SNMP Tutorial - What Is It and How Does It Work?

What is Simple Network Management Protocol? SNMP is an application layer protocol created in 1988 as a short-term solution to manage network elements for growing networks - like the Internet. Simply put, as an open-source protocol, it lets different SNMP-enabled devices communicate with each other to provide robust monitoring and management.

SNMP is a valuable network monitoring tool because it allows for the collection of data, as well as the management of equipment in a network. Since its beginning, it has achieved widespread acceptance and become a standard protocol for tons of applications. As a whole, SNMP information is greatly beneficial in remote monitoring, as it provides insight into issues and facilitates swift responses to potential network failures.

Feel free to use our SNMP tutorial download, or contact us for expedited monitoring.

The Architecture of SNMP

SNMP architecture is based on the manager/agent model. The model consists of the following pieces (SNMP components):

• Manager: An SNMP manager provides the interface between the network management system and the network administrator responsible for the system. In remote monitoring applications, the manager is typically a computer or master station with an SNMP network management software that collects and processes information from multiple remote SNMP agents.
• Agent: An SNMP agent provides the interface between the manager and monitored devices. In alarm monitoring applications, this would be an SNMP capable RTU (Remote Telemetry Unit) that manages objects (components) on itself. RTUs are able to send traps to the manager when an alarm event occurs, and RTUs are also continuously polled by the manager for data collection.
• Managed Objects: Managed objects or managed devices are logical objects in the software that generally correspond to physical things, like inputs and outputs. In remote monitoring, an RTU will have multiple inputs for sensors or serial connections and outputs to control gear at your sites that don't have SNMP capabilities.
• Database: The database acts as a sort of dictionary to help your manager and agent communicate. Its called a MIB and will be discussed later in more detail.

How to Understand the Management Information Base (MIB) and Its Object Identifiers (OID)

The manager and agent use a Management Information Base and a relatively small set of commands to swap information. The MIB file is a formatted text file that defines the data objects used by a particular piece of equipment. Each data object is defined with a unique Object Identifier (OID), and the manager and agent know what the OID corresponds to via the MIB.

As a NOC technician, you would load a MIB file into your SNMP manager so it knows how to communicate with its agents. They should have the MIB loaded already from the manufacturer. Installing MIB files in your manager is analogous to installing drivers on a PC to communicate with a printer, for example.

How Does SNMP Work?

GET: Ask for Information at Any Time

To get status information from the agent, the manager can issue Get and GetNext messages to request information for a specific variable. Once a Get or GetNext message is received, the agent will issue a GetResponse message to the manager. It will contain either the information that was requested or an error explaining why the request cannot be processed.

SET: Control Your Remote Devices

A Set message allows the manager to request a change be made to a managed object (i.e. a control relay). The agent will then respond with a Get-Response message if the change has been made or an error explaining why the change cannot be made.

TRAP: The Most Common SNMP Message

Trap messages are initiated by the agent and are sent to the manager when an important event happens. This makes Traps perfect for reporting alarms to the manager - rather than wait for a status request from the manager when it gets around to polling the agent.

INFORM: Another Valuable Message Type

Inform messages are very similar to traps, except they are slightly more reliable. Inform messages are initiated by the agent, and once the manager receives it, it will send a response to the agent to let it know the message was received. If the agent doesn't receive the response from the manager then the agent will resend the Inform message.

SNMPWALK: Get All the Data

SNMPWALK uses multiple Get-Next requests to retrieve an entire tree of network data from a managed object. These are especially useful when using a tool like iReasoning MIB Browser to view all OIDs an agent offers.

Why Is SNMP "Simple?"

Aside from the small number of commands SNMP uses, it is considered simple because of its reliance on an unsupervised or connection-less communication link. The simplicity of SNMP communication has led directly to its widespread use, especially in internet applications. SNMP is considered "robust" because of the independence of the managers and agents. Because they are typically separate devices, if an agent fails, the manager will continue to function, and vice versa.

Understanding the Packet Types and Structure of SNMP

Basic serial telemetry protocols, like TBOS, are byte-oriented with a single byte exchanged to communicate. Expanded serial telemetry protocols, like TABS, are packet-oriented with packets of bytes exchanged to communicate.

The packets contain header, data, and checksum bytes. SNMP is also a packet-oriented protocol. The packets are composed of the message types discussed earlier: Get, GetNext, GetResponse, Set, and Trap.

Each packet, or variable binding, contains an identifier, a type, and a value (if a Set or Response). The agent uses its MIB to determine whether the object is managed and changeable (if processing a Set). The manager uses its MIB to display the readable name of the variable and sometimes interpret its value for any techs who may need to take corrective action.

The Layered Communication Model of SNMP

To send information, SNMP uses a layered communication model.

While this multi-layer model may seem a bit confusing, it effectively isolates the tasks of communication and ultimately assists in designing and implementing a network.

SNMP Transport Example

To illustrate the function of this layered model, let's look at a single SNMP GET request from the agent's perspective.

Step 1: The SNMP manager wants to know what the Agent's System Name is and prepares a GET message for the appropriate OID.

Step 2: It then passes the message to the User Datagram Protocol (UDP) layer. The UDP layer adds a data block that identifies the manager port that the response packet should be sent to.

Step 3: The packet is then passed to the IP layer, where the data block containing the IP address and Media Access addresses of the manager and the agent are added.

Step 4: The entire assembled packet gets passed to the Network Interface layer. The Network Interface layer verifies media access and availability. It then places the packet on the media for transport.

Step 5: After working its way across bridges and through routers based on the IP information, the packet finally arrives at the agent.

Step 6: Here it passes through the same four layers in exactly the opposite order as it did at the manager.

Understanding Layers Makes Troubleshooting Easier

Understanding this layered model makes it easier to troubleshoot communication problems. When there is a problem, you can simply trace it down, out one end, into, and up the other. LAN/WAN link and activity status indicators provide some visibility to the Network Interface layer.

While ICMP echo requests and responses (Pings) provide some information regarding the proper functioning of the IP layer, active SNMP processing indicators can be used to verify the passage of the packet through the UDP layer and the functioning of the Application layer. Each step can be verified independently until all steps are working correctly for end-to-end communication.

SNMP Versions - v1 vs v2C vs v3

There are currently three commonly used versions of SNMP: v1, v2C, and v3.

The standards for the SNMP protocol are defined in documents called RFCs (request for comments), proposed by the Internet Engineering Task Force (IETF). You can take a look at the RFCs list for SNMPv1, v2c, and v3 here.

Like any advancement in technology, as newer versions of the protocol came out, the complexity of SNMP rose with them. Take a brief look at the differences between them:

• SNMPv1: The first version of SNMP. It requires a plain text "community string" as the only form of security, which means anyone on your network with the community string can listen for SNMP messages.
• SNMPv2C: Version 2C introduced the "Inform" command. Inform allows an SNMP manager to receive a message, but unlike a trap, the manager will send a response, letting the agent know it received the message. If the agent doesn't receive a response, it will resend the message.
• SNMPv3: Version three greatly enhanced SNMP security. It introduced the User-based Security Model (USM) for message security, and the View-based Access Control Model (VACM) for access control.
  Version three also supports the SNMP "Engine ID" Identifier which is used to generate a key for authenticated messages.
  In short, SNMPv3 added authentication and encryption. Authentications ensure that traps are read-only by the intended recipient, and encryption ensures the payload cannot be read by unauthorized users.

If you'd like more information on how you can implement the best SNMP network monitoring software for your scenario, let us know what you're trying to accomplish and we'll design a perfect-fit solution for your needs. You'll have 30 days to free trial your monitoring device, and if you don't like it for any reason, simply return it for a full refund.