SNMP Hardware MIB Enumeration Walk

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects an SNMP Hardware MIB Enumeration Walk. It triggers when a TCP connection to port 161 (SNMP) on the home network contains the byte sequence "30 82" at a depth of 2 bytes. A threshold is set to trigger an alert if 20 such events occur within 30 seconds from the same source IP address. This activity is classified as a network scan, specifically reconnaissance, as it involves querying SNMP for hardware information.