For example, if the NMS is pinging a router to see if it's up or down and a response doesn't come
back, the NMS doesn't really know whether that device is down
all it knows is that the response didn't come back.
The device could be down, but there could also be a routing problem or an intermediate device could
be down or a device between the NMS and the router could be down.
So some device along the path could be down or traffic could be blocked by an ACL or a firewall rule.
All the NMS knows is that it can't reach the device that it's pinging.
SNMP on the other hand is different, with SNMP
the NMS is querying a device and the device is telling the NMS via SNMP the state of an interface.
So if a device indicates that interface, FastEthernet 00 as an example is down
the NMS knows 100 percent that that information is accurate because it received that information
via SNMP from the device that it was querying.
Now, in the event that the actual device is down rather than an interface on the device, you'll get
an unknown state.
That's a different type of signifier than if the interface is down on a device that's up and running
in terms of performance monitoring, ICMP or PING is used for availability calculations and latency
response time as SNMP is used for almost all the other statistics, including CPU, memory, buffers,
interface traffic, and errors, and many, many other statistics.
In some cases, for Windows systems, the NMS might leverage WMI or Windows management instrumentation
to check for performance counter type values.