Copyright (c) 2026 MindMesh Academy. All rights reserved. This content is proprietary and may not be reproduced or distributed without permission.

4.2.1. SNMP and Flow Data

SNMP (Simple Network Management Protocol):
ComponentFunction
AgentSoftware on monitored device that collects and exposes data
Manager/NMSCentral system that polls agents and receives traps
MIBManagement Information Base—database schema of manageable objects
OIDObject Identifier—specific item to query (CPU utilization, interface errors)
TrapUnsolicited alert from agent to manager (link down, threshold exceeded)
Community stringPassword (v1/v2c only); change defaults such as public/private, which anyone can guess and use to query (or, for write strings, change) the device

SNMP Operations: Get (manager polls a value—scheduled polling of interface statistics is repeated Gets), Set (manager changes a value), Trap (unacknowledged alert from agent), Inform (acknowledged alert from agent, v2c/v3).

SNMP Versions:
  • v1/v2c: Community strings in plaintext—insecure but widely deployed
  • v3: Authentication (verifies identity) and encryption (protects data)—recommended

Flow Data (NetFlow, sFlow, IPFIX): Records metadata about network conversations—source/destination IP, ports, bytes transferred, duration. NetFlow is Cisco's format; IPFIX is the IETF standard (RFC 7011) derived from NetFlow v9; sFlow samples packets (1 in N) rather than tracking every flow. Because records include ports and protocols, a collector can attribute bandwidth to applications without endpoint agents—but flow data carries no payload. Useful for:

  • Traffic analysis (what's consuming bandwidth)
  • Security monitoring (unusual traffic patterns)
  • Capacity planning (trending over time)
See how it connects
Start with 40 free practice questions
Alvin Varughese
Written byAlvin Varughese
Founder•20 professional certifications