Simple Network Management Protocol (SNMP)

1. Role and Concept of Network Management

In enterprise networks containing thousands of routers, switches, servers, and access points, network administrators cannot log into each machine individually to check CPU load, interface traffic, or hardware temperature.

The Simple Network Management Protocol (SNMP) (RFC 1157 / 3411) provides a standardized framework for remotely monitoring network health, collecting telemetry, and configuring managed devices from a central console.

                  +-----------------------------------+
                  |  NETWORK MANAGEMENT STATION (NMS) |
                  |  (Manager Console / Monitoring)   |
                  +-----------------------------------+
                       |                             ^
       Get / Set (UDP 161)                           | Trap Alert (UDP 162)
                       v                             |
        +---------------------------------------------------+
        |               MANAGED DEVICES                     |
        |  [ Router ]            [ Switch ]      [ Server ] |
        |  (SNMP Agent + MIB)    (Agent + MIB)   (Agent)    |
        +---------------------------------------------------+

2. Core Architectural Components

SNMP network management is built on three interdependent standards:

                            SNMP FRAMEWORK
                                  |
         +------------------------+------------------------+
         |                                                 |
        SMI                                               MIB
(Structure of Mgmt Info)                       (Management Information Base)
  - Defines object syntax                        - Hierarchical tree database
  - Uses ASN.1 grammar                           - Stores device metrics via OIDs
                                  |
                                 SNMP
                     (Protocol Data Units & Ports)
                       - Get, Set, Trap operations
                       - UDP Ports 161 and 162

SMI (Structure of Management Information): Defines the mathematical rules and data types (using ASN.1) used to name and structure managed objects.
MIB (Management Information Base): A structured, hierarchical tree database stored on the managed device. Every manageable parameter is assigned a globally unique Object Identifier (OID) (e.g., 1.3.6.1.2.1.1.1.0 represents sysDescr).
SNMP Protocol: The application messaging protocol that carries queries and commands between the Manager and Agents.

3. SNMP Operations (PDUs) and Ports

+--------------------------+-----------------------+---------------------------------------------------+
| OPERATION (PDU)          | DIRECTION             | PURPOSE                                           |
+--------------------------+-----------------------+---------------------------------------------------+
| **GetRequest**           | Manager $\rightarrow$ Agent | Queries the value of one or more specific OIDs    |
| **GetNextRequest**       | Manager $\rightarrow$ Agent | Discovers next MIB entry sequentially (MIB Walk)  |
| **GetBulkRequest**       | Manager $\rightarrow$ Agent | Retrieves large tabular arrays in a single packet |
| **SetRequest**           | Manager $\rightarrow$ Agent | Modifies or configures an agent parameter         |
| **Response**             | Agent $\rightarrow$ Manager | Returns requested values or error status          |
| **Trap**                 | Agent $\rightarrow$ Manager | **Unsolicited alert** of an urgent event          |
| **InformRequest**        | Manager $\rightarrow$ Manager| Acknowledged manager-to-manager event notification|
+--------------------------+-----------------------+---------------------------------------------------+

Transport Ports (UDP):

UDP Port 161: Used by the SNMP Agent on managed devices to receive Get and Set requests from the NMS Manager.
UDP Port 162: Used by the NMS Manager to listen for incoming, unsolicited Trap alerts and Inform messages from agents.

4. SNMP Versions Comparison

Feature	SNMPv1 (1988)	SNMPv2c (1993)	SNMPv3 (2002 - RFC 3411)
Security Model	Cleartext Community Strings (`public`/`private`)	Cleartext Community Strings	USM (User-Based Security Model)
Authentication	None (Plaintext password)	None	Cryptographic (HMAC-MD5, SHA-1, SHA-256)
Confidentiality	None (Cleartext over UDP)	None	AES-128 / AES-256 Encryption
Message Integrity	None	None	Cryptographic digest check
Bulk Data Fetch	No (`GetNext` in loops)	Yes (`GetBulkRequest`)	Yes
64-bit Counters	No (32-bit overflows in 5s on 10G)	Yes (`Counter64`)	Yes
Industry Status	Deprecated / Insecure	Widely deployed (Read-Only)	Current Enterprise Standard

5. Key Exam Questions & Takeaways

Why does SNMP use UDP instead of TCP?
- In a heavily congested or failing network, establishing a full TCP connection might fail or exacerbate packet delays. UDP has zero connection overhead, ensuring simple management queries and emergency traps can squeeze through even on degraded, flapping links.
What is an SNMP Trap and which port does it use?
- An SNMP Trap is an unsolicited notification initiated by an Agent to immediately alert the NMS of an anomalous event (e.g., physical link failure, system reboot, power supply failure). Traps are received on UDP Port 162.
What is an OID in the Management Information Base (MIB)?
- An Object Identifier (OID) is a dot-separated sequence of integers identifying a specific managed resource within the globally standardized MIB hierarchical tree (e.g., 1.3.6.1.2.1.2.2.1.10 for interface inbound octets).
Why is SNMPv3 essential over SNMPv1/v2c?
- SNMPv1 and v2c send community string passwords and data in unencrypted plaintext, allowing attackers to hijack network devices via unauthorized SetRequest commands. SNMPv3 adds cryptographic user authentication (SHA) and AES payload encryption.

SNMP