What is SNMP? How managers, agents and MIBs work together

What is SNMP? SNMP stands for Simple Network Management Protocol, a protocol defined by the IETF for monitoring and managing devices on a network. Switches, routers, firewalls, servers, BMCs, UPS network cards, intelligent PDUs and the monitoring cards in precision cooling units mostly ship with a built-in SNMP agent. A monitoring system sends requests to these agents at regular intervals and reads values such as port status, traffic counters, CPU load and temperature; when something happens, such as a link going down, a reboot or a fan failure, the agent also sends a trap to notify the monitoring system on its own. SNMP runs over UDP: agents listen for queries on port 161 and managers receive traps on port 162. SNMP was first proposed in 1988, and version 1 was published as RFC 1157 in 1990. Decades later it remains one of the most widely supported monitoring protocols in the data center.

The three parts of SNMP: manager, agent and MIB

Part	What it is	Examples
Manager (also called the NMS)	The side that sends queries, receives alerts and stores the data	Zabbix, LibreNMS, Prometheus snmp_exporter, or the net-snmp command-line tools
Agent	Runs on the managed device, answers queries and sends traps	The SNMP agent built into a switch, snmpd on Linux, the SNMP service on Windows, UPS network card firmware
MIB (Management Information Base)	The data dictionary describing which objects on a device can be read or written	IF-MIB (interfaces), HOST-RESOURCES-MIB (host resources), UPS-MIB, vendor-specific MIBs
OID (Object Identifier)	The number of each object in a MIB, effectively its path through the tree	1.3.6.1.2.1.1.5.0 is the device name, sysName

The MIB organizes every object into a tree. Each node has a number, and reading the numbers from the root down gives the OID. The trunk of the tree looks like this:

1 iso
└─ 3 org
   └─ 6 dod
      └─ 1 internet                     1.3.6.1
         ├─ 2 mgmt
         │  └─ 1 mib-2                  1.3.6.1.2.1     Standard MIBs
         │     ├─ 1 system              1.3.6.1.2.1.1   Device name, description, uptime
         │     ├─ 2 interfaces          1.3.6.1.2.1.2   Interface table
         │     └─ 25 host               1.3.6.1.2.1.25  Host resources: CPU, memory, disks, processes
         ├─ 4 private
         │  └─ 1 enterprises            1.3.6.1.4.1     Vendor MIBs, followed by each vendor's enterprise number
         └─ 6 snmpV2
            └─ 3 snmpModules            1.3.6.1.6.3     SNMP's own objects, including v3 users and views

There are two kinds of objects. A scalar has a single value and its OID ends in .0, as in sysName.0. A table object has one value per row and its OID ends in the row index; in the interface table, ifDescr.12 is the name of the interface with index 12. A MIB file is only a dictionary that turns numbers into names: the device always returns “OID = value”.

On a Linux server, snmpd is the agent. This is how a manager reads the server’s name and the last minute’s load on each logical CPU:

# Scalar: device name
snmpget -v2c -c 'Rd-Srv-2026' 10.10.0.31 1.3.6.1.2.1.1.5.0
# SNMPv2-MIB::sysName.0 = STRING: web01

# Table: hrProcessorLoad, one row per logical CPU, value = percent of the last minute not idle
snmpwalk -v2c -c 'Rd-Srv-2026' 10.10.0.31 1.3.6.1.2.1.25.3.3.1.2
# HOST-RESOURCES-MIB::hrProcessorLoad.196608 = INTEGER: 7
# HOST-RESOURCES-MIB::hrProcessorLoad.196609 = INTEGER: 12

What the SNMP service does on a server

The “SNMP service” you find on a server is the agent: snmpd on Linux, and on Windows the service named SNMP (display name SNMP Service), with a separate SNMPTRAP service for receiving traps. It has exactly one job: letting a monitoring system read the machine’s status over the network. If no monitoring system collects data from the machine over SNMP, there is no reason to leave it running.

On Linux, two lines are enough to open snmpd to the monitoring server only:

# /etc/snmp/snmpd.conf
# Listen only on the management network address, not on the public address
agentaddress udp:10.10.0.31:161
# Read-only community, usable only from the monitoring server 10.10.0.10
rocommunity Rd-Srv-2026 10.10.0.10

Run systemctl restart snmpd afterwards. On Windows Server, install it from PowerShell with Install-WindowsFeature SNMP-Service; on Windows 10 and 11 it is added under Optional features. Microsoft has listed the SNMP service as deprecated since Windows Server 2012. It can still be installed, but newer Windows monitoring setups mostly rely on WMI, WinRM or the monitoring product’s own agent.

SNMP operations: Get, Set, Trap and the rest

SNMP has very few message types, which is part of what makes it “simple”:

Operation	Direction	Purpose	Since
Get	Manager → agent	Read the values of one or more specific OIDs	v1
GetNext	Manager → agent	Read the “next” OID in the tree; snmpwalk repeats it to walk a whole subtree	v1
GetBulk	Manager → agent	Read many rows in one request, for walking tables efficiently	v2c
Set	Manager → agent	Change a writable object, such as shutting a port or renaming a device	v1
Response	Agent → manager	The reply to any of the requests above	v1 (then called GetResponse)
Trap	Agent → manager	Unsolicited event notification, not acknowledged	v1, with a new format from v2c
Inform	Agent → manager	A notification the receiver must acknowledge; resent if no acknowledgment arrives	v2c
Report	Both	Used inside v3 to report errors and discover the peer’s engine ID	v3

GetBulk makes a visible difference. To read the interface name table of a 48-port switch, assuming exactly 48 rows: GetNext fetches one row per request, so 48 requests plus one more to confirm the walk has left the table, 49 round trips in all. With GetBulk, net-snmp’s snmpbulkwalk fetches 10 rows per request by default, so 5 round trips are enough. When a manager polls hundreds of devices, that difference decides how long each polling cycle takes.

Polling and traps complement each other. Polling reads data at fixed intervals, which produces graphs and traffic figures, but an event that happens and clears between two polls can be missed. A trap goes out the moment an event happens, but it travels over UDP without acknowledgment and is lost if the network is congested or the receiver is restarting. The usual answer is both: polling for metrics, traps for real-time events, and the next poll as a backstop when a trap is lost.

Set is rarely used in practice. With v1 and v2c the community string travels in clear text, so granting write access is risky, and vendors expose few writable objects anyway. Configuration changes normally go through SSH or NETCONF, and SNMP is given read-only access.

SNMP v1 vs v2c vs v3

	v1	v2c	v3
Standard	1990, RFC 1157	1996, RFC 1901 and related	2002, RFC 3411 to 3418
Authentication	Community string in clear text	Community string in clear text	Username and authentication password (USM) with HMAC-MD5 or HMAC-SHA; newer implementations support SHA-2
Encryption	None	None	Optional, DES or AES
Access control	Community string plus source ACL	Same as v1	VACM views that limit which OID subtrees each user can read
Counters	32-bit only	Adds 64-bit Counter64	Same as v2c
Bulk reads	No	GetBulk	GetBulk
Notifications	Trap	Trap, Inform	Trap, Inform
Error handling	One missing OID in a request fails the whole request	Only the missing OID returns an exception such as noSuchObject; the rest are returned normally	Same as v2c
Role today	Essentially obsolete	The common choice on an isolated management network	Used across untrusted networks or where compliance requires it

A few notes:

• The “c” in v2c stands for community. A community string is a shared password carried in clear text in every request, visible to anyone capturing packets. Many devices ship with public as the default read-only community and private as the read-write community; change both before the device goes into service.
• 64-bit counters are reason enough to drop v1. Interface byte counters such as ifHCInOctets are 64-bit objects that can only be read with v2c or v3. A 32-bit byte counter wraps at about 4.3 billion bytes, which on a fully loaded 10G port takes about 3.4 seconds, far too fast for normal 1-minute or 5-minute polling to keep up.
• v3 has three security levels. noAuthNoPriv uses a username with no authentication or encryption; authNoPriv authenticates but does not encrypt; authPriv does both and is the level to use across untrusted networks. Each v3 agent has an engine ID, and user keys are derived from both the password and the engine ID, so after an engine ID changes, existing users usually have to be recreated.

Where SNMP fits in data center monitoring

SNMP is not the only way to collect data in a data center. Each method has its own job:

Method	Main targets	Strength	Relationship to SNMP
SNMP	Switches, routers, firewalls, UPSs, PDUs, servers	General status and counter collection, supported by nearly all network gear	—
IPMI, Redfish	Server BMCs	Power control, temperatures, fans, hardware logs, remote console	Many BMCs also offer read-only SNMP and traps, with fewer features than IPMI or Redfish
Syslog	Network devices, servers	Text logs that reconstruct what happened	Complements traps: a trap says something happened, the log says how
NetFlow, sFlow, IPFIX	Routers, switches	Who is talking to whom, and how much traffic each uses	SNMP only gives per-port totals
Streaming telemetry (gNMI)	Newer data center switches	Devices push data, at intervals down to seconds	Suited to large-scale, high-frequency collection and taking over part of the work SNMP polling used to do
Modbus	Facility equipment: power distribution, cooling, temperature and humidity sensors	Reading registers on industrial equipment	Some facility monitoring gateways expose Modbus data to upper-layer systems over SNMP
Host agents (Zabbix agent, node_exporter)	Server operating systems	Processes, file systems, application metrics, more detailed than SNMP	Where an agent can be installed, it is usually preferred

In day-to-day data center operations, SNMP does three main jobs:

1. Port traffic collection. Read the 64-bit byte counters of every switch port on a schedule, turn the difference between two readings into bandwidth, draw traffic graphs, and compute the 95th percentile from 5-minute samples as the basis for bandwidth billing and capacity planning.
2. Device health. Read switch CPU, memory, temperature, fan and power supply status, and UPS load and remaining battery runtime, and alert when thresholds are crossed.
3. Event notification. Receive traps such as linkDown, linkUp and coldStart so you know at once which device has a problem.

What it does poorly is just as clear: analyzing traffic content takes port mirroring or flow records, configuration changes go through SSH or NETCONF, and application metrics inside servers are better left to agents.

SNMP security checklist

1. Change default community strings. Do not use easily guessed names such as public or private, and grant read-only access only.
2. Restrict the source. Use an ACL on the device to allow only the monitoring servers, and have agents listen only on management network addresses.
3. Never expose UDP 161 to the internet. An exposed SNMP agent is not only a target for community string guessing; it can also be abused for reflection and amplification attacks.
4. Use v3 authPriv across networks, and use VACM views to expose only the subtrees you need, for example system and interfaces, but not the routing or ARP tables.
5. Turn off agents nobody uses. If nothing collects from a server, stop snmpd or the Windows SNMP service:

# Linux: check whether snmpd is listening; if it is not needed, stop it and disable it at boot
ss -ulnp 'sport = :161'
systemctl disable --now snmpd

SNMP in a data center management system

In a data center management system, SNMP usually only reads. That is exactly the split in Toplink DCIM’s switch management: SNMP is used for read-only collection from switches, while port state, VLAN and rate limit changes are pushed over SSH or Telnet, with NETCONF also supported on Juniper devices, so switches only need read-only SNMP access. DCIM adds live traffic graphs with anomaly detection and top-talker rankings to locate busy nodes, and traffic and 95th percentile billing totals outbound, inbound or total traffic, or the 95th percentile, per billing cycle, sends a notice when usage reaches a set percentage, and can throttle or shut the port automatically once the quota is exceeded.