SNMP v2c vs v3, in Practice

Introduction¶

SNMP is still how most switches, routers, PDUs, UPSes, and printers expose metrics. It's easy to set up badly (v2c with public) and only slightly harder to set up right (v3 authPriv). This covers both plus the querying basics.

Concepts¶

• OID (Object Identifier) — a dotted number like 1.3.6.1.2.1.1.3.0 identifying one value (here, sysUpTime). A hierarchical namespace.
• MIB (Management Information Base) — a text file mapping human names (sysUpTime.0) to OIDs and describing types. Purely for readability; the protocol only uses numbers.
• Operations: GET (one OID), GETNEXT/WALK (traverse a subtree), GETBULK (WALK, fewer round trips, v2c+), SET (write — usually disabled), and traps/informs (device-initiated notifications to a manager).

Default ports: UDP 161 (agent), UDP 162 (trap receiver).

Versions¶

A v2c community string is a shared password sent unencrypted every few seconds. On any network where that's a concern, it's a credential leak.

Hands-on¶

Query with v2c¶

snmpget  -v2c -c public host 1.3.6.1.2.1.1.3.0        # sysUpTime
snmpwalk -v2c -c public host 1.3.6.1.2.1.2.2.1        # the interface table
snmpwalk -v2c -c public host IF-MIB::ifDescr          # needs the MIB installed
snmpbulkwalk -v2c -c public host 1.3.6.1.2.1.31.1.1.1 # 64-bit interface counters

Install MIBs (snmp-mibs-downloader on Debian) and set mibs +ALL in /etc/snmp/snmp.conf to use names.

Configure SNMPv3 (Net-SNMP agent)¶

Stop the daemon, then create a user with net-snmp-create-v3-user:

sudo systemctl stop snmpd
sudo net-snmp-create-v3-user -ro -A 'AuthPass_LongRandom' -a SHA \
                                 -X 'PrivPass_LongRandom' -x AES  monitoruser
sudo systemctl start snmpd

This adds a createUser line to /var/lib/snmp/snmpd.conf (consumed and rewritten on start) and rouser monitoruser priv to /etc/snmp/snmpd.conf. Restrict what it can see with a view:

# /etc/snmp/snmpd.conf
view   sysview  included  .1.3.6.1.2.1
rouser monitoruser priv -V sysview

Query with v3¶

snmpwalk -v3 -l authPriv -u monitoruser \
  -a SHA -A 'AuthPass_LongRandom' \
  -x AES -X 'PrivPass_LongRandom' \
  host 1.3.6.1.2.1.1

Levels: noAuthNoPriv (username only — pointless), authNoPriv (authenticated, cleartext data), authPriv (authenticated + encrypted — use this).

Verification and troubleshooting¶

# Is the agent even answering?
snmpget -v2c -c public -t 2 -r 1 host 1.3.6.1.2.1.1.1.0
sudo tcpdump -ni any udp port 161

• Timeout: No Response from host — agent not running, UDP 161 firewalled, wrong community/credentials (v2c gives no error for a wrong community, just silence), or the agent's agentAddress/com2sec restricts your source IP.
• v3 Authentication failure (incorrect password, community or key) — wrong auth passphrase or protocol (SHA vs MD5), or clock skew beyond the time window. Check authKey/privKey and NTP on both ends.
• v3 Unknown user name — the createUser line wasn't processed (daemon didn't restart cleanly) or you're querying the wrong -u.
• WALK returns numbers, not names — MIBs not installed or mibs disabled in snmp.conf. Cosmetic; monitoring systems use numeric OIDs anyway.
• Interface counters wrong / wrapping — you're polling 32-bit (ifInOctets) on a fast link. Use 64-bit ifHCInOctets via snmpbulkwalk.
• Traps not arriving — the agent's trapsink/trap2sink points at the wrong manager, UDP 162 is blocked, or the manager expects informs (acked) not traps (fire-and-forget).

Related tools and reading¶

• On-site: Port Checker, Super Scanner.
• Related posts: NTP stratum and clock discipline, Nagios active vs passive checks.