What Is SNMP?

SNMP stands for Simple Network Management Protocol.

It is a protocol commonly used by network management systems to monitor and manage network devices such as:

• Routers
• Switches
• Firewalls
• Wireless access points
• Servers
• Printers
• UPS devices
• Other network-enabled equipment

Why Do We Need SNMP?

Imagine an organization has 500 network switches. An administrator cannot manually log in to every switch every few minutes just to check interface status and traffic.

An SNMP-based monitoring system can collect information automatically.

            Network Monitoring System
                     |
         +-----------+-----------+
         |           |           |
         v           v           v
      Router       Switch      Firewall
         |           |           |
         +-----------+-----------+
                     |
                   SNMP
    

This allows administrators to monitor network health from a centralized system.

The Three Main SNMP Components

An SNMP environment commonly contains:

1. SNMP Manager
2. SNMP Agent
3. MIB

1. SNMP Manager

The SNMP Manager is usually part of a network management or monitoring system.

It communicates with SNMP agents and collects information about network devices.

Examples of information it may monitor include:

• Interface status
• Interface traffic counters
• CPU utilization
• Memory utilization
• Device uptime
• Environmental information
• Hardware information

2. SNMP Agent

An SNMP Agent is software running on a managed device.

The agent collects or exposes management information from the device and communicates with the SNMP manager.

```

SNMP Manager
|
| SNMP
v
+----------------------+
| Router               |
|                      |
| SNMP Agent           |
|       |              |
|       v              |
| Interface statistics |
| CPU / Memory         |
+----------------------+ 

3. MIB

MIB stands for Management Information Base.

A MIB describes the managed objects that can be monitored or manipulated through SNMP. These objects are identified using standardized object identifiers called OIDs.

For example, a monitoring system may query an object representing an interface counter to determine how much traffic has passed through an interface.

How SNMP Works

A common SNMP monitoring process looks like this:

```

SNMP Manager
|
| 1. Request information
v
SNMP Agent
|
| 2. Reads management information
v
Network Device
|
| 3. Response
v
SNMP Manager 

This process is commonly called polling.

SNMP GET

The SNMP manager can use a GET operation to request a particular piece of management information from an agent.

```

Manager
|
| GET: Interface information
v
Agent
|
| RESPONSE
v
Manager 

SNMP GETNEXT

GETNEXT allows a manager to request the next object in the MIB's object hierarchy. It has historically been useful when walking through groups of management objects.

SNMP SET

SET can be used to modify certain managed values when the device and SNMP configuration permit it.

Because SET can change device information or behavior, it should be protected carefully and used only where appropriate.

SNMP Traps

Polling requires the manager to ask the device for information. But what if a device needs to notify the monitoring system about an important event?

This is where an SNMP Trap can be used.

```

Router
|
| "Interface went down!"
|
| SNMP Trap
v
Monitoring Server
|
v
Administrator Alert 

A trap is an unsolicited notification sent by an agent to a manager.

SNMP Inform

An SNMP Inform is similar to a trap but provides acknowledgment behavior between SNMP systems.

This can be useful when the sender needs confirmation that the notification was received.

SNMP Polling vs Traps

SNMP Ports

SNMP commonly uses UDP.

SNMP Versions

For security-sensitive deployments, SNMPv3 is generally preferred because it provides significantly stronger security capabilities than the community-string-based approaches used by v1 and v2c.

What Is a Community String?

SNMPv1 and SNMPv2c commonly use community strings as a basic form of access control.

You may see configurations using values such as:

```

public
private 

These default or predictable values should not be used in secure production environments.

SNMPv3 Security

SNMPv3 introduces stronger security capabilities, including:

• Authentication
• Message integrity protection
• Privacy through encryption when configured
• User-based security

SNMPv3 should be considered when secure management traffic is required.

Practical SNMP Monitoring Example

Imagine an organization has several switches.

                Monitoring Server
                       |
             +---------+---------+
             |         |         |
             v         v         v
          Switch 1  Switch 2  Switch 3
             |         |         |
          SNMP Agent SNMP Agent SNMP Agent
    

The monitoring server can periodically collect interface counters, device uptime, and other supported information.

If an interface goes down and the devices are configured to send notifications, the monitoring platform may receive an SNMP trap and generate an alert.

Example Cisco SNMP Configuration

A basic SNMPv2c example on Cisco IOS may look like:

```

Router(config)# snmp-server community ATN-MONITOR RO 

RO means read-only access.

In a real production network, access should be restricted to authorized monitoring systems, and SNMPv3 should be considered where supported and appropriate.

SNMP and Network Monitoring

SNMP is commonly used as one component of a larger network monitoring platform.

```

Network Devices
|
| SNMP
v
Monitoring Platform
|
+---- CPU Graph
|
+---- Memory Graph
|
+---- Interface Traffic
|
+---- Device Availability
|
+---- Alerts 

This allows network administrators to monitor the health and performance of infrastructure from a centralized location.

SNMP Advantages

• Centralized network monitoring
• Automated data collection
• Wide support across network devices
• Useful for performance monitoring
• Can provide event notifications
• Helps administrators identify infrastructure problems

SNMP Limitations

• Older SNMP versions have weak security.
• SNMP does not replace every type of network monitoring.
• Collected information depends on what the device exposes.
• SNMP polling creates management traffic.
• SNMP configuration must be secured carefully.

SNMP vs Ping

Quick Quiz

What does SNMP stand for?

What component runs on a managed network device?

Which UDP port is commonly used for SNMP requests and responses?

Which SNMP version provides stronger security features such as authentication and privacy?

Key Takeaways

• SNMP is widely used for network monitoring and management.
• An SNMP manager communicates with agents on managed devices.
• MIBs describe available management objects.
• Polling allows a manager to collect information regularly.
• Traps provide event-driven notifications.
• UDP 161 is commonly used for SNMP requests and responses.
• UDP 162 is commonly used for traps and informs.
• SNMPv3 provides stronger security than SNMPv1 and SNMPv2c.