---
type: Security Guide
title: "SNMP Amplification DDoS: How It Works & How to Stop It"
description: "A defensive explainer on SNMP reflection/amplification DDoS — how it works conceptually, how to tell if your agent is exposed, and how to shut it down."
resource: "https://snmp-monitoring.info/security/amplification-ddos/"
tags: [security]
timestamp: 2026-07-11T00:00:00Z
---

# SNMP Amplification DDoS: How It Works & How to Stop It

A defensive explainer on SNMP reflection/amplification DDoS — how it works conceptually, how to tell if your agent is exposed, and how to shut it down.

## Related concepts

- Up: [SNMP Security: Risks, Hardening & Best Practices](/security/index.md)

## Frequently asked questions

### What is SNMP amplification DDoS?

It's a reflection attack that abuses exposed SNMP agents. An attacker sends small queries to your agents with the source address spoofed to a victim's IP; each agent replies to the victim with a larger response. Multiplied across many agents, this floods the victim with traffic that appears to come from your infrastructure — turning a monitoring protocol into a DDoS weapon.

### Why is SNMP used for DDoS?

Two reasons: it runs over UDP, which has no handshake and so allows source-address spoofing, and its responses can be much larger than the requests — especially with GetBulk against large MIB tables. That combination of spoofable transport and high amplification makes an exposed SNMP agent an efficient reflector for attackers.

### Is my SNMP agent a reflector?

If UDP 161 is reachable from the internet and the agent answers queries — particularly with a default or guessable community — then yes, it can be abused as a reflector. Agents restricted to your management network with a source-IP ACL, or running SNMPv3, are not usable this way. Check that 161 isn't publicly reachable on any host you run.

### How do I prevent SNMP amplification attacks?

Don't expose UDP 161 to the internet; scope it to your managers with a firewall ACL; prefer SNMPv3; disable SNMP on hosts that don't need it; rate-limit responses; and use an OID allowlist to shrink response size. Network operators should also apply BCP 38 egress filtering so spoofed source addresses can't leave their network.

## Source

Concept generated from https://snmp-monitoring.info/security/amplification-ddos/ — the SNMP Monitoring vendor-neutral knowledge base. Content is limited to what that page states (no external claims added here).