SNMP Exposure Check
SNMP is the management protocol that exposes a device's entire inventory — interfaces, ARP and route tables, running processes, serial numbers. When it's reachable from the internet with the default community string, all of that is readable with no real authentication, and the port can double as a DDoS amplification source. Enter a host or IP and this check probes UDP/161 read-only: it tests the default 'public' community, detects clear-text v1/v2c, confirms whether the agent is exposed outside the management network, and measures amplification — then tells you to move to SNMPv3.
Reviewed by the SysGlass team · Updated July 21, 2026
What it checks
- Default community — whether the agent answers the well-known 'public' community, exposing the full device tree with no real authentication (SVC_SNMP_DEFAULT_COMMUNITY)
- Protocol version — whether it speaks SNMP v1/v2c, which send the community string and every value in clear text (SVC_SNMP_V2C)
- Exposure — whether an SNMP agent (including an SNMPv3 engine answering discovery) is reachable from outside the management network at all (SVC_SNMP_EXPOSED)
- Amplification — whether a small GetBulk yields a much larger response, making UDP/161 usable as a reflection/amplification DDoS source (SVC_SNMP_AMPLIFICATION, with the measured ratio)
- The detected SNMP agent product where it is disclosed
- The equivalent command — snmpget -v2c -c public -t 2 <host> 1.3.6.1.2.1.1.1.0
How to read the result
- OK — no agent: nothing answered on UDP/161, so the port is filtered or SNMP isn't running and there is no exposure to address.
- Fail — default community 'public': the device tree (interfaces, ARP/route tables, processes, serials) is readable with no real authentication; disable v1/v2c and move to SNMPv3 (authPriv) behind a source ACL.
- Warn — SNMP v1/v2c reachable: the community string and all values travel in clear text; restrict UDP/161 to the management network and switch to SNMPv3.
- Warn — exposed (SNMPv3 engine answered): the agent is reachable from outside the management network; lock it down with a firewall/ACL and require SNMPv3 authentication + privacy.
- Amplification note: when a GetBulk amplifies by roughly 2x or more, the summary says the port is usable as a UDP reflection/amplification source — another reason to firewall it off.
- The verdict follows the worst finding: a readable default community is the most serious because it leaks the device with effectively no credential.
Frequently asked questions
What's wrong with the 'public' community string?
'public' is the factory-default read community on countless devices. If an agent still answers it, anyone who can reach UDP/161 can walk the entire SNMP tree — interface lists, IP/ARP/route tables, running processes, hardware serials and more — without any real authentication. It is effectively an unauthenticated read of the device's inventory.
Why is SNMP v1/v2c considered insecure?
In SNMP v1 and v2c the 'community string' is the only credential and it, along with every queried value, is sent in clear text over UDP. Anyone on the path can capture it, and the source address is easily spoofed. SNMPv3 replaces this with real user authentication and encryption (the authPriv security level).
How do I secure SNMP?
Three steps: restrict UDP/161 to your management subnet with a firewall/ACL so it isn't reachable from untrusted networks; disable SNMP v1/v2c; and use SNMPv3 with the authPriv level (authentication + privacy/encryption). Change any default community strings in the meantime. After that, re-run this check to confirm the exposure is gone.
How can SNMP be used in a DDoS attack?
A single small GetBulk request can return a much larger response. An attacker spoofs a victim's IP as the request source, so the amplified replies flood the victim — a UDP reflection/amplification attack. This check measures that amplification ratio; the fix is the same as for exposure: keep UDP/161 off the public internet.
Does the check try to write to my device (SNMP SET)?
No. It is read-only: it issues standard read queries (such as a system description GET and a GetBulk) to detect exposure, the version, the default community and amplification. It never performs an SNMP SET and never changes any configuration on the device.
It says no agent answered — is SNMP definitely safe?
From this vantage point nothing replied on UDP/161, which is the desired state for an internet-facing host. Still confirm SNMP is locked to the management network from every untrusted path, and that internal agents use SNMPv3 rather than v2c, since SNMP exposure inside a flat network is still a risk.