Edge Delta SNMP Trap Source

The SNMP Trap source node enables Edge Delta to receive and process SNMP trap notifications from network devices and infrastructure components.

21 minute read

Overview

The SNMP Trap source node enables Edge Delta to receive and process SNMP trap notifications sent from network devices, servers, applications, and infrastructure components. It acts as a trap receiver (trap daemon) that listens for unsolicited SNMP notifications over UDP, supporting SNMPv1, SNMPv2c, and SNMPv3 trap formats. This allows you to capture real-time alerts and events from your entire infrastructure without actively polling devices. Unlike the SNMP Pull source which actively polls devices at intervals, SNMP Trap passively receives notifications when devices detect events.

AI Team: Configure this source using the SNMP Trap connector for streamlined setup in AI Team.

outgoing_data_types: log

The SNMP Trap source node is ideal for:

Network Device Monitoring: Receive alerts from routers, switches, firewalls, and wireless controllers
Infrastructure Alerting: Capture temperature, power, and hardware failure notifications
Application Event Collection: Gather custom traps from SNMP-enabled applications
Security Event Monitoring: Collect authentication failures and security violations
Environmental Monitoring: Receive alerts from UPS systems, cooling units, and sensors

Field Mapping

The SNMP Trap source node extracts and maps the following fields from incoming trap messages:

SNMP Field	Attribute Name	Description
Version	`snmp.version`	SNMP version (1 or 2c)
PDU Type	`snmp.pdu.type`	Protocol Data Unit type (Trap, SNMPv2Trap)
Source IP	`network.peer.ip`	IP address of the trap sender
Variables	`snmp.varbinds`	Variable bindings as OID-value pairs
Variable Count	`snmp.variables.count`	Number of variables in the trap
Request ID	`snmp.request.id`	Request identifier (v2c only)
Enterprise OID	`snmp.enterprise_oid`	Enterprise identifier (v1 only)
Generic Trap	`snmp.generic_trap`	Generic trap type number (v1 only)
Generic Trap Name	`snmp.generic_trap_name`	Human-readable trap type (v1 only)
Specific Trap	`snmp.specific_trap`	Enterprise-specific trap number (v1 only)
Agent Address	`snmp.agent.address`	Agent IP address (v1 only)
Trap OID	`snmp.trap_oid`	Combined trap identifier (v1 only)

SNMP Version Selection

The SNMP Trap source node supports multiple protocol versions to accommodate different security and compatibility requirements:

SNMP v1:

Legacy protocol with basic trap support
Simple community-based authentication
Widely supported across older network devices
Suitable for legacy infrastructure monitoring

SNMP v2c (default):

Enhanced trap format with inform capability
Community-based authentication using a shared password
Widely supported across network devices
Suitable for internal networks with basic security needs

SNMP v3:

Enhanced security with user-based authentication
Supports encryption for data privacy (AES, DES)
Multiple authentication protocols (MD5, SHA family)
Authoritative engine ID for secure trap ingestion
Recommended for production environments and sensitive data
Required when monitoring across untrusted networks

Choose v1 or v2c for quick setup and legacy device compatibility. Use v3 when security is a priority or when compliance requirements mandate encrypted communications.

Trap Type Mapping

SNMPv1 generic trap types are automatically mapped to descriptive names:

Generic Trap	Name	Description
0	coldStart	Agent reinitialized with configuration changes
1	warmStart	Agent reinitialized without configuration changes
2	linkDown	Network interface went down
3	linkUp	Network interface came up
4	authenticationFailure	Authentication attempt failed
5	egpNeighborLoss	EGP neighbor relationship lost
6	enterpriseSpecific	Vendor-specific trap

Example Configurations

Basic Configuration

This minimal configuration uses all default settings to receive SNMP traps. The node automatically listens on the standard SNMP trap port and accepts traps from any source.

nodes:
- name: snmp_trap_receiver
  type: snmp_trap_input

Custom Port Configuration

For environments where the standard trap port is unavailable or when running without elevated privileges, specify a custom port above 1024.

nodes:
- name: snmp_trap_custom_port
  type: snmp_trap_input
  port: 1162
  listen: "0.0.0.0"
  transport: udp

Advanced Configuration with Community String

This configuration demonstrates advanced options including community string validation and specific network interface binding.

nodes:
- name: snmp_trap_secure
  type: snmp_trap_input
  port: 162
  listen: "10.0.0.100"
  transport: udp
  community: "secret-community"
  source_metadata: true

SNMPv3 Secure Configuration

This configuration demonstrates enterprise-grade SNMPv3 trap reception with authentication and encryption. It includes SHA-256 authentication and AES-256 encryption for secure trap ingestion from devices across untrusted networks.

nodes:
- name: snmp_trap_v3_secure
  type: snmp_trap_input
  port: 162
  listen: "0.0.0.0"
  transport: udp
  version: v3
  user: snmp_admin
  security_level: auth_priv
  auth_type: sha256
  auth_password: my_auth_password
  privacy_type: aes256
  privacy_password: my_priv_password
  engine_id: "80001f8880c6127623566ce6a064"

Example Output

When SNMP traps are received, they are parsed and converted into structured log items. Below are examples showing the raw trap sent and the resulting processed data item.

SNMPv2c Cold Start Trap

Raw trap sent:

snmptrap -v 2c -c public <edge-delta-host> '' \
  1.3.6.1.6.3.1.1.5.1 \
  1.3.6.1.6.3.1.1.5.1 s "coldStart trap from router"

Processed data item in pipeline:

{
  "_type": "log",
  "timestamp": 1756958216967,
  "body": "SNMP 2c trap from 10.244.0.20",
  "resource": {
    "ed.source.name": "snmp_trap_receiver",
    "ed.source.type": "snmp_trap_input",
    "host.ip": "172.19.0.2",
    "host.name": "edge-delta-agent",
    "service.name": ""
  },
  "attributes": {
    "network.peer.ip": "10.244.0.20",
    "snmp.pdu.type": "SNMPv2Trap",
    "snmp.request.id": 2112302011,
    "snmp.varbinds": {
      ".1.3.6.1.2.1.1.3.0": {
        "centiseconds": 3522368,
        "duration": "9h47m3.68s",
        "seconds": 35223.68
      },
      ".1.3.6.1.6.3.1.1.4.1.0": ".1.3.6.1.6.3.1.1.5.1",
      ".1.3.6.1.6.3.1.1.5.1": "coldStart trap from router"
    },
    "snmp.variables.count": 3,
    "snmp.version": "2c"
  },
  "observed_timestamp": 1756958216990
}

SNMPv1 Enterprise-Specific Trap

Raw trap sent:

snmptrap -v 1 -c public <edge-delta-host> \
  1.3.6.1.4.1.9 192.168.1.1 6 33 100 \
  1.3.6.1.2.1.2.2.1.1 i 1

Processed data item in pipeline:

{
  "_type": "log",
  "timestamp": 1756958229890,
  "body": "SNMP trap enterpriseSpecific from 10.244.0.20",
  "resource": {
    "ed.source.name": "snmp_trap_receiver",
    "ed.source.type": "snmp_trap_input",
    "host.ip": "172.19.0.2",
    "host.name": "edge-delta-agent",
    "service.name": ""
  },
  "attributes": {
    "network.peer.ip": "10.244.0.20",
    "snmp.agent.address": "192.168.1.1",
    "snmp.enterprise_oid": ".1.3.6.1.4.1.9",
    "snmp.generic_trap": 6,
    "snmp.generic_trap_name": "enterpriseSpecific",
    "snmp.pdu.type": "Trap",
    "snmp.specific_trap": 33,
    "snmp.trap_oid": ".1.3.6.1.4.1.9.0.33",
    "snmp.varbinds": {
      ".1.3.6.1.2.1.2.2.1.1": 1
    },
    "snmp.variables.count": 1,
    "snmp.version": "1"
  },
  "observed_timestamp": 1756958229910
}

Temperature Alert Trap

Raw trap sent:

snmptrap -v 2c -c public <edge-delta-host> '' \
  1.3.6.1.4.1.9.9.13.1.3.0.2 \
  1.3.6.1.4.1.9.9.13.1.3.0.2 s "Temperature threshold exceeded: 85C"

Processed data item in pipeline:

{
  "_type": "log",
  "timestamp": 1756958222627,
  "body": "SNMP 2c trap from 10.244.0.20",
  "resource": {
    "ed.source.name": "snmp_trap_receiver",
    "ed.source.type": "snmp_trap_input",
    "host.ip": "172.19.0.2",
    "host.name": "edge-delta-agent",
    "service.name": ""
  },
  "attributes": {
    "network.peer.ip": "10.244.0.20",
    "snmp.pdu.type": "SNMPv2Trap",
    "snmp.request.id": 786929287,
    "snmp.varbinds": {
      ".1.3.6.1.2.1.1.3.0": {
        "centiseconds": 3522935,
        "duration": "9h47m9.35s",
        "seconds": 35229.35
      },
      ".1.3.6.1.4.1.9.9.13.1.3.0.2": "Temperature threshold exceeded: 85C",
      ".1.3.6.1.6.3.1.1.4.1.0": ".1.3.6.1.4.1.9.9.13.1.3.0.2"
    },
    "snmp.variables.count": 3,
    "snmp.version": "2c"
  },
  "observed_timestamp": 1756958222650
}

Required Parameters

name

A descriptive name for the node. This is the name that will appear in pipeline builder and you can reference this node in the YAML using the name. It must be unique across all nodes. It is a YAML list element so it begins with a - and a space followed by the string. It is a required parameter for all nodes.

nodes:
  - name: <node name>
    type: <node type>

type: snmp_trap_input

The type parameter specifies the type of node being configured. It is specified as a string from a closed list of node types. It is a required parameter.

nodes:
  - name: <node name>
    type: <node type>

Optional Parameters

port

The port parameter specifies the UDP port to listen on for incoming SNMP traps. The standard SNMP trap port is 162, but this requires elevated privileges. Common alternative ports include 1162 for unprivileged operation. If not specified, the node uses its default port configuration.

It is specified as an integer and is optional.

nodes:
  - name: <node name>
    type: snmp_trap_input
    port: 1162

listen

The listen parameter specifies the IP address to bind to for listening. Use “0.0.0.0” to listen on all network interfaces, or specify a particular IP address to restrict trap reception to a specific interface. Default is “0.0.0.0”.

It is specified as a string and is optional.

nodes:
  - name: <node name>
    type: snmp_trap_input
    listen: "0.0.0.0"

transport

The transport parameter specifies the transport protocol for receiving traps. SNMP traps are always sent via UDP according to the SNMP specification. This parameter defaults to “udp” and should not be changed.

It is specified as a string and is optional.

nodes:
  - name: <node name>
    type: snmp_trap_input
    transport: udp

version

The version parameter specifies the SNMP protocol version to use. Valid options are:

v1: SNMP version 1
v2c: SNMP version 2c (default)
v3: SNMP version 3 with enhanced security

It is specified as a string and is optional.

nodes:
  - name: <node name>
    type: snmp_trap_input
    version: v2c

community

The community parameter specifies the SNMP community string to validate incoming traps. If set, only traps with matching community strings will be accepted. If not specified, traps with any community string are accepted. This provides basic authentication for trap sources. This parameter is required when using SNMP v1 or v2c.

It is specified as a string and is optional when using v3.

nodes:
  - name: <node name>
    type: snmp_trap_input
    community: "public"

user

YAML Only

The user parameter specifies the SNMP v3 username. This parameter is required when using SNMP version 3. It is specified as a string.

nodes:
  - name: <node name>
    type: snmp_trap_input
    version: v3
    user: snmp_user