SNMP in depth: managers, agents, MIBs, OIDs, traps and SNMPv3
In short: SNMP lets a monitoring system (the manager) read values from devices (agents) and receive alerts from them. Each value has an object identifier in a structure called the MIB. Managers poll with Get messages; agents push Traps or Informs. SNMPv1 and v2c use clear-text community strings, so use SNMPv3 with authentication and encryption.
Why SNMP is still everywhere
Almost every router, switch, firewall, printer, UPS and server supports the Simple Network Management Protocol (SNMP). It is how monitoring tools draw bandwidth graphs, show CPU and memory use, and raise an alarm when a link fails. Newer methods such as streaming telemetry are growing, but SNMP is still the common language that nearly everything speaks.
Managers, agents, MIBs and OIDs
- The manager is the monitoring system, often called the network management station (NMS).
- The agent is software on the device that answers questions and sends alerts.
- The Management Information Base (MIB) is the catalogue of everything the agent can report, arranged as a tree.
- Each item has an object identifier (OID), a dotted path through that tree. For example 1.3.6.1.2.1.1.5.0 is the device's name (sysName). Vendors add their own branches for device-specific values.
Monitoring tools hide most of this behind friendly names, but when a vendor publishes a new MIB you load it into the manager so it can translate the numbers.
The messages
| Message | Direction | Purpose |
|---|---|---|
| Get / GetNext | Manager to agent | Read one value, or walk to the next one |
| GetBulk (v2c and v3) | Manager to agent | Read many values in one request, such as an interface table |
| Set | Manager to agent | Change a value; rarely allowed in practice |
| Trap | Agent to manager | Unacknowledged alert, such as "link down" |
| Inform (v2c and v3) | Agent to manager | Alert that the manager acknowledges, so it can be resent |
Agents listen on UDP 161; managers receive traps and informs on UDP 162. Polling every few minutes gives you trends; traps tell you about events between polls.
Versions and security
SNMPv1 and v2c protect access with a community string, which is effectively a shared password sent in clear text. Anyone who captures the traffic can read it, and a read-write community lets them change the configuration. The defaults "public" and "private" are still found on networks and are among the first things an auditor checks.
SNMPv3 replaces communities with users. Each group chooses a security level: noAuthNoPriv (no protection), authNoPriv (messages are authenticated) or authPriv (authenticated and encrypted). Use authPriv with SHA and AES.
ip access-list standard NMS-ONLY
permit 10.0.100.40
!
snmp-server view MONITOR iso included
snmp-server group NETOPS v3 priv read MONITOR access NMS-ONLY
snmp-server user nms-poller NETOPS v3 auth sha Auth-Pass-Here priv aes 128 Priv-Pass-Here
snmp-server host 10.0.100.40 version 3 priv nms-poller
snmp-server enable traps snmp linkdown linkup
snmp-server location Building-A Floor-2 Rack-3
snmp-server contact noc@example.orgThe ACL limits which addresses may query the agent, the view controls what they can see, and only a read view is given, so nothing can be changed through SNMP. SNMPv3 users are not shown in the running configuration; check them with show snmp user.
Real-world example: finding the busy link
Staff at a fictional council office said the network was "slow every morning". The new network administrator found SNMPv2c with the community "public" enabled on every switch and no monitoring in place. She first removed the default communities and configured SNMPv3 authPriv users restricted to the monitoring server. Then she polled interface counters every five minutes. Within a week the graphs showed the uplink from the main floor switch hitting 100 percent between 08:30 and 09:15, when every PC pulled software updates at once. Moving the updates to a local cache and staggering them removed the morning slowdown, and the same tool now emails the team when any uplink stays above 80 percent.
Practice
What is the difference between a trap and an inform?
Why is SNMPv2c with a read-write community a risk?
Which SNMPv3 security level should you normally use?
Key takeaways
- SNMP managers poll agents; agents send traps and informs.
- Values live in the MIB and are named by OIDs.
- Agents use UDP 161; traps and informs go to UDP 162.
- v1 and v2c communities are clear-text passwords; remove defaults.
- Use SNMPv3 authPriv, read-only views and an ACL for the manager.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.