SNMP

What is SNMP?

SNMP (Simple Network Management Protocol) is a standardised network protocol that lets a central management system query the status, performance and configuration of network equipment, receive notifications and change settings. The IETF developed the protocol in 1988, and today virtually every switch, router, firewall, UPS and printer supports it. In IT networks SNMP has been the foundation of network management for decades; in OT networks it monitors industrial switches, HMIs and even PLCs. Precisely because SNMP is so widely available, it is also a well-known attack route when it is configured insecurely.

🧠 How does SNMP work?

SNMP follows a simple manager-agent model with three building blocks:

• SNMP manager - the management system (for example Zabbix, PRTG or Nagios) that collects data, watches thresholds and sends commands
• SNMP agent - software on the device itself that keeps the current values and answers requests
• MIB (Management Information Base) - the description of which objects a device exposes; the MIB is the schema, the agent supplies the live values

Every object has an OID (Object Identifier): a numeric path in a global tree. Standard objects live under 1.3.6.1.2.1 (mib-2), such as sysDescr (1.3.6.1.2.1.1.1.0, the device description) and sysUpTime (1.3.6.1.2.1.1.3.0). Vendors define their own objects under 1.3.6.1.4.1 (enterprises), for example for temperature, power supplies or PROFINET diagnostics.

Communication runs over UDP: the agent listens on port 161 for requests, and the manager receives notifications on port 162. SNMP has two modes of operation:

• Polling - the manager queries values periodically, typically every 1 to 5 minutes
• Notifications - the agent reports an event itself, such as a link going down or a restart

🔧 Which message types does SNMP use?

Because UDP does not guarantee delivery, a trap can be lost on the way. For critical notifications an inform or additional polling is therefore more reliable.

🔍 What is the difference between SNMPv1, SNMPv2c and SNMPv3?

The variant usually called “SNMPv2” in practice is almost always SNMPv2c: the community-based version that combines the protocol improvements of v2 with the insecure access model of v1. The IETF has declared v1 and v2c historic because of their weak security.

SNMPv3 adds three security levels: noAuthNoPriv, authNoPriv and authPriv. The original 2002 standard only offered HMAC-MD5 and HMAC-SHA-1 with DES encryption. AES-128 followed in 2004 (RFC 3826) and SHA-2 authentication in 2016 (RFC 7860). So always choose authPriv with SHA-2 and AES, as far as the equipment supports it. Since 2011 SNMP can also run over TLS (ports 10161 and 10162), but OT equipment rarely supports this.

🏭 How is SNMP used in industrial networks?

• Port and link monitoring - status, error counters and bandwidth of Industrial Ethernet switches, including rings and redundant paths
• Fault notifications - traps when a link goes down, a power supply fails or a managed switch restarts
• PROFINET diagnostics - from conformance class B, ProfiNET devices use SNMP for diagnostics and topology detection
• Inventory - reading make, model, firmware version and serial number for the asset inventory
• Infrastructure - battery capacity and load of a UPS, temperature in cabinets and server rooms
• Integration with SCADA - showing network status alongside process data, so the operator can see whether a fault lies in the process or in the network

SNMP complements other sources: Syslog delivers event logs, while Wireshark and passive monitoring analyse the traffic itself. Together they form the basis of network monitoring.

⚙️ How do you set up SNMP securely in an OT network?

A practical approach in six steps:

1. Take inventory of which devices have SNMP enabled and which version. Many devices ship with SNMPv1/v2c enabled and the community public.
2. Disable what is not needed. Turn SNMP off on devices that are not monitored, and disable write access (SetRequest).
3. Migrate to SNMPv3 authPriv with a separate user per device or per zone and strong, unique passwords.
4. Restrict access with an ACL for access control on the device and firewall rules between zones, so that only the management server can reach UDP 161. Place SNMP management in a dedicated management VLAN.
5. Choose the polling direction deliberately. Let the manager poll from within the OT zone and forward only summarised data to IT, in line with the Purdue Model and a DMZ.
6. Monitor SNMP itself. Include SNMP in central logging and send failed authentications and unexpected SNMP requests to a SIEM.

Worked example, 32-bit versus 64-bit counters: a 32-bit octet counter wraps after 2³² bytes. On a fully loaded gigabit link (125 MB/s) that happens after about 34 seconds, so a 5-minute polling interval produces meaningless bandwidth figures. Use the 64-bit counters from the IF-MIB instead (ifHCInOctets, ifHCOutOctets), which RFC 2863 requires for interfaces faster than 20 Mbit/s. These counters need SNMPv2c or v3.

🔐 What are the security risks of SNMP?

• Plaintext passwords - community strings in v1/v2c can be read directly with Wireshark by anyone in the same network segment
• Default community strings - public and private are the first values scanners try
• Information leakage - a walk gives attackers interfaces, routes, ARP tables and firmware versions, ideal for reconnaissance
• Write access - with a write community an attacker can disable ports or change configurations
• Amplification attacks - GetBulk requests with a spoofed source address return on average more than six times as much traffic
• Vulnerabilities in agents - flaws in the SNMP implementation itself, such as CVE-2017-6742 in Cisco IOS

In April 2023 the UK NCSC, the NSA, the FBI and CISA jointly warned that the Russian group APT28 had compromised Cisco routers worldwide in 2021, including routers at US government institutions and around 250 Ukrainian victims. The group used weak or default community strings such as public and the unencrypted SNMPv2. On some routers APT28 also exploited CVE-2017-6742 to install the Jaguar Tooth malware, even though Cisco had patched that vulnerability in 2017. Their advice: disable SNMP where it is not needed, switch off v1 and v2c and use SNMPv3.

Within IEC 62443, SNMPv3 supports the requirements for authenticating devices and processes (SR 1.2) and for information confidentiality (SR 4.1) in IEC 62443-3-3. For organisations covered by the Dutch Cybersecurity Act, in force since 15 August 2026, unencrypted network management is hard to justify as an appropriate measure. See also network segmentation, Hardening and Defense in Depth, and the broader security context.

❓ Frequently asked questions

Which ports does SNMP use?

SNMP uses UDP port 161 for requests to the agent and UDP port 162 for traps and informs sent to the manager. SNMP over TLS or DTLS uses ports 10161 and 10162. In a firewall, only the traffic between the management server and the monitored devices needs to be allowed.

Is SNMPv2c still secure enough for OT?

SNMPv2c is not secure, because the community string travels across the network unencrypted and there is no real authentication. The IETF has declared SNMPv2c historic, and government agencies advise using SNMPv3 instead. If an older OT device only supports SNMPv2c, restrict access strictly with ACLs, use read-only access and a non-default community string.

What is the difference between an SNMP trap and an inform?

An SNMP trap is a notification that the agent sends without acknowledgement, so it can be lost unnoticed during network problems. An inform is acknowledged by the manager and resent if necessary. For critical OT notifications an inform is therefore more reliable than a trap.

What is a MIB file?

A MIB file is a text file in SMI notation that describes which SNMP objects a device has, with their OID, data type and meaning. Vendors supply their own MIB files, which you load into your monitoring software to see readable names instead of numeric OIDs. Without the right MIB file you can still query vendor-specific values, but they are hard to interpret.

Can SNMP disrupt a PLC or the process?

SNMP polling can load vulnerable or older OT devices, especially with short intervals or large GetBulk queries. Test polling intervals in a test environment first and monitor the device’s response time. SNMP write access should be disabled in a production environment.

What is the difference between SNMP and Syslog?

SNMP delivers structured status values and counters that the manager queries, plus a set of predefined notifications. Syslog sends free-text messages about events, such as login attempts and configuration changes, to a central log server. In OT network management, SNMP and Syslog are usually used side by side.

📌 In summary

SNMP has been the standard protocol for monitoring network equipment for more than 35 years and is indispensable in OT networks for visibility of switches, UPS units and PROFINET infrastructure. However, the older versions v1 and v2c send their password in plaintext and are actively exploited.

Use SNMP only with SNMPv3 authPriv, without write access and restricted to a management server within a properly segmented OT architecture.