• Glossary
  • What is Simple Network Management Protocol (SNMP)?

Network observability glossary

What is Simple Network Management Protocol (SNMP)?

Simple Network Management Protocol (SNMP) is a network management protocol that lets a management station monitor and configure devices such as routers, switches, and servers. It exposes device data as objects in a Management Information Base, which the station reads by polling or receives through unsolicited trap notifications.

Let's simplify your DDI
Abstract isometric UI showing network ranges, usage bars, region names (EMEA/APAC), and a purple "Deploy" button
Key takeawaysKey takeaways are generated with AI assistance. Because automated summaries can occasionally contain errors or miss important context, always refer to the full blog post for complete information.

Simple Network Management Protocol (SNMP) is a standard network management protocol that enables monitoring and configuration of enterprise devices such as routers, switches, servers, and firewalls through a manager-agent model operating over UDP ports 161 and 162. SNMP exposes device data as objects in a Management Information Base (MIB) organized by Object Identifiers (OIDs), which the manager accesses through polling requests or receives via unsolicited trap notifications when events occur. Organizations must deploy SNMPv3 with authentication and encryption, maintain accurate MIB files, carefully manage polling intervals, and restrict access by source address to avoid security vulnerabilities, blind spots from misconfiguration, and performance degradation from excessive device CPU load.

  • SNMP uses two primary message types: Get/GetNext/GetBulk requests on UDP port 161 for polling specific or multiple objects in the MIB tree, and trap or inform notifications on UDP port 162 for immediate event alerting without waiting for the next polling cycle.
  • SNMPv1 and SNMPv2c transmit community strings in clear text with widely-known defaults such as ‘public,’ while SNMPv3 adds user-based authentication and optional encryption as defined in IETF RFC 3411 to protect against reconnaissance and unauthorized configuration changes.
  • Common operational failures include unconfigured trap destinations, firewall blocking of UDP port 162, SNMPv3 credential or engine ID mismatches, aggressive polling intervals that overload device CPUs, and use of incorrect or missing vendor MIBs that cause raw numeric OID display or misread counter values.

SNMP at a glance

AttributeValue
Full nameSimple Network Management Protocol
CategoryNetwork management protocol
Protocol and portUDP port 161 for requests to agents, UDP port 162 for traps and informs
OSI layerLayer 7 (application)
Primary useMonitoring and configuring network devices
Related termsMIB, Network monitoring, Syslog, NetFlow

How SNMP works

SNMP uses a manager and agent model. The agent runs on a managed device and exposes its data as objects identified by object identifiers (OIDs) and organized in a Management Information Base (MIB).

  1. Define the data: Each MIB describes the objects a device can report, such as interface counters or CPU load, and gives each object a unique OID in a tree structure.
  2. Send a request: The manager sends a message to the agent on UDP port 161. A Get request reads a specific object, GetNext and GetBulk step through the tree, and Set changes a writable value.
  3. Authenticate the request: SNMPv1 and SNMPv2c identify the sender with a community string. SNMPv3 adds user-based authentication and optional encryption.
  4. Return the response: The agent looks up the requested objects and sends the values or an error back to the manager.
  5. Send a notification: When a defined event occurs, such as a link going down, the agent sends a trap to the manager on UDP port 162 without being polled. An inform works like a trap but requires an acknowledgment.

An SNMP walk is a repeated series of GetNext or GetBulk requests that retrieves every object under a chosen point in the OID tree. It is commonly used to discover what a device exposes. Traps cover events between polling cycles, but UDP delivery of a plain trap is not guaranteed.

Why SNMP matters in enterprise networks

SNMP is supported by nearly every enterprise router, switch, firewall, printer, and server, which makes it a common source of data for monitoring tools. Polling interface counters, error rates, and hardware health lets teams spot capacity problems and failing equipment. Traps shorten the time to detect events such as link failures that would otherwise wait for the next poll.

Security depends heavily on the version in use. SNMPv1 and SNMPv2c send community strings in clear text, and default strings such as public are widely known. SNMPv3, defined in the IETF standards beginning with RFC 3411, adds authentication and encryption. Write access with a weak community string can let an attacker change device configuration, so many organizations restrict SNMP to read-only access and limit which hosts may query.

Poor management leads to blind spots and risk. Agents left unconfigured give no visibility, while excessive polling of many OIDs can load device CPUs. Stale MIBs cause misread values, and unrestricted SNMP exposed to untrusted networks invites reconnaissance and tampering. Keeping an inventory of agents, using SNMPv3, and filtering access by source address keep the protocol useful and safe.

Common SNMP issues

Devices left with community strings such as public or private allow anyone who can reach UDP port 161 to read data, and sometimes to write it. Security scans commonly flag this on printers and switches that were never hardened after installation.

A trap receiver sees nothing because the device has no trap destination configured, a firewall blocks UDP port 162, or the community or SNMPv3 user does not match. Because traps are unsolicited and SNMPv1 and SNMPv2c traps are not acknowledged, the sender gives no sign of failure.

Polls time out or return authentication errors when the manager and agent disagree on the security level, authentication protocol, or privacy protocol. A mismatch in the engine ID used for traps and informs is another frequent cause.

Aggressive polling intervals or large GetBulk walks over big tables, such as routing or ARP tables, can raise CPU use on older devices and produce gaps in graphs. Staggering polls and limiting the OIDs requested usually resolves it.

Without the correct vendor MIB loaded, tools show raw numeric OIDs or misread values. Counter wrap on 32-bit interface counters can also produce false spikes on fast links, where 64-bit counters are the better choice.

See how unified DDI simplifies network operations

Manage DNS, DHCP and IP addresses from one platform with automation, visibility and control built in.

Talk to us

SNMP FAQ

Related terms

Article

User Datagram Protocol (UDP)

An alternative protocol to TCP used primarily for establishing low-latency and loss-tolerating connections between applications on the internet.

Learn more
Article

SNMP module

An SNMP extension; this should be covered under SNMP entry.

Learn more
Article

NTP (network time protocol)

A networking protocol for clock synchronization between computer systems over packet-switched, variable-latency data networks.

Learn more
Article

Remote Authentication Dial-In User Service (RADIUS)

A client/server protocol and software that enables remote access servers to communicate with a central server to authenticate dial-in users and authorize their access to the requested system or service.

Learn more
Article

AAA (Authentication, Authorization and Accounting)

Refers to a family of protocols that mediate network access.

Learn more
Article

ACL (Access Control List)

Limits which entities are allowed to perform certain functions against a DNS server, such as sending queries or performing dynamic updates.

Learn more
Article

OSI model

A conceptual model that characterizes and standardizes the communication functions of a telecommunication or computing system.

Learn more
Article

Transport layer security (TLS)

A cryptographic protocol to provide communications security over a computer network.

Learn more
Browse the full glossary