Simple Network Management Protocol (SNMP)

SNMP has three components. The manager, running on a network management system, polls devices and collects data. An agent runs on each managed device and answers those queries. The Management Information Base (MIB) is the hierarchical database of variables the agent exposes, with each variable identified by a numeric object identifier (OID) — interface counters, CPU utilization, uptime, temperature, and so on.

Traffic flows in both directions. The manager sends Get, GetNext, and GetBulk requests to read values and Set requests to change a configurable one, and the agent replies with a Response. The agent can also speak first: a Trap is an unsolicited notification sent when an event occurs, such as an interface going down, which avoids waiting for the next polling interval. An Inform is a trap that requires acknowledgment from the manager, so it is retransmitted if no acknowledgment arrives. SNMP runs over UDP — agents listen on port 161, and managers receive traps and informs on port 162.

Version matters for security. SNMPv1 and SNMPv2c authenticate using community strings sent in cleartext, with a read-only string and a read-write string acting as simple passwords; anyone capturing the traffic can read them. SNMPv3 adds a user-based security model providing authentication, message integrity, and encryption, which is why it is the recommended version wherever the network carries anything sensitive. SNMPv2c also introduced GetBulk and the Inform message.

The CCNA covers SNMP in the network management portion of the exam blueprint, alongside Syslog, NTP, and device monitoring. Expect questions on the manager-agent-MIB relationship, the difference between polling and traps, the UDP port numbers, and why SNMPv3 is preferred over v2c.