Standard MIBs: MIB-II (RFC 1213) and the Essentials

By the SNMP Monitoring team · Reviewed July 2026

Standard MIBs are the vendor-neutral modules almost every SNMP stack pretends to speak. When a template says “poll CPU” or “graph interfaces,” it's usually aiming at these—not at a random enterprise branch.

They're universal in the sense of spec availability, not in the sense that every toaster implements every object. Always walk the device. Parent: MIB overview. Syntax: MIB structure.

MIB-II (RFC 1213) and its groups

MIB-II is the classic core, RFC 1213, hanging under 1.3.6.1.2.1 (often called mib-2). Groups people actually use:

• system — descr, uptime, contact, name, location
• interfaces — early interface table ideas (modern counters often via IF-MIB)
• ip — IP layer stats (see also IP-MIB later)
• tcp / udp — transport stats / connection info (refined in later MIBs)
• snmp — SNMP instrumentation counters

If someone says “walk mib-2,” they mean this tree. It's the shared language between a 1990s router and a 2026 Linux snmpd—with gaps.

HOST-RESOURCES-MIB

HOST-RESOURCES-MIB (RFC 2790) — root 1.3.6.1.2.1.25. This is the host-centric module:

• Processor load style objects
• Storage / memory framing
• Running software / process related instrumentation
• Other host resources the module defines

Server monitoring how-tos lean here: server monitoring, catalog: sensors/all, CPU twin pair monitor CPU / CPU OIDs.

Switches without host resources will shrug. Don't force HOST-RESOURCES templates onto pure network OS images.

IF-MIB

IF-MIB (RFC 2863) covers interface status and counters more carefully than the original MIB-II interfaces story. Roots in the brief: 1.3.6.1.2.1.2 and 1.3.6.1.2.1.31 (ifXTable-era 64-bit counters live in this family).

This is where bandwidth and error graphs usually come from. OID-oriented notes: interface sensors. Network how-tos: network monitoring.

If your 10G link counters look frozen, check whether you're still on 32-bit columns that wrap in minutes—Counter64 columns exist for a reason.

Other common standard MIBs

• ENTITY-SENSOR-MIB (RFC 3433) — 1.3.6.1.2.1.99 — temp, fan, voltage style physical sensors when implemented
• UPS-MIB (RFC 1628) — 1.3.6.1.2.1.33 — battery, I/O, alarms; see UPS sensors
• Printer-MIB (RFC 3805) — 1.3.6.1.2.1.43 — status/supplies; printer sensors
• TCP-MIB (RFC 4022) — 1.3.6.1.2.1.6
• UDP-MIB (RFC 4113) — 1.3.6.1.2.1.7
• IP-MIB (RFC 4293) — 1.3.6.1.2.1.4

Transport/IP stack objects also surface in tcp-udp-ip sensors. Implementation varies wildly—especially ENTITY-SENSOR on cheap gear.

Standard MIB reference table

Memorize roots for the three you use weekly: mib-2 1.3.6.1.2.1, host …25, interfaces IF-MIB. Look up the rest.

Standard vs enterprise MIBs

Standard = IETF-published modules under the mib-2 style tree. Enterprise = vendor branches under enterprises (1.3.6.1.4.1…). Overview: enterprise OIDs.

Workflow that doesn't waste a week:

1. Try standard MIBs first for portable templates.
2. Walk the device; note gaps.
3. Pull vendor MIB only for the missing features.
4. Keep enterprise OIDs isolated in vendor-specific templates.

Smoke test mib-2:

snmpwalk -v2c -c <RO_string> <host> 1.3.6.1.2.1.1

SNMPv2-MIB::sysDescr.0 = STRING: Linux app-02 6.1.0-generic ...
SNMPv2-MIB::sysUpTime.0 = Timeticks: (3600000) 10:00:00.00
SNMPv2-MIB::sysName.0 = STRING: app-02.example.com

If even system is empty, fix agent/ACL before blaming IF-MIB.

Building a sane baseline template

Numbered starter set many teams use on servers:

1. system group (identity + uptime)
2. HOST-RESOURCES pieces you actually graph
3. IF-MIB for NICs that matter
4. Maybe UCD/net-snmp extras if present (not in the table above—agent-specific)

For switches, swap HOST-RESOURCES for IF-MIB + vendor CPU/health enterprise OIDs after a lab walk.

For UPS/printers, start from UPS-MIB / Printer-MIB roots, then vendor extensions.

Don't enable every row in the table on every device class. Noise is not observability.

When “standard” still fails

• Agent implements the module name but only three objects
• 64-bit counters missing; 32-bit wraps
• Views allow system but not host resources
• Container agents with fake interface tables
• Printers that speak SNMP but laugh at Printer-MIB

Standards give you a shared vocabulary. Hardware gives you reality. Reality wins.

Quick “which root do I walk?” cheat

• Identity / uptime → 1.3.6.1.2.1.1 (system)
• Host CPU/disk-ish → 1.3.6.1.2.1.25
• Interfaces → IF-MIB roots .2 / .31 under mib-2
• UPS → 1.3.6.1.2.1.33
• Printer → 1.3.6.1.2.1.43

Then open the matching sensor or monitoring page for thresholds—not for inventing OIDs.

Structure of the files themselves: MIB structure. Catalog of metrics: sensors/all. Glossary: glossary.

Frequently asked questions

What is MIB-II?

MIB-II (RFC 1213) is the classic standard management information base under 1.3.6.1.2.1, with groups like system, interfaces, ip, tcp, udp, and snmp.

Which MIB has CPU and memory?

HOST-RESOURCES-MIB (RFC 2790) under 1.3.6.1.2.1.25 is the usual standard place for host CPU/storage/memory/process style objects—when the agent implements it.

Which MIB has interface counters?

IF-MIB (RFC 2863) — roots 1.3.6.1.2.1.2 / 1.3.6.1.2.1.31. Also related historical interface objects under MIB-II.

What is the OID for MIB-2?

The mib-2 tree is 1.3.6.1.2.1.

Key takeaways

• Standard MIBs = portable IETF modules; still verify per device.
• Core trio: MIB-II (1213), HOST-RESOURCES (2790), IF-MIB (2863).
• Roots in the table above for UPS, printer, sensors, TCP/UDP/IP.
• Prefer standard first; enterprise for gaps—enterprise OIDs.
• Next: MIB, sensors/all, structure.