Port 10161: SNMP over TLS — The Encrypted Eye on Your Network

What This Port Belongs To

Port 10161 lives in the registered port range (1024-49151). This range exists so that any organization can claim a port number without needing IANA permission—just register it and it's yours. The downside: thousands of organizations have registered thousands of ports, and most of them exist in only a handful of installations worldwide.

Officially, IANA has not assigned port 10161 to any service. But unofficially, it has a very clear job.

What Actually Uses Port 10161

Port 10161 is SNMPv3 over TLS — Secure SNMP. ¹

SNMP is the Simple Network Management Protocol, the system that monitors every router, switch, server, and network device on the Internet. It's how network operators know when a link goes down, when CPU hits 95%, when a disk is full. Every major network device speaks SNMP. When you provision a new data center, the first thing you connect is SNMP monitoring.

Standard SNMP runs on UDP port 161 (and uses 162 for responses). It's been doing this since 1988. And for the first three decades, it did it in plaintext. Every SNMP credential, every system metric, every password could be read by anyone on the network. ²

Port 10161 is the answer: TLS-encrypted SNMP. When you need security for your network monitoring, you point your SNMP manager to port 10161 instead of 161. The protocol is identical. The data is encrypted. The network management traffic that was once readable to any attacker is now protected.

In practice, you'll see both. Most legacy installations still use port 161 and accept the plaintext risk. New installations or security-conscious organizations use 10161. They coexist.

How to Check What's Listening on Port 10161

On macOS or Linux:

# See if anything is listening
lsof -i :10161

# Check TCP and UDP
netstat -an | grep 10161

On Windows (PowerShell):

netstat -ano | findstr :10161
Get-NetTCPConnection -LocalPort 10161

If you find something listening, you'll likely see:

• An SNMP manager (Nagios, Prometheus, Zabbix, etc.)
• A network device offering secured SNMP (router, switch, appliance)

Why Unassigned Ports Matter

Port 10161 isn't officially assigned. But it exists because someone needed secured SNMP, and they had the authority to pick a port number and start using it. Over time, enough organizations did the same that it became de facto standard.

This is how the port system actually works: IANA assigns the famous ports (22 for SSH, 80 for HTTP, 443 for HTTPS). But the vast middle of the port spectrum—thousands of numbers—are claimed organically by organizations that need them. They register with IANA to prevent conflicts, then thousands of companies build tools that use those exact ports.

Most of those tools are internal, proprietary, or specialized. You'll never see them. But port 10161 is different: it's the secure version of a protocol that's fundamental to how the Internet operates. Every piece of critical network infrastructure that someone cares enough to monitor securely is listening on this port, right now, reporting back about its health.

Port 10161 is SNMP finally growing up.

The Broader SNMP Port System

SNMP uses a pair of ports. Port 161 is for manager requests to agents. Port 162 is for agent traps (alerts sent back to the manager). ³

• 161/UDP — Standard SNMP requests (plaintext)
• 162/UDP — Standard SNMP traps/responses (plaintext)
• 10161/TCP or UDP — SNMP over TLS (encrypted requests)
• 10162/TCP or UDP — SNMP over TLS (encrypted traps)

You'll sometimes see port 10161 called "SNMP-TLS" or "Secure SNMP." It's all the same thing.

The Security Story

SNMP was created before the Internet got seriously paranoid about eavesdropping. The original versions (SNMPv1, SNMPv2) had no real security. SNMPv3, released in 1998, added authentication and encryption, but still works on port 161. The encryption is optional and many implementations skip it because why bother. ⁴

Port 10161 exists for the organizations that decided to bother. They said: we're going to run SNMP, we're going to encrypt it, and we're not going to use the standard port because the standard port implies plaintext and we want to be very clear that ours is not.

It's a small protest against a legacy protocol that refuses to die.