SNMP
Managers, agents, MIBs and OIDs; polling versus traps and informs; and what the SNMP versions add for security.
Agents, managers, MIBs and OIDs
SNMP lets a manager (NMS) read and write management data on devices (agents). Data lives in a tree called the MIB; each leaf is an OID — a dotted identifier like 1.3.6.1.2.1.1.5.0 (sysName). The agent listens on UDP 161 for requests; the manager listens on UDP 162 for notifications.
Practical OIDs for network study: sysDescr, sysUpTime, sysName identify the device; ifOperStatus/ifAdminStatus report interface state; ifHCInOctets/ifHCOutOctets are the 64-bit counters used for utilization math. A 32-bit byte counter wraps in ~3.4 seconds on a 10 Gb link — always poll HC counters on fast interfaces.
Polling and notifications
SNMP message types
| Message | Direction | Purpose |
|---|---|---|
| GetRequest / GetNext / GetBulk | NMS → agent (161) | Read OID(s); GetBulk efficiently walks tables |
| SetRequest | NMS → agent (161) | Write a writable OID |
| Response | agent → NMS | Answer to a request |
| Trap | agent → NMS (162) | Unsolicited alert, no acknowledgment |
| InformRequest | agent → NMS (162) | Alert the manager must acknowledge — reliable but heavier |
- Symptom
- Interface utilization graph spikes to absurd values or flatlines at 10G
- The NMS polls ifInOctets — the 32-bit counter.
- At 10 Gbps the counter wraps every ~3.4 seconds; deltas become garbage.
- Switching the poll to ifHCInOctets (64-bit) restores sane values.
Counter width is a real operational constraint, not trivia.
Versions and verification
SNMP versions
| Version | Security | Notes |
|---|---|---|
| v1 | Community string (cleartext) | Legacy, 32-bit counters only |
| v2c | Community string (cleartext) | Adds GetBulk, Inform, 64-bit counters |
| v3 noAuthNoPriv | Username only | No crypto |
| v3 authNoPriv | Auth (MD5/SHA) | Integrity, no encryption |
| v3 authPriv | Auth + encryption | The secure enterprise choice |
Allow monitoring reads from the NMS — Privileged EXEC → Global configuration
Cisco IOS / IOS XE
configure terminal snmp-server community C0mmun1ty RO 10 access-list 10 permit 192.168.99.10 end
show snmp show snmp community show snmp user
- SNMP packet counters increment on polls.
- The NMS can read sysName and interface OIDs.
- Community strings are cleartext — restrict with an ACL and prefer v3 authPriv anywhere it matters.
- Use a placeholder string here — never reuse a real community.
Changes device configuration.
Common mistakes
- Expecting traps on UDP 161 — agents receive requests there; managers receive traps on 162.
- Confusing trap with inform — only informs get acknowledged/retried.
- Leaving RW community strings unfiltered — write access via cleartext community is a real attack path.
- Polling 32-bit counters on fast links — use HC counters.
Observation: Ping succeeds to the device; all SNMP polls time out.
- ACL blocking UDP 161 to the agent
- Wrong community string / version mismatch
- snmp-server not enabled or view restriction excludes the OIDs
| Check | Indicates |
|---|---|
show snmp counters on the agent | Input packets counted? If zero, the requests never arrive — ACL/path. |
| Community/version on both sides | v3 user vs v2c community never authenticates. |
| ACL applied to the community line | A restrictive ACL can silently reject a valid community. |
Correction: Open the path or align credentials/version.
Polls succeed and counters increment on both sides.
Related resources
Sources
- Cisco CCNA 200-301 v1.1 Exam Topics (official PDF) — reviewed 2026-11-02
- RFC 3418 — Management Information Base (MIB) for SNMP — reviewed 2026-11-02
- RFC 3416 — Protocol Operations for SNMPv2 — reviewed 2026-11-02
Targets CCNA 200-301 v1.1 objectives. Supplemental blocks are labeled beyond exam scope.