DevToolsmith

Port 162: SNMP traps

Port 162 (UDP) is where SNMP managers receive traps (alerts) sent by devices. It is a well-known port (0–1023). On Linux and macOS, binding to it needs root or the CAP_NET_BIND_SERVICE capability.

Service
SNMP traps
Protocol
UDP
Range
Well-known (0–1023)
Official
IANA-registered
Exposure
Keep private
Category
Monitoring and logging

What uses port 162

Instead of waiting to be polled on port 161, devices can push events such as a link going down or a fan failing to the monitoring server’s UDP port 162. Open it on the monitoring server only, and only for your device networks.

Should port 162 be open to the internet?

Keep private. Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel.

Check what is listening on port 162

Linux
sudo ss -lunp 'sport = :162'
macOS
sudo lsof -nP -iUDP:162
Windows (PowerShell)
Get-NetUDPEndpoint -LocalPort 162
netstat -ano | findstr :162

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Allow port 162 from trusted networks only

The examples allow 162 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.

Ubuntu / Debian (ufw)
sudo ufw allow from 10.0.0.0/8 to any port 162 proto udp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 162 proto udp
RHEL / Fedora / Rocky (firewalld)
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="162" protocol="udp" accept'
sudo firewall-cmd --reload
Windows (PowerShell, as administrator)
New-NetFirewallRule -DisplayName "SNMP traps 162/UDP" -Direction Inbound -Protocol UDP -LocalPort 162 -Action Allow -RemoteAddress 10.0.0.0/8

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Test port 162 from another machine

macOS / Linux
nc -zvu example.com 162   # UDP has no handshake, so "open" isn't conclusive

Related ports

  • Port 161 (SNMP): used by SNMP for monitoring and managing network devices.
  • Port 514 (Syslog): used by syslog for sending log messages to a central server.

More monitoring and logging ports

4317 (OpenTelemetry (OTLP gRPC)) , 4318 (OpenTelemetry (OTLP HTTP)) , 5601 (Kibana) , 9090 (Prometheus) , 9093 (Alertmanager / Kafka controller) , 9100 (Node exporter / printing) . See all ports in the port lookup.

Sources

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions

What is port 162 used for?

Port 162 is where SNMP managers receive traps (alerts) sent by devices. Instead of waiting to be polled on port 161, devices can push events such as a link going down or a fan failing to the monitoring server’s UDP port 162. Open it on the monitoring server only, and only for your device networks.

Is it safe to open port 162?

Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel. Allow it only from the networks that need it, as in the firewall examples on this page.

How do I check if port 162 is open?

On the server, list listening sockets with "sudo ss -lunp 'sport = :162'" on Linux or "sudo lsof -nP -i :162" on macOS. From another machine, UDP has no handshake, so a port scan can’t reliably tell whether it is open; test with a real client for the service instead.