METHOD AND APPARATUS TO DETECT UNIDENTIFIED INVENTORY

• US 20150058468A1
• Filed: 11/04/2014
• Published: 02/26/2015
• Est. Priority Date: 03/03/2011
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Ramaswamy, Krishnan, Thirukazhukundram, Suresh, Garg, Gaurav, Camplejohn, Christopher, Sinclair, Keith, Rosen, Edward, John, Sunil
• Granted Patent: US 10,110,437 B2
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: H04L 41/0853 by actively collecting configuration information or by backing up configuration information
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: Y02D 30/00 Reducing energy consumption in communication networks

Abstract

Techniques are disclosed for detecting unidentified inventory in a network. In one embodiment, data that was collected from a plurality of network devices is received. The data includes at least one device identifier for a neighboring network device of at least one network device of the plurality of network devices. The at least one device identifier for the neighboring network device is compared to one or more device identifiers of known network devices. In response to determining that the at least one device identifier for the neighboring network device does not match a device identifier for the known network devices, the at least one device identifier is added to a list of unidentified inventory.

Claims

1. A method comprising:

determining a topology exception for a network device on a managed network;

in response to determining the topology exception, identifying one or more network identifiers for unidentified network devices based on topology data from the network device;

adding the one or more network identifiers to a list of unidentified inventory;

wherein the method is performed by one or more computing devices.

2. The method of claim 1, wherein the topology exception is a subnet topology exception and the unidentified network device is a partner node of the network device.

3. The method of claim 1, wherein the topology exception is a topology protocol exception and the unidentified network device is an unidentified Border Gateway Protocol (BGP) neighbor of the network device.

4. The method of claim 1, wherein the topology exception is a topology protocol exception and the unidentified network device is an unidentified Data-Link Switching (DLSw) neighbor of the network device.

5. The method of claim 1, further comprising performing said determining and identifying for a plurality of network devices, the method further comprising:

generating a score for each unidentified network device based on how many network devices detect the unidentified network device.

6. A method comprising;

determining, from a syslog message, a device identifier for a network device that sent the syslog message;

comparing the device identifier to device identifiers for known network devices;

in response to determining that the device identifier does not match a device identifier for the known network devices, adding the device identifier to a list of unidentified inventory;

wherein the method is performed by one or more computing devices.

7. The method of claim 6, wherein the syslog message is one of a plurality of syslog messages that are logged by a syslog server.

8. The method of claim 7, further comprising performing the steps of determining, comparing, and adding for each syslog message logged by the syslog server.

9. The method of claim 6, wherein the plurality of syslog messages are collected from a syslog server using a network collector.

10. The method of claim 6, wherein the device identifier is at least one of an Internet Protocol (IP) address or a hostname.

11. A non-transitory computer-readable storage medium comprising one or more sequences of instructions which when executed cause:

determining a topology exception for a network device on a managed network;

in response to determining the topology exception, identifying one or more network identifiers for unidentified network devices based on topology data from the network device;

adding the one or more network identifiers to a list of unidentified inventory;

wherein the non-transitory computer-readable storage medium is performed by one or more computing devices.

12. The non-transitory computer-readable storage medium of claim 11, wherein the topology exception is a subnet topology exception and the unidentified network device is a partner node of the network device.

13. The non-transitory computer-readable storage medium of claim 11, wherein the topology exception is a topology protocol exception and the unidentified network device is an unidentified Border Gateway Protocol (BGP) neighbor of the network device.

14. The non-transitory computer-readable storage medium of claim 11, wherein the topology exception is a topology protocol exception and the unidentified network device is an unidentified Data-Link Switching (DLSw) neighbor of the network device.

15. The non-transitory computer-readable storage medium of claim 11, further comprising instructions which when executed cause performing said determining and identifying for a plurality of network devices, the non-transitory computer-readable storage medium further comprising instructions which when executed cause:

generating a score for each unidentified network device based on how many network devices detect the unidentified network device.

16. A non-transitory computer-readable storage medium comprising instructions which when executed cause:

determining, from a syslog message, a device identifier for a network device that sent the syslog message;

comparing the device identifier to device identifiers for known network devices;

in response to determining that the device identifier does not match a device identifier for the known network devices, adding the device identifier to a list of unidentified inventory;

wherein the non-transitory computer-readable storage medium is performed by one or more computing devices.

17. The non-transitory computer-readable storage medium of claim 16, wherein the syslog message is one of a plurality of syslog messages that are logged by a syslog server.

18. The non-transitory computer-readable storage medium of claim 17, further comprising instructions which when executed cause performing the steps of determining, comparing, and adding for each syslog message logged by the syslog server.

19. The non-transitory computer-readable storage medium of claim 16, wherein the plurality of syslog messages are collected from a syslog server using a network collector.

20. The non-transitory computer-readable storage medium of claim 16, wherein the device identifier is at least one of an Internet Protocol (IP) address or a hostname.