SNMP is unfashionable and indispensable. Every switch, access point, UPS, and printer speaks it, and most of the numbers on a network dashboard originate from an OID that has not changed since the 1990s.

You do not need to learn the whole MIB tree. You need about a dozen OIDs, an understanding of counter width, and a security configuration that is not public.

The model, in one paragraph

An SNMP manager polls an agent on a device for values identified by OIDs (object identifiers). Values come from MIBs, which are schemas. Traps are unsolicited notifications from the device to the manager. Versions: v1 (obsolete), v2c (community string, plaintext), v3 (users, authentication, encryption).

The OIDs worth knowing

OID Name Use
1.3.6.1.2.1.1.3.0 sysUpTime Reboot detection
1.3.6.1.2.1.2.2.1.8 ifOperStatus Link up/down
1.3.6.1.2.1.2.2.1.10 ifInOctets (32-bit) Legacy byte counter
1.3.6.1.2.1.31.1.1.1.6 ifHCInOctets (64-bit) Bytes in, correct
1.3.6.1.2.1.31.1.1.1.10 ifHCOutOctets Bytes out
1.3.6.1.2.1.2.2.1.14 ifInErrors Receive errors
1.3.6.1.2.1.2.2.1.19 ifOutDiscards Transmit drops
1.3.6.1.2.1.31.1.1.1.15 ifHighSpeed Link speed in Mbps
1.3.6.1.2.1.25.3.3.1.2 hrProcessorLoad CPU (host MIB)

Use the 64-bit counters. The 32-bit byte counters wrap at 4 GB, which on a 1 Gbps link happens in about 35 seconds — a graph built on them shows sawtooth resets that are not reboots.

Counters are cumulative, not rates

An SNMP value is a total since the device booted. Every useful graph is a derivative: (t2 - t1) / (t2 - t1). A counter that goes backwards means a wrap or a reboot, and your poller must handle both or your graphs will show negative traffic.

Polling design

Setting Typical Why
Interval 60 s Fine for capacity; too coarse for microbursts
Timeout 2 s Longer stalls the poll cycle
Retries 2 Enough for a busy device, not enough to pile up
Interfaces Uplinks and access ports you care about Polling 48 idle ports wastes time

Polling every interface on every switch every minute is how a monitoring server falls behind. Poll uplinks, WAN, and any port with a device behind it; leave the rest for on-demand queries.

Traps: useful, but not reliable

Traps are UDP and unacknowledged. A trap can be lost, and a device can reboot without sending one.

Trap Use
linkDown / linkUp Fast notification of a port change
coldStart / warmStart Reboot detection
authenticationFailure Someone tried a bad community string

Treat traps as an accelerator, not a source of truth: poll sysUpTime and ifOperStatus so a lost trap does not become a silent outage.

Poll for state, trap for speed: the two paths into the same dashboard.

Security

SNMP v2c sends the community string in plaintext, and public is the default on far too much equipment. Anyone who can reach UDP 161 can read your interface table, ARP table, and sometimes more.

  • Use v3 with authPriv (SHA-256, AES) where supported.
  • Restrict UDP 161 to the monitoring host by ACL, at the device and the firewall.
  • Never reuse a community string as a password.
  • Disable SNMP on devices that do not need it.

On UniFi, SNMP is configured per site with a community string; v3 support varies by device class, so check before designing around it.

A building reports intermittent slowness. Poll the uplink every minute for a day:

  1. ifHCInOctets and ifHCOutOctets → utilization, p95.
  2. ifInErrors → CRC and alignment errors, which indicate physical problems.
  3. ifOutDiscards → congestion or a full queue.
  4. ifHighSpeed → confirm it is 1 Gbps and not 100 Mbps.

If errors climb while utilization is low, the problem is the cable or the optics. If discards climb with utilization, the problem is capacity. The counters distinguish the two without a capture.

What breaks in production

  • 32-bit counters producing sawtooth graphs on fast links.
  • Polling too much so the poller never finishes a cycle and data goes stale.
  • Community strings of public exposing the device to anyone on the management VLAN.
  • Traps treated as reliable, so a missed trap is a missed outage.
  • No timeout handling, so one slow device delays every other poll.

Checklist

  1. 64-bit counters are used for bytes.
  2. Poll interval and timeout are tuned so a cycle completes.
  3. Only meaningful interfaces are polled at high frequency.
  4. SNMP v3 with authPriv where available; ACLs everywhere.
  5. sysUpTime is polled to catch reboots that traps miss.
  6. Counter wraps and resets are handled by the collector.

Next

SNMP gives you numbers. Continue with Logs and Flow Data for the narrative and the who-talks-to-whom.

  • SNMP
  • OID
  • MIB
  • Polling
  • Traps