SNMP — Simple Network Management Protocol

Why it exists

Operators need a common way to poll counters and receive device events across many vendors without scraping CLI.

SNMPv2c is still common and still weak: community strings are not encryption. Prefer SNMPv3 USM where the platform supports it.

GETBULK walks a table efficiently

A manager uses GETBULK to retrieve repeated lexicographic successors. Oversized max-repetitions or mishandled exceptions abort a walk that GETNEXT would have finished slowly.

Link
Blocking
Packet in flight
Discarded
Emphasis

Select a device to read its state. Arrow keys walk the topology.

Text equivalent of this diagram

Devices and links at this step
Element	Kind	State
NMS	host	—
Agent · UDP 161	router	—
NMS — Agent · UDP 161	link	up

1 / 3

The manager sends GetBulkRequest with non-repeaters and max-repetitions. The agent returns successive variable bindings without a GETNEXT round trip per row.

What changed

GetBulkRequest: NMS → Agent · UDP 161
max-repetitions set

How it works

Object identifiers name managed objects. GET retrieves instances; GETNEXT and GETBULK walk lexicographic order; SET writes when the view allows.

Notifications are separate: SNMPv2-Trap is one-way; InformRequest expects a Response. Both typically use UDP.

The SNMP architecture (RFC 3411) separates applications, the message processing model, and security models such as USM (RFC 3411).

On the wire

Constructed examples, encoded from the field table below them — not captured traffic.

IPv4 or IPv6: Protocol number 17. The addresses are borrowed back for the checksum pseudo-header. RFC 768
UDP header: Source port, destination port, length, checksum. RFC 768
Payload: DNS, DHCP, a VXLAN-encapsulated frame, a QUIC packet — whatever the destination port implies. RFC 768

Configure it

```
snmp-server group RO v3 priv
snmp-server user monitor RO v3 auth sha <configured out of band> priv aes 128 <configured out of band>
```
USM user with authentication and privacy. Security level priv must match what the NMS sends or messages are discarded.
Common mistake: Configuring authPriv on the agent while the NMS still uses authNoPriv — silent timeouts.
RFC 3414 §1.1
```
access-list 10 permit 198.51.100.0 0.0.0.255
snmp-server community <temporary-lab-only> RO 10
```
If v2c must remain briefly for migration, ACL it tightly and prefer removing it. Community strings are not encryption.
Common mistake: Leaving “public”/“private” communities enabled beside v3.
Cisco IOS XE — Configuring SNMP Support §Configuring SNMP Support

Verify

show snmp user: v3 user monitor present with auth and priv protocols.
show snmp group: Group security model v3 / level priv.

Caveats

Marked draft: syntax has not been checked against Cisco documentation or a device.
Placeholder secrets only — never commit real auth/priv passwords.

When it breaks

Symptom first, because that is what you have when it happens.

A table walk stops after the first few rows.
Narrow it down
1. Read error-status and error-index on the Response.
2. Reduce GETBULK max-repetitions and retry.
Cause
The response exceeds an agent or path size limit, or one binding exception aborts the manager’s walk.
Fix
Use bounded GETBULK and handle exception values per binding.
Traffic graphs drop to zero or spike after a reboot.
Narrow it down
1. Correlate counters with agent uptime and discontinuity markers.
2. Confirm 32-bit versus 64-bit counter objects.
Cause
The collector treated a reset or wrap as ordinary monotonic growth.
Fix
Reset baselines when uptime or discontinuity time changes; prefer high-capacity counters.
Traps are missing but polling works.
Narrow it down
1. Check notification destination and source address.
2. Distinguish trap counters from inform counters.
Cause
Traps are unacknowledged and can be lost; source address mismatches also hide events.
Fix
Use informs where acknowledgement matters; configure a stable reachable source.
SNMPv3 queries time out with no Response.
Narrow it down
1. Compare username, auth/priv protocols, and passwords.
2. Confirm engineID discovery and security level (authPriv vs authNoPriv).
Cause
USM discards messages that fail authentication or do not meet the required security level.
Fix
Align USM credentials and level; rediscover engineID after device replacement.
Unauthorized hosts can read interface counters.
Narrow it down
1. List communities and views on the agent.
2. Check whether SNMPv2c is still enabled beside v3.
Cause
A permissive community or overlapping v2c access remains enabled.
Fix
Disable unused communities; restrict views and source addresses; migrate to v3.

Design notes

Counter discontinuities after reboot or wrap invalidate baselines. Correlate with sysUpTime / discontinuity objects before graphing deltas.

Views and groups bound what a user or community may see. A working poll with empty interesting OIDs is often an ACL/view problem, not “SNMP down.” Cisco IOS XE — Configuring SNMP Support §Configuring SNMP Support

Misconceptions

“An OID is just a counter name.”: An OID names an object in a hierarchical schema; an instance may hold a counter, string, state, address, or writable control.
“A trap proves the manager received the event.”: A trap has no application acknowledgement. An inform is the notification that expects a Response.
“SNMPv3 authentication encrypts the MIB values.”: Authentication and privacy are separate USM services. authNoPriv authenticates without encrypting the scopedPDU.

More walkthroughs

USM authPriv versus community stringsdesign-choice

SNMPv2c community strings are shared secrets in the clear on the wire. SNMPv3 USM can authenticate and encrypt; mis-matched security level or engineID produces silent discard.

Link
Blocking
Packet in flight
Discarded
Emphasis

Select a device to read its state. Arrow keys walk the topology.

Text equivalent of this diagram

Devices and links at this step
Element	Kind	State
NMS · USM user	host	—
Agent · v3	router	—
NMS · USM user — Agent · v3	link	up

1 / 3

A community-based GetRequest authenticates only by a string the agent compares. Anyone who can sniff or guess the community can read or write within that view.

What changed

Community is not encryption

Trap lost; inform expects acknowledgementfailure

A trap is an unacknowledged notification. An inform expects a Response. UDP loss plus traps produces missing events while polling still looks healthy.

Link
Blocking
Packet in flight
Discarded
Emphasis

Select a device to read its state. Arrow keys walk the topology.

Text equivalent of this diagram

Devices and links at this step
Element	Kind	State
Agent	router	—
UDP loss	zone	—
NMS · 162	cloud	Event: never seen
Agent — UDP loss	link	up
UDP loss — NMS · 162	link	up

1 / 3

The agent sends a Trap-PDU toward the configured destination. There is no application acknowledgement — loss is invisible to the agent.

What changed

Trap: Agent → UDP loss
Trap dropped
NMS · 162: Event → never seen

Check yourself

Which operation efficiently walks a table?
Which notification expects acknowledgement?
What does an SNMPv2c community string primarily provide?
What does SNMPv3 authPriv provide beyond a community string?
What must a collector check when a counter falls abruptly?
What does an OID identify?
What does a successful SET require beyond connectivity?
Why can SNMPv3 fail after a device is replaced even with the same username?

Why it exists

GETBULK walks a table efficiently

How it works

On the wire

Configure it

Verify

Caveats

When it breaks

A table walk stops after the first few rows.

Narrow it down

Cause

Fix

Traffic graphs drop to zero or spike after a reboot.

Narrow it down

Cause

Fix

Traps are missing but polling works.

Narrow it down

Cause

Fix

SNMPv3 queries time out with no Response.

Narrow it down

Cause

Fix

Unauthorized hosts can read interface counters.

Narrow it down

Cause

Fix

Design notes

Misconceptions

More walkthroughs

USM authPriv versus community stringsdesign-choice

Trap lost; inform expects acknowledgementfailure

Check yourself

Related

NetFlow / IPFIX

NETCONF

Telemetry