Simple Network Management Protocol

Simple Network Management Protocol (SNMP) is an Internet Standard protocol for collecting and
organizing information about managed devices on IP networks and for modifying that information
to change device behavior. Devices that typically support SNMP include cable modems, routers,
network switches, servers, workstations, printers, and more.[1]

SNMP is widely used in network management for network SNMPv3 STD0062

monitoring. SNMP exposes management data in the form of
Communication protocol
variables on the managed systems organized in a management
information base (MIB), which describes the system status and OSI layer Application
configuration. These variables can then be remotely queried (and, in
Port(s) 161, 162
some circumstances, manipulated) by managing applications. (Trap)

Three significant versions of SNMP have been developed and RFC(s) 3411–
deployed. SNMPv1 is the original version of the protocol. More 3418
recent versions, SNMPv2c and SNMPv3, feature improvements
in performance, flexibility and security.
Secure SNMP

SNMP is a component of the Internet Protocol Suite as defined Communication protocol

by the Internet Engineering Task Force (IETF). It consists of a set
OSI layer Application
of standards for network management, including an application
layer protocol, a database schema, and a set of data objects.[2] Port(s) 10161, 10162
(Trap)
Overview and basic concepts RFC(s) 6353

Principle of SNMP Communication

In typical uses of SNMP, one or more administrative computers called managers have the task of
monitoring or managing a group of hosts or devices on a computer network. Each managed system
executes a software component called an agent that reports information via SNMP to the manager.

An SNMP-managed network consists of three key components:

Managed devices

Agent – software that runs on managed devices

Network management station (NMS) – software that runs on the manager

A managed device is a network node that implements an SNMP interface that allows unidirectional
(read-only) or bidirectional (read and write) access to node-specific information. Managed devices
exchange node-specific information with the NMSs. Sometimes called network elements, the
managed devices can be any type of device, including, but not limited to, routers, access servers,
switches, cable modems, bridges, hubs, IP telephones, IP video cameras, computer hosts, and
printers.

An agent is a network-management software module that resides on a managed device. An agent

has local knowledge of management information and translates that information to or from an
SNMP-specific form.

A network management station executes applications that monitor and control managed devices.
NMSs provide the bulk of the processing and memory resources required for network management.
One or more NMSs may exist on any managed network.

Management information base

SNMP agents expose management data on the managed systems as variables. The protocol also
permits active management tasks, such as configuration changes, through remote modification of
these variables. The variables accessible via SNMP are organized in hierarchies. SNMP itself does
not define which variables a managed system should offer. Rather, SNMP uses an extensible design
that allows applications to define their own hierarchies. These hierarchies are described as a
management information base (MIB). MIBs describe the structure of the management data of a
device subsystem; they use a hierarchical namespace containing object identifiers (OID). Each OID
identifies a variable that can be read or set via SNMP. MIBs use the notation defined by Structure of
Management Information Version 2.0 (SMIv2, RFC 2578 (https://datatracker.ietf.org/doc/html/rfc25
78) ), a subset of ASN.1.
Protocol details

SNMP operates in the application layer of the Internet protocol suite. All SNMP messages are
transported via User Datagram Protocol (UDP). The SNMP agent receives requests on UDP port
161. The manager may send requests from any available source port to port 161 in the agent. The
agent response is sent back to the source port on the manager. The manager receives notifications
(Traps and InformRequests) on port 162. The agent may generate notifications from any available
port. When used with Transport Layer Security or Datagram Transport Layer Security, requests are
received on port 10161 and notifications are sent to port 10162.[3]

SNMPv1 specifies five core protocol data units (PDUs). Two other PDUs, GetBulkRequest and
InformRequest were added in SNMPv2 and the Report PDU was added in SNMPv3. All SNMP PDUs
are constructed as follows:

IP header UDP header version community PDU-type request-id error-status error-index variable bindings

The seven SNMP PDU types as identified by the PDU-type field are as follows:

GetRequest
A manager-to-agent request to retrieve the value of a variable or list of variables. Desired variables
are specified in variable bindings (the value field is not used). Retrieval of the specified variable
values is to be done as an atomic operation by the agent. A Response with current values is
returned.
SetRequest
A manager-to-agent request to change the value of a variable or list of variables. Variable bindings
are specified in the body of the request. Changes to all specified variables are to be made as an
atomic operation by the agent. A Response with (current) new values for the variables is returned.
GetNextRequest
A manager-to-agent request to discover available variables and their values. Returns a Response
with variable binding for the lexicographically next variable in the MIB. The entire MIB of an agent
can be walked by iterative application of GetNextRequest starting at OID 0. Rows of a table can be
read by specifying column OIDs in the variable bindings of the request.
GetBulkRequest
A manager-to-agent request for multiple iterations of GetNextRequest. An optimized version of
GetNextRequest. Returns a Response with multiple variable bindings walked from the variable
binding or bindings in the request. PDU specific non-repeaters and max-repetitions fields are used
to control response behavior. GetBulkRequest was introduced in SNMPv2.
Response
 Returns variable bindings and acknowledgement from agent to manager for GetRequest,
SetRequest, GetNextRequest, GetBulkRequest and InformRequest. Error reporting is provided by
error-status and error-index fields. Although it was used as a response to both gets and sets, this
PDU was called GetResponse in SNMPv1.
Trap
Asynchronous notification from agent to manager. While in other SNMP communication, the
manager actively requests information from the agent, these are PDUs that are sent from the
agent to the manager without being explicitly requested. SNMP Traps enable an agent to notify
the management station of significant events by way of an unsolicited SNMP message. Trap
PDUs include current sysUpTime value, an OID identifying the type of trap and optional variable
bindings. Destination addressing for traps is determined in an application-specific manner
typically through trap configuration variables in the MIB. The format of the trap message was
changed in SNMPv2 and the PDU was renamed SNMPv2-Trap.
InformRequest
Acknowledged asynchronous notification. This PDU was introduced in SNMPv2 and was
originally defined as manager to manager communication.[4] Later implementations have
loosened the original definition to allow agent to manager communications.[5][6][7] Manager-to-
manager notifications were already possible in SNMPv1 using a Trap, but as SNMP commonly
runs over UDP where delivery is not assured and dropped packets are not reported, delivery of a
Trap was not guaranteed. InformRequest fixes this as an acknowledgement is returned on
receipt.[6]

RFC 1157 (https://datatracker.ietf.org/doc/html/rfc1157) specifies that an SNMP implementation

must accept a message of at least 484 bytes in length. In practice, SNMP implementations accept
longer messages.[8]: 1870 If implemented correctly, an SNMP message is discarded if the decoding
of the message fails and thus malformed SNMP requests are ignored. A successfully decoded
SNMP request is then authenticated using the community string. If the authentication fails, a trap is
generated indicating an authentication failure and the message is dropped.[8]: 1871

SNMPv1 and SNMPv2c use communities to establish trust between managers and agents. Most
agents support three community names, one each for read-only, read-write and trap. These three
community strings control different types of activities. The read-only community applies to get
requests. The read-write community string applies to set requests. The trap community string
applies to receipt of traps. SNMPv3 also uses community strings, but allows for secure
authentication and communication between SNMP manager and agent.[9]
Protocol versions

In practice, SNMP implementations often support multiple versions: typically SNMPv1, SNMPv2c,
and SNMPv3.[10][11]

Version 1

SNMP version 1 (SNMPv1) is the initial implementation of the SNMP protocol. The design of
SNMPv1 was done in the 1980s by a group of collaborators who viewed the officially sponsored
OSI/IETF/NSF (National Science Foundation) effort (HEMS/CMIS/CMIP) as both unimplementable
in the computing platforms of the time as well as potentially unworkable. SNMP was approved
based on a belief that it was an interim protocol needed for taking steps towards large-scale
deployment of the Internet and its commercialization.

The first Request for Comments (RFCs) for SNMP, now known as SNMPv1, appeared in 1988:

RFC 1065 (https://datatracker.ietf.org/doc/html/rfc1065) — Structure and identification of

management information for TCP/IP-based internets

RFC 1066 (https://datatracker.ietf.org/doc/html/rfc1066) — Management information base for

network management of TCP/IP-based internets

RFC 1067 (https://datatracker.ietf.org/doc/html/rfc1067) — A simple network management

protocol

In 1990, these documents were superseded by:

RFC 1155 (https://datatracker.ietf.org/doc/html/rfc1155) — Structure and identification of

management information for TCP/IP-based internets

RFC 1156 (https://datatracker.ietf.org/doc/html/rfc1156) — Management information base for

network management of TCP/IP-based internets

RFC 1157 (https://datatracker.ietf.org/doc/html/rfc1157) — A simple network management

protocol

In 1991, RFC 1156 (https://datatracker.ietf.org/doc/html/rfc1156) (MIB-1) was replaced by the

more often used:

RFC 1213 (https://datatracker.ietf.org/doc/html/rfc1213) — Version 2 of management

information base (MIB-2) for network management of TCP/IP-based internets
SNMPv1 is widely used and is the de facto network management protocol in the Internet
community.[12]

SNMPv1 may be carried by transport layer protocols such as User Datagram Protocol (UDP), OSI
Connectionless-mode Network Service (CLNS), AppleTalk Datagram Delivery Protocol (DDP), and
Novell Internetwork Packet Exchange (IPX).

Version 1 has been criticized for its poor security.[13] The specification does, in fact, allow room for
custom authentication to be used, but widely used implementations "support only a trivial
authentication service that identifies all SNMP messages as authentic SNMP messages."[14] The
security of the messages, therefore, becomes dependent on the security of the channels over which
the messages are sent. For example, an organization may consider their internal network to be
sufficiently secure that no encryption is necessary for its SNMP messages. In such cases, the
community name, which is transmitted in cleartext, tends to be viewed as a de facto password, in
spite of the original specification.

Version 2

SNMPv2, defined by RFC 1441 (https://datatracker.ietf.org/doc/html/rfc1441) and RFC 1452 (http

s://datatracker.ietf.org/doc/html/rfc1452) , revises version 1 and includes improvements in the
areas of performance, security and manager-to-manager communications. It introduced
GetBulkRequest, an alternative to iterative GetNextRequests for retrieving large amounts of
management data in a single request. The new party-based security system introduced in SNMPv2,
viewed by many as overly complex, was not widely adopted.[13] This version of SNMP reached the
Proposed Standard level of maturity, but was deemed obsolete by later versions.[15]

Community-Based Simple Network Management Protocol version 2, or SNMPv2c, is defined in

RFC 1901 (https://datatracker.ietf.org/doc/html/rfc1901) –RFC 1908 (https://datatracker.ietf.org/d
oc/html/rfc1908) . SNMPv2c comprises SNMPv2 without the controversial new SNMP v2 security
model, using instead the simple community-based security scheme of SNMPv1. This version is one
of relatively few standards to meet the IETF's Draft Standard maturity level, and was widely
considered the de facto SNMPv2 standard.[15] It was later restated as part of SNMPv3.[16]

User-Based Simple Network Management Protocol version 2, or SNMPv2u, is defined in RFC 1909 (htt
ps://datatracker.ietf.org/doc/html/rfc1909) –RFC 1910 (https://datatracker.ietf.org/doc/html/rfc1
910) . This is a compromise that attempts to offer greater security than SNMPv1, but without
incurring the high complexity of SNMPv2. A variant of this was commercialized as SNMP v2*, and
the mechanism was eventually adopted as one of two security frameworks in SNMP v3.[17]
64-bit counters

SNMP version 2 introduces the option for 64-bit data counters. Version 1 was designed only with
32-bit counters, which can store integer values from zero to 4.29 billion (precisely 4 294 967 295). A
32-bit version 1 counter cannot store the maximum speed of a 10 gigabit or larger interface,
expressed in bits per second. Similarly, a 32-bit counter tracking statistics for a 10 gigabit or larger
interface can roll over back to zero again in less than one minute, which may be a shorter time
interval than a counter is polled to read its current state. This would result in lost or invalid data due
to the undetected value rollover, and corruption of trend-tracking data.

The 64-bit version 2 counter can store values from zero to 18.4 quintillion (precisely
18,446,744,073,709,551,615) and so is currently unlikely to experience a counter rollover between
polling events. For example, 1.6 terabit Ethernet is predicted to become available by 2025. A 64-bit
counter incrementing at a rate of 1.6 trillion bits per second would be able to retain information for
such an interface without rolling over for 133 days.

SNMPv1 and SNMPv2c interoperability

SNMPv2c is incompatible with SNMPv1 in two key areas: message formats and protocol
operations. SNMPv2c messages use different header and protocol data unit (PDU) formats than
SNMPv1 messages. SNMPv2c also uses two protocol operations that are not specified in SNMPv1.
To overcome incompatibility, RFC 3584 (https://datatracker.ietf.org/doc/html/rfc3584) defines
two SNMPv1/v2c coexistence strategies: proxy agents and bilingual network-management
systems.

Proxy agents

An SNMPv2 agent can act as a proxy agent on behalf of SNMPv1-managed devices. When an
SNMPv2 NMS issues a command intended for an SNMPv1 agent it sends it to the SNMPv2 proxy
agent instead. The proxy agent forwards Get , GetNext , and Set messages to the SNMPv1
agent unchanged. GetBulk messages are converted by the proxy agent to GetNext messages and
then are forwarded to the SNMPv1 agent. Additionally, the proxy agent receives and maps SNMPv1
trap messages to SNMPv2 trap messages and then forwards them to the NMS.

Bilingual network-management system

Bilingual SNMPv2 network-management systems support both SNMPv1 and SNMPv2. To support
this dual-management environment, a management application examines information stored in a
local database to determine whether the agent supports SNMPv1 or SNMPv2. Based on the
information in the database, the NMS communicates with the agent using the appropriate version of
SNMP.

Version 3

Although SNMPv3 makes no changes to the protocol aside from the addition of cryptographic
security, it looks very different due to new textual conventions, concepts, and terminology.[1] The
most visible change was to define a secure version of SNMP, by adding security and remote
configuration enhancements to SNMP.[18] The security aspect is addressed by offering both strong
authentication and data encryption for privacy. For the administration aspect, SNMPv3 focuses on
two parts, namely notification originators and proxy forwarders. The changes also facilitate remote
configuration and administration of the SNMP entities, as well as addressing issues related to the
large-scale deployment, accounting, and fault management.

Features and enhancements included:

Identification of SNMP entities to facilitate communication only between known SNMP entities –
Each SNMP entity has an identifier called the SNMPEngineID, and SNMP communication is
possible only if an SNMP entity knows the identity of its peer. Traps and Notifications are
exceptions to this rule.

Support for security models – A security model may define the security policy within an
administrative domain or an intranet. SNMPv3 contains the specifications for a user-based
security model (USM).

Definition of security goals where the goals of message authentication service include protection
against the following:
Modification of Information – Protection against some unauthorized SNMP entity altering in-
transit messages generated by an authorized principal.

Masquerade – Protection against attempting management operations not authorized for

some principal by assuming the identity of another principal that has the appropriate
authorizations.

Message stream modification – Protection against messages getting maliciously re-ordered,

delayed, or replayed to affect unauthorized management operations.

Disclosure – Protection against eavesdropping on the exchanges between SNMP engines.

Specification for USM – USM consists of the general definition of the following communication
mechanisms available:
 Communication without authentication and privacy (NoAuthNoPriv).

Communication with authentication and without privacy (AuthNoPriv).

Communication with authentication and privacy (AuthPriv).

Definition of different authentication and privacy protocols – MD5, SHA and HMAC-SHA-2[19]
authentication protocols and the CBC_DES and CFB_AES_128 privacy protocols are supported in
the USM.

Definition of a discovery procedure – To find the SNMPEngineID of an SNMP entity for a given
transport address and transport endpoint address.

Definition of the time synchronization procedure – To facilitate authenticated communication

between the SNMP entities.

Definition of the SNMP framework MIB – To facilitate remote configuration and administration of
the SNMP entity.

Definition of the USM MIBs – To facilitate remote configuration and administration of the security
module.

Definition of the view-based access control model (VACM) MIBs – To facilitate remote
configuration and administration of the access control module.

Security was one of the biggest weaknesses of SNMP until v3. Authentication in SNMP Versions 1
and 2 amounts to nothing more than a password (community string) sent in clear text between a
manager and agent.[1] Each SNMPv3 message contains security parameters that are encoded as an
octet string. The meaning of these security parameters depends on the security model being
used.[20] The security approach in v3 targets:[21]

Confidentiality – Encryption of packets to prevent snooping by an unauthorized source.

Integrity – Message integrity to ensure that a packet has not been tampered while in transit
including an optional packet replay protection mechanism.

Authentication – to verify that the message is from a valid source.

v3 also defines the USM and VACM, which were later followed by a transport security model (TSM)
that provided support for SNMPv3 over SSH and SNMPv3 over TLS and DTLS.

USM (User-based Security Model) provides authentication and privacy (encryption) functions and
operates at the message level.

VACM (View-based Access Control Model) determines whether a given principal is allowed
access to a particular MIB object to perform specific functions and operates at the PDU level.
 TSM (Transport Security Model) provides a method for authenticating and encrypting messages
over external security channels. Two transports, SSH and TLS/DTLS, have been defined that make
use of the TSM specification.

As of 2004 the IETF recognizes Simple Network Management Protocol version 3 as defined by
RFC 3411 (https://datatracker.ietf.org/doc/html/rfc3411) –RFC 3418 (https://datatracker.ietf.org/d
[22]
oc/html/rfc3418) (also known as STD0062) as the current standard version of SNMP. The IETF
has designated SNMPv3 a full Internet standard,[23] the highest maturity level for an RFC. It
considers earlier versions to be obsolete (designating them variously Historic or Obsolete).[15]

Implementation issues

SNMP's powerful write capabilities, which would allow the configuration of network devices, are not
being fully utilized by many vendors, partly because of a lack of security in SNMP versions before
SNMPv3, and partly because many devices simply are not capable of being configured via individual
MIB object changes.

Some SNMP values (especially tabular values) require specific knowledge of table indexing
schemes, and these index values are not necessarily consistent across platforms. This can cause
correlation issues when fetching information from multiple devices that may not employ the same
table indexing scheme (for example fetching disk utilization metrics, where a specific disk identifier
is different across platforms.)[24]

Some major equipment vendors tend to over-extend their proprietary command line interface (CLI)
centric configuration and control systems.[25]

In February 2002 the Carnegie Mellon Software Engineering Institute (CM-SEI) Computer Emergency
Response Team Coordination Center (CERT-CC) issued an Advisory on SNMPv1,[26] after the Oulu
University Secure Programming Group conducted a thorough analysis of SNMP message handling.
Most SNMP implementations, regardless of which version of the protocol they support, use the
same program code for decoding protocol data units (PDU) and problems were identified in this
code. Other problems were found with decoding SNMP trap messages received by the SNMP
management station or requests received by the SNMP agent on the network device. Many vendors
had to issue patches for their SNMP implementations.[8]: 1875
Security implications

Using SNMP to attack a network

Because SNMP is designed to allow administrators to monitor and configure network devices
remotely it can also be used to penetrate a network. A significant number of software tools can
scan the entire network using SNMP, therefore mistakes in the configuration of the read-write mode
can make a network susceptible to attacks.[27]: 52

In 2001, Cisco released information that indicated that, even in read-only mode, the SNMP
implementation of Cisco IOS is vulnerable to certain denial of service attacks. These security issues
can be fixed through an IOS upgrade.[28]

If SNMP is not used in a network it should be disabled in network devices. When configuring SNMP
read-only mode, close attention should be paid to the configuration of the access control and from
which IP addresses SNMP messages are accepted. If the SNMP servers are identified by their IP,
SNMP is only allowed to respond to these IPs and SNMP messages from other IP addresses would
be denied. However, IP address spoofing remains a security concern.[27]: 54

Authentication

SNMP is available in different versions, and each version has its own security issues. SNMP v1
sends passwords in plaintext over the network. Therefore, passwords can be read with packet
sniffing. SNMP v2 allows password hashing with MD5, but this has to be configured. Virtually all
network management software support SNMP v1, but not necessarily SNMP v2 or v3. SNMP v2 was
specifically developed to provide data security, that is authentication, privacy and authorization, but
only SNMP version 2c gained the endorsement of the Internet Engineering Task Force (IETF), while
versions 2u and 2* failed to gain IETF approval due to security issues. SNMP v3 uses MD5, Secure
Hash Algorithm (SHA) and keyed algorithms to offer protection against unauthorized data
modification and spoofing attacks. If a higher level of security is needed the Data Encryption
Standard (DES) can be optionally used in the cipher block chaining mode. SNMP v3 is implemented
on Cisco IOS since release 12.0(3)T.[27]: 52

SNMPv3 may be subject to brute force and dictionary attacks for guessing the authentication keys,
or encryption keys, if these keys are generated from short (weak) passwords or passwords that can
be found in a dictionary. SNMPv3 allows both providing random uniformly distributed cryptographic
keys and generating cryptographic keys from a password supplied by the user. The risk of guessing
authentication strings from hash values transmitted over the network depends on the cryptographic
hash function used and the length of the hash value. SNMPv3 uses the HMAC-SHA-2 authentication
protocol for the User-based Security Model (USM).[29] SNMP does not use a more secure challenge-
handshake authentication protocol. SNMPv3 (like other SNMP protocol versions) is a stateless
protocol, and it has been designed with a minimal amount of interactions between the agent and the
manager. Thus introducing a challenge-response handshake for each command would impose a
burden on the agent (and possibly on the network itself) that the protocol designers deemed
excessive and unacceptable.

The security deficiencies of all SNMP versions can be mitigated by IPsec authentication and
confidentiality mechanisms. SNMP also may be carried securely over Datagram Transport Layer
Security (DTLS).[10]

Many SNMP implementations include a type of automatic discovery where a new network
component, such as a switch or router, is discovered and polled automatically. In SNMPv1 and
SNMPv2c this is done through a community string that is transmitted in clear-text to other
devices.[10] Clear-text passwords are a significant security risk. Once the community string is known
outside the organization it could become the target for an attack. To alert administrators of other
attempts to glean community strings, SNMP can be configured to pass community-name
authentication failure traps.[27]: 54 If SNMPv2 is used, the issue can be avoided by enabling
password encryption on the SNMP agents of network devices.

The common default configuration for community strings are "public" for read-only access and
"private" for read-write.[8]: 1874 Because of the well-known defaults, SNMP topped the list of the
SANS Institute's Common Default Configuration Issues and was number ten on the SANS Top 10
Most Critical Internet Security Threats for the year 2000.[30] System and network administrators
frequently do not change these configurations.[8]: 1874

Whether it runs over TCP or UDP, SNMPv1 and v2 are vulnerable to IP spoofing attacks. With
spoofing, attackers may bypass device access lists in agents that are implemented to restrict SNMP
access. SNMPv3 security mechanisms such as USM or TSM can prevent spoofing attacks.

See also

Agent Extensibility Protocol (AgentX) – Subagent protocol for SNMP

Common Management Information Protocol (CMIP) – Management protocol by ISO/OSI used by

telecommunications devices

Common Management Information Service (CMIS)

 Comparison of network monitoring systems

IEC 62379 – Control protocol based on Simple Network Management Protocol

Net-SNMP – Open source reference implementation of SNMP

NETCONF – Protocol that is an XML-based configuration protocol for network equipment

Remote Network Monitoring (RMON)

Simple Gateway Monitoring Protocol (SGMP) – Obsolete protocol replaced by SNMP

SNMP simulator – Software that simulates devices supporting SNMP

References

1. Douglas R. Mauro & Kevin J. Schmidt. (2001). Essential SNMP (1st ed.). Sebastopol, CA:
O'Reilly & Associates.

2. An Architecture for Describing Simple Network Management Protocol (SNMP) Management

Frameworks (https://datatracker.ietf.org/doc/html/rfc3411) . doi:10.17487/RFC3411 (https://
doi.org/10.17487%2FRFC3411) . RFC 3411 (https://datatracker.ietf.org/doc/html/rfc3411) .

3. RFC 6353 (https://datatracker.ietf.org/doc/html/rfc6353) Section 10

4. J. Case; K. McCloghrie; M. Rose; S. Waldbusser (April 1993). "RFC 1448 – Protocol Operations
for version 2 of the Simple Network Management Protocol (SNMPv2)" (https://tools.ietf.org/ht
ml/rfc1448#page-27) . Internet Engineering Task Force. doi:10.17487/RFC1448 (https://doi.or
g/10.17487%2FRFC1448) . "An InformRequest-PDU is generated and transmitted at the
request an application in a SNMPv2 entity acting in a manager role, that wishes to notify
another application (in a SNMPv2 entity also acting in a manager role) of information in the
MIB View of a party local to the sending application."

5. D. Levi; P. Meyer; B. Stewart (April 1999). "RFC 2573 – SNMP Applications" (https://tools.ietf.or
g/html/rfc2573#section-3.3) . Internet Engineering Task Force. doi:10.17487/RFC2573 (http
s://doi.org/10.17487%2FRFC2573) .

6. "SNMP Inform Requests" (http://www.cisco.com/en/US/docs/ios/11_3/feature/guide/snmpinf

m.html) . Cisco. Retrieved 2011-12-09.

7. "Understanding the SNMP Implementation in JUNOS Software" (https://www.juniper.net/techp

ubs/software/junos-security/junos-security10.2/mib-srx5600-srx5800-service-gateway/topic-2
1511.html) . Juniper Networks. Retrieved 2013-02-11.
 8. Harold F. Tipton; Micki Krause (2007). Information Security Management Handbook, Sixth
Edition. CRC Press. ISBN 9780849374951.

9. Douglas Mauro; Kevin Schmidt (2005). Information Security Management Handbook, Sixth
EditioEssential SNMP: Help for System and Network Administrators. O'Reilly Media, Inc. pp. 21–
22. ISBN 9780596552770.

10. Stuart Jacobs (2015). Engineering Information Security: The Application of Systems Engineering
Concepts to Achieve Information Assurance. John Wiley & Sons. p. 367. ISBN 9781119104797.

11. RFC 3584 (https://datatracker.ietf.org/doc/html/rfc3584) "Coexistence between Version 1,

Version 2, and Version 3 of the Internet-standard Network Management Framework"

12. Wiley, John (2015-12-01). Engineering Information Security: The Application of Systems
Engineering Concepts to Achieve Information Assurance (https://books.google.com/books?id=6
i1cCwAAQBAJ&q=snmpv1+is+obsolete&pg=PA366) . John Wiley & Sons. p. 366.
ISBN 9781119104711. Retrieved 2017-09-14.

13. "Security in SNMPv3 versus SNMPv1 or v2c" (https://web.archive.org/web/20130429201847/h

ttp://www.aethis.com/solutions/snmp_research/snmpv3_vs_wp.pdf) (PDF). Archived from
the original (http://www.aethis.com/solutions/snmp_research/snmpv3_vs_wp.pdf) (PDF) on
2013-04-29.

14. RFC 1157 (https://datatracker.ietf.org/doc/html/rfc1157)

15. "RFC Search Detail: Standards Track snmpv2 RFCs" (http://www.rfc-editor.org/search/rfc_searc

h_detail.php?pubstatus%5b%5d=Standards+Track&std_trk=Any&pub_date_type=any&wg_acro
nym=snmpv2) . The RFC Editor. Retrieved 2014-02-24.

16. RFC 3416 (https://datatracker.ietf.org/doc/html/rfc3416)

17. SNMPv3 -- User Security Model (http://www.drdobbs.com/snmpv3-user-security-model/199100

972) , Dr. Dobbs, retrieved 2019-03-09

18. In This Issue: SNMP Version 3 (http://www.simple-times.org/pub/simple-times/issues/5-1.htm

l) Archived (https://web.archive.org/web/20170727124237/https://www.simple-times.org/pu
b/simple-times/issues/5-1.html) 2017-07-27 at the Wayback Machine The Simple Times (htt
p://www.simple-times.org/) ISSN 1060-6084 (https://www.worldcat.org/search?fq=x0:jrnl&q
=n2:1060-6084)

19. RFC 7860

20. David Zeltserman (1999). A Practical Guide to SNMPv3 and Network Management. Upper
Saddle River, NJ: Prentice Hall PTR.
21. "SNMPv3" (https://web.archive.org/web/20110719232546/http://www.cisco.com/en/US/doc
s/ios/12_0t/12_0t3/feature/guide/Snmp3.html) . Cisco Systems. Archived from the original
(http://www.cisco.com/en/US/docs/ios/12_0t/12_0t3/feature/guide/Snmp3.html) on 2011-
07-19.

22. "SNMP Version 3" (http://www.ibr.cs.tu-bs.de/projects/snmpv3/) . Institute of Operating

Systems and Computer Networks. Retrieved 2010-05-07.

23. RFC Editor (http://www.rfc-editor.org/categories/rfc-standard.html) Archived (https://web.arc

hive.org/web/20071029103140/http://www.rfc-editor.org/categories/rfc-standard.html)
2007-10-29 at the Wayback Machine List of current Internet Standards (STDs)

24. "Understanding Table Index Values in SNMP" (http://www.cisco.com/c/en/us/support/docs/i

p/simple-network-management-protocol-snmp/40700-snmp-ifIndex40700.html) .

25. "SNMP Research presentations in favor of standards-based management over proprietary

CLIs" (http://www.snmp.com/conferences/) . SNMP Research. Retrieved 2010-10-12.

26. CERT Advisory CA-2002-03 Multiple Vulnerabilities in Many Implementations (http://lwn.net/200

2/0214/a/cert-snmp.php3)

27. Andrew G. Mason; Mark J. Newcomb (2001). Cisco Secure Internet Security Solutions. Cisco
Press. ISBN 9781587050169.

28. Andrew G. Mason; Mark J. Newcomb (2001). Cisco Secure Internet Security Solutions (https://a
rchive.org/details/ciscosecureinter00maso) . Cisco Press. pp. 52 (https://archive.org/details/
ciscosecureinter00maso/page/n51) . ISBN 9781587050169.

29. HMAC-SHA-2 Authentication Protocols in the User-based Security Model (USM) for SNMPv3.
RFC 7630 (https://tools.ietf.org/html/rfc7630) .

30. "SANS Institute - CIS Critical Security Controls" (http://www.sans.org/top20/2000/) .

Further reading

Douglas Mauro; Kevin Schmidt (2005). Essential SNMP (Second ed.). O'Reilly Media. ISBN 978-
0596008406.

William Stallings (1999). SNMP, SNMPv2, SNMPv3, and RMON 1 and 2 (https://archive.org/details/
snmpsnmpv2snmpv30000stal/page/619) . Addison Wesley Longman, Inc. ISBN 978-
0201485349.

Marshall T. Rose (1996). The Simple Book. Prentice Hall. ISBN 0-13-451659-1.
RFC 1155 (https://datatracker.ietf.org/doc/html/rfc1155) (STD 16) — Structure and Identification
of Management Information for the TCP/IP-based Internets

RFC 1156 (https://datatracker.ietf.org/doc/html/rfc1156) (Historic) — Management Information

Base for Network Management of TCP/IP-based internets

RFC 1157 (https://datatracker.ietf.org/doc/html/rfc1157) (Historic) — A Simple Network

Management Protocol (SNMP)

RFC 1213 (https://datatracker.ietf.org/doc/html/rfc1213) (STD 17) — Management Information

Base for Network Management of TCP/IP-based internets: MIB-II

RFC 1452 (https://datatracker.ietf.org/doc/html/rfc1452) (Informational) — Coexistence

between version 1 and version 2 of the Internet-standard Network Management Framework
(Obsoleted by RFC 1908 (https://datatracker.ietf.org/doc/html/rfc1908) )

RFC 1901 (https://datatracker.ietf.org/doc/html/rfc1901) (Experimental) — Introduction to

Community-based SNMPv2

RFC 1902 (https://datatracker.ietf.org/doc/html/rfc1902) (Draft Standard) — Structure of

Management Information for SNMPv2 (Obsoleted by RFC 2578 (https://datatracker.ietf.org/doc/ht
ml/rfc2578) )

RFC 1908 (https://datatracker.ietf.org/doc/html/rfc1908) (Standards Track) — Coexistence

between Version 1 and Version 2 of the Internet-standard Network Management Framework

RFC 2570 (https://datatracker.ietf.org/doc/html/rfc2570) (Informational) — Introduction to

Version 3 of the Internet-standard Network Management Framework (Obsoleted by RFC 3410 (http
s://datatracker.ietf.org/doc/html/rfc3410) )

RFC 2578 (https://datatracker.ietf.org/doc/html/rfc2578) (STD 58) — Structure of Management

Information Version 2 (SMIv2)

RFC 3410 (https://datatracker.ietf.org/doc/html/rfc3410) (Informational) — Introduction and

Applicability Statements for Internet Standard Management Framework

STD 62 (https://www.rfc-editor.org/info/std62) contains the following RFCs:

RFC 3411 (https://datatracker.ietf.org/doc/html/rfc3411) — An Architecture for Describing
Simple Network Management Protocol (SNMP) Management Frameworks

RFC 3412 (https://datatracker.ietf.org/doc/html/rfc3412) — Message Processing and

Dispatching for the Simple Network Management Protocol (SNMP)

RFC 3413 (https://datatracker.ietf.org/doc/html/rfc3413) — Simple Network Management

Protocol (SNMP) Applications
 RFC 3414 (https://datatracker.ietf.org/doc/html/rfc3414) — User-based Security Model
(USM) for version 3 of the Simple Network Management Protocol (SNMPv3)

RFC 3415 (https://datatracker.ietf.org/doc/html/rfc3415) — View-based Access Control

Model (VACM) for the Simple Network Management Protocol (SNMP)

RFC 3416 (https://datatracker.ietf.org/doc/html/rfc3416) — Version 2 of the Protocol

Operations for the Simple Network Management Protocol (SNMP)

RFC 3417 (https://datatracker.ietf.org/doc/html/rfc3417) — Transport Mappings for the

Simple Network Management Protocol (SNMP)

RFC 3418 (https://datatracker.ietf.org/doc/html/rfc3418) — Management Information Base

(MIB) for the Simple Network Management Protocol (SNMP)

RFC 3430 (https://datatracker.ietf.org/doc/html/rfc3430) (Experimental) — Simple Network

Management Protocol (SNMP) over Transmission Control Protocol (TCP) Transport Mapping

RFC 3584 (https://datatracker.ietf.org/doc/html/rfc3584) (BCP 74) — Coexistence between

Version 1, Version 2, and Version 3 of the Internet-standard Network Management Framework

RFC 3826 (https://datatracker.ietf.org/doc/html/rfc3826) (Proposed) — The Advanced

Encryption Standard (AES) Cipher Algorithm in the SNMP User-based Security Model

RFC 4789 (https://datatracker.ietf.org/doc/html/rfc4789) (Proposed) — Simple Network

Management Protocol (SNMP) over IEEE 802 Networks

RFC 5343 (https://datatracker.ietf.org/doc/html/rfc5343) (STD 78) — Simple Network

Management Protocol (SNMP) Context EngineID Discovery

RFC 5590 (https://datatracker.ietf.org/doc/html/rfc5590) (STD 78) — Transport Subsystem for

the Simple Network Management Protocol (SNMP)

RFC 5591 (https://datatracker.ietf.org/doc/html/rfc5591) (STD 78) — Transport Security Model

for the Simple Network Management Protocol (SNMP)

RFC 5592 (https://datatracker.ietf.org/doc/html/rfc5592) (Proposed) — Secure Shell Transport

Model for the Simple Network Management Protocol (SNMP)

RFC 5608 (https://datatracker.ietf.org/doc/html/rfc5608) (Proposed) — Remote Authentication

Dial-In User Service (RADIUS) Usage for Simple Network Management Protocol (SNMP) Transport
Models.

RFC 6353 (https://datatracker.ietf.org/doc/html/rfc6353) (STD 78) — Transport Layer Security

(TLS) Transport Model for the Simple Network Management Protocol (SNMP)
 RFC 7630 (https://datatracker.ietf.org/doc/html/rfc7630) (Proposed|Historic) — HMAC-SHA-2
Authentication Protocols in the User-based Security Model (USM) for SNMPv3

RFC 7860 (https://datatracker.ietf.org/doc/html/rfc7860) (Proposed) — HMAC-SHA-2

Authentication Protocols in User-Based Security Model (USM) for SNMPv3

External links