des is Event Service and it is a part of Notification Processor. It runs specified programs according to a value of one of received parameters: -n, -p or -g. des is dedicated to be run by dtrapd. In this way, information included in a SNMP-Trap notification received by dtrapd, is passed to des as its input parameters. So you can say, dtrapd separates stream of information taking sender IP address into consideration while des separates the stream with respect to a kind of messages. Note that des doesn't operate on a SNMP-Trap message but it only use data which are passed as its input parameters. Depending on input arguments and loaded configuration des runs specified programs and passes them almost all information that received itself as input parameters.

des reads its current configuration during startup from a file specified as one of its input parameters.