Using spanning tree protocol (stp) to enhance layer-2 network topology maps

[0001] Spanning tree protocol (STP) data obtained from network switch (SNMP) queries can be used to increase the identification of links between two switches in layer 2 mapping. In particular, by analyzing STP protocol data, ambiguity in port determination can be reduced switch uplinks. In particular, STP data can be used in conjunction with other data to provide layer 2 connectivity for nodes in network topology.

BACKGROUND OF THE INVENTION [0002] Network topology is the development of distribution or mapping of network elements (links, nodes, etc.), especially physical (real) and logical (virtual) interconnections between nodes. A local area network (LAN) is one example of a network that exhibits both physical and logical topology. Any given node in the LAN will have one or more links to one or more other nodes in the network, and mapping these links and nodes to graphs results in a geometric shape that determines the physical topology of the network. Similarly, mapping data streams between nodes in a network determines the logical network topology.

[0003] Network topology thus describes a specific physical or logical arrangement of network elements. The elements can be physical or logical so that the physical elements are real and the logical elements can be, for example, virtual elements or the arrangement of network elements. Two networks can share similar topology if the connection configuration is such

53 / 59P36850PL00

Alone, although networks may differ in other aspects such as physical interconnections, domains, node distance, transmission rates, and / or signal types. A network can contain many smaller networks. For example, a private telephone exchange is a network and this network is part of a local telephone exchange. The local exchange is part of a larger telephone network that allows international calls, and is connected to the mobile telephone network.

LAN networks Star speed distances, partially connected topology [0004] Any given network topology is only determined by graphical representation of physical configuration and / or logical connections between nodes. Topology is technically part of graph theory. between nodes, interconnection, physical connections, and / or signal types may differ in two networks, and yet their topologies may be identical. The arrangement or mapping of network elements leads to some underlying topologies, which can then be combined into combinations to create more complex topologies (hybrid topologies). The most common of these base types of topology include bus topology (such as linear bus, distributed bus), ring topology, mesh topology (inclusive or fully connected mesh), tree topology, hybrid topology that is composed of one or more network topologies, and point-to-point topology.

[0005] The logical topology corresponds to the mapping of visible connections between network nodes, as evidenced by the path that the data apparently chooses when following between nodes. The logical classification of network topologies generally corresponds to the same classifications as those in physical classifications of network topologies, with the path that the data selects between the nodes used to determine the topology as opposed to actual physical connections

53 / 59P36850PL00

EP 2 286 554 B1 used to determine the topology. Logical topologies are often closely related to media access control (MAC) methods and protocols. Logical topologies are essentially determined by network protocols as opposed to determined by the physical arrangement of cables, wires and network devices, or by the flow of electrical signals, although in many cases the paths followed by electrical signals between nodes may closely match the logical data stream, hence so the convention for the interchangeable use of the terms "logical topology" and "signal topology" follows. Logical topologies usually have the ability to be dynamically reconfigured by special types of equipment such as routers and switches.

[0006] Mapping the layer 2 topology is difficult to implement due to the method of organizing the switching of layer 2 data in switches. The switch maintains a table of MAC addresses organized by a port, with each port having one or more MAC address entries for each MAC address received on that port. In the simplest example, the port in the table will have a single MAC address that can be used to uniquely map a network node that corresponds to that single MAC address to a given switch port. However, even the simplest case may not represent the actual topology because switch tables may contain outdated or incomplete data depending on the network traffic that flows through the switch.

[0007] An additional complication of the layer topology mapping is the port data associated with links between switches. For example, when one switch, e.g. T1, is directly connected to another switch, e.g. T2 on port 3, the table maintained in switch T2 will probably contain multiple MAC address entries for port 3. This is storing multiple MAC address entries for port 3 results from the

53 / 59P36850PL00

That some or all of the MAC addresses known by the T1 switch that transmits data through the T2 switch will be present in the T2 switch on port 3. It is these links within the switch that pose the most difficult challenge in creating accurate network topology mappings.

[0008] In conventional methodologies, STP data is regularly transmitted between switches for two main purposes: (a) to identify and prevent loops in the network topology, and (b) to choose the fastest route between switches when redundant switch links occur. Switches that implement the STP protocol maintain an array of directly connected adjacent switches based on the receipt of this periodic data. This STP table data can be used to identify links within switches and thus reduce complexity when restoring connections within switches and identifying and restoring other Layer 2 network connections. US 2002/0046271 A1 describes an architecture for creating a single image for a stack of switches, multiple interconnection devices are provided for stack configuration for interconnection of networks, and software is made in each inter-device so that the inter-device stack is visible as a single device Interconnection for an interconnected network.

SUMMARY OF THE INVENTION [0009] In response to these and other needs, the object of the invention is achieved by the method according to claim 1, the computer program product according to claim 9 and the device according to claim 11. Additional advantageous developments are set out in the respective dependent claims. In particular, embodiments of the present

53 / 59P36850PL00

EP 2 286 554 B1 relates to the creation of a topology mapping by creating an initial network topology mapping. Layer 2 address tables are collected from a topology mapping. Spanning tree protocol (STP) data is then also collected, along with address translation tables (ARPs). Using this information, switches are identified using Layer 2 address tables. STP data can be correlated by comparing data in switches, identifying switch ports directly connected to other switch ports, and eliminating direct port connections between two switches from the considerations area for further mapping of Layer 2 nodes.

[0010] Optionally, mapping the network topology includes transferring artificial data in the network; and tracking artificial data. For example, mapping the network topology may include searching for nodes with a predetermined number of Internet Protocol (IP) addresses, and repeating the search for a predetermined number of hops.

Then, Layer 2 and Layer 3 connectivity can be determined based on any discovered nodes, correlated Layer 2 and Layer 3 address data, and network connectivity of the identified specific IP addresses. In addition, network topology mapping can include receiving and saving user preferences including IP address block size and hop count.

[0011] Relation of STP protocol data may include placing entries for the switch in the associated STP table. For the switch, the bridge base address is compared to the bridge destination address, and the bridge base address is compared to the neighbor bridge destination address. The layer 2 address corresponding to the address of the neighboring port is located, but when no layer 2 address of the neighboring port is found, an artificial entry is created.

53 / 59P36850PL00

EP 2 286 554 B1

The adjacent switch node, which is defined by either the layer 2 address found or an artificial entry, is then saved, and the other layer 2 addresses in the switch are invalidated. For example, comparing the switch bridge base address with the neighbor switch destination address may include, for each table entry that identifies the neighbor switch node Tt, comparing each bridge base address in the layer 2 address table of the adjacent switch with the bridge destination address in the switch Tt. When the bridge destination address and the neighbor's base address match, the designated port in the Tt switch entry is compared to the designated port in the Tn switch entry. When the designated port in the Tt switch entry corresponds to the designated port in the Tn switch entry, a direct connection between the Tt switch and the Tn switch is determined. In this way, the switch ports are identified at each end of the connection.

Invalidating other layer 2 addresses in said switch includes invalidating all other layer 2 address table entries in the Tt switch whose bridge (switch) port matches the identified bridge port. These invalidated entries correspond to layer 2 addresses below connections between two switches and are useful for layer 2 communications in network topology.

are not

BRIEF DESCRIPTION OF THE DRAWINGS [0013] For a proper understanding of the invention, reference should be made to the accompanying drawings, in which:

FIG. 1 is a high level diagram of the mapping system improved by the STP protocol in accordance with the embodiments of the present application;

53 / 59P36850PL00

EP 2 286 554 B1

FIG. 2 is a flowchart of a method of mapping the network in accordance with the embodiments of the present application; and

FIG. 3-4 are flowcharts of how to collect STP data in accordance with the embodiments of this application.

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS [0014] Referring to FIG. 1, embodiments of the present application relate to a topology mapping unit 100 configured to connect to a network 10 that includes, for example, multiple nodes 1, switches 2 with multiple ports 4, and path 3.

[0015] The topology mapping unit 100 includes a mapping module 110. In particular, the mapping module 110 is configured to map components in the network 10. Various techniques for mapping the network topography are known and can be integrated in the embodiments of the present application as described in more detail below.

[0016] Mapping module 110 automatically detects everything on the network, including desktops, servers, printers, switches and routers using identification and detection methods (ping / ICMP, SNMP, SIP based VoIP, NetBIOS and others) to scan ranges IP addresses and node discovery as described below in FIG. 2.

[0017] Referring now to FIG. 2, a way is provided

200 mapping according to embodiments of the present application. In particular, the mapping method 200 includes the step of defining the data mapping criteria in step 210. For example, the user may define the range of IP addresses, the number of hops (or connected devices from each detected device), and the types of devices (e.g., SNMP devices

53 / 59P36850PL00

EP 2 286 554 B1 or clients of responses) to be detected during the search.

[0018] Referring still to FIG. 2, in step 220, a node search is performed. For example, types of detection methods such as ICMP Ping, NetBIOS, SIP clients, etc. involve the transmission of small UDP or ICMP packets to each IP address within a defined range, as well as the detection of devices within the hop count from the detected device. Data is therefore sent and tracked for each defined IP address to determine the device associated with the IP address and the physical and virtual paths used to reach the corresponding IP address. Optionally, large ranges of IP addresses are internally divided into fixed address blocks, such as address blocks, and the response is sought from these addresses. As a result of searching the network in this way by means of small data packets exchanged with a limited number of addresses, noticeable influences in the network bandwidth or devices are minimized.

[0019] Referring still to FIG. 2, node detection in step 220 is described in more detail. Nodes are searched for in blocks containing the previously selected number of N IP addresses using user-configured discovery methods, step 221. Next, layer 3 connectivity can be determined based on the detected nodes in step 222. If hop counts> 0 have been defined, step 221 is repeated with the newly detected network ranges until hop counts are reached, step 223. Then, layer 2 connectivity is determined based on any detected nodes identified as the managed switch in step 224. Layer 2 and Layer 3 address data from steps 221224 are then correlated, for example, by using address translation tables (ARPs) and spanning tree tables collected from discovered SNMP-enabled nodes in step 225. Then, network connectivity is determined in step 226 by

53 / 59P36850PL00

Network nodes, module 110 information for a coherent, examination of the IP address (s) of each detected node. Layer 2 connectivity is used when available; otherwise, layer 3 connectivity is used.

[0020] The results of the network topology search are recorded in step 230. For example, mapping module 110 can collect and save all topology information in a database 140, providing topology source and resource information for the enterprise configuration management database (CMDB) strategy . Mapping module 110 also automatically maintains this data to update network nodes, thus providing engineers with a current representation of the network for compliance requirements.

[0021] Optionally, the results of the network topology search are saved in step 230. For example, when mappings can be detected, the network still easily visible and the network topology, for example, compile the mappings and colored node icons with lines representing the speed of network connectivity per module 110 see

110 managed module complete connected 130 user interface. In this way, mapping enables network engineers exactly how the devices are connected in the mapping network can access switches to accurately represent the port connectivity scheme for all network devices, resulting in a mapping that illustrates all nodes directly with the managed switch with information about ports displayed next to the node.

Returning to FIG 1, in one embodiment of the present application, the mapping module 110 performs mapping of layer 2. Layer 2, or the data link layer, provides functional and procedural means for transferring data between network units and to detect and correct errors as much as possible, which can occur in the physical layer.

53 / 59P36850PL00

EP 2 286 554 B1

Initially, this layer was intended for point-to-point and point-to-point media, which are characteristic of wide area network carriers in the telephone system.

The local area network (LAN) architecture, which contained multi-access media with the possibility of broadcasting, was developed independently of the ISO development, in the IEEE project. LAN services usually organize bits, from the physical layer, into logical sequences called frames.

[0023] The highest sublayer is the Logical Link Control (LLC) layer. This sublayer multiplexes the protocols operating at the top of the data link layer, and optionally provides flow control, acknowledgment and debugging. The LLC layer provides addressing and data link control. It defines which mechanisms are to be used for addressing the station in the transmission medium and for controlling the data exchanged between the source and receiving devices.

[0024] The sublayer below LLC is the media access control (MAC) layer. Sometimes it refers to a sublayer that determines who is allowed to access the media at any one time (usually CSMA / CD), and at other times the expression refers to the frame structure with MAC addresses inside. There are basically two forms of media access control: distributed and centralized. The media access control sublayer also determines where one data frame ends and the next begins.

[0025] Referring still to FIG 1, in one embodiment of the present application, the mapping module 110 performs mapping of layer 3. Layer 3, or the network layer, is the third of seven layers in the OSI model and the third of five layers in the TCP / IP model . In fact, the network layer is responsible for delivering packets between two ends (from source to destination), while the data link layer is responsible for delivering frames

53 / 59P36850PL00

From node to node (hop-to-hop). The network layer provides functional and procedural means for transferring variable length data sequences from source to destination via one or more networks while maintaining service quality, and error control functions. The network layer supports the transmission of information in its entirety from its source to its destination.

[0026] By using multi-level discovery, the mapping module 110 uses a variety of detection methods to ensure that the integrated mapping of the layer 2 and layer 3 topology of the OSI model includes

- IP address - MAC address

- Last logged in user (requires optional response clients)

- DNS name

- node name (specified by SNMP or other client protocol)

- Switch port connection [0027] This topology data can then be saved to the topology database 130.

[0028] This multi-level detection of network infrastructure data in a topology database 130 provides the user with easy access to important time-saving features, including automated representation of topology at levels, to show routers and subnets, additionally managed switches, or in addition, end nodes that can be filtered by type or group to further match the views.

[0029] Referring still to FIG. 1, topology mapping unit 100 further includes STP data collection unit 120. In particular when the module

53 / 59P36850PL00

EP 2 286 554 B1

110 mapping will form a topology mapping, STP protocol data detection unit 120 may use this mapping data to form a span tree to better map layer 2 connections within the detected network elements as described below in FIG. 3 and 4.

[0030] When this information about the location of the network layer 2 topology 10 is created by the STP data collection module 120, this information is stored in the STP protocol database 140. The topology database 130 can be updated to reflect this information in the layer 2 topology using information in the STP protocol database 140.

[0031] The spanning tree protocol (STP) is a layer 2 protocol developed for operation on bridges and switches. The spanning tree is a reduction of the layer 2 network mesh in such a way that packets can be passed through the network without any looping.

The STP protocol specification is defined in IEEE 802.1D, and the RSTP (Rapid Spanning Tree Protocol) protocol is defined in IEEE

802.1w (included in IEEE 802.1D-2004). The main purpose of the STP protocol is to ensure that there will be no loop situations when there are redundant paths in the network. STP achieves this by preventing network loops and providing spare links between switches or bridges. The STP protocol allows devices to interact with other STP compliant devices on a network to ensure that there is only one path between any two stations on the network. If STP or a similar protocol does not exist in a redundant topology network, the switches can infinitely send broadcast packets to all ports (i.e. broadcast storm). When multiple copies of a frame come on different ports

53 / 59P36850PL00

In a switch, a filtering database may follow.

[0032] As the name suggests, spanning within MAC layer 2 instability MAC entries the STP protocol creates a lattice connected which bridges calculate from spanner, it can be

Information management (bridge tree (usually Ethernet switches)), and deactivates links that are not part of this tree, leaving a single active path between any two network nodes.

[0033] The set of bridges in a LAN can be considered as a graph whose nodes are bridges and whose ends are cables connecting the bridges. In order to break the loop in the LAN while maintaining access to all LAN segments, the bridges can jointly calculate the spanning tree. The spanning tree, using the tree protocol determined using the process 300 shown in FIG. 3, described in more detail below.

[0034] Referring now to FIG. 3, embodiments of the present application relate to a method 300 for collecting STP data. The STP protocol data collection method 300 begins with the initial network mapping at step 310 to map the network. As discussed above, various topology mapping methods can be used, such as the methods described in FIG. 2, and in the attached description.

[0035] In step 320, the topology mapping tends to collect Layer 2 address tables from all nodes detected as Simple Network Protocol (SNMP) enabled nodes using the Q-Bridge management database (MIB) (as determined, for example, in Request for Comments (RFC) 2674) and Bridge MIB databases (as specified, for example, in RFC 1493). Detected nodes that return data are then identified as switches. At step 330, STP protocol data is collected from

53 / 59P36850PL00

Switch nodes using the Bridge MIB database (as defined, for example, in RFC 1493).

[0036] In step 340, Address Resolution Protocol (ARP) tables are collected from all nodes detected as SNMP-enabled nodes using the MIB-2 MIB database (RFC 1213) and from other mapping sources between the Ethernet address and IP address .

[0037] Then, in step 350, for each layer 2 address table accumulated in step 320, the bridge (switch) ports with a single Ethernet address are identified. Then, one or more IP addresses mapped to this Ethernet address are found using the mappings collected in step 340. This IP address (s) may then be stored in the Layer 2 table address entry with the corresponding Ethernet address.

[0038]

Then, collected in the stage comparison of stage 360 ​​data, STP protocol data

330 can be correlated by each switch node, identifying those bridge (switch) ports that are directly connected to other neighboring (switch) bridge ports. This correlation is described in more detail in FIG. 4 below and in the appropriate description. The IP address of the adjacent switch together with the adjacent port can also be saved in the Layer 2 table address entry with the corresponding Ethernet address.

[0039] Referring now to FIG. 4, the STP protocol data correlation 400 is described in more detail. In 400 correlation of STP protocol data, the processing of STP protocol data collected in step 330 and referenced in step 360.

[0040] In step 410, each of the target nodes of the switch, Tt, is identified, and each entry in the STP table of that switch is located. Then, in step 420, the base address of the bridge of this entry (dotldBaseBridgeAddress) particular, the process relates to a specific

53 / 59P36850PL00

EP 2 286 554 B1 is compared with its bridge destination address (dot1dStpPortDesignatedBridge). If these addresses are different, then the Tt switch has an adjacent switch node, Tn, which communicates using the bridge destination address.

[0041] In step 430, for each table entry in step 420 that identifies the neighbor switch node, Tt, each entry bridge address is compared, in the layer 2 address table of each other switch, with the bridge destination address in the switch Tt. If these addresses match, the designated port (dot1dStpPortDesignatedPort) in the Tt switch entry is compared to the designated port in the Tn switch entry. If these values ​​also match, there is a direct connection between the Tt switch and the Tn switch and, in addition, the switch ports at each end of the connection are identified.

[0042] Proceeding to step 440, for each direct connection between two switches identified in step 430, a layer 2 address table entry in the switch Tt is found that corresponds to the bridge (switch) port for the neighboring node. If no such layer 2 address table entries exist, an artificial table entry is created as a placeholder for later data. For each layer 2 address table entry in the Tt switch identified or created by step 440, in step 450, the neighbor switch node data collected in step 430 is saved.

[0043] At step 460, all other Layer 2 table address entries in the Tt switch whose bridge (switch) port matches the bridge (switch) port identified in Step 430 are invalidated. These invalidated entries contain layer 2 addresses below the connections between the two switches and are not useful for layer 2 connectivity in network topology. [0044] As discussed above, various embodiments of the invention may be configured in a plurality of elements

53 / 59P36850PL00

They can be configured in a single network element or configured in multiple elements having the various functions described distributed. Control for IP SLA or other monitoring configurations and other functions can be implemented in various network components, such as user equipment, VOIP server, in the access gateway or in another network component related to the VOIP network and network access.

[0045] One skilled in the art will understand that the above-discussed embodiments of the invention are illustrative only, and that the invention can be implemented in a variety of configurations as discussed above. In addition, the invention may be implemented as a computer program on a computer readable medium, the computer program controlling a computer or processor to perform various functions that are discussed as method steps and also described as hardware or hardware / software components.

Solarwinds Worldwide, LLC Representative:

53 / 59P36850PL00

EP 2 286 554 B1