SNMP Trap Receiver with PRTG

SNMP traps are one of the oldest standards for network equipment fault notification, and most network devices with basic management capabilities support SNMP traps. When a device detects an error or a change, the device sends a notification to one or more trap receivers.

SNMP packets consist of a packet header, a PDU header, and a PDU body. For trap messages, the information sent in the PDU header can vary. The PDU header of an SNMP trap packet contains the packet types, the OID of the device, the IP address of the sender, general and company-specific IDs, and the time the trap event occurred. The actual values are sent in the PDU body.

The SNMP protocol (Simple Network Management Protocol) is a standard protocol used to manage and monitor network devices such as routers, switches, servers, firewalls, and other hardware connected to a network. SNMP allows network administrators to remotely monitor device performance, collect and analyze data, and even modify configurations on these devices to ensure the network runs smoothly and efficiently.

Key components of SNMP include:

• Managed devices: These are the network devices that are monitored or managed using SNMP, such as routers, switches, servers, and printers. Each device must run SNMP-compatible software (called an agent) to communicate with the management system.
• SNMP agents: The SNMP agent is software running on the managed device that collects and stores data about the device's performance and status (e.g., CPU usage, memory, network traffic). It responds to requests from the SNMP manager and can send notifications (called "traps") when certain events occur.
• SNMP manager: Also known as the Network Management System (NMS), this is software (or sometimes hardware) that communicates with SNMP agents to gather and analyze information about managed devices. The SNMP manager can request data, receive notifications (traps), and sometimes send commands to modify the behavior or configuration of a device.

Versions of SNMP:

There are three major versions of SNMP, each offering different levels of security and functionality.

• SNMPv1: The original version, with basic functionality but minimal security. It only uses plain-text community strings for authentication.
• SNMPv2c: An improved version that offers better performance and more efficient data retrieval. However, it still lacks strong security features.
• SNMPv3: The latest version, which provides enhanced security features like encryption and secure authentication, making it suitable for use in more sensitive environments.

The term “trap server” is sometimes used synonymously with “trap receiver.” This server receives and processes messages. Our preconfigured sensor for monitoring SNMP traps lets you configure any PRTG probe device as an SNMP trap server. PRTG supports SNMP v1 traps as defined in RFC 1157, and SNMP v2c traps as outlined in RFC 3416.

PRTG receives the traps, which include the number of messages received per second, warnings, errors, and lost data packets. PRTG presents trap content and messages in an easy-to-read table. Data can be filtered however you like.

With PRTG, you get a quick overview of the traps and their contents, and will be notified immediately in the event of a problem. If you need a more thorough analysis, various specialized tools will allow you to examine traps in detail.

By default, SNMP traps are sent via UDP port 162. This port must be set as the destination port in your source devices.

SNMP works on the assumption that a network management system submits a query, and a managed device returns an answer. There are four possibilities for this exchange: Get, GetNext, Set, and Trap.

With Trap, SNMP traps are automatically sent from a device to a compatible receiver – without the receiver requesting them. This is not the case with Get and GetNext. With these commands, queries are performed manually. Set is no traditional monitoring function.

PRTG has always been developed for Windows systems, which means you can also set up your trap monitoring in Windows.

In PRTG, “sensors” are the basic monitoring elements. One sensor usually monitors one measured value in your network, for example the traffic of a switch port, the CPU load of a server, or the free space on a disk drive. On average, you need about 5-10 sensors per device or one sensor per switch port.