Almost every serious piece of infrastructure hardware has been quietly keeping statistics for decades. Switches count packets and track link state. PDUs measure current. UPS units know their battery charge and runtime. Printers count pages and toner. They will all tell you, over SNMP, if something asks — and nothing ever asks.
The usual way to use SNMP is to poll it from a monitoring server. When that server is off-site, it means exposing UDP port 161 to the internet. Do not do that. SNMP v1 and v2c authenticate with a community string sent in the clear, and the protocol is a well-known reflection and amplification vector — it is on the short list of things you should never publish.
So the poll happens where the gear already is. The agent is inside your network and already pushes outbound over 443. It asks the device on the LAN, and only the resulting numbers cross the internet. No inbound rule, no exposed port, no VPN — the community string never leaves your network.
One section. A few reserved keys set up the connection, and every other key is a metric name whose value is the OID to read:
Those arrive as ordinary beacon metrics. Which means they get ordinary alerting — the same thresholds, the same sustained-breach gate, the same incidents and escalation as CPU on a server:
You do not need to learn SNMP to use this. These are standard and work on essentially anything:
| OID | What it is |
|---|---|
1.3.6.1.2.1.1.3.0 | Uptime. A number that went down means the device rebooted — often the most valuable single fact you can collect from network gear. |
1.3.6.1.2.1.2.2.1.8.N | Interface N operational status. 1 is up. Alert on less-than-1. |
1.3.6.1.2.1.2.2.1.10.N | Bytes in on interface N. |
1.3.6.1.2.1.2.2.1.16.N | Bytes out on interface N. |
The N is the interface index, which you find once with snmpwalk against the device and then never think about again. Everything beyond these lives in your vendor’s MIB — PDU current draw, UPS battery runtime, printer toner, chassis temperature.
The temptation with SNMP is to collect everything because it is there. Resist it; a hundred charts nobody reads is not monitoring. The short list that earns its place:
Throughput counters are usually worth charting and not paging on. “The internet feels slow” becomes answerable when you have a month of numbers, and that is a different job from waking someone.
The hardware that has been silently keeping statistics for years starts telling you when something changes — on the same alerting path, status pages and escalation as your servers, with nothing exposed to the internet and nothing installed on the devices themselves.
Start with one switch and the uptime OID. If it reboots at 4 AM you will know, which is more than most networks can say.
The UniFi walkthrough · Simpler reachability probes · Agent documentation
