How SNMP Works: GET, TRAP, Community Strings & SNMPv3 (Animated)

SNMP is how monitoring systems check the health of routers, switches, printers and servers: uptime, CPU, interface traffic, errors. Older versions protect all of this with a single shared password called a community string, sent in clear text and very often left at the default “public”.

1. Get: the monitor asks a device for a value

Every few minutes the monitoring server asks each device for values like uptime and interface counters.

1. GET (Monitoring server → Router): The community string acts as the password, and it travels unencrypted.
2. RESPONSE (Router → Monitoring server): The router answers.

Wireshark filter:

snmp

2. Trap: the device raises an alert

Devices don’t wait to be asked when something breaks: they send a trap to the monitoring server on UDP 162.

1. TRAP (Router → Monitoring server): An interface went down; the SOC or NOC gets an alert straight away.

Wireshark filter:

udp.port == 162

3. Default community: attack: reading the whole device

If the community string is still “public” (read) or “private” (write), anyone on the network can read the device’s full configuration data: every interface, IP address, routing entry and often device names and contacts. Write access can even change settings.

1. GET-BULK (Attacker → Router): The attacker tries the default string.
2. RESPONSE (Router → Attacker): The device hands over a detailed map of the network.

Wireshark filter:

snmp.community == "public"

4. Snmpv3 + acl: defence: real logins, encryption, allow-list

Move to SNMPv3 with authentication and encryption (authPriv), remove “public” and “private”, and allow SNMP only from the monitoring server’s address.

1. GET-BULK (Attacker → Router): The router ignores it.
2. GET (v3) (Monitoring server → Router): The monitoring server keeps working, now authenticated and encrypted.

Router config (cisco):

no snmp-server community public
snmp-server group NOC v3 priv access SNMP-ACL
ip access-list standard SNMP-ACL
 permit 10.0.0.5

FAQ