How Layer 2 Discovery works

Discovery uses multiple probes to gather information about network adapters and their Layer 2 connections.

If Discovery finds a switch in a network, it triggers the SNMP - Switch - Vlan probe and the SNMP - Network - ARPTable probe. For every Vlan Discovery finds, it triggers the switch probes. If the switch has routing capabilities, Discovery triggers the SNMP - Routing probe to collect network adapter information. If Discovery finds a server, it triggers the appropriate Address Resolution Protocol (ARP) probe for that operating system.

During the discovery of a network device, the system creates records in the Router Interface [dscy_router_interface] table containing adapter information for that device. For SNMP-enabled devices, the information is gathered from a routing probe during the exploration phase. The Layer 2 protocol cache probe runs next to collect neighbor data from the device.

As Discovery gathers network information from the probes on a device, it populates the Device Neighbors [discovery_device_neighbors] table. In some cases, the neighbors of this device might not yet be known to the instance. The neighbor's interface cannot be resolved to a record until Discovery eventually finds the neighbor's side of the relationship. When Discovery runs on the neighboring device, Discovery completes the information for the neighbor's interface for the original reporting device.

For a list of the tables used in Layer 2 Discovery and the information they store, see Data collected by Discovery on network routers and switches.

Discovery can retrieve neighbor data from these caches on a network device:

ARP probes

Discovery collects the state of the ARP cache (both dynamic and static entries) for servers and network devices after every run. Discovery provides these probes for extracting IP and MAC address resolution information:
  • Linux - Network ARP Tables: SSH command probe that retrieves the network information from the ARP table on a Linux server.
  • SNMP - Network - ArpTable: SNMP probe that collects information from the ARP table on a switch or router.
  • Solaris - Network ARP Tables: SSH command probe that retrieves the network information from the ARP table on a Solaris server.
  • Windows - Network ARP Table: Powershell probe that retrieves the network information from the ARP table on a Windows server.

Switch probes

Discovery provides these SNMP probes for extracting MAC address, port, and interface index mapping information:
  • SNMP - Switch - BridgePortTable: Collects switch bridge port table information.
  • SNMP - Switch - ForwardingTable: Collects switch forwarding table information.
  • SNMP - Switch - SpanningTreeTable: Collects switch spanning tree table information.