SNMP Explained: Versions, MIBs, OIDs and Traps for Network+

SNMP — Simple Network Management Protocol — is how monitoring systems read status from network devices and how devices report problems. This article covers the protocol itself; community string security is covered separately.

The ports

UDP 161 for queries from the manager to the agent. UDP 162 for traps and informs from the agent to the manager.

Both directions matter when writing firewall rules, and mixing them up is a common exam trap. Think of 161 as "asking" and 162 as "telling". SNMPv3 with TLS uses 10161 and 10162, which is worth recognising but rarely tested.

The components

Manager. The monitoring system that queries devices and receives traps.

Agent. Software on the managed device that answers queries and sends traps.

MIB — Management Information Base. The structured catalogue of what can be queried on a device, organised as a tree.

OID — Object Identifier. A dotted-numeric address for one specific value in that tree, such as 1.3.6.1.2.1.1.3.0 for system uptime.

The relationship is worth stating plainly because the exam tests it: the MIB is the map, and the OID is a coordinate on that map. Vendors publish their own MIBs for device-specific values on top of the standard ones.

Polling versus traps

Two models, and knowing when each is appropriate is the practical exam question.

Polling is the manager asking, on a schedule. Predictable, gives you trend data, and catches a device that has gone silent — because a poll that times out is itself information. The cost is delay: with a five-minute interval, you learn about a failure up to five minutes late, and it generates constant traffic across the whole estate.

Traps are the device telling you, immediately, when something happens. Fast and low-overhead, but unreliable — a trap is UDP and fire-and-forget. If it is lost, nobody ever knows it existed. A device that loses power may not manage to send anything at all.

Informs are acknowledged traps. The manager confirms receipt and the agent retransmits if it does not hear back. More reliable, slightly more overhead, and introduced in v2c.

Real deployments use both: polling for trends and for detecting silence, traps or informs for immediate notification.

The versions

Version	Authentication	Encryption
v1	Community string, plaintext	None
v2c	Community string, plaintext	None
v3	Username with HMAC	Yes (DES/AES)

v1 is the original, with 32-bit counters that wrap quickly on fast interfaces.

v2c added 64-bit counters, bulk retrieval via GetBulk, and informs. The "c" stands for community-based — it kept v1's plaintext community string authentication, which is why it is no more secure than v1.

v3 is the only version with real security, offering three levels: noAuthNoPriv (no authentication, no encryption), authNoPriv (authenticated, not encrypted) and authPriv (authenticated and encrypted). authPriv is the one to specify.

The exam point is blunt: if a scenario asks for secure network monitoring, the answer is SNMPv3 with authPriv. v2c sends credentials in cleartext across the network.

The operations

Get retrieves one value. GetNext walks to the next OID in the tree, which is how an SNMP walk enumerates a device. GetBulk (v2c and later) retrieves many values in one request, far more efficiently than repeated GetNext. Set writes a value, changing device configuration. Trap and Inform are the agent-initiated notifications.

Note Set. SNMP is not read-only by design — write access allows reconfiguring or shutting down interfaces. Read-only access should be the default, and write access granted only where it is genuinely needed.

Security in brief

Because SNMP is so widely deployed and so often left at defaults, it is a favourite target. Use v3 with authPriv. Restrict access by source IP with an ACL. Prefer read-only. Never leave default community strings in place. And note that SNMP is also a DDoS amplification vector — an exposed agent responds to small queries with large replies, so it should never be reachable from the internet.

What to remember

SNMP uses UDP 161 for polling and UDP 162 for traps. The MIB is the catalogue, the OID is the address of a specific value. Polling gives trends and detects silence; traps are immediate but unreliable; informs are acknowledged traps. Only v3 offers authentication and encryption, and authPriv is the level to use.

Related reading: SNMP community strings · Syslog servers · NetFlow and sFlow