METHOD AND APPARATUS TO DETECT UNIDENTIFIED INVENTORY

• US 20120226791A1
• Filed: 03/03/2011
• Published: 09/06/2012
• Est. Priority Date: 03/03/2011
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Thirukazhukundram, Suresh, RAMASWAMY, Krishnan, Camplejohn, Christopher Scott, Sinclair, Keith, Rosen, Edward M., John, Sunil Shashikanth, Garg, Gaurav
• Granted Patent: US 8,880,669 B2
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: H04L 41/0853 by actively collecting configuration information or by backing up configuration information
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: Y02D 30/00 Reducing energy consumption in communication networks

Abstract

Techniques are disclosed for detecting unidentified inventory in a network. In one embodiment, data that was collected from a plurality of network devices is received. The data includes at least one device identifier for a neighboring network device of at least one network device of the plurality of network devices. The at least one device identifier for the neighboring network device is compared to one or more device identifiers of known network devices. In response to determining that the at least one device identifier for the neighboring network device does not match a device identifier for the known network devices, the at least one device identifier is added to a list of unidentified inventory.

Claims

1. A method comprising:

receiving data that was collected from a plurality of network devices;

wherein the data includes at least one device identifier for a neighboring network device of at least one network device of the plurality of network devices;

comparing the at least one device identifier for the neighboring network device to one or more device identifiers of known network devices;

in response to determining that the at least one device identifier for the neighboring network device does not match a device identifier for the known network devices, adding the at least one device identifier to a list of unidentified inventory;

wherein the method is performed by one or more computing devices.

2. The method of claim 1, further comprising, for each selected network device of the plurality of network devices:

determining whether data collected from the selected network device includes a set of device identifiers for a set of neighboring network devices;

determining which neighboring devices of the set of neighboring devices are unidentified network devices by comparing each device identifier of the set of device identifiers to the one or more device identifiers of the known network devices.

3. The method of claim 2, further comprising:

for each unidentified network device, determining whether a corresponding device identifier for the unidentified network device has been added to the list of unidentified inventory;

if the corresponding device identifier has not been added to the list of unidentified inventory, adding the corresponding device identifier to the list of unidentified inventory.

4. The method of claim 3, further comprising:

adding device identifier for the selected network device that detected the unidentified network device to a list of devices that have detected the unidentified network device.

5. The method of claim 3, further comprising:

generating a score for each unidentified network device;

wherein the score is based, at least in part, on how many selected network devices of the plurality of network devices detected the unidentified network device.

6. The method of claim 5, further comprising if the corresponding device identifier has already been added to the list of unidentified inventory, updating the score for the unidentified network device by incrementing the score.

7. The method of claim 5, further comprising sorting the list of unidentified inventory based on the score for each unidentified network device on the list of unidentified inventory.

8. The method of claim 5, further comprising:

determining whether the unidentified network device sent a syslog message;

in response to determining that the unidentified network device sent a syslog message, updating the score for the unidentified network device by incrementing the score.

9. The method of claim 2, wherein data collected from the selected network device includes Cisco Discovery Protocol (CDP) or Link Layer Discovery Protocol (LLDP) data.

10. The method of claim 2, wherein data collected from the selected network device includes topology data from a topology table of the selected network device.

11. A method comprising:

determining a topology exception for a network device on a managed network;

in response to determining the topology exception, identifying one or more network identifiers for unidentified network devices based on topology data from the network device;

adding the one or more network identifiers to a list of unidentified inventory;

wherein the method is performed by one or more computing devices.

12. The method of claim 11, wherein the topology exception is a subnet topology exception and the unidentified network device is a partner node of the network device.

13. The method of claim 11, wherein the topology exception is a topology protocol exception and the unidentified network device is an unidentified Border Gateway Protocol (BGP) neighbor of the network device.

14. The method of claim 11, wherein the topology exception is a topology protocol exception and the unidentified network device is an unidentified Data-Link Switching (DLSw) neighbor of the network device.

15. The method of claim 11, further comprising performing said determining and identifying for a plurality of network devices, the method further comprising:

generating a score for each unidentified network device based on how many network devices detect the unidentified network device.

16. A method comprising;

determining, from a syslog message, a device identifier for a network device that sent the syslog message;

comparing the device identifier to device identifiers for known network devices;

in response to determining that the device identifier does not match a device identifier for the known network devices, adding the device identifier to a list of unidentified inventory;

wherein the method is performed by one or more computing devices.

17. The method of claim 16, wherein the syslog message is one of a plurality of syslog messages that are logged by a syslog server.

18. The method of claim 17, further comprising performing the steps of determining, comparing, and adding for each syslog message logged by the syslog server.

19. The method of claim 16, wherein the plurality of syslog messages are collected from a syslog server using a network collector.

20. The method of claim 16, wherein the device identifier is at least one of an Internet Protocol (IP) address or a hostname.