What are the differences between SNMP v1, v2c and v3?
Show the answer
Say this first
All three share one model: a manager polls agents on UDP 161, and agents send notifications to the manager on UDP 162. v1 and v2c authenticate with a community string sent in clear text. v2c adds GetBulk, 64-bit counters and informs. v3 replaces communities with users and adds real security: authentication with HMAC (MD5 or SHA), encryption (DES or AES) and view-based access control. In production I use v3 with authPriv, and v2c only read-only, locked down with an ACL, on a management network.
Go deeper
| v1 | v2c | v3 | |
|---|---|---|---|
| Security | community, clear text | community, clear text | users, authentication, encryption |
| Counters | 32-bit | 32-bit and 64-bit | 32-bit and 64-bit |
| Bulk retrieval | no | GetBulk | GetBulk |
| Notifications | trap | trap, inform | trap, inform |
Operations
Get, GetNext, GetBulk (v2c and later), Set, Response, Trap, Inform, and Report (v3 error and discovery messages).
Read-write is dangerous
A write community or user can change the device. On Cisco, a Set against the config copy MIB can make the router send its whole configuration to a TFTP server. Avoid RW; if you need it, use v3 and a tight view.
A locked-down v2c baseline
ip access-list standard SNMP-MGRS
permit 10.0.0.50
snmp-server community Oct3t-R0-2026 RO SNMP-MGRSWhere it is going
Streaming telemetry (model-driven, gNMI) pushes counters every few seconds instead of waiting to be polled. SNMP stays everywhere for inventory, basic counters and alarms.
They will ask next
Why do 64-bit counters matter?
A 32-bit octet counter wraps after 2^32 bytes, about 34 gigabits. On a 10 Gbps link that is 3.4 seconds, so a 5 minute poll cannot tell how many times it wrapped.
ifHCInOctetsand friends are 64-bit and need v2c or v3.Why does SNMP run over UDP?
It is light, polls tolerate loss, and managers simply retry. A management protocol also has to work when the network is struggling, and UDP needs no connection state for that.
Traps
- Treating community strings as passwords that protect anything. They cross the wire in clear text.
- Configuring RW communities just in case.