What Is SNMP?

SNMP stands for Simple Network Management Protocol.

It is commonly used by network management systems to monitor and, where permitted, manage network devices.

             SNMP Manager
                   |
                   |
    +--------------+--------------+
    |              |              |
    v              v              v
  Router         Switch        Firewall
    |              |              |
  Agent          Agent          Agent
    

1. What Is an SNMP Manager?

The SNMP Manager is the monitoring or network management system that communicates with SNMP agents.

It can request information from managed devices and process the returned information for dashboards, graphs, reports, and alerts.

For example, a manager may request an interface counter from a switch to determine how much traffic has passed through that interface.

2. What Is an SNMP Agent?

An SNMP Agent is software running on a managed device.

The agent exposes management information and communicates with the SNMP manager.

             SNMP Manager
                  |
                  | SNMP
                  v
          +---------------+
          | Cisco Switch  |
          |               |
          | SNMP Agent    |
          |      |        |
          |      v        |
          | Interface     |
          | Statistics    |
          +---------------+
    

3. What Is a MIB?

MIB stands for Management Information Base.

A MIB describes the management objects that can be accessed through SNMP. These objects are identified using Object Identifiers (OIDs).

A MIB is therefore better understood as a structured definition of available management information rather than simply a database stored on the monitoring server.

4. What Is an OID?

OID stands for Object Identifier.

It identifies a specific managed object in the SNMP information hierarchy.

```

MIB
|
+---- System Information
|
+---- Interface Information
|        |
|        +---- Interface Status
|        +---- Interface Counters
|
+---- IP Information
|
+---- Other Management Objects 

Monitoring software uses OIDs to identify the particular information it wants to retrieve or modify.

How Manager, Agent, MIB and OID Work Together

```

SNMP Manager
|
| "Give me interface information"
v
SNMP Agent
|
| Looks up requested object
v
MIB / OID
|
| Value
v
SNMP Agent
|
| Response
v
SNMP Manager 

SNMP Polling

A monitoring system can periodically poll network devices to collect information.

```

10:00  Manager ----> Switch
"Give interface data"

10:01  Manager ----> Switch
"Give interface data"

10:02  Manager ----> Switch
"Give interface data" 

This allows the monitoring system to build historical graphs and identify changes over time.

SNMP GET

GET requests a particular management object.

```

Manager
|
| GET
v
Agent
|
| RESPONSE
v
Manager 

SNMP GETNEXT

GETNEXT requests the next object in the management information hierarchy. It can be used when walking through related MIB objects.

SNMP SET

SET allows a manager to request a change to a supported management object when the device and access policy permit it.

Because SET can make changes, write access should be restricted and carefully secured.

SNMP Traps

Polling requires the manager to ask the device for information. A trap works differently: the agent sends a notification to the manager when an event occurs.

```

Network Device
|
| Event occurs
|
| SNMP Trap
v
Monitoring Server
|
v
Alert 

SNMP Inform

An SNMP Inform is a notification mechanism that includes acknowledgment behavior. This allows the sender to receive confirmation that the notification was received.

SNMP Ports

SNMP Versions

SNMPv1

SNMPv1 is the original widely used version. It uses community strings for basic access control and does not provide the stronger security capabilities of SNMPv3.

SNMPv2c

SNMPv2c introduced improvements to protocol operations and efficiency while continuing to use community strings.

SNMPv3

SNMPv3 introduces a security framework supporting features such as authentication, integrity protection, and privacy through encryption when configured.

SNMP Version Comparison

Why SNMPv3 Is Important

Monitoring traffic can contain information about network infrastructure. Older community-string-based versions do not provide the same security capabilities as SNMPv3.

SNMPv3 can provide authentication, message integrity protection, and privacy through encryption depending on the selected security configuration.

Basic Cisco SNMP Example

A basic SNMPv2c read-only example on Cisco IOS can be configured with:

```

Router(config)# snmp-server community ATN-MONITOR RO 

In a production environment, access should be restricted to authorized monitoring systems and stronger security options should be considered.

Complete SNMP Monitoring Architecture

                 Monitoring Dashboard
                          |
                          v
                    SNMP Manager
                          |
          +---------------+---------------+
          |               |               |
        SNMP             SNMP            SNMP
          |               |               |
          v               v               v
       Router           Switch          Firewall
          |               |               |
        Agent            Agent           Agent
          |               |               |
         MIB             MIB             MIB
          |               |               |
        OIDs             OIDs            OIDs
    

Real-World Example

Suppose a company has a switch with a heavily used uplink. The monitoring platform can periodically collect interface counters through SNMP.

The monitoring system can use those measurements to create historical traffic graphs. If an interface later goes down and the device sends a configured notification, the monitoring platform can also receive that event.

Common Beginner Mistakes

• Confusing an SNMP manager with an SNMP agent
• Thinking a MIB is simply the monitoring dashboard database
• Using default community strings in production
• Giving unnecessary write access
• Assuming SNMPv1 and SNMPv2c provide encryption
• Exposing SNMP unnecessarily to untrusted networks

Quick Quiz

What component normally runs on a managed router or switch?

What does MIB stand for?

What identifies a specific SNMP management object?

Which SNMP version provides stronger security capabilities?

Key Takeaways

• The SNMP Manager is the monitoring or management system.
• The SNMP Agent runs on a managed network device.
• MIBs describe available management objects.
• OIDs identify specific management objects.
• GET retrieves information.
• SET can modify supported information when permitted.
• Traps and informs provide event notifications.
• UDP 161 is commonly used for SNMP requests and responses.
• UDP 162 is commonly used for traps and informs.
• SNMPv3 provides stronger security capabilities than v1 and v2c.