A security analyst is reviewing network traffic captured during an incident response. The analyst observes a large number of UDP packets originating from an internal host, destined for various external IP addresses, all on port 161. The payload of these packets appears to be standard SNMP GetRequest messages. What is the most likely malicious activity occurring?
- ADistributed Denial of Service (DDoS) attack
- BDNS exfiltration attempt
- CLegitimate network management activity
- DNetwork reconnaissance (SNMP scanning)
Show answer & explanationAnswer & explanation
Correct answer: D. Network reconnaissance (SNMP scanning)
Port 161 is the standard port for SNMP (Simple Network Management Protocol) agents. A 'large number of UDP packets' originating from an internal host to 'various external IP addresses' with 'SNMP GetRequest messages' indicates an internal host is actively scanning external networks for SNMP-enabled devices. This is a common network reconnaissance technique, often a precursor to exploiting SNMP vulnerabilities or gathering information about remote systems.
Why the other options are wrong
- A. DDoS involves overwhelming a target with traffic; while it could use UDP, SNMP GetRequest messages are not typically used in this manner by an internal host towards external targets for a DDoS attack.
- B. DNS exfiltration uses port 53 and embeds data in DNS queries, not SNMP on port 161.
- C. Legitimate network management typically involves an NMS (Network Management System) polling internal devices, not an internal host scanning various *external* IP addresses with GetRequest messages.
SNMP Reconnaissance
The process of using Simple Network Management Protocol (SNMP) queries (often GetRequest messages) to discover devices, enumerate their configurations, and gather network information, often as a precursor to further attacks.
- Targets UDP port 161.
- Aims to extract sensitive information (e.g., system details, running services, network topology).
- Often involves trying default or common community strings.
Memory trick: Like a detective gathering clues before the main event.