SNMP

An OID is a path of numbered arcs through a global registration tree. 1.3.6.1.2.1.1.3.0 reads iso.org.dod.internet.mgmt.mib-2.system.sysUpTime plus .0, the single instance of that scalar; a MIB module supplies the name, type and meaning.

GetRequest reads exactly the named instances; GetNextRequest returns each name's successor in OID order; GetBulkRequest returns many successors at once; SetRequest writes values all or nothing. Each is answered by a Response-PDU with the same request-id, an error-status and an error-index.

An SNMPv1 or SNMPv2c community string is a shared password sent unencrypted in every message, so one captured packet lets anyone reuse it, and nothing protects integrity or freshness. SNMPv3 replaces it with per-user authentication, optional encryption and view-based access control.

Difference two readings of ifHCInOctets (or ifHCOutOctets), multiply by 8, divide by the seconds between the polls, then divide by the interface speed, ifHighSpeed x 1,000,000 bit/s. Each direction is computed separately.

An SNMP Trap is fire-and-forget: the agent sends it once and learns nothing. An InformRequest is confirmed: the receiver answers with a Response-PDU, and the agent retransmits on timeout until a retry count runs out.

noAuthNoPriv names a user but proves nothing; authNoPriv adds an HMAC proving the user, integrity and freshness; authPriv also encrypts the scoped PDU. RFC 3412 forbids privacy without authentication: unauthenticated ciphertext could be altered or replayed undetected.

SNMP polling gives complete, regular data and proves each agent still answers, but sees a failure up to one interval late and misses flaps between polls. Notifications arrive within seconds but only on events and can be lost, so estates use both.

A Counter32 octet counter wraps after 2^32 octets, about 3.4 seconds at 10 Gb/s, so a poller cannot count the wraps between polls. RFC 2863 requires 64-bit ifHCInOctets above 20 Mb/s, and 64-bit packet counters from 650 Mb/s.

Chained GetNext pays a round trip and a full message-processing pass per row. GetBulkRequest returns up to max-repetitions rows per exchange; size that value so each reply fits the manager's maximum message size and one unfragmented datagram, and keep it small under stress.

Contain first: remove read-write communities, replace and source-restrict the read ones. Then add SNMPv3 users at authPriv beside the communities, move pollers and notification receivers device group by group, watch for leftover community traffic, and finally delete the communities.

ifAdminStatus is the desired state and ifOperStatus the actual one. Admin up with oper down means the interface should work but cannot, so RFC 2863 presumes a fault; both down means it was disabled on purpose, with no fault implied.

The User-based Security Model (RFC 3414) establishes which user sent an SNMPv3 message and protects it with authentication, a replay window and optional encryption. The View-based Access Control Model (RFC 3415) then decides which objects that user may read, write or receive.

An SNMP agent answers each request only from the MIB view selected for that requester. An object outside the view is treated exactly like one that does not exist, so a Get gets noSuchObject or noSuchInstance and a walk skips it.

ifOutDiscards counts outbound packets dropped although no error was detected, for example to free buffer space; ifOutErrors counts packets that could not be sent because of errors. Rising discards at moderate average utilisation usually mean bursts overflowing the output buffer.

SMIv2 names a scalar's single instance by appending .0; a table column has one instance per row, so its suffix is the row's INDEX values: an integer as one sub-identifier, a variable-length string as its length then one sub-identifier per octet.

OBJECT-TYPE registers an object's OID and declares its SYNTAX, MAX-ACCESS, STATUS and DESCRIPTION, plus optional UNITS, REFERENCE, INDEX or AUGMENTS, and DEFVAL. A textual convention is a named sub-type of a base type that adds meaning and a display hint, never a new wire type.

A non-zero error-status says the whole request failed, and error-index names the failing binding, counting from one. SNMPv2 exceptions instead mark one binding (noSuchObject, noSuchInstance, endOfMibView) while error-status stays noError and the other values are returned.

The manager sends GetNextRequest with a column's OID, gets the first instance after it, and keeps sending back the name it received. The column has ended when a returned name leaves the column's OID prefix, or the agent returns endOfMibView.

A v1 Trap-PDU names the event in fixed fields: enterprise, agent-addr, generic-trap 0-6, specific-trap and time-stamp. An SNMPv2-Trap-PDU has none of these; its first two varbinds, sysUpTime.0 and snmpTrapOID.0, carry the time and the event's identity.

SNMPv2c added GetBulkRequest, InformRequest, the SNMPv2-Trap format, Counter64 and per-variable exceptions with richer error codes. It kept SNMPv1's message wrapper and cleartext community string, changing only the version field from 0 to 1.

SNMPv3 keeps SNMPv2's PDUs and operations from RFC 3416 and replaces the message around them: msgVersion 3, a header with message ID, maximum size, flags and security model, security-model parameters, and a scoped PDU naming a context, optionally encrypted.

An SNMP proxy forwarder (RFC 3413) relays requests and notifications to another SNMP engine by context, without interpreting the objects; under RFC 3584 it also translates versions. Place it next to the SNMPv1 switches, because its downstream leg still carries a cleartext community.

IF-MIB counters can restart at agent re-initialisation and at times marked by ifCounterDiscontinuityTime. A poller must discard any delta where sysUpTime went backwards or ifCounterDiscontinuityTime changed between polls, instead of treating the drop as a wrap.

Identify the organisation from the IANA enterprise number, use sysObjectID and sysDescr to pick the matching module revision, load it with every module it imports, then match each OID's longest registered prefix and decode the remainder as .0 or INDEX values.

Not with a fixed wait: the defaults are a 15-second timeout (1500 hundredths) and 3 retries, so four sends at 0, 15, 30 and 45 s, abandoned at 60 s, 40 s before the collector returns.

USM repeats the password to 1,048,576 octets and hashes it into a key, then hashes that key, the authoritative engine's snmpEngineID and the key again. Each agent stores only its localized result, so a stolen key opens no agent with a different engine ID.

Each authenticated SNMPv3 message carries the authoritative engine's snmpEngineBoots and snmpEngineTime under the HMAC. A message with stale boots, or time more than 150 seconds off, is rejected - but a copy replayed inside that window is still accepted.

Counter64 cannot be encoded in an SNMPv1 message, so RFC 3584 makes a multilingual agent treat Counter64 instances as out of view for v1 requests: a Get returns noSuchName and a GetNext skips them. Polling with SNMPv2c or, better, SNMPv3 fixes it.

Assume notifications will be lost and design to detect and repair: informs for critical events, two receivers in separate failure domains, receivers that deduplicate and store before acknowledging, and a reconciliation poll that catches what was missed.