Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is it possible to identify an SNMP packet from just the IP header?

share|improve this question

2 Answers 2

up vote 3 down vote accepted

Only indirectly, unreliable and in one direction, via the ports used (the manager sends traffic to UDP port 161, receives traps at 162), and of course that's already in the UDP header, not the IP one.

share|improve this answer

Since the L4 header isn't generally considered part of the L3 header, technically the answer is no since the IP header only carries the protocol type (SNMP is carried over UDP, with the exception of SNMPv3 which uses TCP)

Thus, you would need to look at the UDP/TCP ports to infer that SNMP was being used, but of course, that's not a guarantee that the traffic is genuinely SNMP.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.