---
title: Set up SNMP data monitoring
source: https://docs.newrelic.com/docs/network-performance-monitoring/setup-performance-monitoring/snmp-performance-monitoring
---

You can use our guided install process to install the SNMP monitoring agent, or install the agent manually. This doc covers prerequisites to start this install process and a step-by-step walk through of your install options.

## Prerequisites [#prerequisites]

Before you can start, you'll need to [sign up for a New Relic account](https://newrelic.com/signup). If you choose to install the agent manually, you also need:

-   A New Relic [account ID](https://docs.newrelic.com/docs/accounts/accounts-billing/account-setup/account-id).
-   A New Relic license key.

It's recommended to deploy the SNMP monitoring agent as a container for either Docker or Podman. If you need it, you can alternatively install it as a baremetal service in Linux.

**Docker installation prerequisites**

We recommend using a Docker container to deploy the agent for SNMP monitoring. To use it, you need:

-   Docker installed on one of the [Linux platforms supported by Docker](https://docs.docker.com/engine/install/#supported-platforms).
-   Ability to launch new containers via command line.

**Podman installation prerequisites**

If you're using a Podman container to launch the agent, you need:

-   Podman installed on one of the [Linux platforms supported by Podman](https://podman.io/docs/installation#installing-on-linux)
-   Ability to launch new containers via command line

**Baremetal Linux service installation prerequisites**

If you're using Linux to install the agent as a service, you need:

-   SSH access to the host
-   Access to install/remove applications and services
-   One of these supported operating systems:
-   x84_64/amd64-based CPUs:

    -   Debian 12 (Bookworm)
    -   Debian 11 (Bullseye)
    -   Debian 10 (Buster)
    -   RedHat Enterprise Linux 9 up to 9.7
    -   Ubuntu 20.04 (Focal LTS)
    -   Ubuntu 22.04 (Jammy LTS)
    -   Ubuntu 24.04 (Noble LTS)

    > #### ⚠️ IMPORTANT
    >
    > To receive SNMP Traps, the agent must bind to UDP 162. In a host-based install, the following command will be included during the install process. When executed, KTranslate will be run with elevated privileges.
    >
    > ```bash
    > sudo setcap cap_net_bind_service=+ep /usr/bin/ktranslate
    > ```

There are also prerequisites for your network environment and the network devices themselves.

**SNMP devices prerequisites**

You must configure target devices to accept SNMP polling from the agent's host IP address. You can find some samples of basic SNMP configurations here (this is not an all-inclusive list):

-   Cisco
    -   [IOS](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/snmp/configuration/xe-16/snmp-xe-16-book/nm-snmp-cfg-snmp-support.html#GUID-98F0633A-F3BA-4C59-B886-F523099D3AE5)
    -   [NX-OS](https://www.cisco.com/c/en/us/td/docs/switches/datacenter/sw/4_2/nx-os/system_management/configuration/guide/sm_nx_os_cli/sm_9snmp.html#wp1056898)
-   Juniper
    -   [Junos OS](https://www.juniper.net/documentation/us/en/software/junos/network-mgmt/topics/topic-map/configuring-basic-snmp.html)
-   Palo Alto
    -   [PAN-OS](https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-web-interface-help/device/device-setup-operations/enable-snmp-monitoring.html)

**Network security prerequisites**

Check the [network security prerequisites for SNMP](/install/npm).

## Supported SNMP versions [#supported-snmp-versions]

Our network monitoring container supports all major versions of SNMP (v1, v2c, and v3), including both Traps and Informs. Additionally, SNMP v3 has support for the following authentication and privacy settings:

**SNMP v3 options**

| Setting        | Protocol  |
| -------------- | --------- |
| Authentication | `NoAuth`  |
| Authentication | `MD5`     |
| Authentication | `SHA`     |
| Authentication | `SHA224`  |
| Authentication | `SHA256`  |
| Authentication | `SHA384`  |
| Authentication | `SHA512`  |
| Privacy        | `NoPriv`  |
| Privacy        | `DES`     |
| Privacy        | `AES`     |
| Privacy        | `AES192`  |
| Privacy        | `AES256`  |
| Privacy        | `AES192C` |
| Privacy        | `AES256C` |

> #### 💡 TIP
>
> We recommend using read-only community strings/authentication with SNMP.

## Set up SNMP data monitoring in New Relic [#setup-snmp-monitoring]

**Guided install setup**

1.  Go to **[one.newrelic.com > All capabilities](https://one.newrelic.com/all-capabilities) > Add more data**

2.  Scroll down until you see **Network** and click **SNMP**.

3.  Follow the steps outlined in the guided installation process. You can use Docker, Podman, or Linux.

    [Add SNMP data](https://one.newrelic.com/nr1-core?state=c325cbe0-8fdc-107e-ae02-a9576cf57b42)

    ![SNMP guided setup](https://docs.newrelic.com/images/network_screenshot-full_snmp-guided-install.webp "SNMP guided setup")

    **[one.newrelic.com > All capabilities](https://one.newrelic.com/ll-capabilities) > Add more data > Network > SNMP** to set up SNMP data monitoring.

4.  Investigate your network performance data in the New Relic network performance monitoring UI.

**Manual container setup**

Before reading about installing the SNMP agent manually, consider using our guided install process to avoid errors:

[Add SNMP data](https://one.newrelic.com/nr1-core?state=c325cbe0-8fdc-107e-ae02-a9576cf57b42)

### Docker container

1.  On a Linux host with Docker installed, download the **ktranslate** image by running one of the following:

    -   [Docker Hub](https://hub.docker.com/):
        ```shell
        docker pull kentik/ktranslate:v2
        ```
    -   [Quay.io](https://quay.io/):
        ```shell
        docker pull quay.io/kentik/ktranslate:v2
        ```

2.  Copy the `snmp-base.yaml` file to the local `$HOME` directory of your Docker user, and discard the container by running:

    ```shell
    cd ~
    id=$(docker create kentik/ktranslate:v2)
    docker cp $id:/etc/ktranslate/snmp-base.yaml .
    docker rm -v $id
    ```

3.  Edit the `snmp-base.yaml` file and define the `discovery.cidrs` and `discovery.default_communities` attributes to appropriate values for your network.
    We recommend setting discovery.add_mibs: true to automate the addition of all discovered MIBs into the global.mibs_enabled attribute. Additionally, we recommend setting discovery.check_all_ips: true to avoid discovery issues on devices with tightened security postures.

4.  Start the network monitoring agent to poll target devices and listen for incoming SNMP trap messages. Replace `$CONTAINER_SERVICE` with a unique name for the container and substitute`$YOUR_NR_LICENSE_KEY` and `$YOUR_NR_ACCOUNT_ID` with your values:

    ```shell
    docker run -d --name ktranslate-$CONTAINER_SERVICE -\
      -restart unless-stopped --pull=always -p 162:1620/udp \
      -v `pwd`/snmp-base.yaml:/snmp-base.yaml \
      -e NEW_RELIC_API_KEY=$YOUR_NR_LICENSE_KEY \
      kentik/ktranslate:v2 \
      -snmp /snmp-base.yaml \
      -nr_account_id=$YOUR_NR_ACCOUNT_ID \
      -metrics=jchf \
      -tee_logs=true \
      -service_name=$CONTAINER_SERVICE \
      -snmp_discovery_on_start=true \
      -snmp_discovery_min=180 \
      nr1.snmp
    ```

    > #### 💡 TIP
    >
    > It isn't necessary to run a dedicated agent for trap collection as all SNMP polling agents will run a passive listener. By default the container will listen on the host's port 162 (UDP); but you can change the [published port](https://docs.docker.com/network/#published-ports) mapping in the docker run command - `-p 162:1620/udp`.
    > If you want to set up a dedicated container, you can follow the steps in [this section](https://docs.newrelic.com/docs/network-performance-monitoring/setup-performance-monitoring/snmp-performance-monitoring/#optional-installation-for-snmp-traps).

5.  Investigate your network performance data in the New Relic network performance monitoring UI.

### Podman container

1.  On a host with Podman installed, download the **ktranslate** image by running the following command:
    -   [Docker Hub](https://hub.docker.com/):
        ```shell
        podman pull docker.io/kentik/ktranslate:v2
        ```

2.  Copy the `snmp-base.yaml` file to the local `$HOME` directory of your Podman user, and discard the container by running:

    ```shell
    cd ~
    id=$(podman create kentik/ktranslate:v2)
    podman cp $id:/etc/ktranslate/snmp-base.yaml .
    podman rm -v $id
    ```

3.  Edit the `snmp-base.yaml` file and define the `discovery.cidrs` and `discovery.default_communities` attributes to appropriate values for your network.
    We recommend setting discovery.add_mibs: true to automate the addition of all discovered MIBs into the global.mibs_enabled attribute. Additionally, we recommend setting discovery.check_all_ips: true to avoid discovery issues on devices with tightened security postures.

4.  Rootless Podman containers arn't able to bind to ports under 1024. To handle packet redirection for trap messages, you'll need to create an `iptables` rule that targets packets arriving on UDP port 162:
    ```shell
    sudo iptables -t nat -A PREROUTING -p udp --dport 162 -j REDIRECT --to-port 1620
    ```

5.  Start the network monitoring agent to poll target devices and listen for incoming SNMP trap messages. Replace `$CONTAINER_SERVICE` with a unique name for the container and substitute`$YOUR_NR_LICENSE_KEY` and `$YOUR_NR_ACCOUNT_ID` with your values:
    ```shell
    podman run -d --name ktranslate-$CONTAINER_SERVICE \
      --userns=keep-id --restart unless-stopped --pull=always --net=host \
      -v `pwd`/snmp-base.yaml:/snmp-base.yaml \
      -e NEW_RELIC_API_KEY=$YOUR_NR_LICENSE_KEY \
      kentik/ktranslate:v2 \
      -snmp /snmp-base.yaml \
      -nr_account_id=$YOUR_NR_ACCOUNT_ID \
      -metrics=jchf \
      -tee_logs=true \
      -service_name=$CONTAINER_SERVICE \
      -snmp_discovery_on_start=true \
      -snmp_discovery_min=180 \
      nr1.snmp
    ```
    > #### 💡 TIP
    >
    > It isn't necessary to run a dedicated agent for trap collection as all SNMP polling agents will run a passive listener. By default, the container will listen on the host's port 162 (UDP), but you can change the [published port](https://docs.docker.com/network/#published-ports) mapping in the docker run command - `-p 162:1620/udp`.
    > If want to set up a dedicated container, you can follow the steps in [this section](https://docs.newrelic.com/docs/network-performance-monitoring/setup-performance-monitoring/snmp-performance-monitoring/#optional-installation-for-snmp-traps).

6.  Investigate your network performance data in the New Relic network performance monitoring UI.

### Linux service

1.  Depending on your package manager, use one of the commands below to install `ktranslate`

-   Yum:
    ```shell
    curl -s https://packagecloud.io/install/repositories/kentik/ktranslate/script.rpm.sh | sudo bash && \
      sudo yum install ktranslate
    ```
-   Apt:
    ```shell
    curl -s https://packagecloud.io/install/repositories/kentik/ktranslate/script.deb.sh | sudo bash && \
      sudo apt-get install ktranslate
    ```

2.  Define the environment variables used by `ktranslate`:

    ```shell
    sudo tee "/etc/default/ktranslate.env" > /dev/null <<'EOF'
    NR_ACCOUNT_ID=$YOUR_NR_ACCOUNT_ID
    NEW_RELIC_API_KEY=$YOUR_NR_LICENSE_KEY
    KT_FLAGS="-snmp /etc/ktranslate/snmp-base.yaml \
      -metrics=jchf \
      -tee_logs=true \
      -service_name=$CONTAINER_SERVICE \
      -snmp_discovery_on_start=true \
      -snmp_discovery_min=180 \
      nr1.snmp"
    EOF

    # ensure /etc/default/ktranslate.env is owned by ktranslate user
    sudo chown ktranslate:ktranslate /etc/default/ktranslate.env

    # Ktranslate listens for SNMP Traps on privileged port 162. Allow ktranslate to bind to this port with the following command
    sudo setcap cap_net_bind_service=+ep /usr/bin/ktranslate
    ```

3.  If you don't have an existing `snmp-base.yaml` configuration file, create one with:

    ```shell
    sudo tee "/etc/ktranslate/snmp-base.yaml" > /dev/null <<'EOF'
    devices: {}
    trap:
      listen: '0.0.0.0:162'
    discovery:
      cidrs:
        - x.x.x.x/yy
      ignore_list: []
      debug: false
      ports:
        - 161
      default_communities:
        - public
      default_v3: null
      add_devices: true
      add_mibs: true
      threads: 4
      replace_devices: true
      check_all_ips: true
      use_snmp_v1: false
    global:
      poll_time_sec: 300
      mib_profile_dir: /etc/ktranslate/profiles
      mibs_enabled:
        - IF-MIB
      timeout_ms: 3000
      retries: 0
    EOF

    # ensure /etc/ktranslate/snmp-base.yaml is owned by ktranslate user
    sudo chown ktranslate:ktranslate /etc/ktranslate/snmp-base.yaml
    ```

4.  Edit the `snmp-base.yaml` file and define the `discovery.cidrs` and `discovery.default_communities` attributes to appropriate values for your network.
    We recommend to set discovery.add_mibs: true to automate the addition of all discovered MIBs into the global.mibs_enabled attribute. Additionally, it is recommended to set discovery.check_all_ips: true to avoid discovery issues on devices with tightened security postures.

5.  Restart the `ktranslate` service to apply your changes to the `snmp-base.yaml` file:
    ```shell
    sudo systemctl restart ktranslate
    ```

6.  Investigate your network performance data in the New Relic network performance monitoring UI.

### Optional installation for SNMP Traps

In some circumstances, it's beneficial to isolate the collection of SNMP trap messages into a dedicated container. This is helpful to control scale in large environments as well as creating a distributed monitoring footprint with lower risk of full outages if a container fails. This process is not supported with the Linux service installation.

Note: You cannot monitor both `v2c` and `v3` traps with the same container. If you want to monitor both trap versions, you'll need to launch a secondary dedicated container and configure your trap messages to be sent on a non-default port. For example, if you have `v2c` traps already set up on port `162`:

1.  Configure your `v3` traps to be sent over another port such as `163`.
2.  Change the Docker container's arguments slightly, from `-p 162:1620/udp` to `-p $src:1620/udp` where `$src` is the port your `v3` traps are arriving on.

**Manual container setup for SNMP traps**

#### Docker container

1.  On a Linux host with Docker installed, create the configuration file you'll use to run the container:

    ```shell
    tee "./traps-base.yaml" > /dev/null <<'EOF'
    devices: {}
    trap:
      listen: '0.0.0.0:1620'
    discovery: {}
    global:
      poll_time_sec: 300
      timeout_ms: 30000
    EOF
    ```

    By default the container will use the source IP address as device names in New Relic. You can control this by mapping devices manually in your configuration file:

    ```yaml
    devices:
      # This key and the corresponding 'device_name'
      # need to be unique for each device
      trap_device1:
        device_name: trap_device1
        device_ip: x.x.x.x/yy
        provider: kentik-trap-device
    trap:
      listen: '0.0.0.0:1620'
    discovery: {}
    global:
      poll_time_sec: 300
      timeout_ms: 30000
    ```

    > #### 💡 TIP
    >
    > You can also control device names by providing a [-dns container argument](https://docs.newrelic.com/docs/network-performance-monitoring/advanced/ktranslate-container-management/#container-runtime-options) at runtime. This will allow the container to run a lookup on the source IP address and try name resolution.

2.  Start the network monitoring agent to listen for incoming SNMP trap messages. Replace `$CONTAINER_SERVICE` with a unique name for the container and substitute`$YOUR_NR_LICENSE_KEY` and `$YOUR_NR_ACCOUNT_ID` with your values:

    ```shell
    docker run -d --name ktranslate-$CONTAINER_SERVICE -\
      -restart unless-stopped --pull=always -p 162:1620/udp \
      -v `pwd`/traps-base.yaml:/snmp-base.yaml \
      -e NEW_RELIC_API_KEY=$YOUR_NR_LICENSE_KEY \
      kentik/ktranslate:v2 \
      -snmp /snmp-base.yaml \
      -nr_account_id=$YOUR_NR_ACCOUNT_ID \
      -metrics=jchf \
      -tee_logs=true \
      -service_name=$CONTAINER_SERVICE \
      nr1.snmp
    ```

    This will start a container that will listen for SNMP trap messages on port `162/udp`.

3.  Investigate your results in New Relic by querying the `KSnmpTrap` event type:

    ```sql
    FROM KSnmpTrap SELECT *
    ```

    > #### 💡 TIP
    >
    > It's important to remember that SNMP trap messages are events generated by the source device. If you aren't seeing messages in New Relic, ensure your devices have actually created messages. Vendor documentation on sending sample messages varies, but you can use [snmptrap](http://www.net-snmp.org/docs/man/snmptrap.html) on your Docker host to send a test message like this:
    >
    > ```shell
    > snmptrap -v 2c -c public localhost '' 1.3.6.1.4.1.8072.2.3.0.1 1.3.6.1.4.1.8072.2.3.2.1 i 123456
    > ```

#### Podman container

1.  On a Linux host with Docker installed, create the configuration file you'll use to run the container:

    ```shell
    tee "./traps-base.yaml" > /dev/null <<'EOF'
    devices: {}
    trap:
      listen: '0.0.0.0:1620'
    discovery: {}
    global:
      poll_time_sec: 300
      timeout_ms: 30000
    EOF
    ```

    By default the container will use the source IP address as device names in New Relic. You can control this by mapping devices manually in your configuration file:

    ```yaml
    devices:
      # This key and the corresponding 'device_name'
      # need to be unique for each device
      trap_device1:
        device_name: trap_device1
        device_ip: x.x.x.x/yy
        provider: kentik-trap-device
    trap:
      listen: '0.0.0.0:1620'
    discovery: {}
    global:
      poll_time_sec: 300
      timeout_ms: 30000
    ```

    > #### 💡 TIP
    >
    > You can also control device names by providing a [-dns container argument](https://docs.newrelic.com/docs/network-performance-monitoring/advanced/ktranslate-container-management/#container-runtime-options) at runtime. This will allow the container to run a lookup on the source IP address and try name resolution.

2.  Rootless Podman containers are not able to bind to ports under 1024. To handle packet redirection for trap messages, you will need to create an `iptables` rule that targets packets arriving on UDP port 162:
    ```shell
    sudo iptables -t nat -A PREROUTING -p udp --dport 162 -j REDIRECT --to-port 1620
    ```

3.  Start the network monitoring agent to listen for incoming SNMP trap messages. Replace `$CONTAINER_SERVICE` with a unique name for the container and substitute`$YOUR_NR_LICENSE_KEY` and `$YOUR_NR_ACCOUNT_ID` with your values:
    ```shell
    podman run -d --name ktranslate-$CONTAINER_SERVICE \
      --userns=keep-id --restart unless-stopped --pull=always --net=host \
      -v `pwd`/traps-base.yaml:/snmp-base.yaml \
      -e NEW_RELIC_API_KEY=$YOUR_NR_LICENSE_KEY \
      kentik/ktranslate:v2 \
      -snmp /snmp-base.yaml \
      -nr_account_id=$YOUR_NR_ACCOUNT_ID \
      -metrics=jchf \
      -tee_logs=true \
      -service_name=$CONTAINER_SERVICE \
      nr1.snmp
    ```

4.  Investigate your results in New Relic by querying the `KSnmpTrap` event type:

    ```sql
    FROM KSnmpTrap SELECT *
    ```

    > #### 💡 TIP
    >
    > It's important to remember that SNMP trap messages are events generated by the source device. If you aren't seeing messages in New Relic, ensure your devices have actually created messages. Vendor documentation on sending sample messages varies, but you can use [snmptrap](http://www.net-snmp.org/docs/man/snmptrap.html) on your Docker host to send a test message like this:
    >
    > ```shell
    > snmptrap -v 2c -c public localhost '' 1.3.6.1.4.1.8072.2.3.0.1 1.3.6.1.4.1.8072.2.3.2.1 i 123456
    > ```

## What's next

You can set up more agents to complement your SNMP data:

-   To get better visibility into how your network is used, [set up network flow data monitoring](https://docs.newrelic.com/docs/network-performance-monitoring/setup-performance-monitoring/network-flow-monitoring).
-   To get insights into system messages from your devices, [setup network syslog collection](https://docs.newrelic.com/docs/network-performance-monitoring/setup-performance-monitoring/network-syslog-monitoring).