Bill is a network administrator. He wants to eliminate unencrypted traffic inside his company's network. He decides to setup a SPAN port and capture all traffic to the datacenter. He immediately discovers unencrypted traffic in port UDP 161. what protocol is this port using and how can he secure that traffic?

The Internet Assigned Numbers Authority (IANA) officially assigns UDP port 161 for the Simple Network Management Protocol (SNMP). Early versions of SNMP (v1 and v2c) transmit data, including authentication credentials (community strings), in cleartext. This unencrypted traffic is what the administrator observed. To secure this traffic, the network must be migrated to SNMPv3. This version introduces a robust User-Based Security Model (USM) that provides message integrity, authentication, and encryption (confidentiality), addressing the critical vulnerabilities of its predecessors.

A: SNMP can carry sensitive device configuration, status, and network topology information, which is highly valuable to an attacker. C: UDP port 161 is not used for RPC (Remote Procedure Call). Disabling a critical network management protocol is not a viable solution. D: SNMPv2c, the most common implementation of SNMPv2, does not provide encryption; it still relies on cleartext community strings.

- IANA. (n.d.). Service Name and Transport Protocol Port Number Registry. Retrieved from https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml (Official assignment of port 161 to "snmp").

- Blumenthal, U., & Wijnen, B. (2002). RFC 3414: User-based Security Model (USM) for version 3 of the Simple Network Management Protocol (SNMPv3). The Internet Society. Section 1.1 describes the provision of data integrity, authentication, and encryption.

- Stallings, W. (2017). Cryptography and Network Security: Principles and Practice (7th ed.). Pearson. Chapter 21, "Network Management Security," details the security flaws in SNMPv1/v2 and the cryptographic improvements in SNMPv3.