Network Device Configuration Accessed via SNMP

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•4

This rule detects attempts to access network device configurations via SNMP (UDP port 161) by looking for the string "public" in the UDP payload. A threshold of 10 occurrences within 30 seconds from the same source IP is set to trigger an alert, indicating a potential network scan or reconnaissance activity targeting SNMP with a common community string.