5.4. SNMP

💡 First Principle: SNMP provides a standardized way to monitor and manage network devices remotely. Managers query agents for status; agents can send traps to alert managers of problems. Without SNMP, you'd need to log into every device manually to check status—impossible at scale.

Consider this monitoring scenario: Your network has 500 devices. Without SNMP, checking interface status means 500 SSH sessions, 500 show interface commands, and manually comparing output. With SNMP, your monitoring platform polls all 500 devices automatically, alerts you when thresholds are crossed, and graphs historical trends. SNMP is the foundation of all network monitoring.

What happens when SNMP security fails: SNMP community strings like "public" and "private" are well-known defaults. An attacker scans your network, finds devices responding to SNMP queries with these community strings, and now has a complete map of your infrastructure—IP addresses, interface names, even configurations if read-write access is enabled. Default SNMP settings are a reconnaissance goldmine.

How SNMP works in practice:

1. Polling: The management station periodically asks devices "what's your interface status?" "what's your CPU usage?"
2. Traps: Devices proactively send alerts when something important happens—"my interface just went down!"
3. MIBs: Standardized databases that define what objects can be queried (interface counters, system info, etc.)