Nmap UDP Scan: Identifying SNMP on Port 161
A security analyst runs `nmap -sU -p 161,162 10.0.0.1` and receives output showing port 161/udp is open. Which service is MOST likely running on this port?
Quick Answer
The answer is SNMP (Simple Network Management Protocol) because port 161/udp is its default listening port for receiving management queries like GET and SET requests from SNMP managers, as defined in RFC 1157. When you run an Nmap UDP scan with `-sU` targeting ports 161 and 162, an open result on 161/udp strongly indicates an SNMP agent is active, while port 162/udp is reserved for SNMP traps. On the Certified Ethical Hacker CEH exam, this question tests your ability to map common UDP ports to their services—a frequent topic in the scanning and enumeration domain. A common trap is confusing SNMP with other UDP services like DNS (port 53) or TFTP (port 69), so remember that SNMP is the only major service using port 161. For a quick memory tip: think "SNMP = Simple Network Management Protocol, and 161 is the one for management queries."
⚠ Common exam trap
Many candidates confuse SNMP's port 161 with SNMP trap port 162 or misattribute it to other UDP-based services like DHCP or TFTP, but the scan specifically targets 161, which is exclusively SNMP.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SNMP
Port 161/udp is the default port for SNMP (Simple Network Management Protocol) used by SNMP agents to receive management queries (GET, SET) from SNMP managers. The `-sU` flag performs a UDP scan, and the open result on 161/udp strongly indicates an SNMP service is listening, as defined in RFC 1157.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DHCP
Why it's wrong here
DHCP operates on UDP ports 67 and 68, so 161/udp being open does not indicate it. The option tempts because DHCP is a familiar UDP-based service discovered during network scans. SNMP is the service bound to 161/udp, with 162/udp handling trap messages, matching the nmap result.
- ✓
SNMP
Why this is correct
UDP port 161 is the standard SNMP agent port, with 162 reserved for SNMP traps. An open 161/udp therefore indicates an SNMP service listening, which the analyst can enumerate further for community strings and device information.
- ✗
TFTP
Why it's wrong here
TFTP listens on UDP port 69, so an open 161/udp cannot indicate it. The option tempts because TFTP is a UDP-based file transfer service, but its port assignment differs. SNMP is the service bound to 161/udp, with 162/udp carrying traps, matching the scan output exactly.
- ✗
DNS
Why it's wrong here
DNS uses UDP port 53 for standard queries, not 161, so the open port does not indicate it. It is tempting because DNS is a well-known UDP service and analysts associate UDP scans with it. SNMP is the service actually bound to 161/udp, with traps on 162/udp.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 913-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. During a security assessment, a tester uses `nmap -sU 192.168.1.1`. What type of scan does this command perform?
easy- ✓ A.UDP scan
- B.TCP SYN scan
- C.Ping sweep
- D.OS fingerprinting
Why A: The `-sU` flag in Nmap explicitly instructs the tool to perform a UDP scan. This sends UDP packets to the target ports and analyzes responses (or lack thereof) to determine if a UDP port is open, closed, or filtered. Unlike TCP, UDP is connectionless, so the scan relies on ICMP unreachable messages or lack of response to infer port status.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.