SNMP traps
SNMP push notifications from agent to manager when events occur (interface down, threshold breach, auth fail). UDP 162. Distinct from SNMP polling (manager polls agent periodically, UDP 161).
v2c traps + v3 informs. v3 informs are acked (TCP-like) → guaranteed delivery; v2c traps are fire-and-forget. Standard event-based monitoring: switch/router event → trap to PRTG/Nagios/Zabbix/SolarWinds → alert. Classic trap: rate-limit on agent or IDS system drops trap flood during outage → blind spot exactly when monitoring is required. Modern alternative: syslog + streaming telemetry (gNMI, NETCONF), webhooks from router event system. SNMP still de-facto for legacy + multi-vendor.