Management & monitoringUDP 161, 162 Cleartext by default
Port 161, 162: SNMP
Simple Network Management Protocol
Monitors and configures network devices. Agents listen on 161; traps go to managers on 162.
Secure alternative: SNMPv3
How attackers abuse it
- Default community strings such as 'public' and 'private' (v1/v2c) exposing or changing configuration.
- Community strings sent in clear text.
- Reflection and amplification DDoS.
How to defend it
- Use SNMPv3 with authentication and encryption (authPriv).
- Restrict SNMP to management networks; change defaults.
Exam tip
SNMPv3 is the only version with real authentication and encryption.