What is SNMP?

SNMP (Simple Network Management Protocol) is a standard protocol monitoring systems use to read counters and status, such as interface traffic, from devices.

A device runs an SNMP agent, and a monitoring system (the manager) sends it requests over UDP port 161. Every value the agent can report has an object identifier (OID), a dotted number in a tree defined by MIBs: standard ones such as IF-MIB for interfaces, plus vendor MIBs for everything else. snmpget reads one OID and snmpwalk reads a whole branch, for example every interface's description and byte counters. Most counters only ever increase, so tools such as LibreNMS, Zabbix or Prometheus's SNMP exporter poll every few minutes and divide the difference by the interval to draw traffic graphs; on fast links use the 64-bit counters (such as ifHCInOctets), because 32-bit ones wrap too quickly. Devices can also push unsolicited notifications, called traps or informs, to UDP port 162.

There are three versions you will meet. SNMPv1 and SNMPv2c authenticate with a "community" string sent in clear text, so anyone on the path can read it; they should be restricted to a management network, set read-only, and limited to the monitoring server's address. SNMPv3 adds user-based authentication and encryption, and is the right choice anywhere less isolated. Common mistakes are leaving a default community such as public enabled, allowing write access, and forgetting that a firewall must permit UDP 161 from the poller. SNMP is gradually being supplemented by streaming telemetry and APIs, but it remains the most widely supported way to monitor routers and switches. The Operating VyOS lesson sets up SNMP alongside syslog and NetFlow on a real router.