What is the difference between an SNMP trap and an inform, and what are MIBs and OIDs?
Show the answer
Say this first
A trap is a one-way notification from agent to manager on UDP 162. If it is lost, nobody knows. An inform is the same notification but the manager must acknowledge it, and the agent retries until it does. An OID is the dotted address of one piece of data in a global tree, for example 1.3.6.1.2.1.1.5.0 for sysName. A MIB is a module that defines a set of OIDs with their types and meanings, so the manager knows what the numbers are.
Go deeper
The OID tree
1.3.6.1 iso.org.dod.internet
1.3.6.1.2.1 mib-2, the standard MIBs
1.3.6.1.2.1.1 system: sysDescr .1, sysUpTime .3, sysName .5
1.3.6.1.2.1.2.2.1 ifEntry: ifDescr .2, ifOperStatus .8, ifInOctets .10
1.3.6.1.2.1.31.1.1.1 ifXEntry: ifHCInOctets .6 (64-bit)
1.3.6.1.4.1 enterprises: Cisco is 1.3.6.1.4.1.9Scalars end in .0, as in sysName.0. Table cells end in the row index, usually the ifIndex:
ifInOctets.3 is interface index 3. snmp-server ifindex persist keeps ifIndex values stable
across reloads.
Trap or inform
| Trap | Inform | |
|---|---|---|
| Acknowledged | no | yes, with a Response |
| Retries | none | until acknowledged or retries run out |
| Cost on the device | send and forget | each inform held in memory until acknowledged |
| Versions | v1, v2c, v3 | v2c, v3 |
snmp-server enable traps snmp linkdown linkup coldstart warmstart
snmp-server host 10.0.0.50 version 3 priv nmsuser
snmp-server host 10.0.0.51 informs version 2c Oct3t-Trap-2026They will ask next
Why must ifIndex stay the same after a reload?
Monitoring systems key graphs and alerts by ifIndex. If indexes shift after a reload, a year of history for Gi0/0/1 quietly continues on a different interface.
What does snmpwalk actually do?
It sends GetNext (or GetBulk with snmpbulkwalk) from a starting OID, again and again, until the reply leaves that subtree. That is how you dump a whole table without knowing its indexes.
Traps
- Calling informs secure traps. They are acknowledged traps; security comes from v3.