SNMP FAQ
Most SNMP questions boil down to a handful of things: which version to run, which port to open, what an OID actually is, and why a walk that worked yesterday times out today. This SNMP FAQ is the hub for those quick snmp answers — short, correct, and grounded in real OIDs and real Net-SNMP commands. When a topic needs more room than a paragraph, you'll find a link to the page that owns it in full. Think of this as the front desk. The snmp questions below cover the ground people hit first; the deeper detail lives one click away.
Overview
This page is a fast reference, not a tutorial. Each answer here is deliberately tight — enough to unblock you and point you at the right follow-up. The site groups its SNMP knowledge into a few focused areas, and this FAQ pillar sits on top of them. General "what is / how does it work" material lives under common SNMP questions. Broken commands and cryptic output go to SNMP error messages. Anything about testing and probing a live agent belongs in SNMP diagnostics. The RFC and standards landscape has its own home in SNMP standards & RFCs. If you just want a word defined, the SNMP glossary is the place. Read straight through, or jump to the question that brought you here.
Not sure where your question belongs? Use this quick router:
- "What is it / how does it work" — start at common SNMP questions.
- A command failed or printed something odd — go to SNMP error messages.
- You want to test or probe a live agent — see SNMP diagnostics.
- You need the RFC or version behind a claim — check SNMP standards & RFCs.
- You just want a word defined — open the SNMP glossary.
| If you're asking about… | Go to |
|---|---|
| Versions, ports, OIDs, the poll model | Common SNMP questions |
| Timeouts, empty walks, cryptic output | SNMP error messages |
| Testing an agent, snmpwalk debugging | SNMP diagnostics |
| RFC numbers and standards | SNMP standards & RFCs |
| A single term's meaning | SNMP glossary |
Questions & answers
What is SNMP, in one sentence? SNMP — the Simple Network Management Protocol — is a standard way for a monitoring station to read (and sometimes set) numbered values on a network device. A small agent runs on the device and answers queries over UDP; a manager polls it. The values live in a tree of OIDs. That's the whole model, and it has barely changed since RFC 1157 defined the first version. What has evolved is the security and efficiency around it — bulk transfers, encryption, access control — but the core idea of "an agent publishes numbers, a manager reads them" is the same today as it was decades ago. That stability is exactly why SNMP is still the lingua franca for switches, routers, servers, and printers alike.
Which SNMP version should I run? Three exist in practice: v1 (RFC 1157), v2c (community-based, RFC 1901/3416/3417), and v3 (RFC 3411–3418). Most read-only monitoring runs v2c because it's simple and widely supported. Its catch is that the community string travels in clear text, so it belongs on a trusted network. When you need real authentication and encryption on the wire, use v3. The standards page breaks down the differences.
What port does SNMP use? UDP 161 on the agent for normal polling, and UDP 162 for traps — the unsolicited notifications a device pushes to a manager. Both are UDP, not TCP. The ostr.io docs recommend moving the agent off the default 161 to a random port, which quietly cuts a lot of drive-by scanning.
What's the difference between an OID and a MIB?
An OID is a single address in the management tree, written as dotted numbers like 1.3.6.1.2.1.25.1.1.0. A MIB is the document that gives those numbers names and meaning — for example the Host Resources MIB (RFC 2790) tells you that OID is hrSystemUptime. You poll OIDs; you read MIBs to understand what you're polling. The glossary defines both in plain terms.
How do I test that SNMP is actually working?
Poll it. snmpwalk -v2c -c <community> <host> 1.3.6.1.2.1.25.1.1.0 should return the host's uptime. If you get a value back, the agent is up, the community is right, and the port is open. If it hangs or comes back empty, you've got a diagnosis to run — start with SNMP diagnostics.
Why does my snmpwalk time out? A timeout is a reachability problem, not an OID problem. The usual suspects are a wrong community string, the wrong port, or a firewall dropping UDP 161. The agent might also just be down. An empty result — no timeout — is different and usually means the OID isn't in the agent's allowed view. Both cases are walked through on the errors page.
Can SNMP tell me a server has crashed? Only if something outside the server is asking. SNMP is a pull protocol, so the agent speaks when polled and stays silent otherwise. If the box is down, its agent is down too — no answer comes back, and that silence is itself the signal, but only to a poller that's still running elsewhere. That's the whole argument for external monitoring.
Is SNMP secure by default?
Not with v2c. The community string is a shared password sent unencrypted, so anyone sniffing the segment can read it. You reduce exposure by keeping the agent read-only, allowlisting just the OIDs you poll, changing the port, and restricting source addresses in snmpd.conf. For confidentiality on untrusted paths, v3 adds USM authentication and privacy.
Do I have to install extra software to be monitored?
On the server, you run an SNMP agent — on Linux that's usually the Net-SNMP daemon, snmpd, which many systems already have. On the monitoring side you install nothing if you use a hosted checker. The agent publishes values; the poller reads them. There's no per-metric plugin to babysit, and no code you have to keep patched on every host just to be watched. That's part of SNMP's appeal: the heavy lifting sits in one small daemon that most operating systems ship with, and everything else is just asking it questions.
Related reading
Each of these owns a slice of the topic in full depth:
- Common SNMP questions — the "what is SNMP / how does it work" basics: versions, ports, the poll model, MIB-II and Host Resources MIB.
- SNMP error messages — timeouts, empty walks, "Unknown Object Identifier", noSuchName, and how to fix each.
- SNMP diagnostics — testing a live agent with snmpwalk, snmpget, numeric output, and snmptranslate.
- SNMP standards & RFCs — the version and MIB standards table, from RFC 1157 through RFC 3411–3418.
- SNMP glossary — every term here defined once, cleanly.
- Sensor & OID catalog — the actual metrics you poll: CPU, memory, storage, interfaces.
- SNMP monitoring home — the top of the knowledge base.
For the practical, external side of all this, ostr.io Monitoring runs SNMP health checks against your server from outside your network and sends real-time email and SMS alerts when a reading crosses a limit — so a metric still reaches you even when the box itself can't.
