Simple Network Management Protocol (SNMP)

SNMP

Simple Network Management Protocol

SNMP is a protocol used to manage and monitor network devices such as routers, switches, and servers.

Port: 161 UDP  |  RFC:1157

OSI Layer: 7 (Application Layer)

Cyber Security Stance: Low

Designed by Vivekanand Padala

Protocol Overview

SNMP allows network administrators to gather information about the devices on their network, such as their status, performance, and configurations, and to control them remotely.

SNMP uses a client-server model, with network devices acting as SNMP agents that provide information to SNMP managers (also known as Network Management Systems or NMSs) that make requests for this information.

SNMP is not a secure protocol by default and can be vulnerable to attacks such as eavesdropping and spoofing.

SNMP workflow

1. SNMP manager sends an SNMP request to an SNMP agent on a network device, using the SNMP protocol.
2. The SNMP agent receives the request and checks if it has the requested information in its Management Information Base (MIB). If it does, it retrieves the information and sends it back to the SNMP manager in a response message.
3. If the SNMP agent does not have the requested information, it may need to send additional SNMP requests to other agents on other devices to gather the required data. This is done using the GetNext or GetBulk requests.
4. Once the required information has been gathered, the SNMP agent sends the response message back to the SNMP manager, containing the requested data.
5. If the SNMP manager needs to configure a network device, it can send a Set request to the SNMP agent, specifying the changes to be made.
6. The SNMP agent receives the Set request and verifies the request, ensuring that the changes are allowed and that the new settings are valid.
7. If the Set request is valid, the SNMP agent makes the requested changes to the network device and sends a response message back to the SNMP manager.
8. SNMP agents can also send notification messages to SNMP managers, called Traps, to inform them of certain events, such as a device failure or a change in network configuration.
9. The SNMP manager receives the Trap message and can take appropriate action, such as sending alerts or taking corrective measures.