History of SNMP: From SGMP to SNMPv3 (Timeline)

By the SNMP Monitoring team · Reviewed July 2026

Why bother with history? Because half the "security" fights on modern networks are fossils. Community strings in cleartext aren't a 2020 design choice—they're 1990s pragmatism that never got deleted. If you know how we got v2c instead of "secure v2," the versions page makes more sense.

This is the timeline from SGMP through SNMPv1, the SNMPv2 fracture, v2c, and SNMPv3 (STD 62). Parent: What is SNMP. Dates and RFCs below stick to the brief's reference set—if a year isn't listed, I won't invent one.

Before SNMP: SGMP and 1980s network management

Before SNMP owned the mindshare, there was SGMP—Simple Gateway Monitoring Protocol—published as RFC 1028. Same general itch: manage IP gear without a proprietary silo per vendor.

The late '80s problem was familiar: more routers, more sites, more "please graph this link." Operators needed something implementable on limited hardware, not a perfect academic framework. SGMP scratched that. The industry then pushed toward a broader standard that became SNMP.

I'm not going to romanticize it. These protocols won because vendors shipped them and they were simple enough to code—not because crypto was solved.

SNMPv1 (1990): the first standard

SNMPv1 lands as RFC 1157 (1990). Companion pieces in the same era: SMIv1 in RFC 1155, and MIB-II in RFC 1213—the object set people still trip over when they type system or interfaces into a walk.

What v1 gave the world:

• Manager/agent model
• Community-based access
• Get / GetNext / Set / Trap style operations
• A shared mental model for OIDs

What it didn't give you (and still doesn't if you're stuck on v1):

• Strong authentication or encryption
• Counter64
• GetBulk
• A rich error story for big modern MIBs

v1 succeeded politically. Security was "hope your network is friendly." That assumption leaked into decades of default public/private communities.

Prove the descendant is still alive on a box:

snmpget -v2c -c <RO_string> <host> 1.3.6.1.2.1.1.1.0

SNMPv2-MIB::sysDescr.0 = STRING: Some device that still speaks the old MIB-II system group

Same object family v1-era operators cared about—just often queried with a newer protocol version today.

SNMPv2 and why it fractured

Early SNMPv2 tried to grow up: better bulk retrieval, better data types, a stab at real security. The party-based approach (SNMPv2p, RFC 1441–1452, 1993) was… a lot. Parties, complex security machinery, implementation cost.

Adoption mostly failed. Not because GetBulk was a bad idea—because the security framework was heavy and the industry wouldn't ship it cleanly. There were other v2 experiments (you'll hear v2u and related names in old mailing lists). For operators, the takeaway was simpler: "full v2 security" didn't become the default install.

When standards fork in the real world, the boring variant usually wins. That's the next section.

SNMPv2c: the pragmatic survivor

SNMPv2c is community-based SNMPv2—the compromise people actually configured. Specs in the RFC 1901 / 1905 / 1906 (1996) neighborhood.

Kept from the v2 effort:

• GetBulk
• Counter64
• Improved error handling vs v1

Kept from v1's bad habits:

• Community strings in cleartext
• No standard encryption

So yes: better protocol machinery, same shared-secret-on-the-wire model. That's why v2c still dominates lazy templates and why security teams hate it on untrusted networks. Community string for the object itself; v1/v2c risks for the hangover.

SNMPv3 (1998–2002): adding security

SNMPv3 is where USM and VACM enter the chat. Early docs RFC 2570–2575 (1999) matured into RFC 3411–3418 (2002)—STD 62.

What finally shipped in a form vendors would implement:

• USM — user-based security model (auth, optional privacy)
• VACM — view-based access control
• Engine IDs and the whole "SNMP is not just a community string anymore" operational model

v3 didn't delete v2c from the planet. It gave you a path that isn't embarrassing on a hostile path—if you turn on authPriv and manage users like adults. Comparison without the museum tour: versions. Setup: SNMPv3.

SNMP timeline

Numbered spine:

1. SGMP — RFC 1028 — gateway monitoring predecessor
2. SNMPv1 — 1990 — RFC 1157; SMIv1 RFC 1155; MIB-II RFC 1213
3. SNMPv2p — 1993 — RFC 1441–1452; party-based; weak adoption
4. SNMPv2c — 1996 — RFC 1901/1905/1906; community + GetBulk/Counter64
5. SNMPv3 — 1999→2002 — RFC 2570–2575 then 3411–3418 (STD 62); USM + VACM

SNMP today in 2026

Status check without marketing fluff:

• v1 — still on ancient gear; treat as obsolete for new design
• v2c — still the default in too many templates; OK only with network controls
• v3 — what secure designs should prefer
• MIBs — still how objects are defined; SMIv1/v2 history explains weird tooling edges (MIB)

Deprecate v1/v2c on networks that face untrusted users. Don't pretend a cleartext community is "fine because we've always done it." Risks write-up: SNMPv1/v2c risks. Glossary: glossary.

The protocol's age is also its strength: almost everything has an agent. The history is why that agent might still be speaking 1996 security on a 2026 laptop.

What history changes in a change window:

• You stop being surprised that "SNMPv2" in a datasheet might mean v2c, not party-based v2p.
• You stop treating community strings as a temporary hack—they've been the default for decades.
• You argue for v3 as unfinished 1990s business, not as a vendor upsell.
• You read MIB tooling quirks (SMI eras, module churn) with less panic—MIB for the object model side.

None of that requires memorizing every RFC number. It requires knowing which compromise you're accepting when you type -v2c into a poller.

Frequently asked questions

When was SNMP invented?

SNMPv1 as the first major standard is RFC 1157 in 1990, after SGMP (RFC 1028). People say "late 1980s / 1990" and they're in the right ballpark.

Why did SNMPv2 fail?

The secure/party-based SNMPv2p work (RFC 1441–1452, 1993) was complex and didn't win broad adoption. The features people wanted partly survived in v2c; the heavy security framework didn't become the default.

What replaced SNMPv2?

In practice, SNMPv2c became the workhorse community-based v2, and SNMPv3 became the security-capable line (STD 62, RFC 3411–3418).

Is SNMPv1 obsolete?

For new deployments, yes—treat it as obsolete. It may still answer on old hardware; that doesn't make it acceptable on exposed networks.

Key takeaways

• SGMP (RFC 1028) → SNMPv1 (1990, RFC 1157) → failed v2p → pragmatic v2c (1996) → v3 / STD 62 (2002).
• v2c won operations; v3 won the security model (when configured).
• Cleartext communities are historical debt, not a modern feature.
• Next: version comparison, MIB, security risks.