What is SNMP, and how do you use it to monitor network devices?
How SNMP works — versions, OIDs and MIBs, polling versus traps — what to monitor with it, and how to enable it securely on switches and routers.
Almost every network device, from a basic switch to a server-room UPS, speaks SNMP. That's why it remains the backbone of network monitoring.
What is SNMP?
SNMP (Simple Network Management Protocol) lets a monitoring system (the manager) ask a device (the agent) questions such as “how much traffic is on this interface?” or “how hot is the CPU?”.
OIDs and MIBs, simply
Every readable value has a numeric identifier, an OID: 1.3.6.1.2.1.1.3.0 is the device's uptime (sysUpTime). A MIB is the file that names and describes those identifiers. Standard MIBs (like IF-MIB for interfaces) are the same everywhere; vendors add their own, for example for temperature sensors. An SNMP walk lists every OID a device exposes when you don't know which one you need.
SNMP versions
| Version | Authentication | Use |
|---|---|---|
| v1 | Community (plain text) | Legacy devices only |
| v2c | Community (plain text) | Most common; 64-bit counters for fast links |
| v3 | User, password and encryption | Most secure; for sensitive networks |
Polling vs traps
- Polling: the monitoring system asks on a schedule (say, every minute) — continuous data for graphs and trends.
- Traps: the device sends a message the moment something happens (an interface going down) — fast, but UDP means it can be lost.
Use both: polling for continuous data, traps for instant notice of events like linkDown.
What to monitor with SNMP
- Interface traffic in and out, and utilisation against link speed
- Interface errors and discards
- Interface state (up/down)
- CPU, memory and temperature
- Uptime, to catch unexpected reboots
- UPS battery and load, temperature and humidity sensors
Enabling SNMP securely
- Remove the default
publiccommunity and use a long random string. - Enable SNMP read-only — write access isn't needed.
- Restrict access with an ACL to the monitoring server's IP.
- Use SNMPv3 with authentication and encryption where you can.
- Keep communities in the monitoring system's encrypted vault, not a text file.
Conclusion
Set up well, SNMP gets the most information out of your network for the least effort. In BehMon you can define custom SNMP sensors with your own OIDs, find OIDs with the built-in SNMP walk browser, and turn linkDown/linkUp traps straight into alerts. More on BehMon monitoring.