SNMP glossary

Short, quotable definitions of the SNMP terms you meet when walking devices, setting up SNMPv3 and receiving traps on a Mac.

SNMP

Simple Network Management Protocol: the standard way to read (and sometimes write) operational data from routers, switches, servers, printers, UPS units and NAS boxes over UDP. A manager (SNMP Explorer) sends requests to an agent running on the device.

Agent

The SNMP service on a device. It listens on UDP port 161, answers GET, GET-NEXT and GET-BULK requests and may send traps to a manager on port 162. Small embedded agents in UPS units, PDUs or RAID controllers often process one request at a time.

Manager

The side that asks. SNMP Explorer is a manager: it sends requests, collects walk results, polls OIDs for the Monitor and receives traps. A manager is sometimes called an NMS (network management system).

OID

Object identifier: the dotted path that names one value in the SNMP tree, for example 1.3.6.1.2.1.1.5.0 for sysName. Every OID under 1.3.6.1.2.1 is standard MIB-2; everything under 1.3.6.1.4.1 belongs to a vendor.

In the help center →

MIB

Management Information Base: a text file in ASN.1 notation that gives OIDs their names, types and descriptions. SNMP Explorer ships more than 600 descriptions built in and imports vendor MIB files so a walk shows names instead of bare numbers.

In the help center →

MIB browser

A tool that shows the MIB tree, lets you pick an OID and query it on a device, and shows the result with the MIB description next to it. SNMP Explorer is a MIB browser for macOS.

In the help center →

Walk

Reading a whole subtree by repeating GET-NEXT (SNMPv1) or GET-BULK (v2c and v3) until the agent returns an OID outside the subtree. The command-line tools snmpwalk and snmpbulkwalk do this; SNMP Explorer calls it Full Discovery when it starts at 1.3.6.1.

In the help center →

GET

The request that reads exactly one OID. Scalar objects end in .0 (sysDescr.0); a table cell ends in its row index (ifDescr.3). SNMP Explorer runs a GET from Single Query.

GET NEXT

Returns the OID that follows the one you asked for, in lexicographic order. Chaining GET-NEXT requests is how an SNMPv1 walk works. Agents must return a strictly increasing OID; if they do not, SNMP Explorer stops the walk instead of looping forever.

GET BULK

The SNMPv2c and v3 request that returns many following OIDs in one packet (max-repetitions). It makes a walk of a large table many times faster than GET-NEXT.

Community string

The plain-text password of SNMPv1 and v2c, sent in every packet. "public" is the read-only default on many devices and should be changed. SNMPv3 replaces it with a user name and keyed authentication.

SNMPv1

The original 1990 protocol: 32-bit counters, community strings, GET-NEXT walks and the v1 trap format with an agent address field. Still common on old UPS units and printers.

SNMPv2c

The most widely used version: adds GET-BULK, 64-bit counters (Counter64) and informs, but keeps the community string. This is what most switches, NAS boxes and hypervisors speak by default.

SNMPv3

The secure version: a user name, HMAC authentication (MD5, SHA or SHA-256) and optional privacy (DES, AES or AES-256), defined by the User-based Security Model. SNMP Explorer supports all three security levels and reports wrong credentials as such.

In the help center →

noAuthNoPriv, authNoPriv, authPriv

The three SNMPv3 security levels: user name only; user name plus authentication; authentication plus encryption. The level, the protocols and the passwords must match the device configuration exactly.

In the help center →

USM

User-based Security Model (RFC 3414): the part of SNMPv3 that derives keys from passwords, localises them to the agent's engine ID and signs or encrypts each message. A usmStats report from the agent tells a manager exactly what went wrong.

Engine ID

The unique identifier of an SNMPv3 agent. A manager discovers it with an empty request before the first authenticated call; SNMP Explorer caches it per host and rediscovers it when the agent reports usmStatsUnknownEngineIDs.

Trap

An unsolicited message from an agent to a manager, sent to UDP port 162 by default: linkDown, coldStart, a fan failure. Traps are fire-and-forget. Sandboxed Mac apps cannot bind ports below 1024, so SNMP Explorer listens on 1162 and Preferences shows the pfctl rule that redirects 162.

In the help center →

Inform

A trap that expects an acknowledgement (SNMPv2c and v3). The agent retransmits until the manager answers with a Response PDU. SNMP Explorer acknowledges informs, so devices configured for informs stop retrying.

In the help center →

PDU

Protocol data unit: the request or response inside an SNMP packet (GetRequest, GetNextRequest, GetBulkRequest, Response, Trap, InformRequest, Report). Each carries a request ID and a list of varbinds.

Varbind

Variable binding: one OID paired with its value and type, the unit of every SNMP result. A walk is a long list of varbinds.

Counter32, Counter64, Gauge32, TimeTicks

The SMI value types. Counters only grow and wrap (32-bit interface counters wrap in minutes on a 10 Gbit link, hence Counter64). A Gauge goes up and down (temperature, CPU load). TimeTicks count hundredths of a second, as in sysUpTime.

ASN.1 and BER

The notation (ASN.1) and the binary encoding (Basic Encoding Rules) of every SNMP packet. SNMP Explorer contains its own BER codec written in Swift, which is why it needs no net-snmp library.

Enterprise OID (PEN)

A vendor's private subtree under 1.3.6.1.4.1, numbered by the IANA Private Enterprise Number registry: 9 is Cisco, 2636 is Juniper, 6574 is Synology, 12356 is Fortinet. SNMP Explorer knows about 50 of these roots so a single vendor MIB parses without its core MIB.

sysDescr, sysObjectID, sysUpTime, sysName

The system group at 1.3.6.1.2.1.1: the first thing to read from any device. sysObjectID names the exact model and points into the vendor subtree; sysUpTime tells you when the device last rebooted.

ifTable and ifXTable

The interface tables of MIB-2 (1.3.6.1.2.1.2.2) and IF-MIB (1.3.6.1.2.1.31.1.1): name, speed, status and traffic counters per port. ifXTable holds the 64-bit counters that make sense on gigabit links.

net-snmp, snmpwalk, snmpget

The open-source SNMP toolkit whose command-line tools macOS ships in /usr/bin. They are fine for a quick check; SNMP Explorer does the same work with a native interface, saved devices, a monitor and a trap receiver, without shelling out to them.

In the help center →

UDP 161 and 162

The two SNMP ports: agents answer on 161, managers receive traps on 162. Both are UDP, so a firewall that only allows TCP silently blocks SNMP.

SNMP Explorer for Mac Help center OID reference