SNMP Bulk Get for MIB Configuration Data

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•4

This rule detects Simple Network Management Protocol (SNMP) Bulk Get requests targeting port 161 on the home network, specifically looking for a content byte pattern indicative of MIB (Management Information Base) configuration data. It uses a threshold of 20 such requests within 30 seconds from the same source IP to trigger an alert, suggesting a network scan or reconnaissance activity.