SNMP
Simple Network Management ProtocolSNMP is how a monitoring system knows anything. Every managed device exposes a tree of numbered values — interface counters, temperature, uptime — which a manager polls on a schedule, and the device sends a trap of its own accord when something goes wrong.
SNMP exposes a device’s state as a numbered tree that a manager polls — and lets the device shout a trap when it cannot wait to be asked.
Open the SNMP lab →
Poll a router’s byte counter twice and turn the difference into 45 Mbit/s. Pull a cable and the router speaks first, on port 162. Then ask again with SNMPv3—signed, sealed, and still not anonymous.
How it works
A MIB file is just a dictionary translating those numbers into names — the wire only ever carries 1.3.6.1.2.1.2.2.1.10.3.
Polling gives you a graph over time; traps give you the moment something changed. Most monitoring uses both — the poll for trends, the trap for the alert.
What SNMP does, step by step
The device publishes its state as a tree of OIDs — counters, gauges, strings and tables.
The manager GETs specific OIDs, or walks a table with GETNEXT and GETBULK, every minute or so.
Counters only ever increase; the monitoring system subtracts successive polls to get a rate.
The device sends an unsolicited trap or inform to port 162 when a threshold or link state changes.
In cybersecurity
SNMP v1 and v2c authenticate with a single shared string sent in the clear — and the default is famously public, which makes an unhardened device an open book and sometimes an open door.
v1/v2c send them unencrypted; anyone on the path reads them and can then poll at will.
Scanners sweep for it constantly — one hit maps a device’s interfaces, routes and neighbours.
A writable community string lets an attacker reconfigure the device, not merely read it.
Per-user authentication with SHA and encryption with AES — there is no reason to run anything else.
A small GETBULK can return a very large response, which has been used to reflect DDoS traffic.
Only the monitoring system should be able to reach 161 at all — enforce it on the device and the firewall.