the data back to your manager via the same port 161 that it received the initial request on.
2. Port 162
This port enables your SNMP agents to automatically alert your central SNMP manager when an important event occurs, like an interface failure or high memory usage exceeding predefined thresholds.
To do this, your SNMP agent sends an unsolicited notification alert called an SNMP TRAP from any random UDP source port on the local device, to the UDP port 162 on your SNMP manager server. This allows your manager to receive alerts about issues instantly without needing to poll every agent individually.
Beyond these two, there are also a few additional less common ports that you may encounter:
3. Port 10161
This non-standard alternative SNMP manager request port can be used instead of the standard UDP port 161 when you need extra security on your network.
Using port 10161 for requests works exactly the same as described above for port 161 otherwise.
4. Port 10162
Similarly, this is a non-standard alternative SNMP trap receiver port that you can substitute for the standard UDP port 162 when enhanced security is required.
It functions identically to port 162 for your manager to receive alerts from agents.
SNMP versions and port usage
Having visibility into the different SNMP versions active on your network is critical when it comes to understanding port usage. The three main iterations of the SNMP protocol are versions 1, 2, and 3.
All three SNMP versions communicate over the standard SNMP UDP ports 161 and 162 by default. But they have some key differences you should be aware of:
SNMPv1
This initial version is very bare-bones in terms of functionality.
Communication between manager and agent is plaintext, offering next to no security. SNMPv1 also can only handle 32-bit counter values before rolling over. But it’s universally supported across platforms.
SNMPv2
This release brought some major improvements: 64-bit counters, more robust protocol operations, and better error handling. It came in two flavors: SNMPv2c that is community-based and SNMPv2u that is user-based, with the former being more widely used.
Unfortunately, SNMPv2 failed to address the lack of security for messages, retaining the same vulnerabilities present in v1.
SNMPv3
The most recent SNMP version brings monumental security upgrades through the optional implementation of encryption and authentication.
This protects the contents of messages and verifies the identities of managers and agents communicating. SNMPv3 represents a quantum leap over previous versions when it comes to securing your monitoring data and infrastructure.
The only drawback when comparing SNMPv3 vs SNMPv2 and SNMPv1 is slightly increased resource usage due to the added encryption processing.
Backward compatibility
Importantly, all three SNMP versions are interoperable on the same network.
Your SNMP manager will seamlessly communicate with a mix of v1, v2, and v3 agents installed on devices using the standard 161 and 162 UDP ports by default.
How SNMP ports work in network monitoring
SNMP communication relies on the manager software sending requests to agents, and agents sending back responses and alerts.
This happens using standard ports 161 and 162. Let’s break down how the typical flow works:
1. Monitoring starts with a request
The SNMP manager software sends out a request to the agents it needs data from.
These requests are called “GET” requests. A GET request is how the manager asks the agent “please GET me this data”. The manager sends the GET request from any random TCP or UDP source port on its end, over to the agent’s UDP port 161.
So the destination for requests is always the agent’s port 161.
2. Agent receives request on port 161
The agent has port 161 open and listening for incoming SNMP traffic.
When it receives the GET request on this port from the manager, it knows it needs to gather some data to respond back. Port 161 is like the “front door” for SNMP agents. All incoming requests come through this port.
3. Agent gathers requested data
The agent will now go gather whatever data the GET request asked for.
This could be something like current CPU usage, amount of free disk space, number of packets sent/received, or any number of metrics. If the data requested is not something the agent can access or does not understand, it will simply respond saying so.
4. Agent sends response from port 161
Once the SNMP agent gathers the requested data or determines it does not have access to what’s being asked for, it sends the response data or error message back to the source port on the manager.
So just like requests come in through port 161, responses also go back out the same “front door” using UDP over port 161.
5. Agent can also send alerts from port 162
In addition to just responding to requests, SNMP agents can also send out asynchronous “TRAP” alert messages.
These act like interrupts to notify the manager when something important happens, like an error or failure state. TRAP alerts are sent to port 162 on the SNMP manager software, with port 162 acting as the destination for these one-way asynchronous notifications.
Best practices for SNMP ports
When it comes to securely configuring SNMP, there are several key best practices you should follow related to encryption, port access, authentication, and monitoring.
Use SNMPv3 encryption
If your devices support the latest SNMPv3 standard, leverage its built-in encryption and authentication to protect the privacy and integrity of SNMP communications.
This more secure protocol obscures the data exchanged between manager and agent, shielding it from potential attacks targeting the well-known default SNMP ports. Taking advantage of SNMPv3 hardens your monitoring system without needing to manually reconfigure ports.
Disable unused SNMP ports
Make sure to disable any SNMP ports that are not actively being used for monitoring on your devices.
There is no benefit in keeping them open when not needed. Having unused ports needlessly exposes potential security vulnerabilities.
Restrict access with firewall rules
Set up dedicated firewall rules that specifically block external access from the internet to your internal SNMP ports 161, 162, 10161, and 10162 across all your devices.
Only allow access to the SNMP ports within your private management network to prevent unauthorized snooping of SNMP traffic.
Use complex community strings
The SNMP community strings used for basic authentication between managers and agents should be complex and obscure.
Avoid default or easily guessable passwords. Follow best practices for string generation like sufficient length (at least 12 characters), combination of upper/lower case letters, numbers and symbols, no dictionary words, etc.
Enable SNMP traps
Make use of SNMP traps for the transmission of SNMP notification messages between your devices for events, errors, and so on.
SNMP traps provide instant, unsolicited alerts regarding critical issues so you don’t have to wait for the next polling cycle, significantly reducing MTTR (mean time to resolution). And with SNMPv3, traps benefit from built-in security features, such as data integrity checks and encryption, which makes them more reliable and secure.
Monitor critical SNMP infrastructure
Proactively monitor the vital SNMP infrastructure including ports 161, 162, 10161, and 10162 to detect issues early.
Use an automated monitoring tool that gives you diagnostics and alerts for problems related to the SNMP endpoints. Quickly catch blocked ports, authentication failures, timeouts, and conflicts.
Follow least privilege principles
When configuring SNMP access between managers and agents, grant only the minimum necessary privileges to perform the required monitoring tasks.
Limit read-only rights to non-sensitive data. Restrict user privileges and access controls to reduce the impact of a compromised credential or device.
Test security updates in staging
Before deploying SNMP security updates and patches on production environments, thoroughly test them on internal staging environments first.
Check for compatibility issues, failures, performance limitations, or functionality gaps caused by issues such as new firewall rules and community strings to avoid disruptions.
Common issues with SNMP ports
Here are some common issues that can occur with SNMP ports and how to identify and resolve them:
Blocked ports
If SNMP traffic is not passing between managers and agents, ports 161 and 162 could be blocked by your firewall or ACLs.
Check your network security rules to ensure UDP access is allowed to these ports for devices that need to communicate over SNMP. If external access is not needed, only allow access for internal IP address ranges.
Authentication errors
Mismatched SNMP community strings on managers and agents can lead to authentication issues that prevent communication.
An SNMP community string provides devices access to an agent’s data. Verify the same community string (e.g. “public”) is configured on the monitoring tools and monitored devices. Also, check for spelling errors.
Timeout errors
SNMP communications rely on timely responses from agents when managers send requests, as well as managers receiving trap messages quickly.
High network latency and congestion can disrupt this. Optimize network infrastructure to reduce bottlenecks and lag. For remote sites, use WAN acceleration and QoS prioritization for SNMP traffic.
Port conflicts
Since SNMP uses standard ports 161 and 162, conflicts can occur if other applications bind to these ports.
For example, older VPN clients are known to mistakenly use them. To resolve the issue, check for non-SNMP processes associated with the ports, identify the conflicting application, and reconfigure it or SNMP to use distinct non-overlapping ports instead.
For SNMP specifically, you can often specify different custom ports on both the agents and managers.
Permission issues
Incorrect or missing ACLs and views can prevent the SNMP manager from accessing port 161 on agents or seeing available OIDs.
Ensure access controls are set properly to allow read/write of MIB objects. Limit access only to authorized monitoring systems.
Overloaded agents
Excessive polling from managers can overwhelm SNMP agents and cause delayed or missing responses.
Tune your monitoring solution configurations to optimize polling intervals, timeout thresholds, retries, and so on. Upgrade underpowered agents that can’t handle the request volume.
Packet loss
High amounts of packet loss between managers and agents can lead to missing data and alerts.
This could indicate underlying network reliability issues or interface errors. Inspect interfaces on SNMP devices using packet sniffing and performance monitoring to identify the root cause.
Encryption mismatch
When using SNMPv3 with encryption for added security, communication failures can occur if encryption protocols or ciphers don’t match on both ends.
Verify that SNMPv3 privacy protocols, such as DES and AES, match between managers and agents.
SNMP port monitoring tools
There are many useful tools available to specifically help you monitor your critical SNMP infrastructure including ports. Here we’ll introduce some popular options:
Auvik
A cloud-based network management solution that offers automated network mapping and modeling to visualize connections between devices.
Auvik can automatically discover devices and map network topology. It provides real-time visibility into device connections and relationships.
Paessler PRTG
An all-in-one network monitoring solution with dedicated SNMP sensors to monitor port usage metrics and bandwidth.
PRTG includes customized SNMP sensors to track bandwidth usage, latency, errors, and discards across critical ports. It offers threshold-based alerts when usage limits are exceeded.
SolarWinds NPM
A network performance monitor that lets you track port status, utilization, errors, discards, and more.
SolarWinds NPM continuously polls SNMP devices to log granular port metrics across routers, switches, and servers. It includes visual dashboards and reporting tools.
Datadog
A monitoring platform that enables visual correlation between SNMP port metrics and overall network health.
Datadog integrates SNMP data with metrics from servers, databases, and applications for unified visibility. It allows customized SNMP polling intervals based on device criticality.
Nagios
An open-source network monitoring solution with customizable SNMP plugins for granular port monitoring.
Nagios offers 500+ third-party plugins to capture SNMP metrics from network ports and interfaces. It allows syslog and email alerting based on usage thresholds.
LogicMonitor
A cloud-based network monitoring platform that centralizes and correlates SNMP port data for faster troubleshooting.
LogicMonitor auto-discovers devices and starts collecting SNMP performance metrics out-of-the-box. It includes alerting, reporting, and NOC dashboards.
ManageEngine OpManager
A unified network monitoring system that leverages SNMP traps and alerts to pinpoint port-related issues.
OpManager continuously polls switch ports using SNMP to log traffic stats and detect bottlenecks. It can monitor 10,000 ports per server out of the box.
Checkmk
A flexible and automated IT infrastructure monitoring tool with out-of-the-box SNMP port checks.
Checkmk offers automated discovery of SNMP devices and mapping of network topology. It includes 150+ preconfigured checks for switch ports.
Progress WhatsUp Gold
A network monitoring software solution that combines SNMP polling and traps to optimize port monitoring.
WhatsUp Gold monitors router and switch port traffic, errors, discards, and latency in real-time. It can poll ports as often as every 30 seconds.
Kaseya VSA
An all-in-one IT management platform with integrated SNMP monitoring for tracking network port performance.
Kaseya VSA auto-discovers SNMP devices and starts collecting availability and capacity metrics across critical ports. It includes alerting based on customizable thresholds.
SNMP port FAQs
What does an SNMP do?
SNMP, or Simple Network Management Protocol, allows automated monitoring and management of network-connected devices like routers, switches, and servers. It works by allowing software to communicate with agent software on devices to collect status and performance data.
What are SNMP ports used for?
The main SNMP ports 161 and 162 are used to facilitate communication between network monitoring or management software systems and SNMP agents running on managed devices on the network being monitored.
What port number is used by SNMP?
SNMP typically relies on User Datagram Protocol (UDP) port 161 for managers to send requests to agents and UDP port 162 for agents to send asynchronous notifications called traps back to managers.
What port does SNMP use to receive traps?
Network management stations receive unsolicited notification messages called traps from monitored devices with SNMP agents using UDP port 162 by default to alert them about events and issues.
Is SNMP port 161 TCP or UDP?
While SNMP can leverage either TCP or UDP as its transport protocol, most SNMP implementations choose to use UDP for communications over port 161 due to its lower overhead compared to TCP.
Is SNMP the same as SMTP?
No, SNMP and SMTP are two completely different protocols used for different purposes – SNMP for network monitoring and management and SMTP for transferring email messages between servers.
Is SNMP a security risk?
Older versions of SNMP like v1 and v2 do have vulnerabilities, however the most recent SNMPv3 adds support for advanced security mechanisms like encryption, authentication, and access control to improve security.
