Pure-Python SNMP. Brewing free software for the greater good.

An engine that speaks SNMP v1, v2c and v3, and a MIB distribution that lets it talk about managed objects by name instead of by number. No C extensions and no Net-SNMP bindings -- Python all the way down, on Python 3.10 and later.

pysnmp and mibs are what you use. pysmi and pyasn1 are the layers underneath; pysnmp reaches them for you.

$ pip install 'pysnmplib[compile]'

The compile extra pulls in pysmi, the MIB compiler. Without it pysnmp still speaks SNMP -- it ships the standard modules an engine resolves at start-up -- but it cannot read a MIB it does not already have, and reading those is most of what makes SNMP legible.

import asyncio

from pysnmp.hlapi.asyncio import *


async def run():
    snmpEngine = SnmpEngine()
    errorIndication, errorStatus, errorIndex, varBinds = await getCmd(
        snmpEngine,
        CommunityData("public", mpModel=0),
        UdpTransportTarget(("localhost", 161)),
        ContextData(),
        ObjectType(ObjectIdentity("SNMPv2-MIB", "sysDescr", 0)),
    )

    for varBind in varBinds:
        print(" = ".join(x.prettyPrint() for x in varBind))

    snmpEngine.transportDispatcher.closeDispatcher()


asyncio.run(run())

More of these, for managers, agents, proxies and notification receivers, are in the examples directory and on the documentation site.

pysnmp is the engine: message processing for v1, v2c and v3, USM authentication and privacy, VACM access control, the transport dispatcher, and the high-level API above all of it.

mibs supplies the module definitions. It is a distribution, though not one pip resolves: use it live over HTTPS, or install it locally from the archive or an OCI image. It is what turns .1.3.6.1.2.1.2.2.1.8.1 = 2 into IF-MIB::ifOperStatus.1 = down. Optional: an engine starts without it, on the standard modules pysnmp ships.

pysmi compiles the ASN.1 sources those modules are written in. pysnmp drives it; you call it directly, as mibdump, to compile MIBs outside an engine.

pyasn1 encodes and decodes -- BER on the wire, CER and DER where a representation has to be reproducible byte for byte. Normal use never reaches it by hand.

Resolving a name and translating a trap, end to end, are on the site.

The toolchain is shared, so moving between repositories costs nothing:

• uv for environments, with a committed lockfile; uv sync --locked reproduces exactly what CI runs.
• ruff for lint and formatting against one shared rule set, enforced by pre-commit and again in CI. Where there is a package to type-check, mypy as well; where there is behaviour to test, pytest.
• Conventional Commits, checked on every pull request everywhere. In the three that publish a package they are also load-bearing: semantic-release computes the version and the release notes from them.
• In those three, main carries the released line and next is where work integrates; a release candidate is cut from next, a GA from main. This repository and the site publish nothing, so they have only main.

CONTRIBUTING.md has the details, and applies to every repository here.

Report a vulnerability privately through GitHub Security Advisories, not in a public issue. SECURITY.md says what is supported and what to expect.

SNMPv1 and SNMPv2c have no security by design, and SNMPv3 still specifies MD5, SHA-1 and DES. pysnmp implements them because the protocol does and warns where one is configured; that is not a vulnerability report.

These are forks of Ilya Etingof's work, carried on after he passed away on 10 August 2022. The PySNMP project was originally sponsored by a PSF grant. Everything here stays under the 2-clause BSD license it always had.