Introduction to SNMP¶
In this introduction, we'll cover general information about the SNMP protocol, including key concepts such as OIDs and MIBs.
If you're already familiar with the SNMP protocol, feel free to skip to the next page.
What is SNMP?¶
SNMP (Simple Network Management Protocol) is a protocol for monitoring network devices. It uses UDP and supports both a request/response model (commands and queries) and a notification model (traps, informs).
In the request/response model, the SNMP manager (eg. the Datadog Agent) issues an SNMP command (
BULK) to an SNMP agent (eg. a network device).
SNMP was born in the 1980s, so it has been around for a long time. While more modern alternatives like NETCONF and OpenConfig have been gaining attention, a large amount of network devices still use SNMP as their primary monitoring interface.
The SNMP protocol exists in 3 versions:
The main differences between v1/v2c and v3 are the authentication mechanism and transport layer, as summarized below.
|v1/v2c||Password (the community string)||Plain text only|
|v3||Username/password||Support for packet signing and encryption|
What is an OID?¶
Identifiers for queryable quantities
An OID, also known as an Object Identifier, is an identifier for a quantity ("object") that can be retrieved from an SNMP device. Such quantities may include uptime, temperature, network traffic, etc (quantities available will vary across devices).
To make them processable by machines, OIDs are represented as dot-separated sequences of numbers, e.g.
OIDs are globally defined, which means they have the same meaning regardless of the device that processes the SNMP query. For example, querying the
220.127.116.11.18.104.22.168 OID (also known as
sysDescr) on any SNMP agent will make it return the system description. (More on the OID/label mapping can be found in the MIBs section below.)
Not all OIDs contain metrics data
OIDs can refer to various types of objects, such as strings, numbers, tables, etc.
In particular, this means that only a fraction of OIDs refer to numerical quantities that can actually be sent as metrics to Datadog. However, non-numerical OIDs can also be useful, especially for tagging.
The OID tree¶
OIDs are structured in a tree-like fashion. Each number in the OID represents a node in the tree.
The wildcard notation is often used to refer to a sub-tree of OIDs, e.g.
It so happens that there are two main OID sub-trees: a sub-tree for general-purpose OIDs, and a sub-tree for vendor-specific OIDs.
Located under the sub-tree:
These OIDs are applicable to all kinds of network devices (although all devices may not expose all OIDs in this sub-tree).
22.214.171.124.126.96.36.199 corresponds to
sysDescr, which contains a free-form, human-readable description of the device.
Located under the sub-tree:
These OIDs are defined and managed by network device vendors themselves.
Each vendor is assigned its own enterprise sub-tree in the form of
188.8.131.52.4.1.2.*is the sub-tree for IBM-specific OIDs.
184.108.40.206.4.1.9.*is the sub-tree for Cisco-specific OIDs.
The full list of vendor sub-trees can be found here: SNMP OID 220.127.116.11.4.1.
| || ||An OID whose value is an OID that represents the device make and model (yes, it's a bit meta).|
| || ||A human-readable, free-form description of the device.|
| || ||The device uptime.|
What is an MIB?¶
OIDs are grouped in modules called MIBs (Management Information Base). An MIB describes the hierarchy of a given set of OIDs. (This is somewhat analogous to a dictionary that contains the definitions for each word in a spoken language.)
For example, the
IF-MIB describes the hierarchy of OIDs within the sub-tree
18.104.22.168.2.1.2.*. These OIDs contain metrics about the network interfaces available on the device. (Note how its location under the
22.214.171.124.2.* sub-tree indicates that it is a generic MIB, available on most network devices.)
As part of the description of OIDs, an MIB defines a human-readable label for each OID. For example,
IF-MIB describes the OID
126.96.36.199.2.1.1 and assigns it the label
sysDescr. The operation that consists in finding the OID from a label is called OID resolution.
Tools and resources¶
The following resources can be useful when working with MIBs:
- MIB Discovery: a search engine for OIDs. Use it to find what an OID corresponds to, which MIB it comes from, what label it is known as, etc.
- Circitor MIB files repository: a repository and search engine where one can download actual
- SNMP Labs MIB repository: alternate repo of many common MIBs. Note: this site hosts the underlying MIBs which the
pysnmp-mibslibrary (used by the SNMP Python check) actually validates against. Double check any MIB you get from an alternate source with what is in this repo.
For other high-level overviews of SNMP, see:
- How SNMP Works (Youtube)
- SNMP (Wikipedia)
- Tutorials: Internet Management and SNMP (YouTube) (In-depth videos about SNMP architecture, MIBs, protocol data structures, security models, monitoring code examples, etc.)