Port 705: AgentX — Where SNMP agents learn to delegate

Port 705 is the home of AgentX—the Agent Extensibility Protocol that solves a fundamental scaling problem in network monitoring.

What AgentX Does

SNMP (Simple Network Management Protocol) monitors network devices and systems. Originally, each monitored system ran a single monolithic agent that handled everything—CPU stats, memory usage, network interfaces, disk space, application-specific metrics.

This didn't scale. Different teams wanted to monitor different things. Applications wanted to expose their own metrics. The monolithic agent became a bottleneck.

AgentX splits the job. One master agent handles all SNMP communication with the outside world. Multiple subagents, each running as separate processes, handle specific domains of monitoring data. They communicate through port 705.¹

The Beautiful Division of Labor

The architecture is elegant in its specialization:

The master agent is SNMP-fluent but MIB-ignorant. It speaks the SNMP protocol perfectly, handles authentication, manages requests from monitoring systems—but knows nothing about what data actually exists or what it means.

The subagents are MIB-omniscient but SNMP-ignorant. They know everything about their specific monitoring data (their Management Information Base variables) but know nothing about the SNMP protocol.

Port 705 is where they meet. The master agent listens on TCP port 705. Subagents connect and register which monitoring variables they're responsible for. When an SNMP monitoring system queries the device, the master agent receives the request, figures out which subagent owns that data, forwards it via AgentX on port 705, gets the response, and sends it back via SNMP.²

Why This Matters

This separation enables:

Independent development — Different teams can write subagents for their applications without coordinating with the main SNMP agent or each other.

Process isolation — If a buggy subagent crashes, the master agent keeps running. Other monitoring continues working.

Security boundaries — Subagents can run with different permissions, accessing only the data they need.

Scalability — New monitoring capabilities are added by launching new subagents, not by rebuilding one massive agent.

The Protocol

AgentX, defined in RFC 2741, is a binary protocol running over TCP (port 705) or Unix domain sockets.³ The master agent can also listen on UDP port 705, though TCP is standard for reliability.

Subagents connect and send registration messages: "I handle these monitoring variables." The master agent builds a map of who owns what. When SNMP queries arrive, the master agent becomes a dispatcher, routing requests to the right subagent and aggregating responses.

Security Considerations

Port 705 should only accept connections from localhost in most configurations. External connections to AgentX represent a significant security risk—an attacker connecting as a rogue subagent could register for critical monitoring variables and feed false data to your monitoring system.

Many implementations use Unix domain sockets instead of TCP to ensure only local processes can connect as subagents. When TCP is used, firewall rules should block external access to port 705.

Checking What's Listening

See if AgentX is running on your system:

# Check if port 705 is listening
sudo lsof -i :705
netstat -an | grep 705

# On Linux, check for the Net-SNMP master agent
ps aux | grep snmpd

# Check AgentX configuration in Net-SNMP
snmpd -H 2>&1 | grep -i agentx

Related Ports

• Port 161 — SNMP agent (where external monitoring systems connect)
• Port 162 — SNMP trap (where agents send alert notifications)
• Port 199 — SMUX (an earlier SNMP multiplexing protocol that AgentX largely replaced)

History

AgentX emerged in the late 1990s as SNMP deployments grew more complex. RFC 2257 (March 1998) defined the first version. RFC 2741 (January 2000) obsoleted it with refinements based on implementation experience.³

Before AgentX, extending SNMP monitoring meant either modifying the main agent (difficult, risky) or using SMUX (the SNMP Multiplexing protocol on port 199), which had limitations. AgentX provided a cleaner architecture for agent extensibility and became the standard approach.