SNMP Traps – Complete Guide

1. What Is an SNMP Trap?

An SNMP Trap is an unsolicited, asynchronous message sent by a network device (the SNMP Agent) to an SNMP Manager whenever a predefined event occurs — such as an interface going down, a device rebooting, or CPU utilisation exceeding a threshold.

Unlike polling (where the manager periodically asks "how are you?"), traps are pushed immediately by the agent the moment the event happens. This makes them ideal for real-time alerting with minimal network overhead.

  SNMP Agent (Router/Switch)                SNMP Manager (SolarWinds/PRTG)
        |                                         |
        |  [Interface Gi0/1 goes DOWN at 14:32]   |
        |                                         |
        |-- TRAP: linkDown, Gi0/1 [UDP 162] ------>|  Immediate alert — no polling needed
        |                                         |
        |  [Device reboots at 14:45]              |
        |                                         |
        |-- TRAP: coldStart [UDP 162] ------------>|
    

Related pages: show logging (Syslog) | ACL Overview | Applying ACLs | show running-config | NTP Synchronisation | Common Port Numbers | Step-by-Step: SNMP Configuration | Syslog Configuration Lab

2. SNMP Trap vs. Polling (GET Requests)

Understanding the difference between trap-based and poll-based monitoring is essential for both the CCNA exam and real-world network design.

In practice, both are used together: polling provides regular metrics, traps provide instant event notification.

3. SNMP Trap Types

A. Generic Traps (Defined in RFC 1157)

These are standard traps defined in the base SNMP MIB, supported by virtually all SNMP-capable devices:

B. Specific (Enterprise) Traps

Vendor-defined traps extending beyond the generic set, defined in proprietary MIBs. Examples include:

• Cisco: ciscoEnvMonTemperatureNotification (temperature alarm), cpmCPUTotalHigh (high CPU), bgpEstablished / bgpBackwardTransition (BGP state changes)
• Juniper: jnxLinkDown, jnxOspfNbrStateChange
• Generic server: hrDiskFull (disk space critical), hrProcessorLoad (CPU overload)

4. SNMP Trap Message Format

Every SNMP trap carries a standard set of fields that the manager uses to identify, log, and react to the event:

Example SNMPv2c linkDown trap as seen on the manager:

SNMPv2-MIB::snmpTrapOID.0 = OID: IF-MIB::linkDown
IF-MIB::ifIndex.1 = INTEGER: 1
IF-MIB::ifDescr.1 = STRING: GigabitEthernet0/0
IF-MIB::ifAdminStatus.1 = INTEGER: up(1)
IF-MIB::ifOperStatus.1 = INTEGER: down(2)

5. Configuring SNMP Traps on Cisco IOS

Step 1 — Define the SNMP Trap Receiver (Manager)

Router(config)# snmp-server host 192.168.1.100 traps MyROString

This tells the router to send all enabled traps to the manager at 192.168.1.100 using community string MyROString over UDP port 162.

Step 2 — Enable Specific Trap Categories

Router(config)# snmp-server enable traps                   ! Enable all trap categories
Router(config)# snmp-server enable traps snmp linkdown     ! Interface link-down traps only
Router(config)# snmp-server enable traps snmp linkup       ! Interface link-up traps
Router(config)# snmp-server enable traps bgp               ! BGP state-change traps
Router(config)# snmp-server enable traps config            ! Configuration change traps

Step 3 — Verify the Configuration

Router# show snmp host
Router# show snmp
Router# show running-config | include snmp

Expected output of show snmp host:

Notification host: 192.168.1.100  udp-port: 162  type: trap
user: MyROString  security model: v2c

Configuring SNMPv3 Traps (Recommended for Production)

Router(config)# snmp-server group SNMPGROUP v3 priv
Router(config)# snmp-server user SNMPUSER SNMPGROUP v3 auth sha AuthPass priv aes 128 PrivPass
Router(config)# snmp-server host 192.168.1.100 version 3 priv SNMPUSER

6. SNMP Trap Ports & Protocols

Why UDP? SNMP uses UDP (connectionless) because SNMP operations are simple request-response messages. UDP adds no connection overhead — if a response is needed, the application layer handles retries. For traps, UDP is acceptable because traps are best-effort; if reliability is needed, use Informs instead (see Section 9).

Ensure UDP 162 is open inbound on the SNMP Manager's firewall from your managed devices. See ACL/Firewall and Applying ACLs for guidance.

7. Trap Severity Levels

While SNMP traps do not have built-in severity levels like Syslog, Network Management Systems typically classify them by impact:

8. SNMPv1 vs v2c vs v3 Traps

The key structural difference: SNMPv1 traps use a legacy PDU type with fixed fields (generic-trap, specific-trap, time-stamp). SNMPv2c and v3 use the snmpV2-trap PDU which carries all information as variable bindings — more flexible and extensible.

9. SNMP Trap vs. Inform

SNMPv2c introduced Inform messages as a more reliable alternative to traps for critical events:

Configuring Informs on Cisco IOS:

Router(config)# snmp-server host 192.168.1.100 informs MyROString

10. MIBs for Traps

Every SNMP trap is identified by an OID defined in a MIB (Management Information Base). The manager must have the correct MIB loaded to decode and display the trap meaningfully.

Import vendor-specific MIBs into your NMS (SolarWinds, PRTG, Zabbix) to ensure enterprise traps are decoded correctly. Without the MIB, the NMS will display raw OIDs rather than readable trap names.

11. Testing SNMP Traps

Sending a Test Trap from Linux

snmptrap -v 2c -c public 192.168.1.100 '' IF-MIB::linkDown ifIndex.1 i 1

• -v 2c — SNMP version
• -c public — Community string
• 192.168.1.100 — Manager IP (trap destination)
• IF-MIB::linkDown — Trap OID
• ifIndex.1 i 1 — Variable binding: interface index 1

Listening for Traps on the Manager (Linux)

snmptrapd -f -Lo

This runs snmptrapd in the foreground (-f) with output logged to stdout (-Lo). Press Ctrl+C to stop. Incoming traps will be printed in real time.

Triggering a Real Trap on a Cisco Device

! Shut down an interface to generate a linkDown trap
Router(config)# interface GigabitEthernet0/1
Router(config-if)# shutdown

12. Security Considerations

SNMP traps carry sensitive operational data about your network. Without proper controls, traps can be intercepted, spoofed, or used to flood a manager.

• ✅ Use SNMPv3 with authPriv — traps are authenticated and encrypted
• ✅ Apply ACLs to restrict which devices can send traps to your manager: only permit UDP 162 from known agent IPs
• ✅ Apply ACLs on the Cisco device to restrict which manager IPs receive traps
• ✅ Monitor for excessive authenticationFailure traps — a spike may indicate a brute-force or misconfiguration

! Restrict which manager receives traps using an ACL
Router(config)# access-list 10 permit 192.168.1.100
Router(config)# snmp-server host 192.168.1.100 traps MyROString

13. Common Use Cases

14. Monitoring Traps in Popular NMS Platforms

• SolarWinds NPM: Built-in Trap Viewer with alert generation, filtering, and escalation rules. Supports MIB import for enterprise traps.
• PRTG: SNMP Trap Receiver sensor — configure a sensor on the manager to receive and classify traps by OID pattern.
• Zabbix: Native SNMP trap support via snmptrapd integration. Trap-to-trigger mapping using OID patterns.
• ELK Stack: Integrate traps via Logstash SNMP input plugin, store in Elasticsearch, visualise in Kibana for historical analysis.

15. Troubleshooting SNMP Traps

16. Summary

• SNMP Traps = Real-time, event-driven alerts pushed by the agent to the manager over UDP 162
• Generic traps (coldStart, linkDown, authenticationFailure) are defined in standard MIBs; enterprise traps are vendor-specific
• Trap vs Inform: Traps are unreliable (fire-and-forget); Informs add acknowledgement and retry — use Informs for critical events
• Configuration: Define snmp-server host, enable trap types with snmp-server enable traps
• Security: Use SNMPv3 with authPriv and ACLs to protect trap delivery
• Test: Use snmptrap to send and snmptrapd to receive test traps on Linux

SNMP Traps Quiz