What is SNMP?

Simple Network Management Protocol (SNMP) is an open standard for monitoring and managing devices on IP networks. A management station polls devices for status and performance data, and devices push traps the instant a condition changes – the mechanism most network monitoring platforms use to watch routers, switches, firewalls, and SD-WAN appliances.

Key takeaways

• SNMP lets a manager poll devices and lets devices push alert traps.
• SNMPv1 and SNMPv2c rely on community strings; SNMPv3 adds real security.
• MIBs define the OIDs a device exposes, from CPU load to interface counters.
• Traps notify once; informs add acknowledgment and retransmission.
• VOS devices support SNMPv2c and SNMPv3 with USM users and VACM views.

On this page: Why it matters · How it works · Versions of SNMP · SNMP & Versa · FAQ

Why is SNMP important?

Every operations team needs to know a device is unhealthy before a user complains. SNMP makes that possible: a management station polls routers, switches, firewalls, and SD-WAN appliances for CPU, memory, and session counters, while devices push traps the instant an alarm condition – a link down, a disk failure, a tunnel drop – occurs.

SNMP has shipped on nearly every managed network device for three decades, so one platform can poll gear from dozens of vendors through a single protocol. SNMPv3 closed the original design’s biggest weakness – clear-text community strings – by adding authenticated, encrypted messaging, which is why SNMP remains the default choice for device monitoring today.

What is SNMP?

SNMP works on a manager/agent model. An SNMP agent on the monitored device exposes managed objects, each identified by an object identifier (OID) and defined in a Management Information Base (MIB) – a dictionary of what that device can report. An SNMP manager sends GET requests to read OID values, or SET requests to change them.

Two message flows carry alerts the other way. A trap is fire-and-forget – no acknowledgment, so a lost trap goes unnoticed. An inform is the same idea with a receipt: the manager acknowledges it, and the agent retransmits until it does or the retries run out. SNMPv3 adds the User-based Security Model (USM), authenticating and encrypting messages per user, and the View-based Access Control Model (VACM), restricting which OIDs each user can access.

Versions of SNMP

Three protocol versions are in use. SNMPv1 is the original 1988 design – functional but effectively obsolete. SNMPv2c is what most devices still run: it adds bulk retrieval and keeps SNMPv1’s community-string model, a shared plaintext string acting as a weak password. SNMPv3 replaces community strings with per-user authentication (MD5 or SHA) and optional encryption (DES or AES) through USM, plus VACM access control – the only version secure on an untrusted wire.

Deployments also choose between traps for low-overhead alerts and informs for guaranteed delivery, and depend on MIBs that vary by vendor and device type.

SNMP & Versa

VOS devices ship as full SNMP agents, configured through Director device templates under Objects & Connectors > Connectors > SNMP: trap profiles define which manager receives alerts, communities set the SNMPv2c string, and agent settings choose which protocol versions the device accepts. USM users carry SNMPv3 authentication and privacy settings; VACM restricts what each user can read or be notified about. See Configure SNMP for the full procedure.

VOS device alarms default to Analytics and Director, but nearly every alarm type – CPU, disk, interface, BGP, HA, and more – can also target SNMP, turning health events into traps a collector can consume. That also needs the VNF manager setting: the SNMP server’s address and the interface used to reach it. When SNMP misbehaves, Troubleshoot SNMP on VOS Devices walks through the devel.log and snmp.log files to isolate community mismatches, missing SNMPv3 users, or reachability problems.

Frequently asked questions

What is the difference between SNMP polling and traps?

Polling is manager-initiated: the manager sends a GET request and the agent replies, on a schedule the manager sets. Traps are agent-initiated: the device pushes a notification the moment a condition occurs, without being asked – why traps catch events polling would miss.

Why is SNMPv3 more secure than SNMPv2c?

SNMPv2c authenticates with a community string sent in clear text, readable or spoofable by anyone capturing the traffic. SNMPv3 replaces that with per-user authentication (MD5 or SHA), optional encryption (DES or AES) through USM, and VACM access control limiting what each user sees.

What is a MIB in SNMP?

A Management Information Base (MIB) is a machine-readable file defining the object identifiers (OIDs) a device exposes over SNMP – what each OID means, its data type, and whether it is readable or writable. Vendors publish device-specific MIBs; Versa’s Versa-MIB.pdf ships with each VOS release.

What port does SNMP use?

SNMP polling requests and responses use UDP port 161. SNMP traps and informs use UDP port 162 by default. Both ports must stay open along the full path between the manager or trap collector and the monitored device, or requests and alerts never arrive.

What is the difference between an SNMP trap and an inform?

A trap is sent once with no acknowledgment, so a dropped trap is never resent or noticed. An inform is the same idea with a receipt: the manager acknowledges it, and the agent retransmits until acknowledged or a retry limit is reached – trading overhead for reliability.

More on SNMP

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about SNMP, these are worth looking at next.