AJapps

SNMP Helper — OID Decoder, snmpwalk Analyser, SNMPv3

Understand SNMP without a network background: decode an OID, paste an snmpwalk from a switch to get a port table with errors, duplex problems and down links, and check SNMPv3 security settings before configuring the switch and the management system.

OID decoder

ifInErrors

MIBIF-MIB
MeaningReceived packets with errors (CRC, alignment): a cabling, SFP or duplex problem.

Instance 4: the row index (for interface tables, the ifIndex).

SNMPv3 settings

SNMPv3 assessment

  • OKSHA-1 (HMAC-SHA-96) is the most widely supported option; SHA-2 (RFC 7860) is stronger where both ends support it.
  • OKAES-128 privacy: traffic is encrypted.
  • OKBoth ends must match exactly: user name, security level, authentication protocol and password, privacy protocol and password. A mismatch gives time-outs or 'unknown user name' / 'wrong digest' errors and often an authenticationFailure trap.

Polls use UDP 161 to the device; traps and informs use UDP 162 to the management system. Use SNMPv3 or, if v2c is unavoidable, a non-default read-only community restricted to the management system's address.

snmpwalk output

Device

sysDescrIndustrial Ethernet switch, 8 ports, firmware 6.2
sysUpTime3 d 0 h 0 min 0 s
sysNameSW2
sysLocationControl building, panel +S03

Ports

PortDescriptionSpeedStateIn errOut discDuplex
port1GW1100 Mb/sup00—
port2HMI1100 Mb/sdown00—
port3GPS1100 Mb/sup00—
port4BCU_J0110 Mb/sup18430half
port8Uplink SW11000 Mb/sup0212—

Findings

  • Checkport2 (HMI1): enabled but down — no link. Expected if nothing is connected; a fault if a device should be there.
  • Checkport4: 1843 receive errors (CRC/FCS). Check the cable, connectors or SFP and the duplex setting. Counters are totals since the last reset — read them twice, some minutes apart, to see whether they are still rising.
  • Problemport4: half duplex, 37 late collisions — a duplex mismatch. Set both ends to auto-negotiation (or both to the same fixed speed and duplex).
  • Checkport4: running at 10 Mb/s. A 10 Mb/s link to an IED or switch usually means a negotiation problem or a damaged cable pair.
  • Noteport8: 212 output discards — the port's queue overflowed (congestion or bursts, for example sampled values or a GOOSE avalanche).
  • NoteSpanning tree has changed topology 14 times since the switch started. Frequent changes flush MAC tables and flood traffic; look for a flapping port or a device that bridges two ports.
Tool guide · know before you use

What this tool is, how it works and how far to trust it

A helper for SNMP: an OID decoder, an analyser for snmpwalk output from switches and devices, and an SNMPv3 settings check.

Read this before relying on a result. Every method, formula, assumption and limit is stated here, so you can check the answer yourself instead of accepting it blindly.

What it can do

  • Decode common OIDs (system, interfaces, EtherLike, bridge, VLAN, LLDP, entity, host resources, standard traps) and identify vendor OIDs.
  • Turn an snmpwalk into a port table and flag down links, CRC errors, duplex mismatches, 10 Mb/s links, output discards and spanning-tree changes; list LLDP neighbours.
  • Assess SNMPv3 security level and protocols and list what both ends must match.

Why you need it

  • Switch port counters reveal most cabling and port faults without waiting for the network team.
  • SNMP configuration errors (wrong version, user or protocol) are a common reason monitoring shows devices as down.

Understand this first

  • Interface counters are totals since the last reset: compare two readings some minutes apart to see whether errors are still rising.
  • An OID ends with an instance: .0 for single values, the interface index for table rows.
  • SNMPv1/v2c communities travel in clear text; SNMPv3 authPriv authenticates and encrypts.

What you need before you start

  • An snmpwalk of the device (from the management system or a read-only command such as snmpwalk -v2c -c <community> <address> 1.3.6.1.2.1), in named or numeric form.
  • Or an OID from a trap, alarm or manual.
  • A current browser (Chrome, Edge, Firefox or Safari). Nothing is installed and your data is never uploaded; it is processed on your own computer.

How to use it

  • Paste an OID to see what it is.
  • Paste an snmpwalk (or load the sample switch) and read the port table and findings.
  • Choose the SNMPv3 settings planned for the switch and the management system and read the assessment.

What you get

  • The OID meaning and instance; device information, port table, LLDP neighbours and findings; an SNMPv3 assessment.

How to read the results

  • Rising CRC errors on one port: replace the patch cord or SFP, then check again.
  • Half duplex or late collisions: fix negotiation on both ends.
  • Output discards: the port is congested — check the traffic (multicast filtering, bandwidth).

Technical basis

  • SNMPv2-MIB, IF-MIB (RFC 2863), EtherLike-MIB (RFC 3635), BRIDGE-MIB (RFC 4188), Q-BRIDGE-MIB (RFC 4363), LLDP-MIB (IEEE 802.1AB), ENTITY-MIB (RFC 6933), HOST-RESOURCES-MIB (RFC 2790), SNMPv3 USM (RFC 3414), AES (RFC 3826), SHA-2 (RFC 7860).

Limits: when not to rely on it

  • It does not poll devices (a browser cannot send SNMP); it analyses output you paste.
  • Vendor-private OIDs need the vendor's MIB file.

For preliminary engineering use. Results must be checked by a qualified engineer against the project's standards. How results are checked · Terms & disclaimer · Build 5da9168 · 2026-11-13