Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I´m taking a network management class and the main topic is SNMP. Although my teacher is good at explaining the theoretical part of SNMP ( V1,V2,V3, RMON, MIBS etc.) he is not good at explaining the practical things like how can I use the information I just gathered or how would I use SNMP to detect congestion or unusual traffic on the network. Any information on this would be appreciated.

share|improve this question
up vote 4 down vote accepted

I frequently use SNMP in combination with rrdtool to provide overview graphs letting me know about the traffic flowing through routers on my network and cpu / memory usage of servers. A common command-line tool is 'snmpget' which will grab and output a specific piece of data provided by an SNMP enabled device.

For instance, to get the octets transferred through my Cisco router I use:

snmpget -v 1 -c public $router_ip_address IF-MIB::ifOutOctets.3 | egrep -o "[0-9]+$"

and then pipe the output into rrdtool. In consumer grade devices I've frequently ran into supposed support for SNMP that doesn't actually exist (the chip may be there, but its not actually written into the firmware) - so that's definitely something to watch out for. For instance, the Netgear router that was in place before this Cisco one 'supported' SNMP, but didn't actually output any data.

For figuring out what data is available for a given device, you can use the snmpwalk command or check the MIBs. I've found, however, that checking the MIBs is mostly useless as most devices I've encountered tend to use their own custom MIBs (or don't advertise which ones they support). An example of the snmpwalk command is; snmpwalk -c public $device_ip_address

If you're curious about my rrdtool graphing here's an example of the portion of my script (that runs every five minutes) to graph my router traffic.

function plot_router {
    if [ ! -e $DATA_DIRECTORY/router.rrd ]; then
                rrdtool create $DATA_DIRECTORY/router.rrd --start now \
            DS:bytes_in:COUNTER:600:U:U \
            DS:bytes_out:COUNTER:600:U:U \
                        RRA:AVERAGE:0.5:1:600 \
                        RRA:AVERAGE:0.5:6:700 \
                        RRA:AVERAGE:0.5:24:775 \
                        RRA:AVERAGE:0.5:288:797 \
                        RRA:MAX:0.5:1:600 \
                        RRA:MAX:0.5:6:700 \
                        RRA:MAX:0.5:24:775 \
        bytes_in=`snmpget -v 1 -c public $router_ip  IF-MIB::ifInOctets.3  | egrep -o "[0-9]+$"`
        bytes_out=`snmpget -v 1 -c public $router_ip IF-MIB::ifOutOctets.3  | egrep -o "[0-9]+$"`
        rrdtool update $DATA_DIRECTORY/router.rrd \

        # The actual graphing...
    for (( i=0;i<$SEGMENTS_COUNT;i++)); do
        rrdtool graph $FILENAME -s e-$SEGMENT -e now -h $HEIGHT -w $WIDTH --title "(`date`) Router"\
            --rigid \
            --slope-mode \
            DEF:bytes_out=$DATA_DIRECTORY/router.rrd:bytes_out:AVERAGE \
            CDEF:inverted=0,bytes_out,- \
            AREA:inverted$fg_color1:"Bytes Out (Upload)" \
            DEF:bytes_in=$DATA_DIRECTORY/router.rrd:bytes_in:AVERAGE AREA:bytes_in$fg_color2:"Bytes In (Download)" \
            CDEF:error=bytes_in,UN,INF,0,IF \
            AREA:error$fg_color_error:"Errors" \
            GPRINT:bytes_in:AVERAGE:"Avg Bytes In\: %3.0lf" \
            GPRINT:inverted:AVERAGE:"Avg Bytes Out\: %3.0lf" >> /dev/null

Note the bit about the script running every five minutes. For the life of me, in all my years of using rrdtool, I've never taken the time to figure out the right 'tunings' for the RRAs for anything but a five minute interval. If you get the tunings wrong, you'll end up with completely empty graphs and an utter sense of bafflement. So, from my experience, just use five minute intervals (run your insertion script every five minutes from cron) unless you want to spend some time figuring out the correct RRAs for something else.

I also wanted to point out that, while rrdtool is an amazing tool for Linux systems, it is also available on OSX (it might be available for Windows through Cygwin). Its an easy install through fink - just make sure to add the "unstable/main" and "unstable/crypto" trees to your /sw/etc/fink.conf file and "fink install rrdtool" your way to bliss.

I hope that this sheds some light on some practical uses of SNMP.

share|improve this answer
Nice script. I have my own, but nice nonetheless ;-) – wzzrd Dec 7 '09 at 12:45
This is good. Thank you and I hope you don´t mind me using your script as an inspiration for my own. – Stulli Dec 7 '09 at 13:02
Thanks guys. :) Stulli; I most certainly don't mind. I had a heckuva time figuring this stuff out for myself when I first delved into it a few years ago. – Jordan T. Cox Dec 8 '09 at 0:59

SNMP is primarily used for performance monitoring. With this in mind, you can use SNMP to detect unusual network traffic if by that you mean "unusually busy". Just read the proper metric every x minutes, plot the values in something like rrdtool and check the graphs. You could also read the value every now and then and trigger some alarm (send an email, SMS or something similar if the value is too high).

That said, configuring SNMP will always require some degree of investing time and money. It's not a fire and forget solution, but it is very flexible and powerful.

share|improve this answer

SNMP is used for quite a bit more than just monitoring and measuring network traffic. SNMP can and is used to monitor interface status, CPU and memory usage, hardware status on network and server equipment, etc. In my environment SNMP is the lynchpin of monitoring every piece of hardware running, from servers to switches to firewalls, etc.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.