snmpget

@amitmund September 11, 2026

Linux `snmpget` — Complete Learning Notes & Output Guide

snmpget is a client utility from the Net-SNMP suite that uses the Simple Network Management Protocol (SNMP) to fetch exact, discrete data points from a remote agent or network device (switches, routers, firewalls, Linux/Windows hosts) over UDP port 161.

1. What is `snmpget`?

snmpget issues an SNMP GET-REQUEST protocol data unit (PDU) to retrieve the value of one or more specific Object Identifiers (OIDs) defined in a Management Information Base (MIB).

Unlike snmpwalk or snmpbulkwalk (which traverse entire MIB subtrees), snmpget is an atomic, single-target query: it demands the exact leaf or instance identifier and fails if the target instance does not exist.

It answers specific operational and monitoring questions:

What is the current operational status (up/down) of interface 2 on a core switch?
How many total octets/bytes have traversed a 10GbE uplink (ifHCInOctets)?
What is the exact hardware uptime, firmware revision, or serial number of a remote device?
Is an SNMP agent reachable and authenticating properly with configured community strings or SNMPv3 credentials?

2. Installation & MIB Setup

snmpget is packaged within the Net-SNMP application suite.

Debian / Ubuntu

sudo apt update
sudo apt install snmp snmp-mibs-downloader

(On Debian/Ubuntu, standard MIB files are excluded by default due to licensing. Edit /etc/snmp/snmp.conf and comment out mibs : to enable textual MIB translation).

RHEL / Rocky / AlmaLinux / CentOS

sudo dnf install net-snmp-utils net-snmp

Arch Linux

sudo pacman -S net-snmp

Verify:

snmpget -V

3. Basic Syntax & Primary Command Options

snmpget [options] <agent_ip_or_hostname> <OID> [OID...]

Essential Command Flags

Flag	Purpose	Example
**`-v 1	2c	3`**	Specifies the SNMP protocol version to use.	`-v2c` or `-v3`
`-c <community>`	Specifies the clear-text community string (SNMPv1/v2c only).	`-c public`
`-O <format>`	Controls output formatting (`n`=numeric, `s`=short, `e`=enums, `f`=full).	`-On` (outputs raw dotted-decimal OIDs)
`-t <seconds>`	Sets request timeout in seconds (default is `1`).	`-t 5`
`-r <retries>`	Sets the number of retry attempts before giving up (default is `5`).	`-r 2`
`-m <MIBs>`	Loads specific MIB modules or all with `-m ALL`.	`-m +IF-MIB`
`-u <user>`	Specifies the security username (SNMPv3 only).	`-u monitor_user`
`-l <secLevel>`	Security level for SNMPv3 (`noAuthNoPriv`, `authNoPriv`, `authPriv`).	`-l authPriv`
`-a <proto>`	Authentication protocol for SNMPv3 (`MD5`, `SHA`, `SHA-256`, `SHA-512`).	`-a SHA-256`
`-A <pass>`	Authentication pass phrase (SNMPv3).	`-A AuthPassword123`
`-x <proto>`	Privacy/encryption protocol for SNMPv3 (`DES`, `AES`, `AES-256`).	`-x AES`
`-X <pass>`	Privacy/encryption pass phrase (SNMPv3).	`-X PrivPassword123`

4. Anatomy of `snmpget` Output

Example 1: Basic SNMPv2c Query (System Description)

snmpget -v2c -c public 192.168.1.1 1.3.6.1.2.1.1.1.0

SNMPv2-MIB::sysDescr.0 = STRING: Linux edge-gw01 5.15.0-91-generic #101-Ubuntu SMP x86_64

Example 2: Multiple OIDs in a Single Request (Status, Uptime, Octets)

snmpget -v2c -c secretcommunity 10.0.0.1 \
  DISMAN-EVENT-MIB::sysUpTimeInstance \
  IF-MIB::ifOperStatus.2 \
  IF-MIB::ifHCInOctets.2

DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (14520102) 1 day, 16:20:01.02
IF-MIB::ifOperStatus.2 = INTEGER: up(1)
IF-MIB::ifHCInOctets.2 = Counter64: 48912401024

5. Breakdown of Every Output Component

+-------------------+----------------+---+---------------+---+----------------------------------------+
| MIB Module        | Object Name    | . | Instance Index| = | Data Type: Value                       |
+-------------------+----------------+---+---------------+---+----------------------------------------+
| IF-MIB::          | ifOperStatus   | . | 2             | = | INTEGER: up(1)                         |
+-------------------+----------------+---+---------------+---+----------------------------------------+

5.1 `MIB Module` (`IF-MIB::`, `SNMPv2-MIB::`)

Meaning: The name of the parsed MIB file that defines the syntax and semantics of the queried object.
Diagnostic Role: Verifies that your local system successfully found and loaded the appropriate MIB definition file. If this shows raw numbers (e.g., iso.3.6.1...), the MIB is missing or unparsed.

5.2 `Object Name` (`ifOperStatus`, `sysUpTimeInstance`)

Meaning: The human-readable label mapped to the numeric OID node.

5.3 `Instance Index` (`.0`, `.2`)

.0 (Scalar Instance): Scalar objects (which only ever have one value on a system, like sysDescr or sysName) **must always end in .0** to denote the single instance.
.N (Tabular Column Instance): For objects inside a table (like network interfaces in ifTable / ifXTable), the suffix represents the row index (e.g., interface ifIndex = 2).

5.4 Data Types & Payloads

Net-SNMP prefixes the returned value with its ASN.1 data type definition:

ASN.1 Data Type	Example Returned Value	Description & Troubleshooting Significance
`STRING`	`STRING: "Cisco IOS-XE 17.03"`	Printable ASCII or UTF-8 text string.
`INTEGER`	`INTEGER: up(1)`	Enumerated integer. Shows both the human label and the raw integer value (`1`=up, `2`=down, `3`=testing).
`Timeticks`	`Timeticks: (14520102) 1 day...`	Hundredths of a second ($10\,\text{ms}$) elapsed since device reboot or agent initialization.
`Counter32`	`Counter32: 34120512`	Unsigned 32-bit counter ($0 \to 2^{32}-1$). Wraps rapidly on high-speed interfaces ($>1\,\text{Gbps}$).
`Counter64`	`Counter64: 48912401024`	Unsigned 64-bit high-capacity counter (e.g., `ifHCInOctets`). Required for modern $\ge 1\,\text{Gbps}$ links.
`Gauge32`	`Gauge32: 42`	An integer that fluctuates up and down (temperature, active TCP connections, memory usage %).
`IpAddress`	`IpAddress: 192.168.1.254`	4-byte IPv4 address.
`OID`	`OID: SNMPv2-SMI::enterprises.9.1`	The value itself is another OID pointer (frequently used in `sysObjectID`).

6. Formatting Output: Numeric vs. Symbolic OIDs

By default, Net-SNMP translates raw numbers into textual labels using installed MIB files. You can alter this using -O output options:

# 1. Print raw numeric OIDs (-On):
snmpget -v2c -c public -On 192.168.1.1 sysName.0
# Output: .1.3.6.1.2.1.1.5.0 = STRING: core-switch-01

# 2. Print short object names without MIB prefixes (-Os):
snmpget -v2c -c public -Os 192.168.1.1 sysName.0
# Output: sysName.0 = STRING: core-switch-01

# 3. Print raw values only without variable names (-Ov):
snmpget -v2c -c public -Ov 192.168.1.1 sysName.0
# Output: STRING: core-switch-01

# 4. Print raw integer values without enum translation (-Oe):
snmpget -v2c -c public -Oe 192.168.1.1 ifOperStatus.2
# Output: IF-MIB::ifOperStatus.2 = INTEGER: 1

Translating Between OIDs and Names

Use snmptranslate to navigate between text and numeric forms:

# Translate name to numeric OID:
snmptranslate -On IF-MIB::ifOperStatus
# Result: .1.3.6.1.2.1.2.2.1.8

# Translate numeric OID to full MIB object path:
snmptranslate -Td .1.3.6.1.2.1.1.3.0

7. SNMPv1 vs. SNMPv2c vs. SNMPv3 Security Models

+-----------------------------------------------------------------------+
|  SNMPv1   | Clear-text community string. 32-bit counters only.        |
+-----------+-----------------------------------------------------------+
|  SNMPv2c  | Clear-text community string. Adds 64-bit counters & bulk. |
+-----------+-----------------------------------------------------------+
|  SNMPv3   | USM (User-based Security Model): Crypto Auth + Encryption |
+-----------------------------------------------------------------------+

Querying with Secure SNMPv3 (`authPriv`)

SNMPv3 uses cryptographic credentials instead of vulnerable clear-text community strings:

snmpget -v3 \
  -u secadmin \
  -l authPriv \
  -a SHA-256 -A "AuthPassphrasePhrase88!" \
  -x AES -X "EncryptionKeyPassphrase99#" \
  10.0.0.1 \
  SNMPv2-MIB::sysUpTime.0

noAuthNoPriv: -l noAuthNoPriv -u <user> (Username only; unauthenticated, unencrypted).
authNoPriv: -l authNoPriv -u <user> -a SHA -A <pass> (Cryptographic hash validation; unencrypted payload).
authPriv: -l authPriv -u <user> -a SHA -A <pass> -x AES -X <pass> (Cryptographic authentication plus symmetric encryption of all payload data).

8. Real-World Troubleshooting Scenarios

Scenario A: "Timeout: No Response from "

snmpget -v2c -c public 192.168.1.50 sysDescr.0

Timeout: No Response from 192.168.1.50.

Diagnosis Checklist:

Network Path / Firewall: UDP port 161 is blocked by an intermediate firewall, cloud security group, or local iptables/nftables.
Wrong Community String: The SNMP agent silently drops requests with invalid community strings to prevent brute-force reconnaissance.
Agent Binding: The remote snmpd daemon is bound strictly to 127.0.0.1 instead of 0.0.0.0 or its public IP.
ACL Filtering: The target agent configuration restricts queries to specific client IP subnets.

Scenario B: "No Such Instance currently exists at this OID"

snmpget -v2c -c public 192.168.1.1 sysDescr

SNMPv2-MIB::sysDescr = No Such Instance currently exists at this OID

Diagnosis:

You queried a scalar object (sysDescr), but forgot the mandatory instance suffix .0.
Fix: Re-run as snmpget -v2c -c public 192.168.1.1 sysDescr.0.

Scenario C: "No Such Object available on this agent at this OID"

snmpget -v1 -c public 192.168.1.1 IF-MIB::ifHCInOctets.1

IF-MIB::ifHCInOctets.1 = No Such Object available on this agent at this OID

Diagnosis:

ifHCInOctets is a 64-bit counter (Counter64). 64-bit data structures were introduced in SNMPv2c and are strictly unsupported in SNMPv1.
Fix: Switch the protocol version flag from -v1 to -v2c or -v3.

9. Important Interview Questions & Answers

Q: What is the fundamental difference between `snmpget`, `snmpgetnext`, and `snmpwalk`?

Answer:

snmpget: Issues an atomic GET request for exact OID instances. If you do not provide the exact instance ID (e.g., omitting .0 for a scalar), it fails.
snmpgetnext: Requests the immediate lexicographical successor of the specified OID. It does not require knowing the target instance identifier in advance.
snmpwalk: A client-side automation tool that executes repeated snmpgetnext (or snmpbulkget in snmpbulkwalk) calls sequentially to traverse and retrieve an entire subtree under a specified root OID.

Q: Why must you query `sysUpTimeInstance` or `sysUpTime.0` instead of `sysUpTime` with `snmpget`?

Answer: In the SNMP SMI (Structure of Management Information), sysUpTime is defined as a scalar object. A scalar represents a single variable rather than a table row. In SNMP addressing, a specific instance of a scalar is always addressed by appending .0 to its object identifier. Without .0, the request points to an abstract object definition rather than an instantiated value, prompting the agent to return No Such Instance.

Q: Why do high-speed network interfaces (1Gbps, 10Gbps, 100Gbps) require `ifHCInOctets` instead of `ifInOctets`?

Answer: Standard ifInOctets uses a 32-bit integer counter (Counter32), which rolls over after $2^{32}-1$ octets (~4.29 GB). On a 10 Gbps link running at full capacity:

$$\frac{4{,}294{,}967{,}296 \times 8 \text{ bits}}{10 \times 10^9 \text{ bps}} \approx 3.4 \text{ seconds}$$

The 32-bit counter wraps around roughly every 3.4 seconds, making it impossible for standard 1-minute or 5-minute polling intervals to calculate bandwidth accurately. ifHCInOctets (from ifXTable) uses a 64-bit counter (Counter64), which takes hundreds of years to wrap at the same bandwidth.

Linux snmpget — Complete Learning Notes & Output Guide

1. What is snmpget?