{
  "port": 161,
  "protocol": "udp",
  "service": "SNMP",
  "oneLiner": "SNMP agent — device monitoring queries, UDP 161.",
  "whatItIs": "Routers, switches, printers, UPSes, and servers running an SNMP agent (commonly Net-SNMP's snmpd) listen on UDP 161 and answer GET/GETNEXT requests from monitoring systems. Net-SNMP's default agentaddress is UDP 161 on all IPv4 interfaces. It appears on scans anywhere network monitoring exists, often still configured with SNMPv1/v2c community strings that travel in cleartext. Traps go outbound to port 162, not here.",
  "exposure": {
    "verdict": "never",
    "note": "v1/v2c community strings are cleartext and readable device inventory; keep 161 on a management network and use SNMPv3 with auth and privacy."
  },
  "checkCommand": "snmpwalk -v2c -c public TARGET system",
  "links": [
    {
      "title": "RFC 3411 — Architecture for SNMP Management Frameworks (STD 62)",
      "url": "https://datatracker.ietf.org/doc/html/rfc3411",
      "kind": "spec"
    },
    {
      "title": "Net-SNMP (GitHub)",
      "url": "https://github.com/net-snmp/net-snmp",
      "kind": "github"
    },
    {
      "title": "snmpd.conf manual page",
      "url": "https://www.net-snmp.org/docs/man/snmpd.conf.html",
      "kind": "official-docs"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    }
  ]
}