Automatic discovery of switch devices in a network

• US 6,795,403 B1
• Filed: 03/31/2000
• Issued: 09/21/2004
• Est. Priority Date: 03/31/2000
• Status: Expired due to Term

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Gundavelli, Srinath
• Primary Examiner(s): Kizou, Hassan
• Assistant Examiner(s): MILLS, DONALD L
• Application Number:
  US09/540,717
• Time in Patent Office: 1,635 Days
• Field of Search: 370/254, 370/255, 370/256, 370/258, 370/259, 370/390, 370/408, 370/432
• US Class Current: 370/256
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 45/02 Topology update or discovery
• CPC Class Codes: H04L 45/48 Routing tree calculation

Abstract

A method and apparatus provide automatic discovery of switch devices in a switched network. The remote monitor agent of a router is modified to detect packets received at the router that contain multicast destination addresses, e.g., packets that contain Bridge Protocol Data Units (BPDUs). Each packet is examined to determine a transmitting device identifier and a root device identifier value from the packet. The transmitting device identifier value and root device identifier value are associated with one or more switches in a managed network. The remote monitor agent determines the IP addresses that correspond to the transmitting device identifier value and root device identifier value, e.g., using reverse lookup approach. The IP address values, or other identifying information about the discovered switches, are stored in a MIB table. A network management station may retrieve the switch information from the MIB table and thereby discover switch devices in the network for use in a network management topology display or other applications.

Claims

1. A network comprising:

a network of one or more local area networks;

one or more network management systems coupled to the one or more local area networks;

one or more network management stations carrying at least one of the one or more network management systems;

at least one network device coupled to one more of the local area networks, the at least one network device carrying instructions for performing the method comprising the steps of receiving one or more data packets at a remote monitor agent that is logically coupled to the network, each packet containing a multicast destination address;

determining a transmitting device identifier value and a root device identifier value from the packet;

determining one or more switch device addresses that correspond to the transmitting device identifier value and a root device identifier value;

creating and storing information identifying the switch devices in a storage area that is accessible to the remote monitor agent and the network management system.

2. A machine-implemented method comprising:

a remote monitoring agent or discovery service carried by a network device capturing a plurality of Bridge Protocol Data Unit packets with multicast destination addresses;

discovering devices that communicate Bridge Protocol Data Unit elements, wherein the discovering is performed by at least

determining, for each of the plurality of Bridge Protocol Data Unit packets, a transmitting device identifier and a root device identifier, wherein

the transmitting device identifier is a MAC address,

the root device identifier is a MAC address,

the transmitting device identifier may be identical to, or different than, the root device identifier, and

the devices that are discovered in the discovering step are devices associated with the transmitting device identifier and the root device identifier;

determining IP addresses for the devices tat are discovered in the step of discovering by at least

examining an ARP to determine whether the ARP has an entry with IP addresses corresponding to each of the MAC addresses,

if there is no entry in the ARP for any of the MAC addresses, then the RMON agent or discovery service sends a Reverse Address Resolution Protocol (RARP) broadcast request into the network,

wherein the RARP request includes

the MAC address value and

a parameter that requests the IP address, and

wherein if a response to the RARP request is received, an IP address value received as a result of the response is associated with the MAC address;

storing device information about the devices in an MIB table if an entry containing the device information does not exist, wherein the device information includes at least

the MAC Address,

the IP Address,

a Router Interface Number on which the Bridge Protocol Data Unit was captured,

a Router Interface Address, and

a subnet mask;

a Net Work Management System (NMS) discovering a network device carrying the RMON or discovery service; and

the NMS querying the MIB table associated with the RMON or discovery service, by at least using an SNMP MIB request to retrieve information about devices that have been discovered in the network to discover the devices that are connected to a LAN that is in turn connected to the network device carrying the RMON or discovery service;

the NMS generating a graphical display of a network topology using the information in the MIB tables, wherein the topology includes the devices;

wherein the method is capable of determining that a particular device is an only device of a local area network that is logically coupled to the network device, by determining at least that the Root ID value and Transmitting Bridge ID value in some of the plurality of Bridge Protocol Data Units are identical;

wherein if multiple devices are connected in a cascade, the method is capable of discovering the device corresponding to the Root ID based on the Root ID, discovering the device corresponding to the Transmitting Bridge ID from the Transmitting Bridge ID,

and the method is capable of discovering others of the multiple devices via at least

another RMON agent or discovery service discovering at least some of the others of the multiple devices, wherein the other RMON or discovery service is carried on another network device that is connected to a logical segment containing the multiple devices,

reapplying the method after a network topology change, and

reapplying the method after an occurrence of a Bridge Protocol Data Unit Keep-Alive packet delay in which detecting packets having a delay time of greater than a pre-determined period of time causes the devices to re-elect a new device as root node.

3. A method of automatically discovering network devices in a network for use by a network management system, comprising the steps of:

discovering network devices, wherein the network devices transmit one or more data packets each data packet having at least a transmitting device identifier value and a root device identifier value corresponding to one or more of the network devices, and a multicast destination address, and

wherein the step of discovering includes at least the steps of

receiving the one or more data packets at an entity that is remote from the network management system and that is logically coupled to the network;

determining, at the entity, the transmitting device identifier value and the root device identifier value from the data packet;

determining one or more device addresses that correspond to, but that are different from, the transmitting device identifier value and the root device identifier value, wherein the one or more device addresses correspond to the network devices discovered;

creating and storing information identifying the network devices discovered in a storage area that is accessible to the entity and the network management system.

4. A method as recited in claim 3, wherein the step of receiving the one or more data packets comprises the step of receiving one or more Bridge Protocol Data Units at the entity.

5. A method as recited in claim 3, wherein the step of receiving the one or more data packets at the entity comprises the step of receiving one or more Bridge Protocol Data Units at a remote monitor agent in a router in the network.

6. A method as recited in claim 3, wherein the step of receiving the one or more data packets comprises the step of receiving each packet that has a Spanning Tree multicast destination address and that appears on any interface of a router in the network.

7. A method as recited in claim 3, wherein the step of receiving the one or more data packets comprises the step of receiving each packet that has a Spanning Tree multicast destination address and that appears on any interface of a router in the network, wherein the router is coupled to a logical segment of the network that includes the entity.

8. A method as recited in claim 3,

wherein the step of receiving the one or more data packets at the entity comprises the step of receiving one or more Bridge Protocol Data Units at a remote monitor agent; and

wherein the step of determining a transmitting device identifier value and a root device identifier value comprises the step of identifying and obtaining a Transmitting Bridge ID value and a Root Device ID value from the Bridge Protocol Data Units.

9. A method as recited in claim 3, wherein the network devices are switches and the step of creating and storing information comprises the step of creating and storing a switch information table as an extension to a Management Information Base that is accessible to the entity.

10. A method as recited in claim 3, wherein the network devices are switches, the entity is a remote monitor agent, and the step of creating and storing information comprises the steps of:

creating a switch information table as an extension to a Management Information Base that is accessible to a remote monitor agent;

storing, in the switch information table, an entry for a discovered switch that includes a Switch MAC Address value and Switch IP Address value.

11. A method as recited in claim 3, wherein the network devices are switches, the entity is a remote monitor agent, and the step of creating and storing information comprises the steps of:

creating a switch information table as an extension to a Management Information Base that is accessible to the remote monitor agent;

storing, in the switch information table, an entry for a discovered switch that includes a Switch MAC Address value, Switch IP Address value, Router Interface Number value for a router interface, and Router Interface Address and Subnet Mask values for the router interface.

12. A method as recited in claim 3, further comprising the step of repeating each of the preceding steps in response to election by the network devices of a new Spanning Tree root node.

13. A method as recited in claim 3, wherein the network devices are switches, the entity is a remote monitor agent, and the step of determining one or more device addresses that correspond to, but are different from, the transmitting device identifier value and root device identifier value includes the steps of:

receiving one or more Bridge Protocol Data Units at the remote monitor agent;

identifying and obtaining a Transmitting Bridge ID value and a Root Device ID value from the Bridge Protocol Data Units;

converting the Transmitting Bridge ID value and Root Device ID value into Internet Protocol addresses of one or more forwarding switch devices.

14. A method as recited in claim 3, wherein the network devices are switches, the entity is a remote monitor agent, and the step of determining one or more device addresses that correspond to, but are different from, the transmitting device identifier value and root device identifier value includes the steps of:

receiving one or more Bridge Protocol Data Units at the remote monitor agent;

identifying and obtaining a Transmitting Bridge ID value and a Root Device ID value from the Bridge Protocol Data Units;

determining an Internet Protocol address associated with one or more forwarding switch devices by carrying out a reverse lookup of the Transmitting Bridge ID value and the Root Device ID value.

15. A method as recited in claim 3, wherein the network devices are switches, the entity is a remote monitor agent, and the step of determining one or more device addresses that correspond to, but are different from, the transmitting device identifier value and root device identifier value includes the steps of:

receiving one or more Bridge Protocol Data Units at the remote monitor agent;

identifying and obtaining a Transmitting Bridge ID value and a Root Device ID value from the Bridge Protocol Data Units; and

receiving one or more Internet Protocol addresses associated with the one or more forwarding switch devices in response to issuing a Reverse Address Resolution Protocol (RARP) request to the network, wherein the RARP request includes the Transmitting Bridge ID value and Root Device ID as parameters.

16. A method as recited in claim 3, wherein the network devices are switches, the entity is a remote monitor agent, and the step of determining one or more device addresses that correspond to, but are different from, the transmitting device identifier value and a root device identifier value includes the steps of:

receiving one or more Bridge Protocol Data Units at the remote monitor agent;

identifying and obtaining a Transmitting Bridge ID value and a Root Device ID value from the Bridge Protocol Data Units;

wherein the Transmitting Bridge ID value and the Root Device ID value are MAC Addresses of one or more forwarding switch devices.

17. A method as recited in claim 3, wherein the network devices are switches, the entity is a remote monitor agent, and the step of determining one or more device addresses that correspond to, but are different from, the transmitting device identifier value and a root device identifier value includes the steps of:

receiving one or more Bridge Protocol Data Units at the remote monitor agent;

identifying and obtaining a Transmitting Bridge ID value and a Root Device ID value from the Bridge Protocol Data Units;

wherein the Transmitting Bridge ID value and Root Device ID value are MAC Addresses of one or more forwarding switch devices;

determining an Internet Protocol address associated with the one or more forwarding switch devices by carrying out a reverse lookup of the MAC Addresses in the network.

18. A method as recited in claim 3, wherein the network devices are switches, the entity is a remote monitor agent, and the step of determining one or more device addresses that correspond to, but are different from, the transmitting device identifier value and a root device identifier value includes the steps of:

receiving one or more Bridge Protocol Data Units at the remote monitor agent;

identifying and obtaining a Transmitting Bridge ID value and a Root Device ID value from the Bridge Protocol Data Units;

wherein the Transmitting Bridge ID value and Root Device ID value are MAC Addresses of one or more forwarding switch devices; and

receiving one or more Internet Protocol addresses associated with the one or more forwarding switch devices in response to issuing a Reverse Address Resolution Protocol (RARP) request to the network, wherein the RARP request includes the Transmitting Bridge ID value and Root Device ID as parameters.

19. A method as recited in claim 3, wherein the method further comprises determining that a particular network device is an only network device of a local area network that is logically coupled to the entity, by determining at least that the Root ID value and Transmitting Bridge ID value are identical in at least one of the data packets received.

20. A method as recited in claim 3, further comprising:

discovering one or more of the network devices from an initial application of the method;

discovering one or more additional network devices by reapplying the method after a network topology change, wherein the additional network devices were not found during the initial application;

including in topology information the one or more network devices and the one or more additional network devices.

21. A method as recited claim 3, further comprising:

discovering one or more network devices from an initial application of the method;

discovering one or more additional network devices by reapplying the method after an occurrence of a Bridge Protocol Data Unit Keep-Alive packet delay in which detecting packets having a delay time of greater than a pre-determined period of time causes the devices to re-elect a new device as root node, wherein the one or more additional network devices were not discovered during the initial application of the method;

including in topology information the one or more network devices and the one or more additional network devices.

22. A method as recited in claim 3, wherein at least one of the network devices discovered is not a switch.

23. A method as recited in claim 3, wherein the data packets are Bridge Protocol Data Units and the method is capable of discovering any type of network device that transmits Bridge Protocol Data Units and is associated with a MAC address and an IP address.

24. A method as recited in claim 3, further comprising:

the network management system accessing the storage area for the information; and

the network management system presenting the information as topology information about a topology of the network.

25. A method as recited in claim 3, further comprising:

the network management system gathering the information identifying the network devices from a plurality of entities and forming topology information about the network.

26. A method of automatically discovering switch devices in a network for use by a network management system, comprising the steps of:

receiving one or more data packets at a remote monitor agent that is logically coupled to the network, each packet containing a multicast destination address;

determining a transmitting device identifier value from the packet and a root device identifier value only from a corresponding field in the packet;

determining one or more switch device addresses that correspond to the transmitting device identifier value and root device identifier value;

creating and storing information identifying the switch devices in a storage area that is accessible to the remote monitor agent and the network management system.

27. A computer-readable medium carrying one or more sequences of instructions for providing automatic discovery of switch devices in a network, wherein execution of the one or more sequences of instructions by one or more processors causes the one or more processors to perform a method comprising the steps of:

discovering network devices, wherein the network devices transmit one or more data packets each data packet having at least

a transmitting device identifier value and a root device identifier value corresponding to one or more of the network devices, and

a multicast destination address, and

wherein the step of discovering includes at least the steps of

receiving the one or more data packets at an entity that is remote from the network management system and that is logically coupled to the network;

determining, at the entity, the transmitting device identifier value and the root device identifier value from the data packet;

determining one or more device addresses that correspond to, but that are different from, the transmitting device identifier value and the root device identifier value, wherein the one or more device addresses correspond to the network devices discovered;

creating and storing information identifying the network devices discovered in a storage area that is accessible to the entity and the network management system.

28. A computer readable medium as recited in claim 27, wherein the method further comprises determining that a particular network device is an only network device of a local area network that is logically coupled to the entity, by determining at least that the Root ID value and Transmitting Bridge ID value are identical in at least one of the data packets received.

29. A computer readable medium as recited in claim 27, wherein the method further comprises:

discovering one or more of the network devices from an initial application of the method;

discovering one or more additional network devices by reapplying the method after a network topology change, wherein the additional network devices were not found during the initial application;

including in topology information the one or more network devices and the one or more additional network devices.

30. A computer readable medium as recited in claim 27, wherein the method further comprises:

discovering one or more network devices from an initial application of the method;

discovering one or more additional network devices by reapplying the method after an occurrence of a Bridge Protocol Data Unit Keep-Alive packet delay in which detecting packets having a delay time of greater than a pre-determined period of time causes the devices to re-elect a new device as root node, wherein the one or more additional network devices were not discovered during the initial application of the method;

including in topology information the one or more network devices and the one or more additional network devices.

31. A computer readable medium as recited in claim 27, wherein at least one of the network devices discovered is not a switch.

32. A computer readable medium as recited in claim 27, wherein the data packets are Bridge Protocol Data Units and the method is capable of discovering any type of network device that transmits Bridge Protocol Data Units and is associated with a MAC address and an IP address.

33. A computer readable medium as recited in claim 27, wherein the method further comprises:

the network management system accessing the storage area for the information; and

the network management system presenting the information as topology information about a topology of the network.

34. A computer readable medium as recited in claim 27, wherein the method further comprises:

the network management system gathering the information identifying the network devices from a plurality of entities and forming topology information about the network.

35. A computer readable medium as recited in claim 27, wherein the step of receiving the one or more data packets comprises the step of receiving one or more Bridge Protocol Data Units at the entity.

36. A computer readable medium as recited in claim 27, wherein the step of receiving the one or more data packets at the entity comprises the step of receiving one or more Bridge Protocol Data Units at a remote monitor agent in a router in the network.

37. A computer readable medium as recited in claim 27, wherein the step of receiving the one or more data packets comprises the step of receiving each packet that has a Spanning Tree multicast destination address and that appears on any interface of a router in the network.

38. A computer readable medium as recited in claim 27, wherein the step of receiving the one or more data packets comprises the step of receiving each packet that has a Spanning Tree multicast destination address and that appears on any interface of a router in the network, wherein the router is coupled to a logical segment of the network that includes the entity.

39. A computer readable medium as recited in claim 27,

wherein the step of receiving the one or more data packets at the entity comprises the step of receiving one or more Bridge Protocol Data Units at a remote monitor agent;

and

wherein the step of determining a transmitting device identifier value and a root device identifier value comprises the step of identifying and obtaining a Transmitting Bridge ID value and a Root Device ID value from the Bridge Protocol Data Units.

40. A computer readable medium as recited in claim 27, wherein the network devices are switches and the step of creating and storing information comprises the step of creating and storing a switch information table as an extension to a Management Information Base that is accessible to the entity.

41. A computer readable medium as recited in claim 27, wherein the network devices are switches, the entity is a remote monitor agent, and the step of creating and storing information comprises the steps of:

creating a switch information table as an extension to a Management Information Base that is accessible to a remote monitor agent;

storing, in the switch information table, an entry for a discovered switch that includes a Switch MAC Address value and Switch IP Address value.

42. A computer readable medium as recited in claim 27, wherein the network devices are switches, the entity is a remote monitor agent, and the step of creating and storing information comprises the steps of:

creating a switch information table as an extension to a Management Information Base that is accessible to the remote monitor agent;

storing, in the switch information table, an entry for a discovered switch that includes a Switch MAC Address value, Switch IP Address value, Router Interface Number value for a router interface, and Router Interface Address and Subnet Mask values for the router interface.

43. A computer readable medium as recited in claim 27, further comprising the step of repeating each of the preceding steps in response to election by the network devices of a new Spanning Tree root node.

44. A computer readable medium as recited in claim 27, wherein the network devices are switches, the entity is a remote monitor agent, and the step of determining one or more device addresses that correspond to, but are different from, the transmitting device identifier value and root device identifier value includes the steps of:

receiving one or more Bridge Protocol Data Units at the remote monitor agent;

identifying and obtaining a Transmitting Bridge ID value and a Root Device ID value from the Bridge Protocol Data Units;

converting the Transmitting Bridge ID value and Root Device ID value into Internet Protocol addresses of one or more forwarding switch devices.

45. A computer readable medium as recited in claim 27, wherein the network devices are switches, the entity is a remote monitor agent, and the step of determining one or more device addresses that correspond to, but are different from, the transmitting device identifier value and root device identifier value includes the steps of:

receiving one or more Bridge Protocol Data Units at the remote monitor agent;

identifying and obtaining a Transmitting Bridge ID value and a Root Device ID value from the Bridge Protocol Data Units;

determining an Internet Protocol address associated with one or more forwarding switch devices by carrying out a reverse lookup of the Transmitting Bridge ID value and the Root Device ID value.

46. A computer readable medium as recited in claim 27, wherein the network devices are switches, the entity is a remote monitor agent, and the step of determining one or more device addresses that correspond to, but are different from, the transmitting device identifier value and root device identifier value includes the steps of:

receiving one or more Bridge Protocol Data Units at the remote monitor agent;

identifying and obtaining a Transmitting Bridge ID value and a Root Device ID value from the Bridge Protocol Data Units; and

receiving one or more Internet Protocol addresses associated with the one or more forwarding switch devices in response to issuing a Reverse Address Resolution Protocol (RARP) request to the network, wherein the RARP request includes the Transmitting Bridge ID value and Root Device ID as parameters.

47. A computer readable medium as recited in claim 27, wherein the network devices are switches, the entity is a remote monitor agent, and the step of determining one or more device addresses that correspond to, but are different from, the transmitting device identifier value and a root device identifier value includes the steps of:

receiving one or more Bridge Protocol Data Units at the remote monitor agent;

identifying and obtaining a Transmitting Bridge ID value and a Root Device ID value from the Bridge Protocol Data Units;

wherein the Transmitting Bridge ID value and the Root Device ID value are MAC Addresses of one or more forwarding switch devices.

48. A computer readable medium as recited in claim 27, wherein the network devices are switches, the entity is a remote monitor agent, and the step of determining one or more device addresses that correspond to, but are different from, the transmitting device identifier value and a root device identifier value includes the steps of:

receiving one or more Bridge Protocol Data Units at the remote monitor agent;

identifying and obtaining a Transmitting Bridge ID value and a Root Device ID value from the Bridge Protocol Data Units;

wherein the Transmitting Bridge ID value and Root Device ID value are MAC Addresses of one or more forwarding switch devices;

determining an Internet Protocol address associated wit the one or more forwarding switch devices by carrying out a reverse lookup of the MAC Addresses in the network.

49. A computer readable medium as recited in claim 27, wherein the network devices are switches, the entity is a remote monitor agent, and the step of determining one or more device addresses that correspond to, but are different from, the transmitting device identifier value and a root device identifier value includes the steps of:

receiving one or more Bridge Protocol Data Units at the remote monitor agent;

identifying and obtaining a Transmitting Bridge ID value and a Root Device ID value from the Bridge Protocol Data Units;

wherein the Transmitting Bridge ID value and Root Device ID value are MAC Addresses of one or more forwarding switch devices; and

receiving one or more Internet Protocol addresses associated with the one or more forwarding switch devices in response to issuing a Reverse Address Resolution Protocol (RARP) request to the network, wherein the RARP request includes the Transmitting Bridge ID value and Root Device ID as parameters.

50. A computer-readable medium carrying one or more sequences of instructions for providing automatic discovery of switch devices in a network, wherein execution of the one or more sequences of instructions by one or more processors causes the one or more processors to perform a method comprising the steps of:

receiving one or more data packets at a remote monitor agent that is logically coupled to the network, each packet containing a multicast destination address;

determining a transmitting device identifier value from the packet and a root device identifier value only from a corresponding field in the packet;

determining one or more switch device addresses that correspond to the transmitting device identifier value and root device identifier value;

creating and storing information identifying the switch devices in a storage area that is accessible to the remote monitor agent and the network management system.

51. An apparatus for automatically discovering network devices in a network, comprising:

a processor;

one or more stored sequences of instructions which, when executed by the processor, cause the processor to carry out a method including at least the steps of;

discovering network devices, wherein the network devices transmit one or more data packets each data packet having at least a transmitting device identifier value and a root device identifier value corresponding to one or more of the network devices, and a multicast destination address, and

wherein the step of discovering includes at least the steps of

receiving the one or more data packets at an entity that is remote from the network management system and that is logically coupled to the network;

determining, at the entity, the transmitting device identifier value and the root device identifier value from the data packet;

determining one or more device addresses that correspond to, but that are different from, the transmitting device identifier value and the root device identifier value, wherein the one or more device addresses correspond to the network devices discovered;

creating and storing information identifying the network devices discovered in a storage area that is accessible to the entity and the network management system.

52. An apparatus as recited in claim 51, wherein the method further comprises determining that a particular network device is an only network device of a local area network that is logically coupled to the entity, by determining at least that the Root ID value and Transmitting Bridge I value are identical in at least one of the data packets received.

53. An apparatus as recited in claim 51, wherein the method farther comprises:

discovering one or more of the network devices from an initial application of the method;

discovering one or more additional network devices by reapplying the method after a network topology change, wherein the additional network devices were not found during the initial application;

including in topology information the one or more network devices and the one or more additional network devices.

54. An apparatus as recited in claim 51, wherein the method further comprises:

discovering one or more network devices from an initial application of the method;

discovering one or more additional network devices by reapplying the method after an occurrence of a Bridge Protocol Data Unit Keep-Alive packet delay in which detecting packets having a delay time of greater than a pre-determined period of time causes the devices to re-elect a new device as root node, wherein the one or more additional network devices were not discovered during the initial application of the method;

including in topology information the one or more network devices and the one or more additional network devices.

55. An apparatus as recited in claim 51, wherein at least one of the network devices discovered is not a switch.

56. An apparatus as recited in claim 51, wherein the data packets are Bridge Protocol Data Units and the method is capable of discovering any type of network device that transmits Bridge Protocol Data Units and is associated with a MAC address and an IP address.

57. An apparatus as recited in claim 51, wherein the method further comprises:

the network management system accessing the storage area for the information; and

the network management system presenting the information as topology information about a topology of the network.

59. An apparatus as recited in claim 51, wherein the step of receiving the one or more data packets comprises the step of receiving one or more Bridge Protocol Data Units at the entity.

60. An apparatus as recited in claim 51, wherein the step of receiving the one or more data packets at the entity comprises the step of receiving one or more Bridge Protocol Data Units at a remote monitor agent in a router in the network.

61. An apparatus as recited in claim 51, wherein the step of receiving the one or more data packets comprises the step of receiving each packet that has a Spanning Tree multicast destination address and that appears on any interface of a router in the network.

62. An apparatus as recited in claim 51, wherein the step of receiving the one or more data packets comprises the step of receiving each packet that has a Spanning Tree multicast destination address and that appears on any interface of a router in the network, wherein the router is coupled to a logical segment of the network that includes the entity.

63. An apparatus as recited in claim 51,

wherein the step of receiving the one or more data packets at the entity comprises the step of receiving one or more Bridge Protocol Data Units at a remote monitor agent;

and

wherein the step of determining a transmitting device identifier value and a root device identifier value comprises the step of identifying and obtaining a Transmitting Bridge ID value and a Root Device ID value from the Bridge Protocol Data Units.

64. An apparatus as recited in claim 51, wherein the network devices are switches and the step of creating and storing information comprises the step of creating and storing a switch information table as an extension to a Management Information Base that is accessible to the entity.

65. An apparatus as recited in claim 51, wherein the network devices are switches, the entity is a remote monitor agent, and the step of creating and storing information comprises the steps of:

creating a switch information table as an extension to a Management Information Base that is accessible to a remote monitor agent;

storing, in the switch information table, an entry for a discovered switch that includes a Switch MAC Address value and Switch IP Address value.

66. An apparatus as recited in claim 51, wherein the network devices are switches, the entity is a remote monitor agent, and the step of creating and storing information comprises the steps of:

creating a switch information table as an extension to a Management Information Base that is accessible to the remote monitor agent;

storing, in the switch information table, an entry for a discovered switch that includes a Switch MAC Address value, Switch IP Address value, Router Interface Number value for a router interface, and Router Interface Address and Subnet Mask values for the router interface.

67. An apparatus as recited in claim 51, wherein the method further comprises the step of repeating each of the preceding steps in response to election by the network devices of a new Spanning Tree root node.

68. An apparatus as recited in claim 51, wherein the network devices are switches, the entity is a remote monitor agent, and the step of determining one or more device addresses that correspond to, but are different from, the transmitting device identifier value and root device identifier value includes the steps of:

receiving one or more Bridge Protocol Data Units at the remote monitor agent;

identifying and obtaining a Transmitting Bridge ID value and a Root Device ID value from the Bridge Protocol Data Units;

converting the Transmitting Bridge ID value and Root Device ID value into Internet Protocol addresses of one or more forwarding switch devices.

69. An apparatus as recited in claim 51, wherein the network devices are switches, the entity is a remote monitor agent, and the step of determining one or more device addresses that correspond to, but are different from, the transmitting device identifier value and root device identifier value includes the steps of:

receiving one or more Bridge Protocol Data Units at the remote monitor agent;

identifying and obtaining a Transmitting Bridge ID value and a Root Device ID value from the Bridge Protocol Data Units;

determining an Internet Protocol address associated with one or more forwarding switch devices by carrying out a reverse lookup of the Transmitting Bridge ID value and the Root Device ID value.

70. An apparatus as recited in claim 51, wherein the network devices are switches, the entity is a remote monitor agent, and the step of determining one or more device addresses that correspond to, but are different from, the transmitting device identifier value and root device identifier value includes the steps of:

receiving one or more Bridge Protocol Data Units at the remote monitor agent;

identifying and obtaining a Transmitting Bridge ID value and a Root Device ID value from the Bridge Protocol Data Units; and

receiving one or more Internet Protocol addresses associated with the one or more forwarding switch devices in response to issuing a Reverse Address Resolution Protocol (RARP) request to the network, wherein the RARP request includes the Transmitting Bridge ID value and Root Device ID as parameters.

71. An apparatus as recited in claim 51, wherein the network devices are switches, the entity is a remote monitor agent, and the step of determining one or more device addresses that correspond to, but are different from, the transmitting device identifier value and a root device identifier value includes the steps of:

receiving one or more Bridge Protocol Data Units at the remote monitor agent;

identifying and obtaining a Transmitting Bridge ID value and a Root Device ID value from the Bridge Protocol Data Units;

wherein the Transmitting Bridge ID value and the Root Device ID value are MAC Addresses of one or more forwarding switch devices.

72. An apparatus as recited in claim 51, wherein the network devices are switches, the entity is a remote monitor agent, and the step of determining one or more device addresses that correspond to, but are different from, the transmitting device identifier value and a root device identifier value includes the steps of:

receiving one or more Bridge Protocol Data Units at the remote monitor agent;

identifying and obtaining a Transmitting Bridge ID value and a Root Device ID value from the Bridge Protocol Data Units;

wherein the Transmitting Bridge ID value and Root Device ID value are MAC Addresses of one or more forwarding switch devices;

determining an Internet Protocol address associated with the one or more forwarding switch devices by carrying out a reverse lookup of the MAC Addresses in the network.

73. An apparatus as recited in claim 51, wherein the network devices are switches, the entity is a remote monitor agent, and the step of determining one or more device addresses that correspond to, but are different from, the transmitting device identifier value and a root device identifier value includes the steps of:

receiving one or more Bridge Protocol Data Units at the remote monitor agent;

identifying and obtaining a Transmitting Bridge ID value and a Root Device ID value from the Bridge Protocol Data Units;

wherein the Transmitting Bridge ID value and Root Device ID value are MAC Addresses of one or more forwarding switch devices; and

receiving one or more Internet Protocol addresses associated with the one or more forwarding switch devices in response to issuing a Reverse Address Resolution Protocol (RARP) request to the network, wherein the RARP request includes the Transmitting Bridge ID value and Root Device ID as parameters.

58. An apparatus as recited in clam 51, wherein the-method further comprises:

the network management system gathering the information identifying the network devices from a plurality of entities and forming topology information about the network.

74. An apparatus for automatically discovering network devices in a network, comprising:

a processor;

one or more stored sequences of instructions which, when executed by the processor, cause the processor to carry out a method including at least the steps of;

receiving one or more data packets at a remote monitor agent that is logically coupled to the network, each packet containing a multicast destination address;

determining a transmitting device identifier value from the packet and a root device identifier value only from a corresponding field in the packet;

determining one or more switch device addresses that correspond to the transmitting device identifier value and root device identifier value;

creating and storing information identifying the switch devices in a storage area that is accessible to the remote monitor agent and the network management system.