IP Services · Topic 4 of 9

The Function of SNMP

Learn what SNMP does in network operations, how managers and agents exchange data, the differences between v1, v2c and v3, and what traps and informs are.

  • 4 min
  • Exam objective 4.4
In a nutshell
  • The manager asks questions. The agent answers and sends traps.
  • The MIB is the catalogue. An OID names one value.
  • Get reads, set changes, and a trap is an unsolicited alert.

What it is

SNMP lets a management system monitor, and if allowed change, network devices.

It is how monitoring tools see interface traffic, CPU load and whether a device is up. Without a standard, every vendor would need its own tool. SNMP gives routers, switches, firewalls and printers one common language.

Four parts to know:

  • SNMP manager: the management station that asks questions and collects answers. Also called an NMS.
  • SNMP agent: the software on each managed device that answers and reports problems.
  • MIB (Management Information Base): the organised catalogue of values a device can report.
  • OID (Object Identifier): the numbered address of one item in the MIB tree, such as one interface counter.

How it works

The manager and agent talk using a small set of operations, in two directions.

ManagerNMSget request UDP 161Agentrouterresponse with valueManagerNMSAgentlink goes downtrap UDP 162ManagerNMSacknowledges an informAgent

The operations

OperationWho sends itPurpose
GetManagerRead one value by OID
Get nextManagerRead the next item, to walk a table
Get bulkManagerRead many values at once (SNMPv2c and later)
SetManagerChange a value on the device
ResponseAgentAnswer to any request
TrapAgentUnsolicited alert, such as a link going down
InformAgentA trap the manager must acknowledge (v2c and later)

Polling and notifications

Polling means the manager asks on a schedule. Notifications mean the device speaks up on its own. Most networks use both: polling for trend data, and traps for events that cannot wait.

SNMP uses UDP. Requests go to port 161 on the agent. Traps and informs go to port 162 on the manager.

The three versions

VersionSecurityNotes
SNMPv1Community string onlyOriginal, no encryption
SNMPv2cCommunity string onlyAdds get bulk, informs and larger counters
SNMPv3Users, authentication, optional encryptionThe secure choice

In v1 and v2c, a community string works like a shared password. A read-only string allows reading, and a read-write string allows changes. It travels in clear text, so anyone who captures the traffic can read it.

Watch out

The "c" in v2c stands for community. SNMPv2c is not meaningfully more secure than v1.

SNMPv3 security levels

SNMPv3 replaces communities with users and offers three levels:

  • noAuthNoPriv: a user name only, with no authentication and no encryption.
  • authNoPriv: authenticated, so the sender is known and the message is unchanged, but not encrypted.
  • authPriv: authenticated and encrypted.

A basic Cisco setup

snmp-server community MONITOR ro
snmp-server host 10.1.1.50 version 2c MONITOR
snmp-server enable traps
  • The first line creates a read-only community.
  • The second says where to send notifications.
  • The third turns on trap generation.

The objective asks you to explain the function, so detailed configuration matters less.

What to remember for the exam

Eight points cover most SNMP questions.

  • The manager asks questions. The agent answers and sends traps.
  • The MIB is the catalogue. An OID names one value.
  • Get reads, set changes, and a trap is an unsolicited alert.
  • An inform is a trap that must be acknowledged.
  • SNMPv1 and v2c use community strings sent in clear text.
  • SNMPv3 adds user authentication and optional encryption. The level with both is authPriv.
  • Polling is manager-initiated. Traps and informs are device-initiated.
  • Agent queries use UDP 161. Traps use UDP 162.
Exam tip

If a question asks which version is secure, the answer is SNMPv3, and the level that also encrypts is authPriv.

Common mistakes

These five errors appear most often.

Calling a trap a poll. A trap is sent without being asked. A poll is a request from the manager.

Mixing up manager and agent. The agent runs on the managed device. A router is an agent, not a manager.

Leaving write access open. A read-write community lets someone change settings. Use read-only unless a change is truly needed.

Treating an inform as better in every way. It is acknowledged, but it costs more because the device must wait for the reply and may retry.

Assuming a community string is secret. It is sent in clear text in v1 and v2c.

Check yourself

Try these three prompts.

  • What are the roles of the manager, the agent and the MIB, and how does an OID relate to them?

    The manager asks questions and collects answers, the agent on the managed device answers and reports problems, and the MIB is the catalogue of values a device can report. An OID is the numbered address of one item in the MIB tree.

  • How does a trap differ from an inform, and which gives the sender confirmation?

    A trap is an unsolicited alert from the device, and an inform is a trap the manager must acknowledge. The inform gives the sender confirmation.

  • Why is SNMPv3 more secure than v2c, and which of its levels adds encryption?

    SNMPv3 uses users with authentication and optional encryption, while v2c uses only a clear-text community string. The authPriv level adds encryption.

Topic 4 of 9 in IP Services

Test yourself on IP Services

The full Cisco CCNA 200-301 question bank has 1,206 questions, with timed practice exams and an explanation for every answer.

SubscribeTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.