SNMP: a not-so-simple protocol

SNMP stands for Simple Network Management Protocol. The “Simple” is the irony of the century: the protocol uses OIDs (Object Identifiers) that are trees of numbers, MIBs (Management Information Base) that translate the numbers into names, communities (public, private) that serve as cleartext passwords and versions (v1, v2c, v3) each with its own quirks.

The OIDs: the tree

Every piece of data in SNMP has an OID: a dot-separated sequence of numbers. The standard tree:

1.3.6.1.2.1.1    = system (uptime, contact, hostname)
1.3.6.1.2.1.2    = interfaces (list, stats)
1.3.6.1.4.1.2021 = UCD-SNMP-MIB (disk, load, memory, processes)
1.3.6.1.4.1.9    = Cisco (proprietary)

The 1.3.6.1.4.1 node is the “enterprise” node, where every vendor has a branch. Cisco = 9, HP = 11, etc. Under the enterprise branch, each vendor invents its own hierarchy and the MIBs that translate these numbers into readable names are text files to install in the SNMP client.

The queries

# The system name
snmpget -v2c -c public 192.168.1.1 1.3.6.1.2.1.1.5.0

# The uptime
snmpget -v2c -c public 192.168.1.1 1.3.6.1.2.1.1.3.0

# The interfaces table (walk)
snmpwalk -v2c -c public 192.168.1.1 1.3.6.1.2.1.2

# The load average (in the UCD branch)
snmpget -v2c -c public 192.168.1.1 1.3.6.1.4.1.2021.10.1.3.1

snmpget asks for a specific value, snmpwalk enumerates all values under an OID. The -c public is the community: in SNMP v1 and v2c, the community is the only “password” and it travels in cleartext in every packet.

What it is for

SNMP is the protocol Cacti uses to collect metrics: network traffic (interface OIDs), CPU, memory, disk, temperature. The Cacti polling queries the equipment every 5 minutes via SNMP and stores into RRDtool, which generates the monitoring graphs.

SNMP is also the protocol that network equipment speaks natively: switches, routers, firewalls, servers. An SNMP scan on the network reveals every device speaking SNMP with the public community (the default, rarely changed) and those devices expose their configuration, their interfaces, their ARP tables.

The danger

SNMP v1/v2c sends the community in cleartext. A sniffer on the network sees public in every SNMP packet and can then query the equipment itself. SNMP v3 encrypts and authenticates, but it is more complex to configure and many networks still run v2c with public.

The SNMP default (community=public, port 161/udp open, anyone can read) is the kind of flaw that goes unnoticed: no error logs, no alerts, just data leaking silently to whoever knows the protocol.

[edit: 2026] SNMP v3 became the standard for recent equipment, but v2c with public survives in legacy fleets. Modern monitoring tools (Prometheus, Grafana) added SNMP exporters, but the protocol underneath is still SNMP. The OIDs are still number trees, the MIBs are still text files nobody reads and the public community still leaks.