Build an SNMP Lab with Docker: A Complete Tour of Trishul SNMP Suite

You do not need a physical switch or router to test the basics of SNMP polling, MIB resolution and notification delivery. A local responder, an SNMP manager and a notification listener can give you a controlled environment for experimenting with all three.

I built Trishul SNMP Suite to bring those jobs together. Instead of jumping between a device simulator, MIB utilities, walk scripts and separate trap tools, the Suite provides one browser-based workbench backed by a single Docker container.

This is a hands-on tour of the v2.2.4 release. We’ll get a local lab running, make a simulated device answer queries, send a trap to a listener, and then explore the features that become useful when the simple examples turn into real integration work. Along the way, I’ll show where each of the Suite’s seven pages fits.

Scope: The examples use SNMPv2c on a trusted local machine. The Suite’s current operator interface does not expose full SNMPv3 parity and its simulator is read-only; this is not a guide to operating a publicly exposed monitoring service.

Web UI · TCP 8980 Browser workbench Dashboard · Simulator · Walk & Parse · Traps · MIB Manager · MIB Browser · Settings

Single Docker application FastAPI Unified REST API (/api/…) and live events (/api/ws)

Trishul SNMP Simulate & walk Responder, manager · UDP 1061

Trishul SNMP Traps & informs Sender, listener · UDP 1162

Trishul SMI MIB knowledge Compilation, JSON bundles, OID resolution

Persistent Docker volume SQLite + bundle files Settings, sessions, notification history, compiled MIBs and custom OID data

Simplified component map. The responder and listener are in-process services, not separate containers; the MIB catalog enriches SNMP operations.

1. What you are building

The minimum useful lab has three network-facing endpoints:

Endpoint	Default	Why it exists
Web interface and API	http://localhost:8980 — TCP	Configure the lab, inspect results, use API docs
Simulated SNMP device	127.0.0.1:1061 — UDP	Receive GET / GETNEXT / GETBULK requests and respond
Notification listener	127.0.0.1:1162 — UDP	Receive traps and informs sent during testing

They’re not three standalone products. The current Suite runs its SNMP responder, manager and notification handling in process, with the FastAPI application serving both the interface and the API. Docker publishes the relevant ports to your host.

Seven pages form the operator workbench:

• Dashboard: health, status, MIB totals and counters.
• Simulator: configure a responder with custom OIDs and dynamic values.
• Walk & Parse: query an SNMP endpoint, resolve and export results.
• Traps: start a listener, send notifications, replay or decode them.
• MIB Manager: validate sources, compile MIBs and manage bundles.
• MIB Browser: explore OID trees, symbols, types and constraints.
• Settings: credentials, runtime configuration and statistics.

A lab is most useful when you can see both the configured inputs and the resulting traffic. We’ll first establish that loop end to end.

2. Install the Suite and secure the dashboard

You need Docker and a free host TCP port 8980, plus UDP ports 1061 and 1162. Docker Compose v2 is optional if you use the included installer.

For a reproducible walkthrough, check out the v2.2.4 release rather than following the moving main branch or a latest image:

git clone --depth 1 --branch v2.2.4 \
  https://github.com/tosumitdhaka/trishul-snmp-suite.git
cd trishul-snmp-suite

./install-trishul-snmp-suite.sh up \
  --image ghcr.io/tosumitdhaka/trishul-snmp-suite:2.2.4

The installer is documented to pull the image, create or reuse the persistent data volume and start the application. It also supports an up-local path if you want to build from your checkout. The installation guide covers alternate ports and architectures.

Confirm that Docker started the app:

./install-trishul-snmp-suite.sh status
./install-trishul-snmp-suite.sh logs

Then open http://localhost:8980. The documented initial credentials are admin / admin123. Immediately go to Settings and rotate those credentials, then sign in again. Treat the default login as first-run setup data, never as a safe permanent password.

Network safety: The Docker configuration publishes host ports. Unless you explicitly restrict binding or firewall access, these ports might be reachable from more than your own computer. Keep this demo on an isolated, trusted host; don’t expose the web console or the SNMPv2c public community to the internet. SNMPv2c community strings are not encrypted.

Component tour: Dashboard

Actual Trishul SNMP Suite project image (v2.2.4 repository asset). Select the image to inspect the original at full size.

The Dashboard is your starting checkpoint. Look for the application version, simulator and trap-listener status, MIB counts and activity statistics. The page also links to the main lab tasks. During testing, the application pushes relevant status and stats changes through /api/ws; a refreshing browser view shouldn’t be your only way to learn that an event arrived.

Use the Dashboard again after the next two exercises to see whether the status and counters changed. Under Settings, you can review session and application configuration, reset or export stats, and inspect product metadata. Some settings may require a restart; read their UI indicators before changing them.

3. Create a simulated SNMP device

A predictable device is better than a feature-rich but uncontrolled one for the first test. We’ll provide two familiar system OIDs: the machine’s descriptive text and its name.

Open Simulator and save these custom OID values in the JSON editor:

{
  "1.3.6.1.2.1.1.5.0": "lab-switch-01",
  "1.3.6.1.2.1.1.1.0": "Trishul SNMP Suite demo agent"
}

They correspond to sysName.0 and sysDescr.0, respectively. Use port 1061, community public for this isolated exercise, and start the responder. The status card should show that it is running.

Actual Trishul SNMP Suite project image (v2.2.4 repository asset). Select the image to inspect the original at full size.

The Simulator is more than a static key/value server:

• You can provide numeric OIDs or, when their MIBs are available, symbolic names.
• The runtime supports dynamic simulation rules for counter, random, timestamp and uptime values.
• The activity log helps trace responder lifecycle and incoming requests, with follow/pause and severity filtering.
• Custom values persist in the Suite’s data area; newer releases validate MIB-declared ranges, sizes and syntax rather than blindly accepting any input.

This is intentionally not a complete vendor router emulator. It is a focused read-only SNMPv2c responder suitable for query and data-shape testing, not hardware-specific behavior or arbitrary SET transactions.

Checkpoint: A green or running responder status proves startup, not yet that the manager can reach it. We test that next.

4. Walk OIDs and interpret the results

Open Walk & Parse. The documented same-host example is:

Field	Value
Target	127.0.0.1
Port	1061
Community	public
Root OID	1.3.6.1.2.1.1
JSON Output	Enabled

Run the walk. Under that system subtree, look for the two values you entered: lab-switch-01 and Trishul SNMP Suite demo agent. The precise formatting depends on which parsing and MIB-resolution options are enabled.

Actual Trishul SNMP Suite project image (v2.2.4 repository asset). Select the image to inspect the original at full size.

This exercise makes the difference between three concepts tangible:

1. A numeric OID identifies a managed object, even when you have not loaded a vendor MIB.
2. A MIB symbol such as SNMPv2-MIB::sysName supplies a readable name and associated schema information.
3. A varbind is an OID/value pair returned by an SNMP operation.

The Walk & Parse page supports both readable text and JSON-oriented representations, with Resolve OIDs and Grouped JSON options when you have an appropriate MIB bundle. The more advanced controls include timeout/retry settings, a cancel action, result filtering and sorting, copy or export operations, and a shortcut to the MIB Browser.

Try running the same walk with and without resolution. The raw numeric identifier still represents the same object; only the available context changes. Avoid treating a failed symbolic lookup as proof that an SNMP agent is down.

Checkpoint: If the returned sysName.0 does not match your JSON, check the target address, exposed host port, community and simulator status before chasing MIB compilation problems.

5. Send, receive, inspect and replay notifications

Polling asks a device for data. A trap takes the opposite direction: a sender emits a notification to a receiver, without a request/response acknowledgement at the SNMP protocol level. An inform adds an acknowledgement.

Open Traps and start the listener on UDP 1162 with community public. In the sender, enter target 127.0.0.1, port 1162, and use a valid numeric trap OID or a loaded template. For the simplest documented test, keep the prefilled sysUpTime varbind and send.

Now look at the received-events table. It should show the local notification, including its source, time and varbind details.

Actual Trishul SNMP Suite project image (v2.2.4 repository asset). Select the image to inspect the original at full size.

Once you have the basic flow, this page supports a broader troubleshooting toolkit:

• Trap library: find notification definitions from the currently loaded MIB set and populate sender fields.
• Typed varbind editor: choose data types and, where the schema allows it, enumerated labels instead of raw integers.
• Inform sending: use request/acknowledgement semantics rather than assuming a best-effort trap was received.
• Replay: resend a recorded notification to reproduce downstream behavior.
• Offline decode: inspect an encoded notification payload without depending on a live event.
• History operations: browse paginated received events, pause live updating, delete individual events and export CSV.

The Suite documents community-string redaction in event-list and export surfaces. That is useful hygiene, but it does not turn SNMPv2c into an encrypted transport.

A useful second test is to send the same notification twice and compare the history. This manual sender exercise does not imply the simulator spontaneously generated an interface-down event. For a real fault scenario, you would define a controlled trigger or use another sender.

6. Make the MIB Manager part of the workflow

The previous tests work with numeric OIDs. MIBs make the lab understandable and reusable. They describe symbols, imported definitions, value syntax, enumerations, constraints and notifications. In Trishul SNMP Suite, compiled MIB information feeds the browser, walker, simulation validation and trap tools.

Open MIB Manager. The page reports loaded and failed modules, source groups and notification counts, and offers upload, validation, dependency-fetch and catalog-export actions.

Actual Trishul SNMP Suite project image (v2.2.4 repository asset). Select the image to inspect the original at full size.

For a simple exercise, use a nonproprietary test MIB file you are allowed to distribute or a compatible MIB you already have. Before you apply it to the active catalog:

1. Select the file or files for upload and validate the batch.
2. Review imports, missing dependencies and whether a module would be shadowed by an existing higher-precedence copy.
3. Upload and reload when ready; check the resulting loaded, failed and shadowed states rather than assuming a successful upload means a successful compile.
4. Use the built-in dependency-fetch action only when approved remote sources are configured, or upload dependencies manually.

The Suite’s source precedence is deliberate: root-level uploads first, then common/, explicit vendor groups, auto-fetched/ and finally bundled starter MIBs. Duplicate stored modules may exist, but one copy wins in the active aggregate bundle. That is why shadowed is informational, not an outright compilation error.

Bundle sets, diff and rollback

The current release also maintains versioned compiled JSON bundle sets. This is important when one MIB update changes a symbolic resolution or introduces a dependency problem.

From the Bundle Sets panel, the documented lifecycle is inspect → compare/diff → activate, with the option to return to a previous bundle. A content-hash fast path helps distinguish changes without needlessly treating identical artifacts as new ones. Activation updates the in-memory MIB knowledge and broadcasts relevant state changes to connected browser sessions.

In practice, use this to answer a much better question than “did the upload work?”: What changed in the active catalog, and can I recover the previous version?

The compiler behind this flow is Trishul SMI; it produces compiled modules and indexes that the rest of the Suite can consume. The earlier origin story explains why I separated MIB compilation from SNMP execution in the first place.

7. Browse the actual OID hierarchy

Open MIB Browser after confirming the relevant modules loaded.

Actual Trishul SNMP Suite project image (v2.2.4 repository asset). Select the image to inspect the original at full size.

Choose between a module-oriented view and the numeric OID tree. Search by module name, object name, notification name or numeric OID. Select an object to inspect its symbolic name, numeric OID, type, access, description and, where available, table indexes, enumeration labels, units or range/size/BITS constraints.

A useful comparison is to find the sysName object by name, then by its numeric OID. The browser tells you what that identifier means; the walker tells you what an agent returned for it.

Use Use in Walker or Use in Traps when you want to carry a selected object into another operation. This avoids copying long numeric paths by hand and makes the catalog feel like part of the workflow rather than a disconnected reference page.

An empty search result does not always mean an object does not exist. First verify that the module actually compiled, any imported dependencies were resolved, and your module/type filters are not hiding the symbol.

8. Dashboard and Settings: operating the lab rather than just demoing it

It is easy to ignore operational controls after the first successful request. Don’t.

Return to Dashboard and check the status of the responder, listener, current MIB set and request counters. If the page appears stale, inspect whether the live connection is healthy; the UI can also use polling fallbacks in relevant views.

In Settings, the current release includes:

• Operator credential rotation and session-related configuration.
• Application settings, including options relevant to approved remote MIB sources.
• Statistics reset and export.
• Application version, active bundle and producer-version metadata.

The current runtime stores credentials and sessions in its SQLite-backed application state. There is no in-product password-reset flow in v2.2.4; keep a secure recovery plan and a backup of your data volume before major configuration changes.

For persistence, the standard container volume is trishul-snmp-suite-data. It contains SQLite state, uploaded MIB sources, compiled bundle sets and custom simulation data. The installer documents backup and restore commands:

./install-trishul-snmp-suite.sh backup
# Restore requires a backup archive from your installation:
./install-trishul-snmp-suite.sh restore YOUR-BACKUP.tar.gz

Restoring stops the running container first. It’s a recovery operation, not something to try on a live working environment without checking what the archive contains.

There is not yet a repository-provided assets/snips/settings.png image in this release’s screenshot collection. Rather than substitute another application’s Settings screenshot, this guide describes the verified controls and leaves that visual to a later actual-app capture.

9. What runs underneath the seven pages?

The modern Suite is not the older split process architecture. In v2.2.4 a single FastAPI application serves the compiled frontend, REST endpoints under /api/... and live browser events under /api/ws.

Its key pieces have distinct responsibilities:

Part	Responsibility
Trishul SNMP	In-process asynchronous responder, manager, notification listener and notifier
Trishul SMI	Parse and compile MIB sources into versioned JSON bundles
FastAPI services	Authentication, simulated-device control, walks, traps, MIB management and result formatting
SQLite	Operator settings, sessions, bundle metadata, compile history and notification history
Compiled bundle files	Manifests, OID indexes and per-module JSON artifacts
WebSocket channel	Push status, statistics, new traps and simulator activity to connected pages

The API is useful even if you spend most of your time in the browser. Open http://localhost:8980/docs to inspect the local OpenAPI documentation. Useful documented endpoints include:

GET  /api/health
GET  /api/meta
GET  /api/simulator/status
POST /api/walk/execute
GET  /api/traps/status
GET  /api/mibs/status
GET  /api/mibs/browse/modules

Most operational endpoints require an authenticated session via X-Auth-Token. A repeatable integration test can first check /api/health, then authenticate and exercise operations through the supported routes; do not build scripts that assume the default password will remain enabled.

There is no separate Nginx layer or subprocess WebSocket bridge in this release. For a one-host SNMP lab, this reduces the number of services an operator has to start, configure and troubleshoot.

10. Troubleshooting the usual failures

When a lab step fails, isolate the layer before changing everything at once.

Symptom	First things to check
Page never loads	Docker running, 8980/tcp free, container status and logs
Simulator will not start	1061/udp binding, valid custom-data JSON, active bundle constraints
Walk times out	Host-facing UDP port, target address, community, responder status
Numeric walk works but symbols do not	Required MIB loaded, imports resolved, active bundle and filters
Sent trap does not appear	Listener started, sender targeting 1162/udp, matching community
Imported MIB is missing	Validate status, dependency errors, source precedence, shadowing
Old data absent after upgrade	Check SQLite/bundle migration compatibility; don’t assume every old file was converted

For logs:

./install-trishul-snmp-suite.sh logs
docker logs --tail 200 trishul-snmp-suite

The release notes document fixes for tricky real-world cases: simulator defaults outside a vendor MIB’s allowed ranges, empty byte-valued OCTET STRINGs, and large MIB catalogs that made client-side search too heavy. Those are good reminders that passing a simple loopback test is only the first step toward confidence with actual vendor data.

11. Where the boundaries are

A practical tool deserves a clear limits section:

• SNMPv2c focus in the Suite: Do not confuse the standalone Trishul SNMP library’s broader protocol capabilities with what the Suite v2.2.4 interface exposes.
• Read-only simulation: No writable SET responder or complete vendor-device behavioral emulation.
• Local lab, not hardened public hosting: The documented default credentials and public community are starter values for controlled testing, not production security settings.
• MIB coverage depends on input quality: Vendor files can have missing imports, unexpected syntax or incompatible constraints. The manager reports errors instead of pretending every module compiled.
• Not distributed monitoring: This is an integrated workbench. Fleet-scale polling and orchestration are separate engineering problems.

The next interesting experiments are to define a few constrained custom objects, compare walker output before and after MIB resolution, send an acknowledged inform, replay a saved trap, or deliberately change a compiled bundle and roll it back.

Try it, inspect it and challenge it

If you maintain SNMP integrations, the value of a reproducible local lab is simple: you can see the request, the generated response, the notification and the MIB interpretation in one place, without waiting for access to a production network device.

Start with the Trishul SNMP Suite source and installation guide, and use the release-tagged first-steps documentation alongside this article.

If a step behaves differently in your environment, that is useful feedback: include the Suite version, Docker platform, sanitized logs, target ports and enough synthetic OID data to reproduce it. That is how a lab tool becomes more dependable.

Technical reproducibility note: The commands and UI behaviors here were checked against the public v2.2.4 source, tagged installation guide and operator documentation. This article has not yet been validated with a fresh, live Docker walkthrough; screenshots are genuine project repository assets, not captures of this exact example run.