Manager ↔ agent over UDP: queries on 161, traps/informs on 162. Devices expose a MIB tree addressed by OIDs; managers poll (GET/GETNEXT/GETBULK) or receive async TRAP (fire-and-forget) / INFORM (acknowledged).

Version	Security	Notes
v1	cleartext community	legacy
v2c	still cleartext	adds GETBULK, everywhere
v3	auth (SHA) + priv (AES)	the only correct choice; needs NTP

v3’s model chain — memorise as USER → GROUP → VIEW → MIB: user holds credentials, group sets security level (noauth/auth/priv) and rights, view scopes which OIDs are visible.

snmp-server view READONLY iso included
snmp-server group NMS-GROUP v3 priv read READONLY
snmp-server user NMSUSER NMS-GROUP v3 auth sha AuthPass priv aes 128 PrivPass

Wrap SNMP in an ACL; community strings are passwords; traps can vanish (UDP) — informs for anything you must know about.