[revelation]

They capture at the fiber going out or in (or undersea), if you follow the other commenters here SNMP traffic would never go over those.

[tptacek]

I mean never say never. You definitely CAN tell an ASA to allow SNMP on an external interface. But it's probably not where you end up by default.