Port 161 (SNMP): Uses and Security

What uses port 161

Monitoring systems poll routers, switches, printers, UPSs and servers over SNMP on UDP 161 for metrics like interface traffic, CPU and temperature. Devices send unsolicited alerts (traps) to the manager on UDP 162. SNMP v1 and v2c authenticate with a plain-text community string, often left at the default public; use SNMPv3 with authentication and encryption.

Should port 161 be open to the internet?

Keep private. Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel.

Never expose SNMP to the internet. Devices with the default public community leak their whole configuration, and SNMP is used for DDoS amplification.

Check what is listening on port 161

Linux

sudo ss -lunp 'sport = :161'

macOS

sudo lsof -nP -iUDP:161

Windows (PowerShell)

Get-NetUDPEndpoint -LocalPort 161
netstat -ano | findstr :161

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Allow port 161 from trusted networks only

The examples allow 161 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.

Ubuntu / Debian (ufw)

sudo ufw allow from 10.0.0.0/8 to any port 161 proto udp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 161 proto udp

RHEL / Fedora / Rocky (firewalld)

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="161" protocol="udp" accept'
sudo firewall-cmd --reload

Windows (PowerShell, as administrator)

New-NetFirewallRule -DisplayName "SNMP 161/UDP" -Direction Inbound -Protocol UDP -LocalPort 161 -Action Allow -RemoteAddress 10.0.0.0/8

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Test port 161 from another machine

macOS / Linux

nc -zvu example.com 161   # UDP has no handshake, so "open" isn't conclusive

Related ports

Port 162 (SNMP traps): where SNMP managers receive traps (alerts) sent by devices.
Port 514 (Syslog): used by syslog for sending log messages to a central server.
Port 9100 (Node exporter / printing): used by Prometheus node_exporter and by raw network printing (JetDirect).

More monitoring and logging ports

4317 (OpenTelemetry (OTLP gRPC)) , 4318 (OpenTelemetry (OTLP HTTP)) , 5601 (Kibana) , 9090 (Prometheus) , 9093 (Alertmanager / Kafka controller) . See all ports in the port lookup.

Sources

IANA port registry: 161

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions

What is port 161 used for?

Port 161 is used by SNMP for monitoring and managing network devices. Monitoring systems poll routers, switches, printers, UPSs and servers over SNMP on UDP 161 for metrics like interface traffic, CPU and temperature. Devices send unsolicited alerts (traps) to the manager on UDP 162. SNMP v1 and v2c authenticate with a plain-text community string, often left at the default public; use SNMPv3 with authentication and encryption.

Is it safe to open port 161?

Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel. Allow it only from the networks that need it, as in the firewall examples on this page.

How do I check if port 161 is open?

On the server, list listening sockets with "sudo ss -lunp 'sport = :161'" on Linux or "sudo lsof -nP -i :161" on macOS. From another machine, UDP has no handshake, so a port scan can’t reliably tell whether it is open; test with a real client for the service instead.