MIB Viewer

What is SNMP?

SNMP (Simple Network Management Protocol) is the standard protocol network devices use to report status information to monitoring systems, and in some cases to be reconfigured remotely. If you've ever seen a network monitoring dashboard showing interface traffic, CPU load, or device uptime, there's a very good chance SNMP is how that data got there.

It's been the dominant protocol for this job since the late 1980s, and despite plenty of newer alternatives (streaming telemetry, NETCONF/YANG, vendor REST APIs), it's still supported on essentially every piece of network equipment made - routers, switches, firewalls, printers, UPS units, and more. That ubiquity is really SNMP's main selling point: it's the one management protocol you can almost always count on being there.

The basic model: managers and agents

SNMP works on a simple client/server-style relationship, though the terminology is specific to SNMP:

  • An agent is software running on the managed device (a switch, a server, a UPS) that knows how to answer questions about that device's current state.
  • A manager (also called an NMS, or Network Management Station) is the system that asks those questions - typically a monitoring platform polling hundreds or thousands of devices on a schedule.

The manager sends a request, the agent replies with the current value. That's the core of it. There's also a second, inverted flow: agents can proactively send unsolicited messages called traps to a manager when something notable happens (an interface going down, for example), rather than waiting to be asked.

What's actually being asked for

Every piece of data SNMP can report on has a unique numeric address called an OID (Object Identifier) - something like 1.3.6.1.2.1.1.1.0. A MIB (Management Information Base) is the document that defines what a given OID actually means, and gives it a human-readable name (that same OID is sysDescr.0, a plain-text description of the device). When you ask a manager to "get CPU utilization from this router," under the hood it's translating that into a specific OID and sending an SNMP request for it.

Transport: UDP, not TCP

SNMP runs over UDP, traditionally on port 161 for requests (manager asking agent) and port 162 for traps (agent notifying manager). UDP was a deliberate choice: it's lightweight, and a management protocol shouldn't itself become a burden on a device that might already be struggling. The tradeoff is that SNMP has to handle its own retries and timeouts, since UDP doesn't guarantee delivery the way TCP does - which is part of why timeouts are such a common thing to run into.

Versions, briefly

SNMP has gone through three major revisions - v1, v2c, and v3 - mainly improving performance and, eventually, real security. Community strings (the "password" in v1/v2c) are sent in plain text and offer essentially no real protection; v3 is the first version with actual authentication and encryption. See SNMP versions for the full comparison.

The four core operations

A manager can ask an agent for data in a few different ways - GET for a specific value, GETNEXT and GETBULK for walking through a whole table efficiently, and SET to change a value rather than read one. Agents can push data back unprompted via TRAP or the more reliable INFORM.