Topology discovery, the process of discovering and mapping network devices and links, is vital for a network’s efficiency. With the advent of virtualization and mobile computing, current networks change dynamically, and automatic topology discovery is essential for network mapping and monitoring, identifying bottlenecks and failures, and ensuring optimum network efficiency.
Keeping an up-to-date network inventory of hardware and software assets, physical and virtual resources, deployed patches and topology maps is only possible via automatic Layer 2/3 discovery tools. While Layer 3 identifies devices, Layer 2 connectivity is essential for identifying the physical topology between devices.
Device discovery tools simplify the process using a variety of discovery protocols to discover and collect information about:
A device discovery tool should include both Layer 3 (devices) and Layer 2 discovery (port-to-port connectivity). While Layer 3 uses IP addressing to discover devices with routing and subnet information, Layer 2 discovery is essential to discover the actual physical (port/interface level) connections between devices.
By drilling down to individual switch ports, it is possible to offer a more granular view of the network topology. By combining Layer 3 and Layer 2 discoveries, a network device discovery tool can provide a 360° view of the network, right down to the switch, port, VLAN and MAC information for a given IP address.
SNMP is the predominantly used network management protocol, with a majority of network devices being SNMP-enabled. The SNMP manager software, present in the network management solution, uses UDP polling to identify SNMP-enabled devices in the network. This is done by identifying replies sent by the SNMP agent software installed on all SNMP devices. Additionally, using UDP avoids the traffic overload of a full-blown TCP poll, and has minimal impact on network performance. Further queries are sent to these devices to identify them (as a router, switches, hubs, firewalls and so on). Device-related data are stored in SNMP-enabled devices as Object Identifiers (OIDs) – varying as per the device; printers would have data on ink levels and so on; switches would provide port in/port out data; routers might provide forwarding data, NAT table information etc). These OIDs, stored in Management Information Bases (MIBs), are exchanged between SNMP agent software and the manager software for automatic discovery of network devices and their attributes.
Link Layer Discovery Protocol (LLDP) is a vendor-neutral one-way protocol, working at Layer 2 to facilitate exchange of device information between directly connected devices. Each LLDP enabled device transmits device information (device type/ID, port ID) on to its directly connected neighbors, which then store this information on management information databases (MIBs). Network management software ideally uses these MIBs to collect device information, moving on from neighbor to neighbor until the entire network topology is mapped out.
Ping is another network discovery tool – by sending ICMP echo queries, and subsequently discovering echo replies, network management software can discover devices on a network responding to ICMP requests.
Active probes send out light-weight executables (the “probe” packets) through the network. The probes scan the network, and transmit device-related data back to the discovery tool through a secure communication channel.
Address Resolution Protocol (ARP) maps IP addresses to the corresponding Layer 2 MAC address. By using SNMP to query the ARP cache of a device, the network management software can build its own database of routing and subnet information (Layer 3) as well as interface information (Layer 2) of the device’s neighbors. This process is continued with the neighboring devices until the entire network is discovered.