Objective 4.4
Explain the function of SNMP in network operations
What SNMP does
Simple Network Management Protocol (SNMP) lets a central management station ask devices “how are you doing?” and lets devices shout “something just happened!” It is the foundation of most network monitoring dashboards: interface utilization graphs, CPU and memory charts, and “device down” alerts almost always come from SNMP.
The pieces:
- Manager (or Network Management Station, NMS): the monitoring server, such as SolarWinds, PRTG, LibreNMS, or Cisco Prime. It sends queries and receives notifications.
- Agent: software running on each managed device (router, switch, server, printer) that answers the manager’s queries and sends notifications.
- MIB (Management Information Base): the structured database of everything an agent can report, organized as a tree. Think of it as the device’s catalog of measurable things: interface counters, CPU load, uptime, temperature.
- OID (Object Identifier): the “address” of one variable in the MIB tree, written as dotted numbers, for example
1.3.6.1.2.1.1.3.0issysUpTime. Managers use OIDs to say exactly which variable they want.
An analogy: the MIB is a warehouse; each OID is a shelf location; the manager is a clerk sending a runner (the agent) to fetch or update what is on a given shelf.
SNMP message types
| Message | Direction | Purpose |
|---|---|---|
| Get | Manager to agent | Read one variable (by OID) |
| GetNext / GetBulk | Manager to agent | Walk through a table of variables (GetBulk is v2c and later) |
| Set | Manager to agent | Change a variable (e.g., shut an interface). Requires read-write access |
| Response | Agent to manager | The answer to Get/Set |
| Trap | Agent to manager | Unsolicited alert (“interface down”); not acknowledged |
| Inform | Agent to manager | Like a trap, but the manager acknowledges it and the agent retransmits if no ack arrives (v2c and later) |
Polling (Get) is the manager pulling data on a schedule, typically every few minutes. Traps and informs are the device pushing an event the moment it happens. A good monitoring design uses both: polling for graphs and trend data, traps for immediate alerts.
Ports
SNMP runs over UDP. The agent listens on UDP 161 for Get/Set requests from the manager. The manager listens on UDP 162 for traps and informs from agents. A firewall between an NMS and its devices must allow UDP 161 toward the devices and UDP 162 back toward the NMS.
SNMP versions and security
| Version | Authentication | Encryption | Notes |
|---|---|---|---|
| SNMPv1 | Community string (plain-text password) | None | Original, 32-bit counters, mostly obsolete |
| SNMPv2c | Community string (plain-text password) | None | Adds GetBulk, Inform, 64-bit counters; still very common |
| SNMPv3 | Username with MD5/SHA authentication | DES/AES privacy (encryption) | The only secure option; should be used wherever possible |
A community string is simply a password sent in clear text in every packet. There are two kinds: a read-only (RO) community lets the manager Get; a read-write (RW) community also allows Set. Anyone who sniffs the RW community string can reconfigure your device, so v1/v2c should be restricted with an ACL and never use defaults like public and private.
SNMPv3 replaces communities with users and three security levels:
- noAuthNoPriv: username only, no authentication, no encryption.
- authNoPriv: authenticates the message (MD5 or SHA hash) so it cannot be forged, but data is readable.
- authPriv: authenticates and encrypts (DES, 3DES, or AES). This is what “auth/priv” means when people describe SNMPv3.
Basic SNMP configuration
! Restrict who may poll us
R1(config)# access-list 10 permit host 192.168.1.50
! Read-only community, restricted by ACL 10
R1(config)# snmp-server community NetMonRO ro 10
! Read-write community (only if truly needed)
R1(config)# snmp-server community NetMonRW rw 10
! Descriptive info the NMS will display
R1(config)# snmp-server location Building A, Floor 2
R1(config)# snmp-server contact netops@example.com
! Send v2c traps to the manager using the RO community as the credential
R1(config)# snmp-server host 192.168.1.50 version 2c NetMonRO
! Turn on trap generation (all traps; or list specific ones)
R1(config)# snmp-server enable traps
The snmp-server host command names the manager that receives traps; add the keyword informs before version to send informs instead of traps. An SNMPv3 setup uses snmp-server group and snmp-server user with auth sha and priv aes 128 options; the exam expects you to recognize the concept, not memorize the full syntax.
Verification: show snmp shows counters of packets in and out and whether the agent is enabled; show snmp community lists communities; show snmp host lists trap receivers.