Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to identify an SNMP packet from just the IP header?

share|improve this question
up vote 3 down vote accepted

Only indirectly, unreliable and in one direction, via the ports used (the manager sends traffic to UDP port 161, receives traps at 162), and of course that's already in the UDP header, not the IP one.

share|improve this answer

Since the L4 header isn't generally considered part of the L3 header, technically the answer is no since the IP header only carries the protocol type (SNMP is carried over UDP, with the exception of SNMPv3 which uses TCP)

Thus, you would need to look at the UDP/TCP ports to infer that SNMP was being used, but of course, that's not a guarantee that the traffic is genuinely SNMP.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.