SNMP Bulk Walk Enumeration

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects SNMP Bulk Walk Enumeration attempts. It triggers when UDP traffic on port 161 (SNMP) contains the case-insensitive string "private" and exceeds a threshold of 10 occurrences from the same source IP within 30 seconds. This activity is indicative of an adversary performing reconnaissance to gather information about network devices.