SNMP Versions Explained: From ‘Trust Everyone’ to ‘Prove Who You Are

 

SNMP Versions

SNMP has versions, not because people were bored, but because the early ones were… not great.
Each new version exists because someone eventually said:

“Okay, this works… but this is also a terrible idea.”

Let’s walk through them.

SNMPv1 — “It Works, Don’t Ask Questions”

What it is

SNMPv1 is the original version.
It was created when networks were smaller, friendlier, and everyone trusted each other a little too much.

It lets you:

• Ask devices for information
• Get replies
• Feel proud that it works

How security works (or doesn’t)

SNMPv1 uses a community string, which is basically a password.

But:

• It’s sent in plain text
• Anyone on the network can read it
• No encryption
• No user identity

Explanation:

“If you know the secret word, you’re allowed in.
And we shout the secret word out loud.”

Common community string:

public

Which translates to:

“Please don’t hack me (but you totally can).”

When people still use it

1.      Old devices

2.      Lab environments

3.      “It’s always been like this” networks

SNMPv1 personality

1.      Old

2.      Trusting

3.      Not secure

4.      Still somehow alive

SNMPv2c — “Same Idea, Slightly Faster”

Why it exists

People liked SNMPv1, but wanted:

• Better performance
• Better error handling
• Bigger counters

So SNMPv2c was born.

What changed?

• Faster
• More efficient
• Better data handling

What did NOT change?

Security.
At all.

It still:

• Uses community strings
• Sends them in plain text
• Trusts everyone too much

Explanation:

“We upgraded the engine, but kept the doors unlocked.”

Why it’s popular

Because it’s:

• Easy to configure
• Supported everywhere
• Works with almost all tools

Admins often say: “Yes, it’s insecure… but it’s simple.”

SNMPv2c personality

1.      Less old

2.      Faster

3.      Still insecure

4.      Very common

SNMPv3 — “Okay, Now We’re Serious”

Why SNMPv3 exists

Eventually, security people showed up and said:

“You cannot keep doing this.”

So SNMPv3 was created to:

• Fix security
• Add authentication
• Add encryption
• Stop shouting passwords across the network

SNMPv3 security 

SNMPv3 finally acts like a modern system.

It supports:

• Users (real identities)
• Passwords
• Authentication (prove who you are)
• Encryption (hide the data)

Explanation:

“Who are you?”
“Prove it.”
“Okay, now we’ll talk privately.”

SNMPv3 security levels (important)

1️⃣   noAuthNoPriv

• No authentication
• No encryption

Meaning:

“I don’t know who you are, and I don’t care.”

(Almost nobody should use this.)

2️⃣   authNoPriv

• Authentication ✔
• Encryption ✖

Meaning:

“I know who you are, but others can still listen.”

3️⃣   authPriv (best)

• Authentication ✔
• Encryption ✔

Meaning:

“I know who you are, and nobody else can hear us.”

This is the recommended mode.

Why people fear SNMPv3

SNMPv3 is secure… but:

• More settings
• More typing
• More things to mess up
• Less “it just works”

Reaction:

“Why does monitoring need a PhD?”

But once configured:

• Very safe
• Very reliable
• Very professional

Real-life admin choices

• Home lab / test → v2c
• Production → v3
• Very old hardware → v1 (with regret)

One-sentence summary

• SNMPv1: “Trust everyone”
• SNMPv2c: “Trust everyone, but faster”
• SNMPv3: “Trust only verified people, quietly”

Final advice

If someone asks:

“Which SNMP version should we use?”

The grown-up answer is:

SNMPv3, unless you have a really good reason not to.