1
00:00:00,670 --> 00:00:05,920
Now he has an S&P message once again from the network management station.

2
00:00:06,010 --> 00:00:11,500
In other words NPM to write a to 10 1 100 2.

3
00:00:11,530 --> 00:00:19,790
You can see this as an S&P message and S&P uses UDP or use a data Graham protocol which is a connection

4
00:00:19,790 --> 00:00:20,720
list protocol.

5
00:00:20,720 --> 00:00:28,000
Unlike TTP UDP doesn't provide reliability in the same way that TTP does.

6
00:00:28,000 --> 00:00:34,660
You'll also notice that the port is Pt. 1 6 1 so the network management station is communicating with

7
00:00:34,660 --> 00:00:43,060
the router on Destination Port 1 6 1 and the rudders replying back from Port 1 6 1 to the ephemeral

8
00:00:43,390 --> 00:00:47,950
or random port number that was chosen by the animus for this connection.

9
00:00:47,950 --> 00:00:56,920
It's important to remember that UDP port 161 is the destination port that the in a mess initiates sessions

10
00:00:56,920 --> 00:00:57,930
too.

11
00:00:57,940 --> 00:01:06,370
In other words the animus or NPM in this case is going to be initiating sessions to routers on Port

12
00:01:06,520 --> 00:01:08,380
161.

13
00:01:08,380 --> 00:01:18,010
You need to ensure that your firewalls or access lists or ACLU permit or allow UDP port 161 from the

14
00:01:18,010 --> 00:01:24,130
enemies to the devices that are being monitored and the reverse traffic also needs to be permitted.

15
00:01:24,160 --> 00:01:30,120
You may even want to configure devices to use a non default port for S&P.

16
00:01:30,300 --> 00:01:37,630
So rather than using the default port of 161 you may choose to use a another port number like ten thousand

17
00:01:38,110 --> 00:01:43,690
one hundred sixty one you would configure that on the device and you would also need to configure that

18
00:01:44,020 --> 00:01:52,990
on NPM so it knows which port number to use to connect to that device for monitoring in both the S&P

19
00:01:52,990 --> 00:01:57,550
get or S&P request as well as the response.

20
00:01:57,550 --> 00:02:06,250
You'll see the OED values and move information that NPM is getting from the device.

21
00:02:06,350 --> 00:02:12,880
So in the request we can see that the values on null and in the reply we can see the actual values for

22
00:02:12,880 --> 00:02:14,470
those of I.D..

23
00:02:14,800 --> 00:02:22,260
We'll explore that in more detail in a separate video where we discuss I.D. maps and other options.