Editing Simple Network Management Protocol (section)

=== Using SNMP to attack a network ===
Because SNMP is designed to allow administrators to monitor and configure network devices remotely it can also be used to penetrate a network. A significant number of software tools can scan the entire network using SNMP, therefore mistakes in the configuration of the read-write mode can make a network susceptible to attacks.<ref name="Mason">{{Cite book|title= Cisco Secure Internet Security Solutions|author1=Andrew G. Mason |author2=Mark J. Newcomb |publisher= Cisco Press|year=2001 |isbn= 9781587050169}}</ref>{{rp|52}}

In 2001, [[Cisco]] released information that indicated that, even in read-only mode, the SNMP implementation of [[Cisco IOS]] is vulnerable to certain [[denial of service]] attacks. These security issues can be fixed through an IOS upgrade.<ref>{{Cite book|title= Cisco Secure Internet Security Solutions|url= https://archive.org/details/ciscosecureinter00maso|url-access= limited|author1=Andrew G. Mason |author2=Mark J. Newcomb |publisher= Cisco Press|year=2001 |isbn= 9781587050169|pages=[https://archive.org/details/ciscosecureinter00maso/page/n51 52]}}</ref>

If SNMP is not used in a network it should be disabled in network devices. When configuring SNMP read-only mode, close attention should be paid to the configuration of the [[access control]] and from which IP addresses SNMP messages are accepted. If the SNMP servers are identified by their IP, SNMP is only allowed to respond to these IPs and SNMP messages from other IP addresses would be denied. However, [[IP address spoofing]] remains a security concern.<ref name="Mason"/>{{rp|54}}