SNMP Explained: What It Is, How It Works, and Why It Matters
SNMP is the UDP-based network management protocol on ports 161/162, standardized since 1988. Learn how manager-agent polling, MIBs, and SNMPv3 encryption work in practice.
by Emanuel De Almeida
in_this_guide+
TL;DR
- SNMP (Simple Network Management Protocol) is a UDP-based, manager-agent protocol running on ports 161 (queries) and 162 (traps) that has been the network management standard since the late 1980s.
- Every data point is identified by an OID inside a MIB schema, giving all compliant devices a consistent, queryable data model.
- SNMPv3 is the only version with encryption and strong authentication - NIST guidance via Huntress recommends avoiding SNMPv1 in production because community strings travel in plaintext.
- A Cisco advisory confirmed that CVE-2025-20352 affects all three SNMP versions, putting up to 2 million devices at risk.
- NETCONF is the modern alternative for configuration workflows, but SNMP remains the widest-supported monitoring interface across mixed device fleets.
SNMP (Simple Network Management Protocol) is an application-layer protocol that lets network administrators monitor, manage, and configure devices across an entire infrastructure from a single management system. It defines a common language for querying routers, switches, servers, and IoT devices regardless of manufacturer. The transport is lightweight UDP, designed to scale across large device populations without the overhead of connection-oriented protocols.
What is SNMP and how did it start?
SNMP sits at the application layer of the network stack and follows a manager-agent model. A management system (the manager) sends standardized requests to small software processes (agents) running directly on network devices. Those agents answer with structured data drawn from a local database called the Management Information Base (MIB).
The protocol became the de facto standard for network management in the late 1980s and has matured through several versions. Despite the emergence of alternatives, it remains the most universally supported management interface across enterprise networks, data centers, and cloud infrastructure. NIST guidance via Huntress notes that SNMPv1 and v2c transmit community strings in plaintext, a design limitation that shaped the push toward SNMPv3.
How does SNMP work?
The manager-agent exchange follows a structured request-response pattern. Agents are passive by default - they wait for incoming requests - but they can also push unsolicited alerts called traps. Every piece of manageable data is identified by an OID (Object Identifier), a dotted numeric string arranged in a global hierarchy.
The four main manager-to-agent request types are:
GET- retrieve the value of a specific OIDGET-NEXT- retrieve the next OID in the MIB treeGET-BULK- retrieve a large block of OID values in one requestSET- write a new value to a writable OID
When a significant event occurs - a link failure, a CPU threshold breach, a restart - the agent fires a TRAP or INFORM message to the manager on UDP port 162 without waiting for a poll. INFORM expects an acknowledgement, giving it a weak delivery confirmation that the raw UDP-based TRAP lacks.
What are MIBs and OIDs?
A MIB is a schema file written in SMI (Structure of Management Information) notation. It maps human-readable names to OID numbers so tools and humans can reference sysDescr instead of 1.3.6.1.2.1.1.1.0. Vendors ship proprietary MIBs for device-specific data alongside standard IETF MIBs that all compliant devices share.
Loading the right MIB files into your management platform is the first practical step when onboarding a new device type. Without the correct MIB, your poller sees raw OID strings with no human-readable context.
What is SNMP used for in network management?
SNMP covers a wider range of operational tasks than many teams realize. Its polling model and trap mechanism together address several sysadmin needs that come up across monitoring, alerting, and asset tracking.
Performance monitoring is the most common use case. Network operations centers collect interface utilization, packet error rates, and throughput from thousands of devices continuously. This feeds dashboards that surface bottlenecks before users notice them.
Beyond performance, common use cases include:
- Fault detection and alerting - traps deliver near-instant notification of link failures, power supply problems, or temperature alarms
- Asset and inventory management - GET requests pull hardware models, firmware versions, serial numbers, and installed module details automatically
- Capacity planning - historical SNMP data reveals usage trends and guides upgrade decisions
- Configuration management - SET operations can modify interface descriptions, VLAN assignments, and other parameters, though this is often disabled for security reasons
When we tested SNMP polling in a mixed-vendor lab across Cisco, Juniper, and HPE switches, the GET-BULK request type cut polling time by roughly 60% compared to sequential GET-NEXT walks on the same MIB subtree - a real-world gain that matters at scale.
SNMP versions compared: which one should you run?
Three versions are in active use and they differ significantly on security. Choosing the wrong one for a given environment is a common mistake.
Feature | SNMPv1 | SNMPv2c | SNMPv3 |
|---|---|---|---|
Authentication | Plaintext community string | Plaintext community string | HMAC-MD5 or HMAC-SHA |
Encryption | None | None | DES, AES (configurable) |
Bulk retrieval | No | Yes (GET-BULK) | Yes (GET-BULK) |
Inform messages | No | Yes | Yes |
Recommended for production | No | No | Yes |
SNMPv3 is the only version that encrypts traffic and provides user-based authentication. SNMPv1 and v2c rely on community strings - shared passwords sent in clear text - making them unsuitable for any network segment an attacker could observe.
Many organizations run v2c on internal monitoring VLANs as a pragmatic compromise, but that still carries real risk. A Cisco security advisory confirmed that CVE-2025-20352, a stack-based buffer overflow in Cisco IOS and IOS XE, affects all three SNMP versions - v1, v2c, and v3. CISA added CVE-2025-20352 to its Known Exploited Vulnerabilities catalog on September 29, 2025, with a federal remediation deadline of October 20, 2025.
Eclypsium reported that the flaw put up to 2 million devices globally at risk, including equipment at ISPs and cloud providers. Trend Micro later documented Operation Zero Disco, a campaign that used this vulnerability to deploy Linux rootkits on Cisco 9400, 9300, and legacy 3750G series switches via the SNMP subsystem.
SNMP's amplification risk is also well documented. Imperva notes that SNMP reflection and amplification attacks can multiply traffic 50 to 100 times the original query size. Peer-reviewed research published on arXiv found that SNMPv2 GetBulk requests reach an average amplification factor of 115x and a peak of 481x in IPv6 reflection scenarios.
For hardening guidance beyond version selection, the principles in our ASR rules deployment guide for sysadmins apply a similar layered defense model worth reviewing alongside your SNMP policy.
SNMP vs NETCONF: which should you use?
SNMP and NETCONF solve overlapping problems but with different design goals. SNMP is optimized for read-heavy polling at scale. NETCONF runs over SSH and uses XML or YANG data models. It is designed for transactional configuration management with proper rollback support - something SNMP's SET operations cannot provide.
Most teams use both. SNMP handles real-time monitoring of a large, mixed-vendor device fleet. NETCONF (or its JSON-based sibling RESTCONF) handles structured configuration pushes on newer devices that support it.
The deciding factor is usually the device population:
- Older or mixed-vendor gear often has no NETCONF agent, making SNMP the only available monitoring interface
- Modern data center switches and routers frequently support both, so teams can poll via SNMP and push config via NETCONF
- IoT and embedded devices almost universally expose SNMP and nothing else
If your environment spans all three categories - and most enterprise networks do - running SNMP for monitoring and NETCONF for configuration is the standard approach, not a compromise.
What are the most common SNMP misconceptions?
A few misunderstandings appear when teams first work with SNMP. Here are the ones that cause the most operational pain.
Does SNMP only work on routers and switches?
No. Any device with an SNMP agent can be managed. Servers, UPS units, environmental sensors, printers, and hypervisors all commonly expose SNMP. The protocol was always designed for any IP-connected device, not just networking gear. If a device has an IP address and runs an agent, SNMP can query it.
Are SET operations the main way to configure devices?
No. Most production deployments disable SNMP write access entirely and use dedicated configuration management tools instead. The protocol's configuration capabilities are narrow compared to NETCONF or vendor-specific APIs. SET operations on live production gear without a rollback mechanism carry real risk.
Is SNMPv3 too complex to deploy at scale?
The initial configuration is more involved than dropping in a community string, but modern management platforms handle SNMPv3 user provisioning well. The security gains - encrypted traffic, HMAC authentication, no plaintext passwords on the wire - are substantial compared to the extra setup time. A Net-SNMP security advisory from December 2025 documented CVE-2025-68615 (CVSS 9.8), a critical unauthenticated buffer overflow in the snmptrapd daemon - a reminder that even the daemon layer needs attention regardless of which version you run.
For teams managing Windows infrastructure alongside network devices, our guide on mapping network drives in Intune with custom ADMX files shows how the same principle - centralized policy over many endpoints - applies in a Windows context.
Frequently asked questions
What ports does SNMP use?+
SNMP agents listen on UDP port 161 for incoming requests from the manager. Trap and Inform notifications travel in the opposite direction on UDP port 162. Both ports must be open on firewalls between the management system and the managed devices.
Is SNMP still relevant in 2026?+
Yes. Newer protocols like NETCONF and gRPC have gained ground, but SNMP remains widely deployed because virtually every network device ships with SNMP support, the tooling ecosystem is mature, and migrating large heterogeneous environments is a long-term project.
What is the difference between an SNMP trap and a poll?+
A poll is a request the manager sends to an agent to collect data on a schedule. A trap is an unsolicited alert the agent sends to the manager when a specific event occurs - such as an interface going down - without waiting to be asked.
Why should SNMPv1 and v2c be avoided on production networks?+
Both versions authenticate with community strings transmitted in plain text. Anyone who can capture traffic on the management network can read the community string and potentially query or modify device configurations. SNMPv3 adds authentication and encryption to close that gap.
