Simple Network Management Protocol (SNMP)

In network administration, you need a reliable way to monitor devices and make changes when necessary. As networks grow, manual checks and one-off scripts don’t scale well. Simple Network Management Protocol (SNMP) solves this by giving network devices a standard way to share operational information and by giving administrators a consistent way to read (and sometimes change) that information.

SNMP’s core idea is simple: devices expose operational data - such as configuration settings, status, and performance counters - as a structured set of variables. A central management system can then collect, analyze, and (when allowed) modify those variables. Whether you’re managing a router, switch, or server, SNMP provides a consistent approach to network oversight.

The core components of SNMP

SNMP works through three main components: the SNMP Manager, SNMP Agent, and the Management Information Base (MIB).

Image

Image Title - Network diagram displaying SNMP roles

SNMP manager (Network Management System - NMS)

The SNMP Manager, also called a Network Management System (NMS), is usually a software application running on a central server or workstation. It acts as the administrator’s console:

• It initiates communication with managed devices.
• It collects and processes device data.
• It presents that data in a usable format (dashboards, reports, alerts).

Tools like Cisco Catalyst Center use SNMP to provide a broad view of the network, helping administrators visualize performance, generate reports, and receive event notifications.

SNMP agent

An SNMP Agent is a software component running on each managed device (for example, routers, switches, and servers). The agent:

• Collects and stores management information about the device.
• Responds to requests from the NMS with configuration, performance, and status data.

Cisco IOS devices, for example, come with a built-in SNMP agent.

Management Information Base (MIB)

The Management Information Base (MIB) is the structured collection of objects that an SNMP agent manages. It defines which variables (parameters, status values, counters) are available on a device.

MIBs are organized hierarchically. Each variable is uniquely identified by an Object ID (OID), which is a numerical string showing the variable’s position in the MIB tree. For example, a particular OID might represent a router interface’s bandwidth utilization.

It would look like this, for example: 1.3.6.1.2.1.31.1.1.1.10

MIBs include:

• Standard definitions (such as MIB-II), which are common across many devices
• Vendor-proprietary definitions, which are specific to a manufacturer (such as Cisco)

For an NMS to manage a device correctly, it needs the relevant MIBs so it can interpret OIDs and display the associated data in a meaningful way.

SNMP communication: Get, Set, and Notifications

SNMP uses specific message types for communication between managers and agents.

Polling for information (Get operations)

The NMS typically polls agents for data using “Get” operations:

• SNMP Get Request: The NMS asks an agent for the value of a specific MIB variable. The agent responds with an SNMP Get Response containing the requested data.
• SNMP GetNext Request: Useful for walking through lists or tables, this request asks for the next variable in the MIB after a specified one. This helps the NMS traverse a MIB without needing to know every OID in advance.
• SNMP GetBulk Request: Introduced in SNMPv2, GetBulk retrieves multiple successive variables in a single request, improving performance when collecting large data sets.

SNMP Get messages typically use UDP port 161

Configuring devices (Set operations)

The SNMP Set request message allows the NMS to write values to MIB variables, enabling remote configuration changes on a device. For example, an NMS could use a Set request to enable or disable an interface.

Because Set operations can change device behavior, they have serious security implications. They should be tightly controlled and protected with strong security measures.

Proactive notifications (Traps and Informs)

SNMP agents can also notify the NMS when important events occur:

• SNMP Trap: Available since SNMPv1. When a predefined event occurs (for example, an interface goes down), the agent sends a Trap to the NMS. Traps use UDP (port 162) and provide no application-layer reliability; if lost, they are not retransmitted. They are low-overhead and commonly used for non-critical alerts.
• SNMP Inform: Introduced in SNMPv2, Informs provide reliable notification. The agent sends an Inform and expects an acknowledgment from the NMS. If no acknowledgment is received, the agent retransmits the Inform. This improves delivery for critical notifications, with slightly more overhead.

Securing SNMP communications

SNMP can expose sensitive management data, so security is essential.

• Access Control Lists (ACLs): Use ACLs on devices to restrict SNMP access to only trusted NMS IP addresses.
• SNMPv1 and SNMPv2c Communities: These versions use “community strings” (clear-text passwords) for authentication. Both the NMS and agent must share the same string. This is insecure because community strings are transmitted unencrypted and can be captured by eavesdropping.
• SNMPv3: This version adds a stronger security model:
  • Authentication: Verifies the sender’s identity using usernames and hashed passwords, helping prevent unauthorized access.
  • Integrity: Ensures messages haven’t been altered in transit. All messages sent in SNMPv3 are included with integrity.
  • Encryption (privacy): Encrypts message contents to protect sensitive data from eavesdropping. This optional feature provides confidentiality by encrypting the entire contents of SNMPv3 messages. If an attacker intercepts an encrypted SNMPv3 message, they will be unable to read its contents, protecting sensitive configuration data or operational statistics. This is often achieved using encryption algorithms like AES or DES.

SNMPv3 is the recommended version for secure network management because it provides authentication, integrity, and optional encryption.

The function of SNMP in network operations (CCNA Perspective)

For the CCNA 200-301 v1.1 exam preparation, it helps to connect SNMP concepts to real operational tasks:

1. Network monitoring and performance management: SNMP enables continuous monitoring of device status (CPU, memory), interface statistics (bandwidth, errors), and other critical metrics. This data helps administrators track performance trends, identify bottlenecks, and plan capacity.
2. Proactive problem identification and alerting: Administrators can set thresholds for MIB variables (e.g., high CPU usage). When a threshold is crossed, the agent sends a Trap or Inform to the NMS, which can then alert staff. This supports proactive troubleshooting before issues impact users.
3. Troubleshooting and diagnostics: SNMP provides diagnostic information on demand. By querying specific MIB variables, administrators can gather targeted data to help pinpoint root causes and speed up resolution.
4. Configuration management: While less common for routine changes, SNMP Set operations can be used for remote configuration. Because of security risks, this is often restricted or handled by more secure protocols like SSH.
5. Inventory and asset management: SNMP can collect device details like model, serial number, and software version, helping maintain an accurate network inventory.