Address Resolution Protocol in Layer 2 Discovery

The Discovery probes for Address Resolution Protocol (ARP) map the IP address of a computer or network device to a MAC address.

Devices that support SNMP, such as Linux computers and network devices, cache two types of address information in the Network ARP Table [discovery_net_arp_table] table:
  • Static: Manually added address resolutions.
  • Dynamic: Hardware name and IP address pairs added to the cache by previous, successful ARP resolutions.
When the ARP table Discovery completes, the system collects all static and dynamic table entries from devices via SNMP. If a new ARP entry is available, it is added to the ARP table in the CMDB. If any previously discovered ARP entries are no longer cached in the device’s ARP table, the system removes the corresponding records from the CMDB using the reconciliation process.
Note: If new ARP entries are created after Discovery runs, they are not discovered until the next Discovery schedule. If ARP entries are removed from the device after Discovery runs, the CMDB ARP table is not updated until Discovery runs again.

ARP probes

Discovery uses probes for the Address Resolution Protocol (ARP) that retrieve the IP address and MAC address for a configuration item (CI) from the Network Infrastructure Item [discovery_net_base ] table and store the results in the Network ARP Table [discovery_net_arp_table].

Discovery provides these probes for extracting IP and MAC address resolution information:
Probe ECC queue topic Command Description
Linux - Network ARP Tables SSHCommand arp -n SSH command probe that retrieves the network information from the ARP table on a Linux server.
Solaris - Network ARP Tables SSHCommand arp -an SNMP probe that collects information from the ARP table on a switch or router.
Windows - Network ARP Table Powershell arp -a SSH command probe that retrieves the network information from the ARP table on a Solaris server.
SNMP - Network - ArpTable SNMP Table

The SNMP probe uses this OID first: iso.org.dod.internet.mgmt.mib-2.ip.ipNetToMediaTable ipNetToMediaPhysAddress,ipNetToMediaNetAddress.

If the probe fails to return results, it uses this OID: iso.org.dod.internet.mgmt.mib-2.ip.ipNetToPhysicalTable ipNetToPhysicalNetAddress,ipNetToPhysicalPhysAddress.

Powershell probe that retrieves the network information from the ARP table on a Windows server.