SNMP Firmware Version Enumeration

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects attempts to enumerate firmware versions using SNMP. It specifically looks for TCP traffic on port 161 (SNMP) containing the string "sysDescr" (case-insensitive). A threshold is applied to trigger an alert if 5 such events are observed from the same source IP within a 30-second window, indicating a potential network scan for device information.