Managing and monitoring network devices is essential for ensuring the smooth operation of organizations. For this purpose, organizations prefer using SNMP — Simple Network Management Protocol. 

SNMP is a standard Internet protocol through which network administrators collect information about the status and performance of these devices and configure them.

In this article, we'll dive deeper into SNMP monitoring, exploring its different versions and components. 

What Is SNMP monitoring?

Short for Simple Network Management Protocol, SNMP is a standard Internet protocol for managing and monitoring network devices, such as routers, switches, servers, printers and more. 

SNMP allows network administrators to collect information about the status and performance of these devices and configure and control them remotely. It operates on the concept of a management system and managed devices. 

The management system — a network management software or tool — sends requests to the managed devices using SNMP to retrieve information or perform specific actions. 

(See how monitoring & observability come together.)

---

---

How does SNMP monitoring work?

SNMP monitoring has several components that collect and manage network device information. Here's an explanation of how each component interacts:

• The SNMP Manager is a central monitoring system that collects data from SNMP-enabled devices. It initiates and controls monitoring by sending requests to the SNMP agents on managed devices. The manager processes the received data, generates reports, triggers alerts and performs other management tasks.
• The agent is software running on a network device that collects and provides information about the device's status and performance. The agent responds to SNMP requests from the manager and sends unsolicited SNMP traps to notify the manager of specific conditions.
• The managed device refers to the network equipment being monitored, such as routers, switches, servers, printers, or other SNMP-enabled devices. These devices have SNMP agents installed, which allows them to respond to requests from the SNMP manager.
• Management Information Base (MIB) is a hierarchical database that organizes the information available for monitoring and managing SNMP devices. It defines a set of objects representing specific attributes or parameters of the managed devices. Each object is identified by an OID (Object Identifier), a numeric sequence that forms the object's address in the MIB hierarchy.
• Object Identified (OID) Object Identifier is a numeric identifier that identifies each object in the MIB. It follows a hierarchical structure similar to a file system path, where each number in the OID represents a branch in the MIB tree. 

Commands of SNMP monitoring

SNMP commands help with data collection, settings configuration, and receiving event notifications in SNMP monitoring. They enable the SNMP manager to communicate with SNMP agents on managed devices and gather the necessary information for network management.

Here are some of the commonly used SNMP commands:

GET

GET retrieves the value of a specific SNMP object or attribute from a managed device. It is initiated by the SNMP manager and sent to the SNMP agent. The command includes the OID (Object Identifier) of the desired object. The agent responds with the value of that object.

GETNEXT

GETNEXT retrieves the value of the next object in the MIB hierarchy. The manager specifies the OID of the current object, and the agent responds with the OID and value of the next object.

SET

SET configures the value of an SNMP object on a managed device. The SNMP manager can change the settings or parameters of the device using this command.

GetBulk

GetBulk retrieves a large amount of data from a managed device in a single request. It's more efficient than multiple Get or GetNext commands for retrieving various objects. 

Traps

Traps are unsolicited notifications sent by SNMP agents to the SNMP manager. The agent sends a trap message to the manager, which includes information about the event and its severity. Specific events or conditions trigger them, such as a link failure, high CPU usage, or system reboot. 

SNMP v1, v2, v3: What's difference?

Simple Network Management Protocol has evolved over time. Different versions of SNMP have been introduced to enhance security, functionality and performance. Here's an overview of SNMP versions 1, 2, and 3.

SNMP v1

SNMP version 1 is the original version of SNMP and is the most basic version. It uses a community-based security authentication model, using a community string as a shared password-like credential. SNMP v1 has limited security features and does not support encryption. 

SNMP v2c

SNMP version 2 introduced several enhancements over SNMP v1 to improve its functionality. It introduced features like SNMP GetBulk operation for retrieving large amounts of data and SNMP Inform messages for reliable delivery of notifications.

However, SNMP v2c still relies on the community string for authentication, making it vulnerable to security risks. SNMP v2c also lacks robust security mechanisms to protect the integrity and confidentiality of SNMP messages.

3) SNMP v3

SNMP version 3 is the most recent version of SNMP. It addresses the security concerns of earlier versions and provides enhanced security features. Being the most secure version of SNMP, it also introduced the concept of security levels and security models.

Security Models: SNMPv3 defines three security models:

• User-based Security Model (USM). The USM provides authentication and encryption for SNMP messages using mechanisms like HMAC (Hash-based Message Authentication Code) and MD5 or SHA (Secure Hash Algorithm).
• View-based Access Control Model (VACM). VACM enables fine-grained access control by defining access policies and rules based on MIB views.
• Transport Security Model (TSM). TSM ensures secure communication by supporting transport-level security protocols like Transport Layer Security (TLS).

Security Levels: SNMPv3 also defines three security levels:

1. noAuthNoPriv provides no authentication or encryption.
2. authNoPriv uses HMAC for message authentication.
3. authPriv provides both authentication and encryption of SNMP messages.

SNMPv3 provides improved security, including strong authentication, message integrity and encryption. These enhanced features make it a recommended secure SNMP monitoring and management version.

Importantly, SNMPv3 is not backward compatible with earlier versions. However, many network devices and monitoring systems support multiple SNMP versions, allowing flexibility in deployment and compatibility with legacy systems.

Key SNMP metrics for comprehensive network device monitoring

SNMP metrics provide valuable insights into network device performance, health and usage. Here are some standard SNMP metrics.

Interface metrics

• Interface status indicates whether the interface is up or down.
• Interface traffic measures the inbound and outbound traffic on an interface, including bytes, packets and errors.
• Interface bandwidth represents the maximum capacity or speed of the interface.

System metrics

• CPU utilization measures the CPU usage or load on a device.
• Memory utilization indicates the amount of memory used by a device.
• Disk usage provides information about the utilization of disk storage.

Network metrics

• Network latency measures the time it takes for data packets to travel between devices.
• Network errors count the number of network errors, such as packet drops or collisions.
• Network throughput represents the data transmitted over the network within a certain period.

---

---

Device metrics

• Device temperature measures the temperature of the device.
• Power supply status indicates the status of power supplies, such as whether they are operating normally or in a failure state.
• Device uptime represents the duration of time since the device was last restarted.

Application-specific metrics:

• DNS query counts the number of DNS queries processed by a DNS server.
• HTTP response time measures the time it takes for a web server to respond to HTTP requests.
• Database connections track the number of active database connections.

The metrics available will depend on the device and its SNMP implementation. Network administrators can select the relevant metrics based on their monitoring requirements and use them to gain insights into the overall health of their network infrastructure.

(Know the difference between NOCs and SOCs.)

Popular tools for SNMP monitoring

Several SNMP monitoring tools are available in the market to help network administrators monitor and manage SNMP-enabled devices. But here are some popular ones:

SolarWinds Network Performance Monitor 

SolarWinds NPM is a comprehensive network monitoring solution that supports SNMP monitoring. It provides real-time monitoring, alerting, and reporting capabilities for SNMP devices. It offers device discovery, performance monitoring, bandwidth utilization analysis, and automated alerting.

Pasessler PRTG Network Monitor 

PRTG stands out among other tools because of its unique approach to monitoring, using "sensors." These sensors are the building blocks of the tool's monitoring capabilities. 

Each sensor focuses on a specific aspect of monitoring. Consider it as one sensor can monitor the CPU load of a server while another sensor can track the amount of available disk space.

What makes PRTG unique is that it has various pre-configured SNMP sensors. These sensors work with different device manufacturers like HP, Synology, Dell, and Cisco. This means you can easily monitor devices from these manufacturers without additional configuration.

ManageEngine OpManager

ManageEngine OpManager is another excellent tool for managing SNMP. It can set different target levels to ensure everything is running smoothly. OpManager also has extra features like mapping the network and customizing how you see the information. 

Spiceworks Network Monitor 

Spiceworks Network Monitor is a free tool for SNMP monitoring. Unlike other software packages, it focuses solely on this function. It has a user-friendly dashboard that you can set up quickly. 

You can add SNMP-enabled devices as widgets to the dashboard, providing constant visibility into important device data. The alerting system is simple and easy, using basic thresholds for notifications globally and per device. 

Observium 

Observium is a low-maintenance SNMP monitoring tool offering three versions: 

• Professional
• Enterprise
• Community

No matter which version you choose, Observium is easy to use. You can add the devices you want to monitor by using the automatic discovery feature or manually adding them. Once you have added the devices, you can go to the overview page to see the status of each device. 

Summing up SNMP monitoring

SNMP monitoring is a robust solution for network management that provides administrators with the necessary tools and insights to ensure the efficient operation of their network infrastructure. By leveraging SNMP monitoring and using the right tools, you can monitor, manage and address issues in your organization's network. 

 

What is Splunk?

This posting does not necessarily represent Splunk's position, strategies or opinion.