-1

I noticed some wierd behavior in our firewall logs: a computer in our subnet 192.168.1.0/24 sending UDP packets in port 161 to an IP in subnet 192.168.20.0 (we don't have a subnet like that), and the packets going through the LAN to WAN policy. I have installed Sysmon in the computer that is creating this connection, but I don't know what to look for in it. Does anybody in here have an idea of what is going on? I'm sorry if I'm not giving enough info. I don't want to mess up giving too much details.

  • 2
    Welcome to the site! You will probably need to provide much more information about the system and ensure the question specifically relates to information security, otherwise it may be off topic. – multithr3at3d Jul 20 '19 at 20:06
3

Not giving much details means that you get a global answer.

161 is SNMP. Not traps, SNMP. Anything doing an unexpected SNMP should be subject of investigation. The process may be called something with snmp in the name. If you (or the owner) do not know why this system uses SNMP, you should disconnect it from the network and run a full up-to-date virusscan on it.

I don't know your network set-up, but if your network is 192.168.1.0/24, anything outside that subnet will go to the gateway, which is probably your firewall. Therefore your firewall will see it.

Not the answer you're looking for? Browse other questions tagged or ask your own question.