By the SNMP Monitoring team · Reviewed July 2026
SNMP is the Simple Network Management Protocol—an IETF application-layer standard that runs over UDP so a management station can read (and sometimes write) variables on network devices and servers. Agents speak it; managers poll it; traps show up when something goes sideways.
Featured-snippet version if you need forty words: SNMP lets a manager query an agent for typed values addressed by OIDs in a MIB, usually on UDP port 161, with optional traps to port 162. Versions in the field: v1, v2c, and v3.
This pillar page is the map. Child pages go deep. Home hub: /.
What does SNMP stand for?
Simple Network Management Protocol.
- Layer: application
- Transport you'll actually see: UDP (not a TCP session API)
- Standard home: IETF RFCs (v1 starts at RFC 1157, 1990)
Definition: SNMP is a request/response (and notification) protocol for managing network elements. The manager asks; the agent answers from objects defined in MIBs and addressed by OIDs—or the agent sends a trap/inform when it has an event.
If someone says "we don't use SNMP," check the UPS, the switch, and the printer closet before you believe them.
Related reading when the acronym soup thickens: history for how v2c happened, ports for firewall tickets, PDU when you care what GetBulk actually is.
What is SNMP used for?
Day jobs, not theory:
- Monitoring — CPU, memory, disks, interface counters, ups charge, weird vendor sensors
- Fault detection — linkDown traps, coldStart, "this process count just exploded"
- Performance — rates from counters, load averages, error deltas
- Light config / control — SetRequest where views allow it (many shops disable write entirely)
Common use-case bullets:
- Graph interface throughput from IF-MIB
- Page when disk OID crosses a threshold
- Inventory-ish walks of system and interface tables
- External "is the box answering SNMP at all" checks from outside the LAN
Hands-on paths: monitoring. Leaf catalog: sensors.
How SNMP works (high level)
Four nouns, one conversation:
- Manager decides what to poll and how often.
- Agent on the device listens (typically UDP 161).
- Manager sends Get / GetNext / GetBulk with OID(s).
- Agent resolves them via its MIB implementation and returns typed values.
- Separately, agent may push traps/informs to UDP 162.
That's the whole dance. Wire-level detail and a live snmpget: how SNMP works. Architecture and roles: architecture.
Prove the path:
snmpget -v2c -c <RO_string> <host> 1.3.6.1.2.1.1.3.0
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (9876543) 1 day, 3:26:05.43
sysUpTime is the usual "is anyone home?" object. Replace public fantasies with a real RO string or move to v3.
Core components
Manager
The client side: NMS, poller, SaaS checker, or you with Net-SNMP. Owns schedules, credentials, thresholds. Doesn't live on the managed box (unless you're doing something weird).
Agent
Daemon or embedded stack on the device—snmpd, vendor agent, etc. Implements a subset of MIBs, enforces views, answers queries. More: agent, manager.
MIB
Management Information Base—the schema. Modules describe object names, types, and semantics. Without a MIB (or at least a numeric OID), you're guessing in the dark. See MIB.
OID
Object Identifier—the address. Dotted numbers like 1.3.6.1.2.1.1.3.0. Tables add indexes. OID overview, tree.
Also in the family: PDUs (Get, Response, Trap, …) → PDU; community strings on v1/v2c → community string.
SNMP versions at a glance
Three you'll still configure:
| Version | Auth model | Encryption | GetBulk / Counter64 |
|---|---|---|---|
| SNMPv1 | Community (cleartext) | None | No / No |
| SNMPv2c | Community (cleartext) | None | Yes / Yes |
| SNMPv3 | USM (auth options) | Optional priv (e.g. AES/DES family) | Yes / Yes |
v3 is what you want on anything that isn't a sealed lab VLAN. Full comparison: versions. Timeline: history.
Polling vs traps
Polling = pull on a timer. Graphs and capacity live here.
Traps / informs = push when the agent cares. Faster for discrete failures; bad as your only disk-full signal if the box is too dead to speak.
Both models are real SNMP. Trade-offs: traps vs polling.
Ports SNMP uses
- UDP 161 — agent queries (Get, Set, …)
- UDP 162 — notifications to the manager/trap receiver
Firewall both directions you actually need. Details: ports.
Is SNMP still relevant in 2026?
Hardware vendors still ship agents. Datacenter iron still answers walks. People still open tickets because someone left public on the internet.
Is it the only telemetry story? No. Prometheus exporters, gNMI, vendor APIs—all real. But "we rewrote monitoring" rarely means "we ripped SNMP out of the ToR switches and every UPS." Ubiquity is the relevance argument. Comparisons if you're choosing stacks: comparisons. Terms: glossary.
For an independent off-box check that the agent still answers from outside your LAN, some teams add external SNMPv2c polling (for example via ostr.io) beside the primary NMS—not instead of understanding the protocol.
One more practical note: SNMP will not replace application APM, log pipelines, or synthetic checks. It answers "what does the device admit about itself over the management plane?" That's a huge slice of infrastructure work—and a terrible answer to "why is checkout latency 900ms?" Use the right tool. Comparisons live under comparisons when you're arguing stacks in a design review.
If you're onboarding a junior, the order that wastes the least time is: this page → how it works → one successful snmpget → setup for their OS → one metric how-to under monitoring. Skipping the successful get is how you get three days of dashboard archaeology.
Frequently asked questions
What is SNMP in simple terms?
A standard way for monitoring software to ask devices for status numbers (and receive alerts) over the network, using OIDs defined in MIBs.
What is SNMP used for?
Mostly monitoring and fault notification on network gear and servers—interfaces, resources, environmentals, UPS, and vendor-specific objects.
What layer is SNMP?
Application layer, carried over UDP in normal deployments.
Is SNMP TCP or UDP?
UDP for classic agent access (161) and traps (162). Don't design like it's a TCP API with free retransmit semantics—timeouts and retries are your problem.
Key takeaways
- SNMP = Simple Network Management Protocol, IETF, UDP, manager/agent, MIB/OID.
- First major standard: RFC 1157 (1990); field versions v1 / v2c / v3.
- Ports 161 (queries) and 162 (traps/informs).
- Poll for metrics; trap for events.
- Next reads: how it works, versions, architecture, history.