ESXi SNMP have a port open other than UDP/161

Products

• VMware vSphere ESXi

Issue/Introduction

This article provides information about the SNMP port open other than UDP/161.

Symptoms:

 

• While Listing Ports, you can see ports other than UDP/161 open:

From ESXi shell:

$ lsof | grep snmpd | grep SOCKET
ipv6:
1061300snmpd SOCKET_INET 5 :: :161
1061300snmpd SOCKET_INET 8 :: :0 < not assigned

ipv4:
1061300 snmpd SOCKET_INET 6 0.0.0.0 :161
1061300 snmpd SOCKET_INET 7 0.0.0.0 :29891 < dynamically assigned local port number
 

Note: 

• The port value :0 indicates an unassigned port, one that is disconnected.
• The port number is not fixed, snmpd will use this socket to connect to the set of trap destinations.
• The port does not receive any data.

• Where no IPv4 or IPv4 trap destination is not being sent to:

lsof | grep snmpd | grep SOCKET_INET

1061461 snmpd SOCKET_INET 5 :: :161
1061461 snmpd SOCKET_INET 6 0.0.0.0 :161
1061461 snmpd SOCKET_INET 8 0.0.0.0 :0
1061461 snmpd SOCKET_INET 9 :: :0

Note: IP Stack assigns a random port.

Environment

VMware vSphere ESXi 5.1
VMware vSphere ESXi 6.7
VMware vSphere ESXi 6.5
VMware vSphere ESXi 6.0

Cause

When snmpd is enabled it will allocate a socket to send on but not bind it to a specific source side port.

Resolution

This is an expected behavior and does not impact the functionality of using SNMP ports.