As I understand, SNMP Management Information Base databases are used by Network Management Stations to translate data from SNMP agents into understandable form. For example in case of sysUpTimeInstance:

$ snmpwalk -v 2c -c public sysUpTimeInstance
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (28267576) 3 days, 6:31:15.76

..I guess it is thanks to MIB that 28267576 is converted into 3 days, 6 hours, 31 minutes, 15.76 seconds? Now I searched for the correct MIB file to see this translation:

$ grep -ir sysUpTimeInstance /usr/local/share/smi/mibs/
/usr/local/share/smi/mibs/ietf/DISMAN-EVENT-MIB:sysUpTimeInstance OBJECT IDENTIFIER ::= { sysUpTime 0 }
/usr/local/share/smi/mibs/ietf/DISMAN-EVENT-MIB:    DEFVAL { sysUpTimeInstance }
/usr/local/share/smi/mibs/ietf/DISMAN-EXPRESSION-MIB:sysUpTimeInstance OBJECT IDENTIFIER ::= { sysUpTime 0 }
/usr/local/share/smi/mibs/ietf/DISMAN-EXPRESSION-MIB:    DEFVAL      { sysUpTimeInstance }

..and looks like it is defined in /usr/local/share/smi/mibs/ietf/DISMAN-EVENT-MIB file. How should I understand this sysUpTimeInstance OBJECT IDENTIFIER ::= { sysUpTime 0 }?


It can be very tedious to chain it back manually. There are tools such as snmptranslate to do this sort of thing for you. Try snmptranslate -M /path/to/mibs -m ALL -Pu -Tso|grep -B1 sysUpTimeInstance. To see the full details for sysUpTime, use snmptranslate -Td -OS .iso.org.dod.internet.mgmt.mib-2.system.sysUpTime This will show you that it is measured in TimeTicks.

But to answer your question, MIB files are written in ASN.1 where each object can build on all previous objects. Among other things, like descriptions and object types, etc, it builds OIDs, aka Object IDenifiers which map OIDs to names such as .iso.org.dod.internet.mgmt.mib-2.system.sysUpTime.sysUpTimeInstance

For this entry sysUpTimeInstance OBJECT IDENTIFIER ::= { sysUpTime 0 } roughly translates to "The OID for sysUpTimeInstance is equal to the OID of sysUpTime plus '.0' and the MIB is equal to the MIB of sysUpTime plus '.sysUpTimeInstance'

To see what the OID and the rest of the MIB for sysUpTime is, you have to look earlier in the file. Keeping in mind that it may have been imported from another file. In this case, it was, so if you look in IMPORTS section you will see that sysUpTime was imported from SNMPv2-MIB. If you then check that file, you will see sysUpTime defined and in that definition you will find ::= { system 3 }.

So far, we have .3.0 and system.sysUpTime.sysUpTimeInstance, which is just the last part of the OID and full MIB name. We could then trace system back to it's definition, etc, etc. By following this chain back through the files you will eventually get the whole OID and full MIB.

Of course, you could just use snmptranslate, as shown in the first paragraph, to do all of this for you. It will show you the MIB and OID. For most of us, that is usually as far as we need to go.

For more info see:

(product pamplet, but also contains a good MIB summary) https://scadahacker.com/library/Documents/ICS_Protocols/Demystifying%20the%20SNMP%20MIB.pdf


  • Thanks! And am I correct that conversion of TimeTicks(for example "28267576" to "3 days, 6:31:15.76") happens inside the snmpget/snmpwalk utility itself? According to mib.c in net-snmp tarball it looks like so.
    – Martin
    Jul 8 '15 at 9:54
  • 1
    @Martin That is correct. There are options such as -Ot to just display the raw numbers.
    – Mel
    Jul 8 '15 at 15:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.