Port 199 – SMUX (SNMP Multiplexing Protocol)

Port 199 is the registered port for SMUX (SNMP Multiplexing Protocol), defined in RFC 1227. SMUX lets SNMP subagents connect to a master SNMP agent over TCP and register the parts of the MIB tree they want to serve — so when a manager polls those OIDs on SNMP port 161, the master agent hands the query off to the right subagent. It’s the older mechanism that AgentX (RFC 2741, TCP 705) later replaced, and modern deployments almost always use AgentX. When port 199 is open today it usually means an snmpd daemon was built with SMUX support and left enabled — a legacy footprint rather than a deliberate design.

Why It’s Open

SMUX ships as a compile-time module in Net-SNMP (and the older UCD-SNMP), and when it’s enabled the agent binds a listener on TCP 199 for subagent connections. Historically the agent opened 199 even when no smuxpeer was configured, so the port turns up on plenty of hosts whose owners never intentionally use SMUX. You’ll find it alongside the rest of the SNMP stack — polling on UDP 161 and traps on UDP 162 — on network appliances, monitoring boxes, Unix servers, and some security gear. Net-SNMP’s own documentation now steers new subagent development to AgentX and calls it “outright superior to smux,” so an open 199 is a good signal that the SNMP configuration is dated and worth a closer look.

Common Risks

• Weak peer authentication. An SMUX subagent registers with only an OID identity and a single cleartext string password. That’s the entire credential — there’s no transport security — so a peer password is guessable or sniffable, and the master agent has historically bound 199 on all interfaces (0.0.0.0) rather than just localhost.
• Exposes the SNMP MIB tree. SMUX is bolted onto the same SNMP agent, so the real prize sits on port 161: if the agent answers a default public/private community string, an attacker walks the device inside-out regardless of what SMUX itself does. A SMUX footprint on 199 is a flag to go check the community strings on 161.
• Denial of service. Simply connecting to the listener has crashed the SNMP service on real products — Cisco ESA/WSA/Secure Email and Web Manager (CVE-2022-20675).
• Cleartext everywhere. Like SNMPv1/v2c, SMUX has no encryption. Registrations, passwords, and the queries relayed to subagents all cross the wire in the clear.
• Legacy, unmaintained code path. SMUX is deprecated in favor of AgentX. Where it’s still enabled, it’s rarely watched, patched, or monitored the way an actively-used service would be.

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

Book a Demo

Enumeration & Testing

Detect the service and version

nmap -sV -p 199 <target>

Nmap fingerprints an open 199 as smux. There is no dedicated SMUX NSE script or Metasploit module — enumeration pivots to the SNMP agent behind it.

Confirm the listener

nc -nv <target> 199

A raw connect proves the port is open, but SMUX won’t reveal much without a full PDU handshake — the useful data lives in the SNMP MIB.

Read the SMUX peer table via SNMP (from port 161)

# smuxPeerTable is 1.3.6.1.4.1.4.4.1 (RFC 1227, unix.smux.1)
snmpwalk -v2c -c public <target> 1.3.6.1.4.1.4.4.1

Registered subagents (identity, description, status) show up here when the community string is known — the same community-string weakness covered on the port 161 page.

Check the agent config (defensive / on-host)

grep -E 'smuxpeer|smuxsocket' /etc/snmp/snmpd.conf

smuxpeer sets the allowed peer OID and password; smuxsocket sets the bind address. A missing smuxsocket (default all-interfaces bind) is the exposure worth flagging.

Log every open instance and every community string you crack so it lands in the final pentest report instead of a scratch terminal.

What to Look For

Known CVEs and Exploits

• CVE-2022-20675 — The one clearly port-199-specific entry. On Cisco Email Security Appliance, Web Security Appliance, and Secure Email and Web Manager, an open listener on TCP 199 lets an unauthenticated remote attacker connect and crash the SNMP process, causing a denial of service. CVSS 5.3; no workaround, fixed by Cisco’s software update (advisory cisco-sa-ESA-SNMP-JLAJksWK).
• Design-level, not a single CVE. SMUX itself has very few dedicated CVEs — the durable risk is architectural: RFC 1227 peer authentication is a single cleartext password, and SMUX exposes the same MIB tree an attacker can already reach through SNMP. The adjacent Net-SNMP issue that actually turns MIB access into code execution lives on the query side: CVE-2020-15862 — SNMP write access to the EXTEND MIB runs arbitrary commands as root (CVSS 7.8), covered on the port 161 page. Treat an open 199 as a reason to audit the SNMP agent it belongs to, not as a standalone exploit target.

Mitigation

• Disable SMUX and use AgentX. If you don’t have a genuine SMUX subagent, rebuild or reconfigure snmpd without SMUX so it stops binding 199. For subagents that are still needed, migrate to AgentX (TCP 705), which handles SET reliably and is SNMPv3-aware.
• Bind SMUX to localhost. If SMUX must stay on, set smuxsocket 127.0.0.1 in snmpd.conf so only local subagents can connect, and set a strong, non-default smuxpeer password.
• Firewall TCP 199. Restrict the port to management hosts. It should never be reachable from the internet.
• Fix the SNMP side too. The bigger exposure is usually the agent on 161: move to SNMPv3, replace default community strings, and disable read-write access so a SMUX footprint can’t be pivoted into full device enumeration.
• Patch the platform. Keep appliances current — Cisco’s CVE-2022-20675 fix, and Net-SNMP updates generally — so a stray 199 listener isn’t also a crashable one.

Real-World Example

In April 2022, Cisco disclosed CVE-2022-20675: its Email Security Appliance, Web Security Appliance, and Secure Email and Web Manager all left an SMUX listener open on TCP 199, and an unauthenticated attacker who simply connected to that port could crash the SNMP service, knocking out monitoring on the box. There was no protocol exploit and no password to guess — the vulnerability was the exposed 199 listener itself. It’s a tidy illustration of why SMUX matters on a pentest even though it’s obsolete: the port shouldn’t have been reachable at all, and its presence was both the finding and the fix. Cisco shipped patched releases with no available workaround.

FAQ

What is port 199 used for?

Port 199 is the registered TCP port for SMUX, the SNMP Multiplexing Protocol (RFC 1227). It lets SNMP subagents register with a master SNMP agent so the agent can delegate parts of the MIB tree to them. In modern setups this job is done by AgentX on TCP 705, so an open 199 usually points to a legacy or default snmpd configuration.

What service runs on port 199?

An SNMP agent — typically Net-SNMP’s snmpd (or the older UCD-SNMP) — built with SMUX support. The agent opens TCP 199 to accept subagent connections while it answers normal SNMP polling on UDP 161.

Is port 199 dangerous?

On its own SMUX is low-severity, but an open 199 is a strong hint that the whole SNMP stack deserves scrutiny. The real risk is the agent behind it leaking the MIB tree through a default community string on 161, plus weak SMUX peer authentication and denial-of-service bugs like Cisco’s CVE-2022-20675.

What’s the difference between SMUX and AgentX?

Both let subagents extend a master SNMP agent, but AgentX (RFC 2741, TCP 705) is the modern replacement: it handles SET requests reliably, supports overlapping registrations, and is aware of SNMPv3 contexts. SMUX (RFC 1227, TCP 199) is deprecated, and Net-SNMP’s own docs recommend AgentX for any new subagent.

How do I secure or close port 199?

Disable SMUX in snmpd if nothing uses it, or migrate the subagent to AgentX. If SMUX must remain, bind it to localhost with smuxsocket 127.0.0.1, set a strong smuxpeer password, and firewall TCP 199 to management hosts. Harden the SNMP agent on 161 at the same time, then rescan to confirm 199 no longer answers.

TL;DR

• Service: SMUX (SNMP Multiplexing Protocol, RFC 1227) — SNMP subagent registration
• Default port: 199/TCP (SNMP polling on 161, traps on 162; superseded by AgentX on 705)
• Biggest risk: a legacy snmpd footprint that flags weak SNMP community strings and MIB exposure, plus weak cleartext peer auth and DoS bugs (Cisco CVE-2022-20675)
• Mitigation: disable SMUX / move to AgentX, bind to localhost, firewall 199, and harden the SNMP agent on 161