SNMP Ports: 161 & 162 (UDP) Explained

By the SNMP Monitoring team · Reviewed July 2026

What port does SNMP use? Classic SNMP uses UDP 161 on the agent for queries (Get, Set, walks) and UDP 162 on the manager side for traps and informs. Don't swap them. 161 is where the device listens; 162 is where your trap receiver listens.

That's the answer ticket systems want. The rest of this page is why firewall rules still get it wrong, what TLS/DTLS ports exist on paper, and how to change the listen port when you're not stuck on defaults. Parent: What is SNMP. Flow on the wire: how it works.

SNMP port table

Memorize the first two rows. The 10161/10162 pair shows up when someone enables secure transport stacks—not in every random snmpd default on a dusty VM.

Port 161: agent queries

This is the port people mean when they say "open SNMP." The agent binds here. Managers send PDUs at it. No long-lived TCP session in the normal case—UDP datagram in, hopefully a response out.

What hits 161:

• GetRequest / GetNext / GetBulk (reads)
• SetRequest (writes, if allowed)
• Your accidental full-table walk at 3 a.m.

Net-SNMP talks to 161 by default:

snmpget -v2c -c <RO_string> <host>:161 1.3.6.1.2.1.1.3.0

DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (44556600) 5 days, 3:46:06.00

You can omit :161; it's implied. Specifying it is useful when you're debugging non-default ports or writing runbooks for people who think SNMP is "just another TCP service."

If 161 is filtered toward the agent, you get timeouts—not a polite ICMP essay. Treat silence as "path or agent dead," not "metric is zero." More on the request path: how it works.

Port 162: traps and informs

162 is not on the managed server in the common design. It lives on the NMS / trap receiver. Agents send notifications to that address:port when something happens—link down, cold start, vendor event.

• Direction: agent → manager
• Port: UDP 162
• Model: push (see traps vs polling)

I've watched teams open 161 everywhere and forget 162 entirely, then wonder why traps never arrive. Or they open 162 on the agent host. Wrong side of the conversation.

Trap config is always two problems: (1) agent knows where to send, (2) receiver is listening and not dropping UDP. Firewalls in the middle love to "help."

TLS/DTLS variants (10161/10162) and TCP

Plain SNMP is UDP. That's what 99% of production still means.

Secure transport variants exist:

• TLS for SNMP — RFC 6353 territory; requests often associated with TCP 10161, notifications 10162
• DTLS — RFC 5953 era; UDP-based secure transport, same 10161/10162 style port pair in the secure model

You'll also hear that SNMP can ride TCP in some stacks. Uncommon in the field compared with classic UDP 161/162. Don't design your whole firewall matrix around TCP SNMP unless your vendor docs force it—and then still verify with a capture.

If someone says "we use port 10161 so we're safe," ask whether TLS/DTLS is actually configured end-to-end or they just opened a high port and left community strings in cleartext on 161 anyway. Port numbers aren't security theater that works by itself.

SNMP and firewalls

Rules people actually need:

Polling path

1. Allow UDP from poller source IPs → agent 161
2. Allow return traffic (stateful firewalls usually handle related UDP if they track it; some don't—test)
3. Deny 161 from the rest of the universe

Trap path

1. Allow UDP from agents → trap receiver 162
2. Don't require agents to accept inbound 162
3. Log drops for a week when you cut over—UDP fails quiet

Numbered checklist before you call it done:

1. Confirm agent ss/netstat shows listen on 161 (or custom).
2. snmpget from the real poller IP, not your laptop on VPN-A while prod is VPN-B.
3. Send a test trap if you rely on traps; watch the receiver, not just the agent log.
4. Document non-default ports in the same place as the community/v3 user.
5. Pair with host ACLs / agent allowlists—not only the edge firewall.

Longer how-to: firewall setup. Hardening mindset: security hardening.

Changing the SNMP port

Yes, you can move off 161/162. Agents and some managers support a non-default listen/send port. Reasons: obscure scanning a bit, share an IP with conflicting services, match a weird vendor default, or satisfy an external poller that allows custom ports.

Costs:

• Every poller and trap target must match
• Monitoring templates hard-code 161 more often than anyone admits
• "Is SNMP down?" now includes "did we document the port?"

Step-by-step on the agent side: change SNMP port. After you change it, re-run the snmpget with explicit host:port. If you forget, you'll debug the wrong failure for an hour.

External pollers that only speak classic SNMPv2c still expect some reachable UDP port—default or custom—with a community and allowlist. Don't open 161 to the whole internet because a SaaS needs a check; scope sources.

Field notes that save tickets

• Host firewall vs network firewall. Opening the path on the router but leaving firewalld/nftables drop on the box is the classic "works from localhost snmpget" trap.
• Anycast and load balancers. UDP SNMP behind LBs is a special hell; prefer direct to the agent IP for monitoring.
• IPv6. Same port numbers, different address family—don't assume "we opened 161" covered udp6.
• Containers. Port published on the host isn't always where snmpd listens inside the netns.
• Trap storms. After a power event, 162 can melt a receiver; rate-limit and buffer on the NMS side.

None of that changes the IANA defaults. It changes whether your diagram matches production.

When you document a service, write both numbers every time: "queries 161/udp, traps 162/udp." People remember one and invent the other.

Frequently asked questions

What port does SNMP use?

UDP 161 for agent queries; UDP 162 for traps/informs to the manager. Secure-transport deployments may use 10161/10162 (TLS/DTLS).

Is SNMP TCP or UDP?

Normally UDP. TCP and TLS/DTLS variants exist but are far less common than classic UDP 161/162.

What is port 162 used for?

Traps and informs—asynchronous notifications from the agent to a trap receiver on the manager side. Not for routine Get requests.

Can I change the SNMP port?

Yes, if agent and managers agree. See setup/port. Update firewalls and every poller config or you'll create a silent outage.

Key takeaways

• 161 = agent queries (manager → agent).
• 162 = traps/informs (agent → manager). Both usually UDP.
• 10161/10162 = secure-transport pairs (TLS/DTLS RFCs); not every network uses them.
• Firewalls: allow only needed sources; test with real poller IPs.
• Non-default ports: supported, easy to misconfigure—document them.
• Related: traps vs polling, firewall, glossary.