What is SNMP?
SNMP (Simple Network Management Protocol) is an IETF standard protocol that lets a management system read status and performance data from network and infrastructure devices and receive alerts from them. It dates from the late 1980s and is built into almost every switch, router, firewall, UPS, PDU, storage array and environmental sensor. Each device runs an SNMP agent, and a network management system (NMS) queries that agent or listens for the notifications it sends. Because support is so widespread, SNMP is often the one interface that every device in a mixed data center has in common.
How SNMP works
The manager polls agents with Get, GetNext and GetBulk requests on UDP port 161. Agents send unsolicited notifications to the manager on UDP port 162. Each value an agent exposes is an object with a numeric identifier. The key terms are:
- OID: a dotted number such as 1.3.6.1.2.1.1.3.0, which is sysUpTime.
- MIB: a text module that names and describes a group of OIDs, from standard MIBs like IF-MIB to vendor MIBs.
- Trap: a one-way notification, such as a link going down.
- Inform: a notification the manager acknowledges, so the agent can resend it if it is lost.
- Set: a write operation, which many teams disable for safety.
SNMP versions and security
SNMPv1 and SNMPv2c authenticate with a community string sent in clear text, so anyone who can capture the traffic can read it. SNMPv2c added GetBulk and 64-bit counters but kept the same weak security. SNMPv3, defined in RFC 3411 to RFC 3418, adds the User-based Security Model with message authentication and encryption, and the View-based Access Control Model to limit what each user can read or write. Use SNMPv3 with authentication and privacy (authPriv) wherever devices support it, choosing SHA-2 and AES where available.
If a device supports only v2c, give it a unique read-only community string and restrict which source addresses may query it.
A worked example: interface utilization from counters
Interface counters show why polling details matter. In IF-MIB, ifHCInOctets counts bytes received on an interface as a 64-bit value. If a poll at 10:00:00 reads 812,400,000,000 and the next poll at 10:01:00 reads 816,900,000,000, the difference is 4.5 billion bytes in 60 seconds. That is 36 billion bits, or 600 Mbps, so a 1 Gbps port averaged 60 percent inbound utilization for that minute. The older 32-bit ifInOctets counter wraps after about 4.3 billion bytes, which takes roughly 34 seconds at full 1 Gbps line rate, so fast links need the 64-bit counters.
Polling vs traps
Polling gives regular, comparable samples and reveals when a device stops answering. Traps give fast notice of events between polls, such as a power supply failure or a temperature threshold breach. Because traps travel over UDP without acknowledgment, one can be lost without anyone noticing. Most teams combine both methods: they poll every one to five minutes for metrics and availability, and treat traps or informs as early warnings that the next poll confirms.
SNMP vs IPMI, Redfish and streaming telemetry
SNMP is the common language of network and facility devices. Servers usually expose deeper hardware detail through their BMC using IPMI or Redfish, although many BMCs can also send SNMP traps. On large network fabrics, vendors now offer streaming telemetry such as gNMI, which pushes data at short intervals. SNMP remains the baseline because nearly every device supports it, including older UPS and cooling units that offer no other interface.
How CloudSino approaches SNMP
CloudSino uses SNMP in two products. DCOS, its out-of-band hardware monitoring platform, collects data from server BMCs through IPMI and Redfish and also supports SNMP and SSH as data collection methods. Its supported device types include switches, routers, firewalls, storage and server room infrastructure such as UPS units and PDUs. iDCOS, the ITSM and automation platform, accepts SNMP Trap alarms alongside API, SDK, email and syslog integrations, and it can convert alarms from third-party monitoring systems into work orders in its processing workflow.
Frequently asked questions
Which ports does SNMP use?
Agents listen for requests on UDP port 161, and managers listen for traps and informs on UDP port 162. A later standard defines SNMP over TLS and DTLS on ports 10161 and 10162, but few data center devices support it, so most deployments use SNMPv3 on the standard UDP ports.
What is a MIB file and where do I get one?
A MIB file is a text module written in SMI syntax that maps numeric OIDs to names, data types and descriptions. Standard MIBs ship with most monitoring tools. Vendor MIBs for a specific UPS, PDU or switch are published by the manufacturer, usually on its support site, and must be loaded into the NMS.
Should I allow SNMP Set on production devices?
Usually not. Write access lets anyone with the right credentials change configuration or, on some PDUs, switch outlets off. If you need it, restrict it to SNMPv3 users with authPriv security, a narrow access view and a small set of management hosts.