Poll a device with SNMP and read the OID

short · 40 min · Objective 3.2

Task

Run an SNMP agent, poll it for interface statistics, and follow an OID from its numeric form to what it actually means. SNMP is described abstractly in the objective and is much clearer as a walk of a real MIB.

Steps

  1. Configure the agent on the router for SNMPv3 with authentication and privacy rather than a v2c community string. Create a user with net-snmp-create-v3-user -ro -A <authpass> -X <privpass> -a SHA -x AES labmon while snmpd is stopped, then start it.
  2. From Host A, poll the system description: snmpget -v3 -l authPriv -u labmon -a SHA -A <authpass> -x AES -X <privpass> 192.168.10.1 sysDescr.0.
  3. Walk the interface table: the same command with snmpwalk and ifTable. Read the interface names, their operational status, and the octet counters.
  4. Translate an OID both ways. snmptranslate -On IF-MIB::ifInOctets gives the numeric form; snmptranslate 1.3.6.1.2.1.2.2.1.10 gives the name. Note the structure: the tree is hierarchical, and the last number identifies the interface.
  5. Poll ifInOctets twice a minute apart and compute the rate. That subtraction is what every monitoring graph you have ever seen is doing.

Verify

snmpget -v3 -l authPriv -u labmon -a SHA -A authpass123 -x AES -X privpass123 192.168.10.1 sysDescr.0
snmpwalk -v3 -l authPriv -u labmon -a SHA -A authpass123 -x AES -X privpass123 192.168.10.1 ifDescr
snmptranslate -On IF-MIB::ifInOctets

sysDescr.0 must return the router's OS string. The ifDescr walk must list every interface by name. And the translation must return 1.3.6.1.2.1.2.2.1.10, which is the numeric OID for inbound octets.

Notes

The version distinction is examinable and it matters in practice. v1 and v2c authenticate with a community string sent in clear text — a password on the wire, readable by anyone capturing. v3 adds real authentication and encryption, which is why hardening guidance says v3 or nothing. If you must run v2c, change the community from public and restrict it by source address.

The other half of SNMP is the trap: instead of the manager polling on a schedule, the device pushes an event when something happens. Polling is on port 161, traps arrive on 162, and the trade is the same as everywhere else — polling has a detection delay equal to the poll interval, traps are immediate but arrive over UDP and can be lost.

Flow data answers a different question again. SNMP tells you how much traffic an interface carried; NetFlow, sFlow and IPFIX tell you who was talking to whom. When the graph shows a spike, SNMP found it and flow data explains it.