When managing network devices, understanding SNMP default ports for TCP versus UDP is essential for monitoring and security. Many teams rely on SNMP to collect metrics, yet the default transport settings are sometimes misunderstood, leading to blocked polls or traps.
This overview clarifies how SNMP ports work, contrasts TCP and UDP usage, and highlights best practices to keep your infrastructure observable and resilient.
| Transport | Default Port | Direction | Use Case | Firewall Recommendation |
|---|---|---|---|---|
| UDP | 161 | Agent to Manager / Manager to Agent | Standard polling and traps with minimal overhead | Allow inbound/outbound 161 where monitoring is required |
| TCP | 161 | Manager to Agent (less common) | Bulk walks or environments requiring reliable delivery | Allow 161 only if legacy polling tools demand TCP |
| UDP | 162 | Agent to Manager | SNMP traps and inform responses | Permit 162 for trap ingestion and alerting pipelines |
| TCP | 162 | Rarely used | Not standard; may appear in custom integrations | Inspect unexpected TCP 162 traffic for misconfiguration |
SNMP Default Ports and Protocol Behavior
By default, SNMP uses UDP for both requests and notifications because lightweight delivery is preferred over reliable transport. The standard read community string polls target the agent on UDP 161, while traps and informs are sent to the manager on UDP 162.
Because connection setup is not required, UDP reduces latency and CPU load on devices, which is crucial for high-frequency polling and resource-constrained hardware. TCP is not part of the classic SNMP specification, yet some implementations allow it for specific scenarios where packet loss must be mitigated.
SNMP UDP 161 for Polling and Queries
UDP 161 is the primary channel for manager-initiated polling and agent responses. Simple Network Management Protocol operations such as GET, GETNEXT, and GETBULK traverse this port, enabling rapid collection of interface counters, system descriptions, and configuration data.
Network teams should verify that inbound and outbound UDP 161 is allowed between monitoring stations and managed devices. In secured environments, using read-only community strings and source binding helps reduce the risk of unauthorized configuration queries.
SNMP UDP 162 for Traps and Inform Delivery
SNMP traps and informs are delivered to the manager on UDP 162, providing event-driven visibility into link failures, authentication errors, and threshold breaches. Because these messages are sent asynchronously, they bypass the request-response cycle and arrive as soon as an event is detected.
Unlike polling, traps do not require manager queries, yet firewalls often block unsolicited inbound 162 traffic. Placing collectors near edge firewalls and allowing explicit UDP 162 paths ensures that critical alerts are ingested without delay.
When TCP May Be Used with SNMP Services
Although TCP is not a traditional SNMP transport, some modern platforms and proxy gateways accept connections on TCP 161 to accommodate environments where UDP is restricted. This approach can help traverse network address translation or strict egress filtering, at the cost of added connection overhead.
Before enabling TCP 161 for SNMP, evaluate the trade-offs between reliability and performance. Reserve TCP for specialized integrations or legacy tools that explicitly require it, and monitor for unexpected traffic on TCP 162, which is not part of standard behavior.
Key Recommendations for SNMP Port Management
- Prioritize UDP 161 for polling and UDP 162 for traps to align with protocol defaults.
- Restrict SNMP traffic to trusted networks and use SNMPv3 with encryption where possible.
- Document allowed ports and directions in your firewall policy to simplify troubleshooting.
- Monitor and log dropped packets on UDP 161 and 162 to detect filtering or device issues early.
- Use TCP only when necessary for legacy tools, and validate performance impact before wide deployment.
FAQ
Reader questions
Should I open UDP 161, TCP 161, or both on my firewall for SNMP polling?
Open UDP 161 between your manager and devices for standard polling, and allow TCP 161 only if a specific tool mandates it; most modern polling solutions perform reliably over UDP alone.
Is it safe to allow inbound UDP 162 from the internet to my monitoring server?
Permit inbound UDP 162 only from trusted sources and use community string protections or SNMPv3 authentication to prevent unauthorized trap injection or amplification attacks.
What should I do if traps are not arriving on UDP 162 despite correct configuration?
Verify that intermediate firewalls permit outbound and inbound UDP 162, confirm the manager address and port in the agent configuration, and inspect local ACLs that might silently drop the traffic.
Can SNMP work over TCP 162 for guaranteed delivery of traps and informs?
TCP 162 is not defined in standard SNMP specifications; reliable delivery for traps is typically achieved via informs over UDP, retry logic, or application-layer proxies rather than native TCP transport.