SNMP

SNMP: Protocol for querying and configuring network and infrastructure devices over UDP. For internal network enumerationEnumerationIdentifies users, services, shares, or other resources of a target system. it is one of the richest and simultaneously most overlooked sources.

How it works and where it fits

SNMP runs on UDP port 161 and organises device information in a tree of object identifiers. Queries can retrieve system description, interfaces, routing tables, ARP entries, running processes, and — depending on extensions — even command output. In versions 1 and 2c, access control rests solely on a cleartext community string; defaults such as public and private remain widespread. Only SNMPv3 adds authentication and encryption.

Practical security relevance

Because SNMP runs over UDP, it is entirely absent from TCP-only scans, which is exactly why it has a reputation as a blind spot. For attackers, read access yields a precise network map and write access the ability to reconfigure. Hardening means using SNMPv3 with authentication and encryption, removing default communities, restricting access to management networks, and keeping write access only where genuinely required.

Related concepts

• EnumerationEnumerationIdentifies users, services, shares, or other resources of a target system.: Identifies users, services, shares, or other resources of a target system.
• Network AccessNetwork AccessThe ability of a user, device, or workload to connect to and use network resources.: The ability of a user, device, or workload to connect to and use network resources.
• MonitoringMonitoringThe continuous observation of systems, identities, networks, and controls for relevant changes.: The continuous observation of systems, identities, networks, and controls for relevant changes.
• ReconnaissanceReconnaissanceCollection of information regarding targets, systems, individuals, and attack surfaces.: Collection of information regarding targets, systems, individuals, and attack surfaces.