First, the essential ideas
- SNMP manager and agent
- Simple Network Management Protocol lets a manager request managed information from an agent on a device. The manager is the monitoring application; the agent exposes supported objects under access controls.
- MIB and OID
- A Management Information Base defines managed objects and their meaning. An Object Identifier is the numeric tree path identifying an object or instance. MIB is not a packet capture or a complete device configuration.
- Scalar and table instance
- A scalar has one value and commonly ends with instance .0. A table object uses an index identifying a row, such as an interface. The index must be discovered, not guessed from a port label.
- Polling, trap and inform
- Polling asks periodically for current values. A trap is an unacknowledged notification. An inform requests acknowledgement, but neither notification guarantees that an operator saw or resolved an event.
- Counter and gauge
- A counter accumulates events or units and can reset or wrap. A gauge represents a current magnitude that may rise or fall. Rates require at least two appropriate counter samples and elapsed time.
- SNMPv3 authPriv
- The authPriv security level authenticates messages and protects their contents with encryption. SNMPv3 also has weaker levels, so the version number alone does not prove encryption.
- View and baseline
- A view limits which object subtrees a user may read or write. A baseline records normal behavior over a defined period, with collection interval, units and resets documented.
- Console and credentials
- Open the named GNS3 node's Console. IOS uses >, # and configuration prompts; Linux uses a shell. Lab-only secrets must be chosen privately, never reused or included in evidence.
The manager asks a precise object question and the agent returns an authorized value. The lab reads only the system subtree; it never changes device state using SNMP. Interface-rate calculations and notifications are taught separately as paper analysis, not fabricated collector output.
See the idea
An SNMP poll ends with a value at the manager
The agent authorizes a specific object read; the reply proves that exchange, not the whole service.
Ask the exact instance
Manager1 requests sysName.0 or sysUpTime.0 from 192.0.2.1. The scalar instance suffix is part of the question.
What this model leaves out: One private manager-agent link. No trap receiver or application server is configured; interface-rate and notification examples remain paper analysis.
Full visual explanation and references
Manager1 sends an authenticated encrypted object request to Agent1. Agent1 returns the permitted value to Manager1 across the same private link.
One private manager-agent link. No trap receiver or application server is configured; interface-rate and notification examples remain paper analysis.
- Ask the exact instance
Manager1 requests sysName.0 or sysUpTime.0 from 192.0.2.1. The scalar instance suffix is part of the question.
www.rfc-editor.org - Authorize the read
Agent1 checks the v3 user, security level, source restriction and read view. A successful ping does not satisfy these checks.
www.cisco.comwww.cisco.com - Return and interpret
The permitted value returns to Manager1. Record its type and collection time without claiming every user application is healthy.
www.rfc-editor.org
One idea at a time
Start with something familiar.
Treat an OID like a precisely labeled measurement request. Before using a value, know its meaning and unit. This lesson uses numeric identifiers so missing downloaded MIB name files do not conceal the underlying object being queried.
Why learn this?
A dashboard can report a device unreachable because credentials changed while the device still forwards traffic. Conversely, a device can answer management requests while a user service is broken. Monitoring must state what was actually observed.
An everyday comparison
A building supervisor can ask a sensor for temperature or receive an alarm when a threshold is crossed. A sensor answering one question does not prove every room is comfortable.
What happens in a network
The monitoring manager polls an agent for specific values; notifications report selected events. Different objects answer different questions about the device.
Where the comparison stopsSNMP data types, indexes, access controls and transport behavior are defined protocol mechanisms. The analogy does not guarantee alarm delivery or establish that a collected value is the right service indicator.
Follow one worked example
- Choose the exact instance to read.
The system uptime OID ends in .0 because it is a scalar instance. A table such as interface counters would require a specific discovered row index.
Why: A correct object family with a missing or wrong instance can still fail.
- Establish restricted protected access.
Agent1 allows Manager1 to read system objects with authPriv. The manager stores lab secrets in a private local configuration file rather than command arguments.
Why: Monitoring should not require unrestricted write access or casually expose reusable credentials.
- Separate response failure from device failure.
One request uses an intentionally unknown username while the IP path remains working. The response or timeout is recorded, then the correct user is retried.
Why: A management-access fault can explain a missing metric without proving a forwarding outage.
- Interpret two samples before calculating a rate.
A paper counter rises by 3000000 octets over 30 seconds, giving 800000 bits/s after multiplying by eight.
Why: A raw accumulated counter is not utilization, and a reset makes a naive difference invalid.
Your first small task
On paper, a byte counter increases from 1000000 to 4000000 over 30 seconds with no reset. Calculate bits per second. Then state the extra information required to express utilization as a percentage.
Show a hint
Subtract first, multiply the octet difference by eight, then divide by elapsed seconds.
Check the expected result
The rate is 800000 bits/s. A meaningful percentage also needs the appropriate interface or service capacity and a consistent measurement direction.
Pause and explain it in your own words
An SNMP query times out while ping replies. Is the router definitely broken?
Show a hint
The tests use different protocols and SNMP also depends on identity, security level and view permissions.
Show the explanation
No. Inspect the SNMP service path, credentials, algorithm agreement and permissions. Ping only confirms its own exchange, while a failed SNMP poll alone does not prove forwarding or application failure.
Short answer
What should you understand today?
SNMP lets a manager read supported objects from a device agent and receive notifications. Useful monitoring combines the right object, units, collection interval and baseline. A ping or successful uptime query does not prove application health. Use restricted access and an appropriate SNMPv3 security level; the word v3 alone does not guarantee authentication and encryption.
Before you begin
Learning targets
- Recall Day 41 why observation timestamps and clock context matter.
- Use GNS3 2.2.55, an entitled C8000v IOS XE 17.12.1a agent and Ubuntu 24.04 LTS with Net-SNMP 5.9.4 tools.
- Prepare a fresh Linux user and two distinct private lab-only passphrases; do not use any production credentials.
- Explain managers, agents, MIB definitions and OID instances.
- Compare polling, traps and informs without promising guaranteed event delivery.
- Interpret scalar and counter evidence and recognize resets and index changes.
- Configure a read-only system-object view and an SNMPv3 authPriv user.
- Test one wrong-username request and recover without weakening security controls.
Words you will meet
Open a word when you need its meaning. You do not need to memorize the whole list before reading.
SNMP manager and agent
Simple Network Management Protocol lets a manager request managed information from an agent on a device. The manager is the monitoring application; the agent exposes supported objects under access controls.
MIB and OID
A Management Information Base defines managed objects and their meaning. An Object Identifier is the numeric tree path identifying an object or instance. MIB is not a packet capture or a complete device configuration.
Scalar and table instance
A scalar has one value and commonly ends with instance .0. A table object uses an index identifying a row, such as an interface. The index must be discovered, not guessed from a port label.
Polling, trap and inform
Polling asks periodically for current values. A trap is an unacknowledged notification. An inform requests acknowledgement, but neither notification guarantees that an operator saw or resolved an event.
Counter and gauge
A counter accumulates events or units and can reset or wrap. A gauge represents a current magnitude that may rise or fall. Rates require at least two appropriate counter samples and elapsed time.
SNMPv3 authPriv
The authPriv security level authenticates messages and protects their contents with encryption. SNMPv3 also has weaker levels, so the version number alone does not prove encryption.
View and baseline
A view limits which object subtrees a user may read or write. A baseline records normal behavior over a defined period, with collection interval, units and resets documented.
Console and credentials
Open the named GNS3 node's Console. IOS uses >, # and configuration prompts; Linux uses a shell. Lab-only secrets must be chosen privately, never reused or included in evidence.
A manager asks the agent a typed question
The manager sends requests to an agent, commonly on UDP 161. The agent exposes implemented objects according to its access controls. Get retrieves named instances; walking uses successive requests to inspect a subtree or table. SNMP Set can change supported objects, so read-only monitoring and write authorization must be treated separately.
- Choose an object because its definition answers the operational question.
- Do not turn on write access merely to make a monitoring tool connect.
An object identifier needs the right instance
MIB definitions specify object syntax, units, access and meaning. Numeric OIDs form a tree. A scalar's .0 instance differs from an interface table row indexed by ifIndex. A physical label such as GigabitEthernet1 is not guaranteed to have index 1. Indexes can change after platform or software events, so a monitoring system must maintain the mapping.
- Numeric syntax avoids dependence on local text-name MIB loading.
- Missing objects, denied views and transport timeouts are different observations.
Polling and notifications complement one another
Polling provides periodic samples and can establish a baseline, but an event shorter than the interval may occur between samples. Traps report selected events without an acknowledgement at the SNMP operation level. Informs request acknowledgement and may be retried, yet receipt is not proof that storage, alert routing or human response succeeded. Notifications commonly target UDP 162.
- An acknowledgement is not incident resolution.
- The collector's availability and retention are dependencies too.
A counter becomes a rate only with time and continuity
A counter accumulates units; a gauge represents a current level. To calculate a rate, subtract compatible counter samples and divide by the elapsed interval. Check counter size, discontinuity or reset indicators and interface identity. High-capacity counters help on fast interfaces but still require correct interpretation. A negative delta after a reboot is not negative traffic.
- Use actual elapsed time, not an assumed perfectly punctual poll interval.
- Utilization also depends on the meaningful link or service rate.
Version, security level and access scope all matter
SNMPv1/v2c community strings do not provide the authPriv protection used here. SNMPv3 supports several security levels; authPriv requires authentication plus privacy. Algorithm support varies, so both ends must agree. A view restricts accessible objects, while a source ACL restricts which manager may use the group. Neither replaces sound credential management.
- Do not paste real secrets into captions, screenshots or review artifacts.
- Verify SNMP users with show snmp user; their full creation line may not appear in running configuration.
Monitoring should lead to a bounded diagnosis
A failed poll can reflect routing, agent state, security-level mismatch, credentials, view restrictions or unsupported objects. Test these layers without disabling every control. A successful poll proves only the authorized object exchange. Add interface, route and application evidence according to the service being monitored; do not replace service health with an availability-only dashboard.
- Keep a known-good query and private console available during diagnosis.
- v1.1 is current through 2 February 2027; v2.0 begins 3 February 2027.
Real-world walkthrough
The dashboard is red after a credential change
In a fictional branch, monitoring reports the router down after its SNMP identity changes. Users can still reach an internal application. The operator should not reboot the router merely to clear the red indicator. The monitoring exchange, the forwarding path and the user's service are separate systems with different evidence.
- Preserve the last successful poll time and the first failed request; confirm which object and security level were used.
- Check the management path with a bounded test, then inspect the agent's user, group, source ACL and view from its Console.
- Compare the manager's configured identity and algorithms without printing secrets into an incident ticket.
- Correct only the approved monitoring configuration and repeat the known-good scalar request.
- Verify application health independently and classify the incident as monitoring access failure only when the evidence supports that limited conclusion.
Guided GNS3 lab
Restricted SNMPv3 polling with one identity fault
Read two system scalar instances using authPriv, compare a wrong-user request and restore the known-good request. No SNMP runtime or notification delivery was measured during authoring.
Addressing plan
| Device | Interface | Address | Purpose |
|---|---|---|---|
| Agent1 | GigabitEthernet1 | 192.0.2.1/24 | SNMP agent on UDP 161. |
| Manager1 | ens3 | 192.0.2.10/24 | Only permitted polling source. |
Set up the lab
- Install Net-SNMP tools and nano before isolating the manager. Confirm SHA-256/AES support on both selected versions; stop on a mismatch.
- Create two distinct 16-character or longer random alphanumeric lab-only secrets privately. Replace AUTH_SECRET and PRIV_SECRET everywhere; placeholders are not literal passwords.
- Use a fresh Linux user whose ~/.snmp directory does not already contain settings. The private snmp.conf file stores plaintext lab secrets and must remain mode 600 in a mode 700 directory.
- In nano, Ctrl+O then Enter saves and Ctrl+X exits. Do not include this file or credential-bearing Console lines in shared evidence.
- Paper alternative: follow the numeric OID and request/response flow and solve the counter example. It does not prove authPriv negotiation or agent support.
Prepare the agent interface
In GNS3, right-click Agent1 and choose Console before typing. Start at > or # on the fresh router. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
enable
configure terminal
hostname Agent1
interface GigabitEthernet1
ip address 192.0.2.1 255.255.255.0
no shutdown
endWhat each command means
enable- Enter privileged EXEC (#) from user EXEC (>); use only your authorized lab credentials.
configure terminal- Enter global configuration mode from privileged EXEC (#); accepted changes affect the running device.
hostname Agent1- Set the disposable router's name, which the system-name query will inspect.
interface GigabitEthernet1- Select the cable to Manager1 ens3.
ip address 192.0.2.1 255.255.255.0- Assign the private agent /24 address.
no shutdown- Enable the management link.
end- Return to privileged EXEC (#). This neither saves the configuration nor reverses accepted changes.
- What you should see
- Agent1 owns .1 on the only cable; no default route is needed.
- Why this step matters
- A direct isolated path avoids hidden routing or public service dependencies.
Prepare the manager link
In GNS3, right-click Manager1 and choose Console before typing. At the Linux shell, confirm ens3 is the isolated interface. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
ip -br address
sudo ip address add 192.0.2.10/24 dev ens3
sudo ip link set ens3 up
ping -c 3 192.0.2.1
snmpget --versionWhat each command means
ip -br address- Inspect the interface map before assigning the planned address.
sudo ip address add 192.0.2.10/24 dev ens3- Assign the only allowed manager source address.
sudo ip link set ens3 up- Enable the private link.
ping -c 3 192.0.2.1- Send three local reachability probes, not SNMP requests.
snmpget --version- Record the tool version before using the configured algorithms.
- What you should see
- Agent1 should answer ping; SNMP is not yet proven.
- Why this step matters
- Address and tool evidence make later authentication errors easier to distinguish.
Create the restricted view and user
In GNS3, right-click Agent1 and choose Console before typing. Start at #. Replace both secret placeholders privately before typing; never record their values in shared notes. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
configure terminal
ip access-list standard MANAGER
permit host 192.0.2.10
exit
snmp-server view SYSTEM 1.3.6.1.2.1.1 included
snmp-server group LABREAD v3 priv read SYSTEM access MANAGER
snmp-server user learner LABREAD v3 auth sha-2 256 AUTH_SECRET priv aes 128 PRIV_SECRET
end
show snmp user
show snmp groupWhat each command means
configure terminal- Enter global configuration mode from privileged EXEC (#); accepted changes affect the running device.
ip access-list standard MANAGER- Create the dedicated source restriction list.
permit host 192.0.2.10- Allow only the planned manager source.
exit- Return to global configuration.
snmp-server view SYSTEM 1.3.6.1.2.1.1 included- Permit the system subtree only, not the entire MIB or write access.
snmp-server group LABREAD v3 priv read SYSTEM access MANAGER- Require authenticated encrypted v3 requests and apply the read view and source ACL.
snmp-server user learner LABREAD v3 auth sha-2 256 AUTH_SECRET priv aes 128 PRIV_SECRET- Create the lab user with SHA-256 authentication and AES-128 privacy using the two private substituted secrets.
end- Return to privileged EXEC (#). This neither saves the configuration nor reverses accepted changes.
show snmp user- Inspect identity and algorithms without expecting the full secret-bearing creation line in running-config.
show snmp group- Inspect the group's security level and view attachment.
- What you should see
- The user and read-only group should match the manager plan.
- Why this step matters
- The setup explicitly limits source, objects and security level instead of relying on the version number alone.
Create private manager settings
In GNS3, right-click Manager1 and choose Console before typing. At the Linux shell run umask first, then create and edit the new file. Enter one line each: defVersion 3; defSecurityName learner; defSecurityLevel authPriv; defAuthType SHA-256; defPrivType AES; defAuthPassphrase AUTH_SECRET; defPrivPassphrase PRIV_SECRET. Semicolons here separate instructions, not file text. Substitute the same private secrets, save and exit nano. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
umask 077
mkdir -m 700 ~/.snmp
nano ~/.snmp/snmp.conf
chmod 600 ~/.snmp/snmp.confWhat each command means
umask 077- Ensure newly created files are private to this user.
mkdir -m 700 ~/.snmp- Create the fresh user's private settings directory; stop if unexpected existing data is present.
nano ~/.snmp/snmp.conf- Enter the seven settings on separate lines without semicolons; this file supplies credentials without command-line password arguments.
chmod 600 ~/.snmp/snmp.conf- Restrict file read/write permission to its owner.
- What you should see
- The file is private and contains matching v3 identity, algorithms and lab secrets.
- Why this step matters
- This avoids putting secrets in process arguments, though the file still needs protection and later removal.
Read the two scalar instances
In GNS3, right-click Manager1 and choose Console before typing. At the Linux shell, preserve returned values but never include the private configuration file in evidence. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
snmpget -On -r 0 -t 2 192.0.2.1 1.3.6.1.2.1.1.5.0
snmpget -On -r 0 -t 2 192.0.2.1 1.3.6.1.2.1.1.3.0What each command means
snmpget -On -r 0 -t 2 192.0.2.1 1.3.6.1.2.1.1.5.0- Read sysName.0 with numeric output, no retry and a two-second timeout using private default credentials.
snmpget -On -r 0 -t 2 192.0.2.1 1.3.6.1.2.1.1.3.0- Read sysUpTime.0; .0 selects the scalar instance, and the value represents management-subsystem uptime.
- What you should see
- The name should identify Agent1 and uptime should return a TimeTicks value; record actual results.
- Why this step matters
- A successful response establishes only these authorized objects and this management exchange.
Repeat a sample without inventing a rate
In GNS3, right-click Manager1 and choose Console before typing. At the Linux shell, wait a documented interval using your observation clock and then repeat the uptime query. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
snmpget -On -r 0 -t 2 192.0.2.1 1.3.6.1.2.1.1.3.0What each command means
snmpget -On -r 0 -t 2 192.0.2.1 1.3.6.1.2.1.1.3.0- Read another uptime sample with the identical security context and instance.
- What you should see
- The management uptime should advance unless a reset occurred; it is not an interface byte counter.
- Why this step matters
- Do not use uptime differences as traffic rates; the counter-rate exercise is a separate paper example.
Make one wrong-identity request
In GNS3, right-click Manager1 and choose Console before typing. At the Linux shell, make one bounded request with an unknown username. Do not change the agent or weaken its security. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
snmpget -u wronguser -On -r 0 -t 2 192.0.2.1 1.3.6.1.2.1.1.5.0
ping -c 3 192.0.2.1What each command means
snmpget -u wronguser -On -r 0 -t 2 192.0.2.1 1.3.6.1.2.1.1.5.0- Override only the username for this request; keep the target, instance and security level otherwise unchanged.
ping -c 3 192.0.2.1- Confirm the basic IP path can remain reachable despite the failed authorized object exchange.
- What you should see
- The wrong identity should not obtain the protected value; the tool may report an error or timeout.
- Why this step matters
- A failed management query is not automatically a forwarding outage. Avoid repeated login attempts or brute-force testing.
Retest the original identity
In GNS3, right-click Manager1 and choose Console before typing. At the Linux shell omit the wrong-user override and use the original private defaults again. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
snmpget -On -r 0 -t 2 192.0.2.1 1.3.6.1.2.1.1.5.0
snmpget -On -r 0 -t 2 192.0.2.1 1.3.6.1.2.1.1.3.0What each command means
snmpget -On -r 0 -t 2 192.0.2.1 1.3.6.1.2.1.1.5.0- Repeat the exact known-good name query with learner's stored credentials.
snmpget -On -r 0 -t 2 192.0.2.1 1.3.6.1.2.1.1.3.0- Confirm the protected uptime instance remains readable.
- What you should see
- The original authorized object reads should recover without any agent-side security downgrade.
- Why this step matters
- The fault was a per-command override, so rollback is returning to the original request rather than editing every credential.
Document scope and retire lab secrets
Record the successful, wrong-user and restored results with collection times. Stop both nodes and discard the disposable manager and agent snapshots containing secrets, or remove only their dedicated lab credential configuration under your local retention policy.
- What you should see
- The notes contain object values and limitations, not secret contents or claims of notification delivery.
- Why this step matters
- A complete monitoring exercise includes secret handling and avoids presenting read-only scalar polling as production service assurance.
Verify
- Confirm v3 authPriv, matching SHA-256/AES algorithms, restricted source and the system-only read view.
- Record the exact numeric OID including .0, response type and actual value for each scalar.
- Show that a wrong-user request fails while the same device can still respond to ping, then repeat the original successful query.
- Label traps/informs, interface-rate calculations and application-health examples as conceptual rather than executed.
Troubleshoot
- Timeout: compare source address, UDP 161 path, user, security level and algorithm support; do not enable v2c public as a shortcut.
- No such object or instance: check the numeric subtree, .0 suffix and allowed view before changing routing.
- User line missing from running-config: inspect show snmp user and show snmp group as documented; do not assume the identity was never created.
- Counter discontinuity in later monitoring: remap interface identity and reset the baseline rather than interpreting a negative delta as real traffic.
GNS3 does not provide Cisco software images. Use Cisco images only when the applicable license or entitlement permits this environment. Do not share or redistribute image files. Cisco Modeling Labs is an official alternative; its supplied reference images are licensed for CML, not automatically for export to GNS3. Use the labeled paper alternative when authorized software is unavailable. No emulator execution is claimed by this lesson.
- Stop the isolated project and retire both lab-only secrets; do not reuse them outside this lesson.
- Keep private credential files and snapshots out of published evidence; retain only sanitized object and fault observations.
Practice set
Answer before you reveal
01Why include .0 on sysName?
A MIB object definition and a concrete readable instance differ. Interface-table objects instead need the appropriate row index.
02What does authPriv add?
SNMPv3 supports weaker levels too, so merely stating v3 is insufficient. The endpoints must agree on supported algorithms and credentials.
03Does an inform guarantee an operator responded?
Collection, storage, alerting and human action are additional dependencies beyond the acknowledgement.
04What invalidates a naive counter subtraction?
Inspect discontinuity and indexing information and establish a new baseline when continuity cannot be proven.
05What does a successful uptime query prove?
It does not establish application health, every interface's status or the successful delivery of event notifications.
06What is the rate for a 3000000-octet increase over 30 seconds?
Multiply the delta by eight and divide by elapsed seconds. A percentage additionally requires the meaningful capacity for that direction.
Knowledge check
Quiz: prove the reasoning
Keep these
Technical takeaways
- Choose objects by their defined meaning and instance.
- Polls and notifications provide complementary, incomplete evidence.
- Rates need compatible samples, elapsed time and continuity checks.
- SNMPv3 protection depends on security level and supported algorithms.
- A management timeout is a symptom, not a device-outage diagnosis.