---
type: Sensor Reference
title: "SNMP TCP / UDP / IP OIDs: Stack Counter Reference"
description: "The SNMP OIDs for the IP stack — TCP-MIB connections and retransmits, UDP-MIB datagrams, and IP-MIB counters, with what each reveals and a snmpget example."
resource: "https://snmp-monitoring.info/sensors/tcp-udp-ip/"
tags: [sensors]
timestamp: 2026-07-11T00:00:00Z
---

# SNMP TCP / UDP / IP OIDs: Stack Counter Reference

The SNMP OIDs for the IP stack — TCP-MIB connections and retransmits, UDP-MIB datagrams, and IP-MIB counters, with what each reveals and a snmpget example.

## Related concepts

- Up: [SNMP Sensors & OID Catalog: Every Metric You Can Monitor](/sensors/index.md)

## Frequently asked questions

### What OID is the TCP connection count?

tcpCurrEstab at 1.3.6.1.2.1.6.9.0 from the TCP-MIB — a Gauge32 with the number of TCP connections currently in the ESTABLISHED state. Because it's a gauge, you read it directly rather than diffing; watch it against a baseline for connection leaks or floods.

### What OID shows UDP errors?

udpInErrors at 1.3.6.1.2.1.7.3.0 counts inbound UDP datagrams that couldn't be delivered for reasons other than a missing port. For traffic to ports with no listener, use udpNoPorts (1.3.6.1.2.1.7.2.0). Both are cumulative counters, so alert on the rate of change.

### What MIB has IP statistics?

The IP-MIB (RFC 4293) at 1.3.6.1.2.1.4, with scalar counters like ipInReceives, ipInDiscards, and ipForwDatagrams. It reports the network layer's packet totals — received, discarded, and forwarded — which complement the interface-level counters in the IF-MIB.

### Should I alert on TCP retransmits?

Yes, but on the rate or ratio, not the total. tcpRetransSegs (1.3.6.1.2.1.6.12.0) only ever climbs, so a big lifetime number is meaningless. Diff it between polls and compare to segments sent — a rising retransmit ratio is a strong early sign of packet loss or congestion.

## Source

Concept generated from https://snmp-monitoring.info/sensors/tcp-udp-ip/ — the SNMP Monitoring vendor-neutral knowledge base. Content is limited to what that page states (no external claims added here).