diff --git a/CHANGELOG b/CHANGELOG
index f8565c96..87a19c25 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -19,6 +19,9 @@ HISTORY
 
   ++ New features:
 
+  2010-01-26: Simon Goldschmidt
+  * snmp: Use memp pools for snmp instead of the heap; added 4 new pools.
+
   2010-01-14: Simon Goldschmidt
   * ppp.c/.h: Fixed bug #27856: PPP: Set netif link- and status-callback
     by adding ppp_set_netif_statuscallback()/ppp_set_netif_linkcallback()
diff --git a/src/core/memp.c b/src/core/memp.c
index 2439d6f9..29d5307c 100644
--- a/src/core/memp.c
+++ b/src/core/memp.c
@@ -54,6 +54,8 @@
 #include "lwip/stats.h"
 #include "netif/etharp.h"
 #include "lwip/ip_frag.h"
+#include "lwip/snmp_structs.h"
+#include "lwip/snmp_msg.h"
 
 #include <string.h>
 
diff --git a/src/core/snmp/mib_structs.c b/src/core/snmp/mib_structs.c
index f4dc2929..00f24b11 100644
--- a/src/core/snmp/mib_structs.c
+++ b/src/core/snmp/mib_structs.c
@@ -37,7 +37,7 @@
 #if LWIP_SNMP /* don't build if not configured for use in lwipopts.h */
 
 #include "lwip/snmp_structs.h"
-#include "lwip/mem.h"
+#include "lwip/memp.h"
 #include "lwip/netif.h"
 
 /** .iso.org.dod.internet address prefix, @see snmp_iso_*() */
@@ -169,7 +169,7 @@ snmp_mib_ln_alloc(s32_t id)
 {
   struct mib_list_node *ln;
 
-  ln = (struct mib_list_node *)mem_malloc(sizeof(struct mib_list_node));
+  ln = (struct mib_list_node *)memp_malloc(MEMP_SNMP_NODE);
   if (ln != NULL)
   {
     ln->prev = NULL;
@@ -183,7 +183,7 @@ snmp_mib_ln_alloc(s32_t id)
 void
 snmp_mib_ln_free(struct mib_list_node *ln)
 {
-  mem_free(ln);
+  memp_free(MEMP_SNMP_NODE, ln);
 }
 
 struct mib_list_rootnode *
@@ -191,7 +191,7 @@ snmp_mib_lrn_alloc(void)
 {
   struct mib_list_rootnode *lrn;
 
-  lrn = (struct mib_list_rootnode*)mem_malloc(sizeof(struct mib_list_rootnode));
+  lrn = (struct mib_list_rootnode*)memp_malloc(MEMP_SNMP_ROOTNODE);
   if (lrn != NULL)
   {
     lrn->get_object_def = noleafs_get_object_def;
@@ -210,7 +210,7 @@ snmp_mib_lrn_alloc(void)
 void
 snmp_mib_lrn_free(struct mib_list_rootnode *lrn)
 {
-  mem_free(lrn);
+  memp_free(MEMP_SNMP_ROOTNODE, lrn);
 }
 
 /**
diff --git a/src/core/snmp/msg_in.c b/src/core/snmp/msg_in.c
index 1b40f2bb..ad60f099 100644
--- a/src/core/snmp/msg_in.c
+++ b/src/core/snmp/msg_in.c
@@ -41,7 +41,7 @@
 #include "lwip/snmp_msg.h"
 #include "lwip/snmp_structs.h"
 #include "lwip/ip_addr.h"
-#include "lwip/mem.h"
+#include "lwip/memp.h"
 #include "lwip/udp.h"
 #include "lwip/stats.h"
 
@@ -181,7 +181,7 @@ snmp_msg_get_event(u8_t request_id, struct snmp_msg_pstat *msg_ps)
     en = msg_ps->ext_mib_node;
 
     /* allocate output varbind */
-    vb = (struct snmp_varbind *)mem_malloc(sizeof(struct snmp_varbind));
+    vb = (struct snmp_varbind *)memp_malloc(MEMP_SNMP_VARBIND);
     LWIP_ASSERT("vb != NULL",vb != NULL);
     if (vb != NULL)
     {
@@ -200,7 +200,8 @@ snmp_msg_get_event(u8_t request_id, struct snmp_msg_pstat *msg_ps)
       vb->value_len = (u8_t)msg_ps->ext_object_def.v_len;
       if (vb->value_len > 0)
       {
-        vb->value = mem_malloc(vb->value_len);
+        LWIP_ASSERT("SNMP_MAX_OCTET_STRING_LEN is configured too low", vb->value_len <= SNMP_MAX_VALUE_SIZE);
+        vb->value = memp_malloc(MEMP_SNMP_VALUE);
         LWIP_ASSERT("vb->value != NULL",vb->value != NULL);
         if (vb->value != NULL)
         {
@@ -216,7 +217,7 @@ snmp_msg_get_event(u8_t request_id, struct snmp_msg_pstat *msg_ps)
           LWIP_DEBUGF(SNMP_MSG_DEBUG, ("snmp_msg_event: no variable space\n"));
           msg_ps->vb_ptr->ident = vb->ident;
           msg_ps->vb_ptr->ident_len = vb->ident_len;
-          mem_free(vb);
+          memp_free(MEMP_SNMP_VARBIND, vb);
           snmp_error_response(msg_ps,SNMP_ES_TOOBIG);
         }
       }
@@ -295,7 +296,7 @@ snmp_msg_get_event(u8_t request_id, struct snmp_msg_pstat *msg_ps)
 
             msg_ps->state = SNMP_MSG_INTERNAL_GET_VALUE;
             /* allocate output varbind */
-            vb = (struct snmp_varbind *)mem_malloc(sizeof(struct snmp_varbind));
+            vb = (struct snmp_varbind *)memp_malloc(MEMP_SNMP_VARBIND);
             LWIP_ASSERT("vb != NULL",vb != NULL);
             if (vb != NULL)
             {
@@ -314,7 +315,9 @@ snmp_msg_get_event(u8_t request_id, struct snmp_msg_pstat *msg_ps)
               vb->value_len = (u8_t)object_def.v_len;
               if (vb->value_len > 0)
               {
-                vb->value = mem_malloc(vb->value_len);
+                LWIP_ASSERT("SNMP_MAX_OCTET_STRING_LEN is configured too low",
+                  vb->value_len <= SNMP_MAX_VALUE_SIZE);
+                vb->value = memp_malloc(MEMP_SNMP_VALUE);
                 LWIP_ASSERT("vb->value != NULL",vb->value != NULL);
                 if (vb->value != NULL)
                 {
@@ -328,7 +331,7 @@ snmp_msg_get_event(u8_t request_id, struct snmp_msg_pstat *msg_ps)
                   LWIP_DEBUGF(SNMP_MSG_DEBUG, ("snmp_msg_event: couldn't allocate variable space\n"));
                   msg_ps->vb_ptr->ident = vb->ident;
                   msg_ps->vb_ptr->ident_len = vb->ident_len;
-                  mem_free(vb);
+                  memp_free(MEMP_SNMP_VARBIND, vb);
                   snmp_error_response(msg_ps,SNMP_ES_TOOBIG);
                 }
               }
@@ -1339,7 +1342,7 @@ snmp_varbind_alloc(struct snmp_obj_id *oid, u8_t type, u8_t len)
 {
   struct snmp_varbind *vb;
 
-  vb = (struct snmp_varbind *)mem_malloc(sizeof(struct snmp_varbind));
+  vb = (struct snmp_varbind *)memp_malloc(MEMP_SNMP_VARBIND);
   LWIP_ASSERT("vb != NULL",vb != NULL);
   if (vb != NULL)
   {
@@ -1351,12 +1354,13 @@ snmp_varbind_alloc(struct snmp_obj_id *oid, u8_t type, u8_t len)
     vb->ident_len = i;
     if (i > 0)
     {
+      LWIP_ASSERT("SNMP_MAX_TREE_DEPTH is configured too low", i <= SNMP_MAX_TREE_DEPTH);
       /* allocate array of s32_t for our object identifier */
-      vb->ident = (s32_t*)mem_malloc(sizeof(s32_t) * i);
+      vb->ident = (s32_t*)memp_malloc(MEMP_SNMP_VALUE);
       LWIP_ASSERT("vb->ident != NULL",vb->ident != NULL);
       if (vb->ident == NULL)
       {
-        mem_free(vb);
+        memp_free(MEMP_SNMP_VARBIND, vb);
         return NULL;
       }
       while(i > 0)
@@ -1374,16 +1378,17 @@ snmp_varbind_alloc(struct snmp_obj_id *oid, u8_t type, u8_t len)
     vb->value_len = len;
     if (len > 0)
     {
+      LWIP_ASSERT("SNMP_MAX_OCTET_STRING_LEN is configured too low", vb->value_len <= SNMP_MAX_VALUE_SIZE);
       /* allocate raw bytes for our object value */
-      vb->value = mem_malloc(len);
+      vb->value = memp_malloc(MEMP_SNMP_VALUE);
       LWIP_ASSERT("vb->value != NULL",vb->value != NULL);
       if (vb->value == NULL)
       {
         if (vb->ident != NULL)
         {
-          mem_free(vb->ident);
+          memp_free(MEMP_SNMP_VALUE, vb->ident);
         }
-        mem_free(vb);
+        memp_free(MEMP_SNMP_VARBIND, vb);
         return NULL;
       }
     }
@@ -1401,13 +1406,13 @@ snmp_varbind_free(struct snmp_varbind *vb)
 {
   if (vb->value != NULL )
   {
-    mem_free(vb->value);
+    memp_free(MEMP_SNMP_VALUE, vb->value);
   }
   if (vb->ident != NULL )
   {
-    mem_free(vb->ident);
+    memp_free(MEMP_SNMP_VALUE, vb->ident);
   }
-  mem_free(vb);
+  memp_free(MEMP_SNMP_VARBIND, vb);
 }
 
 void
diff --git a/src/include/lwip/memp_std.h b/src/include/lwip/memp_std.h
index 7ff6fb1c..17396dfd 100644
--- a/src/include/lwip/memp_std.h
+++ b/src/include/lwip/memp_std.h
@@ -68,6 +68,12 @@ LWIP_MEMPOOL(IGMP_GROUP,     MEMP_NUM_IGMP_GROUP,      sizeof(struct igmp_group)
 
 LWIP_MEMPOOL(SYS_TIMEOUT,    MEMP_NUM_SYS_TIMEOUT,     sizeof(struct sys_timeo),      "SYS_TIMEOUT")
 
+#if LWIP_SNMP
+LWIP_MEMPOOL(SNMP_ROOTNODE,  MEMP_NUM_SNMP_ROOTNODE,   sizeof(struct mib_list_rootnode), "SNMP_ROOTNODE")
+LWIP_MEMPOOL(SNMP_NODE,      MEMP_NUM_SNMP_NODE,       sizeof(struct mib_list_node),     "SNMP_NODE")
+LWIP_MEMPOOL(SNMP_VARBIND,   MEMP_NUM_SNMP_VARBIND,    sizeof(struct snmp_varbind),      "SNMP_VARBIND")
+LWIP_MEMPOOL(SNMP_VALUE,     MEMP_NUM_SNMP_VALUE,      SNMP_MAX_VALUE_SIZE,              "SNMP_VALUE")
+#endif /* LWIP_SNMP */
 
 /*
  * A list of pools of pbuf's used by LWIP.
diff --git a/src/include/lwip/opt.h b/src/include/lwip/opt.h
index 3dd7fe84..cb65964c 100644
--- a/src/include/lwip/opt.h
+++ b/src/include/lwip/opt.h
@@ -329,6 +329,39 @@
 #define MEMP_NUM_TCPIP_MSG_INPKT        8
 #endif
 
+/**
+ * MEMP_NUM_SNMP_NODE: the number of leafs in the SNMP tree.
+ */
+#ifndef MEMP_NUM_SNMP_NODE
+#define MEMP_NUM_SNMP_NODE              50
+#endif
+
+/**
+ * MEMP_NUM_SNMP_ROOTNODE: the number of branches in the SNMP tree.
+ * Every branch has one leaf (MEMP_NUM_SNMP_NODE) at least!
+ */
+#ifndef MEMP_NUM_SNMP_ROOTNODE
+#define MEMP_NUM_SNMP_ROOTNODE          30
+#endif
+
+/**
+ * MEMP_NUM_SNMP_VARBIND: the number of concurrent requests (does not have to
+ * be changed normally) - 2 of these are used per request (1 for input,
+ * 1 for output)
+ */
+#ifndef MEMP_NUM_SNMP_VARBIND
+#define MEMP_NUM_SNMP_VARBIND           2
+#endif
+
+/**
+ * MEMP_NUM_SNMP_VALUE: the number of OID or values concurrently used
+ * (does not have to be changed normally) - 3 of these are used per request
+ * (1 for the value read and 2 for OIDs - input and output)
+ */
+#ifndef MEMP_NUM_SNMP_VALUE
+#define MEMP_NUM_SNMP_VALUE             3
+#endif
+
 /**
  * PBUF_POOL_SIZE: the number of buffers in the pbuf pool. 
  */
@@ -611,7 +644,8 @@
 
 /**
  * SNMP_CONCURRENT_REQUESTS: Number of concurrent requests the module will
- * allow. At least one request buffer is required. 
+ * allow. At least one request buffer is required.
+ * Does not have to be changed unless external MIBs answer request asynchronously
  */
 #ifndef SNMP_CONCURRENT_REQUESTS
 #define SNMP_CONCURRENT_REQUESTS        1
@@ -643,6 +677,31 @@
 #define SNMP_SAFE_REQUESTS              1
 #endif
 
+/**
+ * The maximum length of strings used. This affects the size of
+ * MEMP_SNMP_VALUE elements.
+ */
+#ifndef SNMP_MAX_OCTET_STRING_LEN
+#define SNMP_MAX_OCTET_STRING_LEN       127
+#endif
+
+/**
+ * The maximum depth of the SNMP tree.
+ * With private MIBs enabled, this depends on your MIB!
+ * This affects the size of MEMP_SNMP_VALUE elements.
+ */
+#ifndef SNMP_MAX_TREE_DEPTH
+#define SNMP_MAX_TREE_DEPTH             15
+#endif
+
+/**
+ * The size of the MEMP_SNMP_VALUE elements, normally calculated from
+ * SNMP_MAX_OCTET_STRING_LEN and SNMP_MAX_TREE_DEPTH.
+ */
+#ifndef SNMP_MAX_VALUE_SIZE
+#define SNMP_MAX_VALUE_SIZE             LWIP_MAX((SNMP_MAX_OCTET_STRING_LEN)+1, sizeof(s32_t)*(SNMP_MAX_TREE_DEPTH))
+#endif
+
 /*
    ----------------------------------
    ---------- IGMP options ----------