Okay, so here's what my SNMP research has turned up. I can't verify this is all 100% accurate, but I feel that I have a much better grasp on SNMP in general and hopefully this information will help someone who is just getting started.
First, SNMP seems to me to be a messy system. It was developed in the late 80s and there's just not a good alternative so I guess we work with what we've got.
SNMP is made up of 3 pieces: an SNMP management system, at least 1 network device, and a software agent on those network devices. For example, you might use Naigos or MaxFocus as an SNMP management system to query devices on your network like printers, switches, routers, etc. Those devices are all running little software components that were made by their manufacturers. Those software components basically produce a bunch of SNMP data based on how the device is functioning. For instance, a printer may produce data on it's toner levels, or a router might produce data on how many concurrent connections it currently is supporting. The SNMP management system can then query these devices for this info.
But how is it actually done? Well, some standards organizations put together MIBs back in the 80s to help with this. A MIB is basically a large data tree of SNMP attributes that can be queried. These standard MIBs cover a large amount of query-able attributes - from toner to network settings - but as you can imagine as new devices and technology has emerged they don't cover everything. So Manufacturers have produced product specific MIBs that help fill these gaps.
MIBs sound pretty great, but the reality is they seem to often be difficult to understand, and poorly written. Sometimes they are not written to proper spec so it becomes difficult to utilize them. That said, the general process for making use of a MIB to find out what items you can query on your device of choice (router, printer, etc) is this:
- Get yourself a free MIB Browser software. They are all crappy, but I find that NetTools Pro by Axence or the MIB Browser from ManageEngine are the least crappy.
- Most MIB browsers come with the "default" MIB files preloaded. But if you want to know what vendor specific items you can query on your devices you'll have to download a custom MIB file from your vendor. (Sonicwall, HP, etc) If your vendor does not offer MIB files, there are some online resources that host a bunch of MIB files. I think there's one called MIB Depot or something...
- Once you get your custom vendor specific MIB file downloaded, import it into your MIB browser.
- Now we perform what is called a "walk" against your SNMP device. To do this, you'll need to punch in the devices IP address, and it's community string. (The community string is really just a password or shared secret used for authentication. Why the creators of SNMP decided they needed to be different and call it a community string is beyond me...) I should also mention that the device you are querying needs to be set up to allow SNMP queries. This is usually done through the devices web interface, which is also typically where you set the community string.
- Once you get your MIB browser connected to your device then perform the "walk" function. Every MIB browser works a bit differently, so you'll need to play around a bit to see how it's walk function works. But in general it should return a list of OIDs from your device. These IDs correspond to an entry in the MIB files. Usually you can double click or highlight one of these OIDs and it will find the corresponding MIB item that will tell you what that OID is used for, e.g. toner levels, OS version, network connections, etc. Then you can punch in the OID number into your SNMP management system and begin monitoring that attribute!
So after all my research I find that SNMP appears to me at least to be a very flawed and cumbersome system. But from what I've read it seems that at the very least, once you get it configured it tends to be reliable and speedy. I hope this information helps someone else who is just delving into the world of SNMP! Here's a further reference that I found helpful:
http://www.allthingsmax.com/2014/02/take-snmp-walk-creating-new-snmp-checks.html
UPDATE: I will add another tip here. When walking a devices OID values there are two different types of values you can possibly retrieve: scalar and tabular.
Tabular is used for devices that need to provide the same type of value for several components. For instance a router may have 9 ports on it. Each port has a different physical address or MAC address. this is represented by a table in a MIB.
Scalar is used for values that don't require a tabular layout.
THE IMPORTANT PART: Scalar values are always appended with a .0 and tabular values are appended with a number representing a specific device value. For instance on a router port 1 would likely be appended with .1, port 2 with .2, and so on. Then when you enter the OID into your SNMP management system, you need to make sure to include this last numeric character. For instance, ifPhysAddress = .1.3.6.1.2.1.2.2.1.6, but without appending a tabular value it will do you no good. This is similar for scalar values which will always need a .0 appended. A decent MIB browser should show you these append values when walking the device. ManageEngine's MIB browser does a good job of this. It format's it like so:
--Scalar values:
sysUpTime.0
sysContact.0
sysName.0
--Tabular values:
ifPhysAddress.1
ifPhysAddress.2
ifPhysAddress.3
...
