SNMP Community String Enumeration

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects attempts to enumerate SNMP community strings by looking for UDP traffic on port 161 containing the string "public" (case-insensitive). It uses a threshold of 10 occurrences within 30 seconds from the same source IP to identify potential scanning activity.