Determination of physical topology of a communication network

[0002] 1. Field of the Invention

[0003] This invention relates to a technique for determining a topology of a communication network.

[0004] 2. Discussion of the Known Art

[0005] Physical network topology refers to the physical connectivity represented by links such as, for example, twisted wire pairs, fiber optic or wireless links that exist among elements such as switches and routers in a communication network. This topology is part of a so-called physical layer or layer-1 of a known seven-layer ISO network model standard. Determining the physical interconnections of network elements is a prerequisite to certain critical network management tasks including, e.g., reactive and proactive resource management, server siting, event. correlation, and root-cause analysis.

[0006] For example, consider a fault monitoring and analysis application running on a central Internet Protocol (IP) network management platform. Typically, a single fault in the network causes multiple alarm signals from different interrelated network elements. Knowledge of the physical interconnections among the elements is essential to discriminate secondary alarm signals, and to correlate primary signals in order to isolate the actual failure site in the network. See, e.g., I. Katzela and M. Schwarz, Schemes for Fault Identification in Communication Networks, 3 IEEE/ACM Transactions on Networking, at 753-64 (Dec. 1995). Further, an accurate map of physical interconnections in a communication network enables a proactive analysis of the impact of element and link failures. Early identification of potential failure sites capable of disrupting a large number of network users, allows a network manager to enhance the survivability of the network, for example, by adding alternate routing paths before outages occur.

[0007] Certain systems, including Hewlett Packard's Open View Network Node Manager, and IBM's Tivoli for AIX, feature an IP mapping function for discovering routers and subnets, and for generating a network layer (i.e., ISO layer-3) topology showing router-to-router interconnections and router-to-subnet relationships. But a layer-3 topology tends to ignore complex physical interconnections of layer-1 network elements such as switches and bridges that comprise one or more subnets of the network. Thus, a network manager is not fully able to troubleshoot end-to-end connectivity, or to assess the potential impact of a link or device failure in a switched network based only on layer-3 topology information.

[0008] U.S. Pat. No. 5,727,157 (Mar. 10, 1998) relates to an apparatus and method for determining a computer network topology. According to the patent, a list of network addresses heard at each port of a data-relay device in a computer network is compiled for each device. Each device acquires a source address table listing addresses heard by each port of the device. The lists are compared to determine the existence of a direct or transitive connection between selected ports on different devices, to define interconnections between the devices in the network. The patented method does not, however, contemplate the existence of multiple subnets in the network. Thus, the method may not always generate an accurate topology of physical interconnections in networks that have more than one subnet.

[0009] U.S. Pat. No. 5,933,416 (Aug. 3, 1999) and U.S. Pat. No. 5,926,462 (Jul. 20, 1999) disclose a method of determining a network topology, involving monitoring traffic received by and emitted out of devices in the network. Traffic out of the devices is correlated with traffic into the devices, and a communication path between a pair of devices is indicated when the correlation of traffic out of one of the devices with traffic into another one of the devices, exceeds a predetermined threshold. The patented methods predict with a certain probability a physical connection between two nodes, but do not confirm the existence of such a connection between the nodes, however.

[0010] U.S. Pat. No. 5,850,397 (Dec. 15, 1998); U.S. Pat. No. 5,708,772 (Jan. 13, 1998); and U.S. Pat. No. 5,606,664 (Feb. 25, 1997) relate to apparatus and methods of determining a topology of a non-heterogeneous network, using proprietary information tables associated with the network elements.

[0011] U.S. Pat. No. 5,729,685 (Mar. 17, 1998) relates to apparatus for determining the topology of an asynchronous transfer mode (ATM) network, and U.S. Pat. No. 5,684,959 (Nov. 4, 1997) discloses a method of determining a topology of a fiber distributed data interface (FDDI) network. Neither of the two patents is expandable to arbitrary networks that include bridges, switches, hubs and the like.

[0012] U.S. Pat. No. 5,297,138 (Mar. 22, 1994) relates to determining a topology of a network consisting of repeaters, concentrators and bridges, and requires significant packet content monitoring. U.S. Pat. No. 5,684,796 (Nov. 4, 1997) discloses a method and apparatus for determining and maintaining agent topology information in a multi-segment, non-heterogeneous network, and U.S. Pat. No. 5,737,319 relates to a topology discovery method applicable only to static networks and not to data networks with rapidly changing topology. None of the foregoing patents presents a practical solution for discovering a physical or layer-1 topology in a heterogeneous (multi-vendor) IP network, in which more than one subnet may exist.

[0013] According to the invention, a method of discovering a physical topology of a network having elements each of which is assigned to one of a number of subnets within the network, wherein each element has one or more interfaces each of which is linked with an interface of another element, includes generating address sets for each interface of each network element, wherein members of a given address set correspond to network elements that can be reached from the interface for which the given address set was generated, and comparing members of first address sets generated for corresponding interfaces of a given network element with members of second address sets generated for corresponding interfaces of network elements other than the given element. A set of candidate connections between one or more interfaces of the given element and one or more interfaces of another network element are determined, such that, for each candidate connection, (a) none of the members of a first address set is also a member of a second address set, and (b) the members of the first address set and the members of the second address set together represent all network elements assigned to each subnet represented by the members of the first and the second address sets.

[0014] If only one candidate connection is determined between a first interface of the given network element and a second interface of another network element, the one candidate connection is identified as an actual connection between the elements. If more than one candidate connection is determined, those connections with other network elements that are in the same subnet as the given network element are eliminated from the set of the candidate connections.

[0015] For a better understanding of the invention, reference is made to the following description taken in conjunction with the accompanying drawing and the appended claims.

[0016] In the drawing:

[0017] FIG. 1 is a representation of a switched communication network having multiple subnets;

[0018] FIG. 2 is a representation of a communication network with two subnets;

[0019] FIG. 3 is a representation of another communication network with three subnets;

[0020] FIG. 4 is a representation of an ordered communication network;

[0021] FIG. 5 is a representation of a communication network that is not ordered;

[0022] FIG. 6 is a representation of a communication network containing virtual local area networks (VLANs) having multiple subnets; and

[0023] FIGS. 7A & 7B define a general flow chart of a method of discovering a physical topology of a network having multiple subnets.

[0024] The present topology discovery technique makes use of network information that typically is collected in known SNMP Management Information Bases (MIBs) associated with network elements. No modification of operating system software running on the elements or on any hosts, is required. Specifically, the present technique may incorporate information from address forwarding tables of the elements, e.g., the set of Medium Access Control (MAC, or ISO layer-2) addresses that are reachable from each element interface. In the presently disclosed technique, this information is then used to identify interconnections between network elements such as routers and switches to arrive at a physical network topology. In heterogeneous networks having elements from different vendors, the requisite address forwarding data may need to be gathered by accessing and interpreting MIB variables stored in vendor-specific private MIBs, or in custom-designed files.

[0025] IP networks typically comprise switched domains having multiple subnets, with elements (nodes) of the different subnets often being directly physically connected to one another, as in FIG. 1. Therefore, one element can be completely invisible (logically) to a neighboring element with which it is physically linked, if the two elements belong to different subnets of the network. Nonetheless, the present topology discovery technique is capable of identifying an accurate physical topology of a broad class of networks having multiple subnets using address forwarding information alone, as described below.

[0026] Element address forwarding tables typically employ an aging mechanism that discards infrequently encountered destination MAC addresses from an address cache. Thus, sets of MAC addresses found in these tables may not necessarily be complete. This problem may be resolved using either one or a combination of the following techniques:

[0027] 1. Generate extra network traffic across switches (using the known IP “ping” mechanism) to ensure that the address forwarding tables are adequately populated; and

[0028] 2. Employ reasonable approximations, noted below, concerning whether or not two particular elements could in fact be interconnected.

[0029] Because it is unlikely that accumulated address forwarding information for a particular element interface is complete without an inordinate amount of extra traffic, a hybrid of steps (1) and (2) above will likely work best in practice.

[0030] Virtual local area networks (VLANs) allow IP network managers to break a linkage between physical and logical connections in a network, by assigning the interfaces of a single network element to different subnets. The present topology discovery technique may be applied to VLANs if the VLAN interface assignments, available in most proprietary MIBs, are known.

[0031] Consider a domain whose physical topology is to be discovered, as a management domain communication network N in FIG. 1. Also assume that nodes in the network correspond to network elements, for example and without limitation, routers (R), and switches (S) each of which switches serves a group of users or hosts having different IP addresses in the network N. A m direct physical connection between a pair of interfaces belonging to different network elements is referred to as an “edge” between the corresponding nodes of the network.

[0032] Define a switched domain to be the maximal set S of switches such that there is a path in network N between every pair of switches in S, involving only switches in S. In FIG. 1, R1, R2, and R3 are routers, while S1 through S5 are switches forming two distinct switched domains (S1, S2, S3), and (S4, S5). Further, define a subnet as the maximal set of IP addresses such that any two elements within a subnet can communicate (at ISO layer-3 or above) with each other without directing traffic through a router. Note that a switched domain may comprise parts of different subnets, and that communication between switches of different subnets must be directed through a router. Also assume in FIG. 1 that the switched domain (S4, S5) contains only one subnet (subnet 1), while the switched domain (S1, S2, S3) contains two subnets, one containing S1 and S3 (subnet 2), and the other containing 52 (subnet 3).

[0033] A packet from S1 to S2 is routed first to R1 which determines that since S2 is in a different subnet than S1 (i.e., S2 is not “local” to S1), S1's packet is sent from R1 to R2, the latter being the router assigned to S2's subnet, despite the existence of a direct physical connection between S1 and S2. R2 then sends S1's packet to S2. Also, in FIG. 1, a packet from S1 to S3 is first sent to R1, which determines that since S3 is in the same subnet as S1, S1 may communicate “directly” with S3 via the physical links with S2, even though S2 is in a different subnet than S1 and S3.

[0034] Switches in a switched domain typically employ a known spanning tree protocol to determine unique forwarding paths for each switch. See, e.g., A. S. Tanenbaum, Computer Networks, 3d ed. (Prentice Hall 1996), all relevant portions of which are incorporated by reference. The present topology discovery method may incorporate MAC addresses acquired through backward learning (id.) on interfaces that are part of the switched domain spanning tree. Therefore, edges between interfaces that are not active (i.e., are eliminated by the spanning tree protocol) may not be discovered. It is therefore assumed that all inactive edges may be ignored in the management domain network of interest.

[0035] Denote the jth port or interface of a switch Si, by Sij. For each interface Sij, a set of addresses that have been determined (by backward learning or otherwise) for that interface is referred to as the address forwarding table Aij for Sij. Typically, Aij is a set whose members are MAC addresses that have -been seen as source addresses on frames or packets received at Sij. Thus, Aij represents those nodes that can be reached to receive frames directed out from the interface Sij. Aij is considered complete if Aij contains the addresses of all switches and routers from which frames can be received at Sij. If the switched domain comprises only one subnet, the Aij represents the set of nodes in N that are reachable from Si via the interface Sij by a path in the switched domain spanning tree. In the case of multiple subnets, however, the foregoing is not necessarily true. For example, in FIG. 1, S3 will never receive a frame from S2 with S2 as the source MAC address. The reason is that if S2 (in subnet 3) has to communicate with S3 (in subnet 2), then a packet from S2 is first sent to R2, which in turn forwards it to R1. Finally, R1 forwards the frame to S3 with the source MAC address being that of R2 (even though the frame passes through S2).

[0036] Assume that:

[0037] (i) each switched domain contains exactly one subnet,

[0038] (ii) no VLANs are present in the management domain, and

[0039] (iii) the address forwarding tables are complete.

[0040] Discovering Routers in the Management Domain

[0041] A set of routers in the management domain may be discovered by repeatedly identifying neighboring routers of currently known routers, until no new routers are discovered. Assume that the IP address of at least one router in the management domain, e.g., R₁, is known to bootstrap this process. The neighboring routers of any router R are the set of routers that are next hops for some destination in the ipRouteTable in the MIB for R. See, e.g., K. McCloghrie and M. Rose, Management Information Base for Network Management of TCP/IP-based Internets: MIB-II, Internet RFC-1213 (Mar. 1991) (hereafter MIB-II). All relevant portions of MIB-II are incorporated by reference herein. The following procedure may therefore be used for discovering the entire set of routers in the management domain.

[0042] Discovering Switches in the Management Domain

[0043] A set of switches in the Management Domain may be identified, for example, by first discovering, for each interface of a router R, the subnet that it is directly connected to or, equivalently, the set of IP addresses D to which it can perform direct delivery. This is obtained by first obtaining the IP address of an interface of R using the ipAddrTable described in MIB-II. D is then computed by enumerating the set of IP addresses in the subnet corresponding to the IP address of an interface.

[0044] The above enumeration takes into account subnet masks and IP address formats. Once D is computed, for each IP address in D, it can be determined if it is a switch by checking for the presence of a Bridge MIB. See E. Decker, et al, Definitions of Managed Objects for Bridges, Internet RFC-1493 (Jul. 1993), all relevant portions of which are incorporated by reference. Actually, both routers and switches contain a Bridge MIB and, therefore, the value of the ipForwarding variable is used to determine if an IP address belongs to a switch or a router. If IpForwarding is equal to 1, the element is a router; otherwise it is a switch. Persons skilled in the art will understand that other known techniques for discovering switches and routers in a network may be employed.

[0045] Having discovered the set of routers and switches in the management domain, i.e., the nodes of N, the physical interconnections or edges between the nodes may be determined as follows:

[0046] Discovering the Edges in N

[0047] The edges of N are discovered one switched domain at a time. Let μ be the set of MAC addresses corresponding to the switches and the routers of a subnet S. A necessary and sufficient condition for an interface of a switch to be connected to an interface of another switch, is established by lemma (1), below.

[0048] (1) Interfaces Sij and Skl are connected to each other if, any only if, Aij∪Akl=μ, and Aij∩Akl=φ.

[0049] To prove lemma (1), assume Sij and Skl are connected to each other. Clearly, Aij∩Akl=φ. Further, since the Aij's are complete, Aij∪Akl=μ.

[0050] Next, assume Aij∪Akl=μ and Aij∩Akl=φ. Let, if possible, Sij and Skl not be connected to each other, let P be the path from Si to Sj in the spanning tree, and recall the assumption that all the Aij are complete. Then, there are three possibilities:

[0051] 1. P contains both Sij and Skl: If so, there exists another switch Sm in P and, therefore, it can not be the case that Aij∩Akl=φ.

[0052] 2. P contains exactly one of Sij or Skl. If so, once again it can not be the case that Aij∩Akl=φ.

[0053] 3. P contains neither Sij nor Skl. If so, Aij∪Akl ≠μ, since the union will not contain both Si and Sk.

[0054] Lemma (1) thus provides a routine to discover connections between switches in single subnet switched domains. Connections between routers and switches must also be discovered, however. A condition for a router to be connected to a switch will now be described with respect to the following definition.

[0055] A “leaf interface” of a switch Si is an interface that is not connected to an interface of any other switch.

[0056] Accordingly, an interface Sij for which there does not exist another interface Skl, such that Aij and Akl satisfy the conditions specified in lemma (1), is a leaf interface. Lemma (2) below states a necessary and sufficient condition for a router to be connected to a switch.

[0057] (2) A router R is connected to an interface Sij if and only if (a) Sij is a leaf interface, and (b) Aij contains the MAC address of R.

[0058] The edge discovery procedure based on Lemmas (1) and (2) above, may be described as follows:

[0059] As described above, for switched domains containing a single subnet, interfaces Sij and Skl are connected if and only if the union Aij∪Akl contains all the nodes in the subnet, and the intersection Aij∩Akl is empty. Unfortunately, it can not always be assumed that switches in a given switched domain are all members of a single subnet. For example, see FIG. 1 and consider the network depicted in FIG. 2.

[0060] Assume in FIG. 2 that switches S1 and S4 belong to subnet 1, while switches S2 and S3 belong to subnet 2. The procedure described above for single subnet switched domains will not be able to connect interfaces S21 to S12, as it should for the topology of FIG. 2. This is because switches S2 and S3 of subnet 2 will not be identified in the address forwarding table A12 for interface S12 of switch Si in subnet 1. That is, since S2 and S3 are associated with a different subnet than S1, frames originating at S2 and S3 for transmission to S1 are routed through R2. Even if the single subnet discovery procedure were modified to state that two interfaces are connected if the union of the address sets includes all switches of one subnet, the procedure would not work. Since A12∪A21, A12∪A31, and A12∪A41 each contain all the switches in subnet 1 in FIG. 2, then interfaces S21, S31, and S41 would all be valid candidates for connection to interface S12, which violates the condition that interface matching must be one-to-one.

[0061] The single subnet topology discovery procedure, above, may be extended to account for cases when the procedure uncovers multiple interfaces that are potentially connected to another, single interface. This extension make uses of properties of the known spanning tree algorithm, and enables the choice of interfaces that can be connected to a given interface to be narrowed. Although it is shown below that there are cases where it is impossible to determine a unique topology of switches based only on address forwarding information, it is expected that such cases will be rare.

[0062] Consider the distinct network topologies depicted in. FIGS. 3(a) and 3(b). Assume that switches S1 and S4 belong to subnet 1, while switches S2 and S3 belong to subnets 2 and 3, respectively. The address forwarding tables for switches in both topologies will be identical, even though S2 is connected to S1 in FIG. 3(a), and S3 is connected to S1 in FIG. 3(b). Thus, any procedure that relies only on address forwarding table information may not distinguish between the two topologies. It is possible, however, to determine a minimal set of candidate topologies that contain the actual network topology.

[0063] Properties of Switched Domains containing Multiple Subnets

[0064] As mentioned, when discovering a physical topology of switched domains containing multiple subnets, interfaces that cannot be connected are determined and ruled out. The following lemmas identify conditions under which two interfaces cannot be matched, and make use of the following property for switched domains containing multiple subnets:

[0065] Suppose Si and Sk are two switches from different subnets; Then Aij contains Sk if and only if there is a node Sp from the same subnet as Sk such that Sp, . . . , Si . . . , Sk is a path in the spanning tree. Let Uijkl denote the union Aij∪Akl.

[0066] Lemma (3) Let Sij and Skl be different interfaces. If Aij∩Akl≠φ, then interfaces Sij and Skl cannot be matched:

[0067] Proof: Suppose to the contrary that switch Sp appears in both Aij and Akl, and interfaces Sij and Skl are connected. Then, there is a path from Sp to Si via Sk, and from Sp and Sk via Si. Further, each of these paths belongs to the spanning tree, which leads to a contradiction. Thus, if two interfaces have non-empty intersections, they cannot be matched.

[0068] Lemma (4): Let t be a subnet that contains at least two switches Sp and Sq. If Aij∩Akl=φ and Uijkl contains either Sp or Sq, but not both, then the interfaces Sij and Skl cannot be matched.

[0069] Proof: Suppose that Sij and Skl are connected. Without loss of generality, let Sp∈Aij. Thus, there must be a path from Sp to Si passing through Sk in the spanning tree. We consider two cases:

[0070] 1. The path from Sq to Si in the spanning tree does not pass through Sk: In this case, Sq will belong to Akl since the path in the spanning tree from Sq to Sp will pass through Si and Sk, and S1 and Sp belong to the same subnet t.

[0071] 2. The path from Sq to Si in the spanning tree passes through Sk: In this case, since Sp is in Aij, there must be a switch Sr such that Sp, . . . , Sk, Si, . . . , Sr is a path in the spanning tree and Sr also belongs to subnet t. Thus, it follows that Sq, . . . , Sk, Si, . . . , Sr will also be a path in the tree and Sq will belong to Aij also.

[0072] Thus, we have shown above that both Sp and Sq must belong to Uijkl if Sij and Skl are connected, and so the interfaces cannot be connected.

[0073] Lemma (5): Let Aij∩Akl=φ and Aij∩Apt=φ. If Uijkl=Uijpt and Si and Sk belong to the same subnet which is different from that of Sp, then Sij and Skl cannot be matched.

[0074] Proof: Suppose Sij and Skl are connected. Note that Akl=Apt since Aij∩Akl=φ, Aij∩Apt=φ and Uijkl=Uijpt. Also, since Si and Sk are from the same subnet, Si∈Akl and thus, Si∈Apt. Thus, there must exist a switch Sr, belonging to the same subnet as Si such that Si, Sk, . . . , Sp. . . , Sr is a path in the spanning tree for the subnet. Since Si and Sk belong to the same subnet, however, this implies that Sk∈Apt, which leads to the contradiction that Sk∈Akl.

[0075] Assume initially that every candidate pair of interfaces is physically connected. The results of the lemmas presented above are applied next in order to eliminate pairs of interfaces that cannot be matched. Then, for a selected interface, a set of other interfaces are left to which the selected interface may potentially be connected. If, after excluding pairs of interfaces that cannot match, every interface matches only one other interface, a unique physical topology of the network has been computed.

[0076] From Lemmas 3, 4 and 5, it follows that for any pair of interfaces Sij and Skl to match, the following must hold:

[0077] 1. Aij∩Akl is empty.

[0078] 2. For every subnet t, Aij∪Akl contains either all nodes from subnet t, or none of them.

[0079] 3. If Sij and Skl belong to the same subnet, then there does not exist a switch Sp from a different subnet such that Uijkl=Uijpt and Aij∩Apt=φ.

[0080] For all pairs of potentially matching interfaces Sij and Skl satisfying the above conditions, unions Uijkl are referred to as “valid” unions representing candidate connections. For a valid union Uijkl, if Skl does not occur in any other valid union, then we can conclude that Sij is connected to Skl. As a result, all other valid unions containing Sij can be eliminated. This follows since the set of valid unions represents a superset of the actual connections in the network. Also note that, since between any pair of switches there can be at most one direct active connection, once an interface of Si is connected with an interface of Sk, all other valid unions containing both Si and Sk can be eliminated.

[0081] After generating sets of addresses that can be reached from each interface of each element in a multiple subnet network, the present procedure may be summarized as follows. See FIG. 7.

[0082] 1. Generate an initial set of valid unions U.

[0083] 2. Repeat the following step until no further valid unions can be deleted from U.

[0084] 2.1. If an interface Skl occurs in only one valid union Uijkl in U, then (1) delete all valid unions containing Sij from U except for Uijkl, and (2) delete all valid unions Uixky, x≠j, y≠l.

[0085] 3. For every valid union Uijkl remaining in U, output “Sij connected to Skl”.

[0086] Connections output by the present procedure are assuredly a superset of the actual connections in the network. As mentioned earlier, for certain networks (see FIGS. 3(a) & 3(b)), it may be impossible to compute the network topology accurately. For such networks, the present procedure may not output a unique network topology, but, rather, output multiple possible connections for a selected interface only one of which is an actual connection in the network. For most practical network topologies, however, the procedure should generate precise topology information in which there is a one-to-one mapping between interface pairs.

[0087] The following example shows that while the earlier described topology discovery procedure for the single subnet case cannot produce the correct topology for the 2-subnet network in FIG. 2, the above multiple subnet procedure will identify the network topology correctly.

[0088] Consider the network of FIG. 2. Switches S1, S4 and router R1 belong to subnet 1, while switches S2, S3 and router R2 belong to subnet 2. There is a single interface (S11) that contains only R1, and a single interface (S23) that contains only R2. Consequently, S11 is matched with R1, and S23 is matched with R2. The remaining sets of addresses Aij are listed below.

[0089] Valid unions (candidate connections) are as follows:

[0090] Note that U1231={S1, S2, S4, R1, R2} is not a valid union due to Lemma (4) since it contains switch S2 but not switch S3 which belongs to subnet 2. Further, U1241={S1, S4, R1} is also eliminated due to Lemma (5) since U1241=U1221 and switches S1 and S4 belong to the same subnet, while S1 and S2 belong to different subnets. Since every interface occurs only once in the above set of valid unions, S12 is matched with S21, S22 is matched with S31, and S32 is matched with S41.

[0091] Characterization of Identified Topologies

[0092] A class of networks for which the present multiple subnet topology discovery procedure will identify a unique physical topology, are defined herein as “ordered” networks. Also, a set of addresses A are defined to be legal if, for any subnet t, A contains either all or none of the addresses in t.

[0093] Specifically, a network is an ordered network if it can be arranged as a tree that satisfies the following two properties:

[0094] 1. For each subtree in the network tree, and for each subnet contained in the subtree, there exists a node belonging to the same subnet in another subtree of the network.

[0095] 2. For any two subtrees rooted at switches Si and Sk in the network, if the union of address in the two subtrees is legal, then the switches Si and Sk belong to the same subnet and their parents also belong to the same subnet.

[0096] Denote a connection between interfaces Sij and Skl wherein Si is a parent of Sk in the network tree, by <Sij, Skl>. A pair of subtrees are “legal” subtrees if the union of addresses in the subtrees is legal. The first property of ordered networks ensures that for a connection <Sij, Skl>, the address table Aij contains all the addresses in the subtree rooted at Sk. The second property, by requiring that roots and parents of a pair of legal subtrees belong to the same subnet, ensures that valid unions which do not correspond to matching connections are eliminated by the topology discovery procedure. This requirement is not too restrictive, since most networks will likely contain few pairs of legal subtrees. Furthermore, it is trivially satisfied in networks that do not contain pairs of legal subtrees, or networks in which each subnet occurs in more than two distinct subtrees of the root.

[0097] The network depicted in FIG. 2 is an ordered network. Consider the network in FIG. 2 arranged as a tree with switch S2 as the root, as re-drawn in FIG. 4. Note that for each subtree in the network tree, there is a node assigned to a subnet that extends to another subtree of the network. For example, consider the subtree rooted at S1. Node S4 belongs to the same subnet as S1, but is not contained in the same subtree. Also, the network satisfies the second property of the ordered network definition. To see this, note that the subtrees rooted at switches S1 and S4 constitute a pair of legal subtrees since they contain all the addresses in subnet 1. The parents S2 and S3 of switches S1, S4 also belong to the same subnet (subnet 2). The following discussion demonstrates that the present topology discovery procedure produces an accurate physical topology for ordered network graphs.

[0098] In ordered networks, for any connection <Sij, Skl>, Aij is the set of addresses that appear in the subtree rooted at Sk. Also, Akl is the set of addresses belonging to subnets in Sk's subtree that are not contained in Aij. We refer to these addresses as the complement of Aij and denote them by Aij. Note that Aij∪Aij is legal. Thus, Akl=Aij and Aij=Akl.

[0099] In an ordered network, for any distinct pair of switch connections <Sij,Skl> and <Spq,Suv>, Aij≠Apq and Akl≠Auv. As a result, for the connection <Sij, Skl>, there can exist at most one other connection <Spq,Suv>such that Aij=Auv and Akl=Apq. In this case, the subtrees rooted at Sk and Su constitute a pair of legal subtrees. Furthermore, these connections can result in the following four valid unions that are all equal, namely, Uijkl, Uijpq, Upquv and Ukluv. Of these, Uijpq and Ukluv can be deleted since Si and Sp belong to the same subnet, and Sk and Su also belong to the same subnet (due to the second property of ordered networks). It must be shown that the valid unions Uijkl and Upquv will not be deleted, however. To accomplish this, Si and Sk must be shown to belong to different subnets. A similar argument can be used to show that Sp and Su also belong to different subnets. If Si is in the same subnet as Sk, then Si must belong to Skl. Since Skl=Spq, however, Si must be in the subtree rooted at Su. This would mean that Sk is in the subtree rooted at Su, and that Sk∈Spq, which is impossible since Skl=Spq.

[0100] The present topology discovery technique can also find an accurate topology of networks that may not be ordered. FIG. 5 depicts one such network. In the figure, switches S1, S3, S5 and router R2 belong to subnet 1; switch S2 and router R1 belong to subnet 2; and switch S4 and router R3 belong to subnet 3. For every possible network tree, one of subnets 2 or 3 will be entirely contained in a single subtree. Thus, the network cannot be ordered. The present technique will, however, accurately discover the physical topology of the network. Thus, ordered networks are only a subclass of a broader class of networks for which the present technique will identify a unique physical network topology.

[0101] The following shows how the topology discovery procedures disclosed above can be extended to handle incomplete address forwarding tables, and VLANs.

[0102] Dealing With the Completeness Requirement

[0103] Thus far, it was assumed that each address forwarding table Aij was complete, i.e., that it contained all MAC addresses reachable from node Si through the node interface Sij. In practice, however, this condition may not always be true. One reason is that although the tables are learned based on source addresses in frames received at the interface Sij, the learned entities are aged (and removed) by the switches. Therefore, unless a switch constantly receives packets from a source at intervals less than the aging interval (typically 5 minutes), the switch may delete the entry corresponding to that source, leaving the forwarding table for interface Sij incomplete.

[0104] Two complementary solutions to the above problem are presented. The first attempts to keep the Aij's as complete as possible, while the second attempts to handle minor deviations from completeness. Together, the solutions ensure that the present technique will work satisfactory in practice.

[0105] The first solution involves generating constant traffic between any pair of switches in the switched domain and, consequently, not allowing the address forwarding table entries to age. For example, traffic from a node X to a node Y can be. generated in response to an ICMP (Echo Request) message from a network management station to node X, with the source address in the ICMP packet set to the IP address of node Y. This will cause node X to respond to the Echo Request by replying to Y. A minor modification of publicly available code for generating ICMP messages to build the appropriate IP header for the ICMP Echo Request, can be performed by persons skilled in the art. The second solution remedies minor deviations from completeness, by choosing to match interface Sij with interface Skl when Aij∩Akl=φ, and Aij∪Akl contains either no switches from each subnet, or a reasonably large (user-defined) fraction of the switches in the subnet.

[0106] Handling VLANs

[0107] Virtual LANs (VLANs) define multiple spanning trees within a switched domain. A switch may belong to multiple VLANs, and effectively maintain address forwarding tables for each VLAN of which it is a part. Frames belonging to a specific VLAN are forwarded by a switch using forwarding tables produced for that VLAN.

[0108] Therefore, with access to the address forwarding tables for interface Sij for each VLAN, the present topology discovery process can be repeated for each VLAN to generate a spanning tree for the VLAN. Care should be taken to stay within the universe of addresses comprising only MAC addresses in each VLAN. Even though standard SNMP MIBs usually do not provide information on address forwarding tables for individual VLANS, such information can be collected using proprietary MIBs (for example, the Prominent MIB for Cajun Switches).

[0109] The following example demonstrates that, even in the presence of multiple subnets and VLANs in a switched domain, and in the absence of specific information on forwarding tables for each VLAN, the present, multiple subnet topology discovery technique will identify the correct physical network topology.

[0110] Consider the network depicted in FIG. 6. Switches S1, S4, and router R1 belong to subnet 1; switches S2, S3, and router R2 belong to subnet 2; and switches S5, S6, and router R3 belong to subnet 3. In addition, there are 3 VLANs, one for each subnet. The first VLAN includes the path R1, S1, S2, S4; the second includes the tree involving router R2 and switches S1, S2 and S3; and the third includes the path R3, S6, S3, S4, S2, S5. The address forwarding tables for the interfaces, without taking into account VLAN information, are also shown in FIG. 6.

[0111] There are single interfaces that contain only R1 or R2, or R3. Consequently, these interfaces, r1, r2 and r3 are matched respectively with S11, S12, and S62, and are eliminated from further consideration. The set of valid unions is as follows:

[0112] The valid unions U1322, U1431, and U2341 all contain interfaces that appear only once in the set of unions. Consequently, S13, S14 and S23 are matched with S22, S31, and S41, respectively. Thus, union U2142 is eliminated since S23 is already matched with S41. Deletion of U2142 causes U2151 to be selected (since interface S21 appears only once). Thus, in the next iteration, U3351 is deleted. In the final iteration, among the remaining unions, since interfaces S32 and S33 occur only once, U3261 and U3342 are retained, while U4261 is eliminated. Thus, the final set of valid unions yields the actual topology of the network.

[0113] A practical procedure for discovering physical topology in heterogeneous IP networks, has been described. The procedure uses local address forwarding information routinely collected in the SNMP MIBs of routers and switches, and “stitches” such information together to produce a global layer-1 topology of a given network. The procedure can handle switched domains each comprising one or more subnets, and can be readily extended to deal with incomplete information and Vs.

[0114] While the foregoing description represents preferred embodiments of the invention, it will be obvious to those skilled in the art that various changes and modifications may be made, without departing from the spirit and scope of the invention pointed out by the following claims.