Mental model
You manage 50 switches. You want to know: is each one up? CPU load? Interface utilization? Memory? Bandwidth on Gi0/24 over the last hour?
SNMP is the protocol that lets your monitoring system pull this info from every device on a schedule, and lets devices push critical events to your system in real time.
Two flows:
- Polling (GET) — manager asks agent: “what’s your CPU?” every 5 minutes.
- Traps (asynchronous) — agent pushes: “my interface just went down.” Immediately.
For 25 years, SNMP has been the dominant network monitoring protocol. It’s being replaced by streaming telemetry (gRPC / NETCONF subscriptions, see NETCONF & YANG), but you’ll meet SNMP on every device for a long time yet.
Three versions — only v3 is OK for production
| Version | Auth | Encryption | Use? |
|---|---|---|---|
| v1 | Community string (plain text) | None | Never |
| v2c | Community string (plain text) | None | Only on isolated mgmt VLANs |
| v3 | Username + password (hashed/encrypted) | Optional AES-256 encryption | Yes — production |
Community strings in v1/v2c are essentially passwords sent in plain text. Anyone sniffing the management network can read them. Anyone reading them can poll your devices and read all configuration.
SNMPv3 uses real authentication (HMAC-SHA) and optional encryption (AES). It’s not perfect (still UDP, replay protection is finicky) but it’s the only acceptable choice for production.
SNMP messages
| Message | Direction | Purpose |
|---|---|---|
| GET / GET-NEXT / GET-BULK | Manager → Agent | Read one or many values |
| SET | Manager → Agent | Write a value (rare in practice — usually monitoring is read-only) |
| RESPONSE | Agent → Manager | Reply to GET / SET |
| TRAP | Agent → Manager | Async alert. Fire-and-forget. |
| INFORM | Agent → Manager | Acknowledged alert (more reliable than trap) |
For CCNA: know GET, TRAP, INFORM. TRAP vs INFORM — the difference is whether the manager acknowledges receipt. INFORM is retried if the manager doesn’t ACK. TRAP is sent once and forgotten.
Ports
- UDP 161 — agent (polled by manager)
- UDP 162 — manager (receives traps from agents)
Both UDP, so neither is guaranteed delivery. SNMP traps in particular can be lost.
MIB and OID — the data model
SNMP data lives in a MIB (Management Information Base) — a hierarchical tree of values. Every node in the tree has a unique OID (Object Identifier), like 1.3.6.1.2.1.2.2.1.10.1 (which means interface Gi0/0 inbound octet count).
Real OIDs are unreadable. You’ll work with named MIBs:
ifInOctets.1 ← human form
1.3.6.1.2.1.2.2.1.10.1 ← OID form
Common MIBs you’ll touch:
- IF-MIB — interface stats (counters, errors, status)
- HOST-RESOURCES-MIB — CPU, memory, storage
- CISCO-PROCESS-MIB — Cisco-specific CPU details
- CISCO-MEMORY-POOL-MIB — Cisco memory details
- BGP4-MIB, OSPF-MIB — routing protocol state
Monitoring systems (PRTG, SolarWinds, LibreNMS, Zabbix) ship with pre-built MIBs and templates — you rarely need to look up OIDs by hand.
Commands — SNMPv3 config (recommended)
! Create a view limiting what can be read (good practice)
SW1(config)# snmp-server view READ-VIEW iso included
SW1(config)# snmp-server view READ-VIEW 1.3.6.1.6.3 excluded ! exclude SNMP config from view
! Create an SNMPv3 group
SW1(config)# snmp-server group ADMINS v3 priv read READ-VIEW
! Create an SNMPv3 user (auth + privacy)
SW1(config)# snmp-server user monitor ADMINS v3 auth sha auth-password priv aes 256 priv-password
! Where to send traps
SW1(config)# snmp-server host 10.0.99.5 version 3 priv monitor
! Enable trap types
SW1(config)# snmp-server enable traps
SW1(config)# snmp-server enable traps snmp linkdown linkup coldstart warmstart
SW1(config)# snmp-server enable traps config
SW1(config)# snmp-server enable traps cpu threshold
Commands — SNMPv2c (only on isolated networks)
! Read-only community
SW1(config)# snmp-server community public RO
! Read-write — basically gives full control. Use sparingly.
SW1(config)# snmp-server community secret RW
! ACL restricting which IPs can query
SW1(config)# ip access-list standard SNMP-ALLOWED
SW1(config-std-nacl)# permit host 10.0.99.5
SW1(config)# snmp-server community public RO SNMP-ALLOWED
! Trap host
SW1(config)# snmp-server host 10.0.99.5 version 2c public
Verification
SW1# show snmp
SW1# show snmp user
SW1# show snmp host
SW1# show snmp group
SW1# show snmp view
From your laptop (Linux/macOS), test with snmpwalk:
$ snmpwalk -v3 -l authPriv -u monitor -a SHA -A auth-password \
-x AES -X priv-password 10.0.0.1 ifDescr
If you get back the list of interface descriptions, SNMPv3 is working.
Common mistakes
-
Using v2c with default communities (
public/private). Anyone on the management VLAN can poll your devices. Always set unique community strings — or better, use v3. -
Read-write community enabled with default password. An attacker who guesses the community can reconfigure everything via SNMP SET. Use RO only unless you actively need writes; if you do, use long random community strings on v3.
-
No ACL on SNMP. Polling can come from anyone if no ACL is set. Always restrict by source IP.
-
Traps over UDP, no fallback. UDP traps can be lost. For critical alerts, use INFORM (acknowledged) instead.
-
Polling too aggressively. 1-second polls on 500 devices = constant CPU on devices. Match polling rate to monitoring need (1-5 min is typical).
-
Confusing community string with username. v2c uses a community string (one “password” shared by everyone). v3 uses per-user credentials. v3 is properly authenticated; v2c is not.
-
Forgetting
snmp-server enable traps. Configured a trap host but no events arriving? Probably forgot to enable specific trap types globally.
Lab to try tonight
- Install LibreNMS, PRTG, or any SNMP monitoring tool (free tier available for most).
- Configure SNMPv3 on a Cisco router using the commands above. Use strong passwords.
- Add the device to your monitoring tool with SNMPv3 credentials.
- Verify metrics appear (CPU, interface utilization, uptime).
shutdownan interface — verify a trap arrives in the monitoring tool.- From CLI:
snmpwalk -v3 ...against the device. Match the values to what the GUI shows. - Bonus: install a v2c community and try
snmpwalk -v2c -c public .... Notice the plain-text community intcpdumpcapture.
Cheat strip
| Concept | Plain English |
|---|---|
| SNMPv1 / v2c | Community-string auth, plain text. Don’t use in 2026. |
| SNMPv3 | Per-user, hashed auth, optional AES encryption. Use this. |
| Manager | The polling / receiving system |
| Agent | The device being polled |
| GET | Manager reads from agent |
| TRAP | Agent pushes event to manager (UDP, no ACK) |
| INFORM | Agent pushes event, waits for ACK (more reliable) |
| OID | Object Identifier — tree path like 1.3.6.1.2.1.2.2.1.10.1 |
| MIB | Module defining a chunk of OIDs (IF-MIB, etc.) |
| UDP 161 | Polling (agent listening) |
| UDP 162 | Traps (manager listening) |
| Read-only / read-write | RO is safe; RW = remote config. Limit RW carefully. |