Purpose of snmpd Daemon in Linux Network Monitoring

The snmpd daemon is a background service on the Linux operating system that implements the Simple Network Management Protocol (SNMP) agent. Its primary purpose is to collect host metrics, expose system telemetry to centralized network management systems (NMS), and send automated alert notifications when system thresholds are breached. By standardizing how performance and hardware data are retrieved, snmpd allows administrators to monitor Linux servers alongside network switches, routers, and other infrastructure from a single pane of glass.

Core Functions of the snmpd Daemon

1. Responding to Metric Queries (GET Requests) The primary task of snmpd is listening on UDP port 161 for requests from a network management station (such as Zabbix, Nagios, or Prometheus via the SNMP exporter). When queried, the daemon reads kernel data and system states, packaging the information into standardized SNMP data formats to report metrics such as:

   • CPU utilization and load averages
   • Physical and virtual memory consumption
   • Storage space and disk I/O metrics
   • Network interface status, bandwidth consumption, and error rates
   • Running processes and uptime

2. Sending Event Notifications (Traps and INFORMs) Rather than waiting for a central system to poll it for data, snmpd can be configured to proactively push alerts to an SNMP trap receiver (typically on UDP port 162). If a critical event occurs—such as a storage volume filling up, a critical interface failing, or a system reboot—the daemon generates an SNMP Trap or INFORM message to notify administrators immediately.

3. Remote Configuration Management (SET Requests) Although many production environments restrict SNMP to read-only access for security reasons, snmpd natively supports write operations via SNMP SET commands. This allows authorized management systems to change system parameters, restart services, or alter interface configurations directly over the network.

4. Custom Extensibility The snmpd architecture supports custom extensions using the extend or pass directives in its configuration file (/etc/snmp/snmpd.conf). Administrators can execute local shell scripts or binaries, allowing snmpd to monitor application-specific metrics that are not part of standard system tables.

How snmpd Operates Within Linux

The daemon organizes its telemetry using Management Information Bases (MIBs) and Object Identifiers (OIDs). An OID is a numeric address in a standardized hierarchical tree that points to a specific metric—for instance, system uptime is addressed via 1.3.6.1.2.1.1.3.0. When snmpd receives an OID query, it translates the identifier, fetches the live data from the Linux /proc and /sys filesystems, and responds to the manager.

Security and Protocol Versions

The snmpd daemon supports three major SNMP protocol versions:

• SNMPv1 and SNMPv2c: Rely on plaintext "community strings" acting as shared passwords (e.g., public or private). These versions lack encryption and are vulnerable to packet sniffing on untrusted networks.
• SNMPv3: The modern standard supported by snmpd, introducing cryptographic security. It provides user-based authentication (using SHA or MD5) and payload encryption (using AES or DES) to protect monitoring traffic from tampering and interception.