Network devices and SNMP

SNMP supplies the device’s own view of its interfaces and resources. RouteSpear combines those polls with machine identity and other measurements, so an investigation can move from an affected address to the device, port, and counters that describe it.

Use a SNMP check for a known target or SNMP Discovery to maintain checks for responding devices in selected IPv4 subnets. Devices can include switches, routers, access points, servers, printers, and UPS equipment; available sections depend on the MIBs each device implements and allows you to read.

Start with one device

1. Open Configure → Test management → New test and select SNMP.
2. Choose an agent that can reach the device’s management address and SNMP port.
3. Enter the target, port, and SNMP version. Versions 1 and 2c use a community; version 3 adds a username and authentication/privacy settings. Auth and privacy passphrases come from the agent-local credential reference. See secrets for supported credential sources.
4. Leave the standard collection enabled and choose the optional sections needed for the device. Start with the default 60-second polling interval.
5. Save and verify a successful test result. After inventory processing, find the target under Monitor → Infrastructure → Machines and open Device.

Use a read-only device account with access to the required MIBs. A successful basic response does not establish that every optional table is readable.

Discover a subnet

For SNMP Discovery, enter the IPv4 CIDRs to scan, one per line, and the credential settings that responding devices should use. The discovery process creates and maintains individual SNMP checks for the devices it finds.

Two intervals have different jobs:

• Discovery interval controls subnet sweeps, with a default of five minutes.
• Device polling interval controls the generated SNMP checks, with a default and minimum of one minute. Changes apply to existing discovered checks as well as new ones after the next discovery sync with a fresh sweep.

The credential, custom OIDs, and optional collection choices are passed to the generated device checks. Appearance in Infrastructure follows discovery sync, the first device poll, and inventory processing; it can take a few minutes.

Read interface behavior

The Interfaces section shows the device’s ports, states, speed, traffic, errors, and discards. Names are resolved from the device’s own interface data. Virtual interfaces are hidden by default; use Show virtual to include them.

Counters are cumulative, while rate columns describe the change between polls. Rates need two usable polls. Counter resets or unavailable counter data can leave a rate absent, and counter-width hints matter on devices with older counters.

Inspect both administrative and operational state when investigating a down port. A deliberately disabled port and an enabled port that cannot establish a link are different situations. Compare traffic with reported interface speed, then examine errors and discards over the same period.

Follow the device’s network context

Optional device sections expose the information behind an address or cable:

• Neighbours: LLDP and CDP announcements, including local port and the remote system and port identifiers the neighbour reported.
• Learned addresses: the forwarding database, showing learned MAC addresses and their associated ports where available.
• ARP: IP-to-hardware-address entries reported by the device.
• VLANs: the VLAN information returned by its bridge tables.
• IP stack: supported IP, TCP, and UDP stack counters.

For an endpoint problem, start from its observed IP or MAC, use ARP and learned addresses to identify a candidate port, then inspect that port’s state and counters. Neighbour announcements can add context about the connected switch. These are observations at their respective poll times; a learned address alone does not prove a complete physical path.

Inspect hardware and device-specific health

RouteSpear goes beyond interface polling when the device supplies the data:

• Hardware: chassis and physical inventory, including reported vendor, model, serial, and component hierarchy.
• Sensors: supported ENTITY-MIB sensor readings and status.
• Storage: capacity and usage reported through host resources.
• Processes: process and user counts, plus optional process names, CPU, and memory. The per-process list is bounded and can be expensive on some devices.
• Printer: supply levels, page counts, printer alerts, and detected error states. A missing capacity does not become a fabricated supply percentage.
• UPS: battery condition, charge and runtime information, output source, and supported electrical/load readings.
• Custom OIDs: up to 50 operator-defined OIDs for measurements beyond the standard sections.

Use Collect bridge tables, Collect topology, Collect inventory, Collect IP stack, Collect device class, and Collect processes to control the work performed. Optional sections appear when the poll supplies their data or relevant truncation information; every device need not have every section.

Combine device and path evidence

If Path Health shows a change toward a service, find the relevant device and interface using the identity evidence. Compare its poll times, utilization, errors, and discards with the affected path window.

This can strengthen or challenge an explanation. It does not make an SNMP counter the packet-loss rate of a particular probe flow, and a router’s management address need not be the interface responding to those probes.

When a section is empty

Check whether the device implements the MIB, whether the account can read it, whether collection is enabled, and whether the poll had time to finish. The Poll budget limits optional collection. A Not polled: poll budget exhausted notice means those sections were skipped, not that the device reported empty tables. Adjust the budget or selected sections to match the device and collection interval.

For a failed poll, inspect its recorded error and verify reachability, version, port, and credentials. For missing rates, wait for a second successful poll and check for a reboot or counter reset. Continue with Infrastructure troubleshooting.