Method and apparatus to detect unidentified inventory

• US 8,880,669 B2
• Filed: 03/03/2011
• Issued: 11/04/2014
• Est. Priority Date: 03/03/2011
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Thirukazhukundram, Suresh, Camplejohn, Christopher Scott, Sinclair, Keith, Rosen, Edward M., John, Sunil Shashikanth, Garg, Gaurav, Ramaswamy, Krishnan
• Primary Examiner(s): Srivastava, Vivek
• Assistant Examiner(s): BUKHARI, SIBTE H
• Application Number:
  US13/040,097
• Publication Number:
  US 20120226791A1
• Time in Patent Office: 1,342 Days
• Field of Search: 709223-226
• US Class Current: 709/223
• CPC Class Codes: H04L 41/0853 by actively collecting configuration information or by backing up configuration information
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: Y02D 30/00 Reducing energy consumption in communication networks

Abstract

Techniques are disclosed for detecting unidentified inventory in a network. In one embodiment, data that was collected from a plurality of network devices is received. The data includes at least one device identifier for a neighboring network device of at least one network device of the plurality of network devices. The at least one device identifier for the neighboring network device is compared to one or more device identifiers of known network devices. In response to determining that the at least one device identifier for the neighboring network device does not match a device identifier for the known network devices, the at least one device identifier is added to a list of unidentified inventory.

Claims

1. A method comprising:

receiving data that was collected from a plurality of network devices;

wherein the data includes at least one device identifier for a neighboring network device of at least one network device of the plurality of network devices;

comparing the at least one device identifier for the neighboring network device to one or more device identifiers of known network devices;

in response to determining that the at least one device identifier for the neighboring network device does not match a device identifier for the known network devices, adding the at least one device identifier to a list of unidentified inventory;

generating a score for the neighboring network device based, at least in part, on how many devices of the plurality of network devices detected the neighboring network device;

determining a rank, within the list of unidentified inventory, for the neighboring network device based, at least in part, on the score and how many devices of the plurality of network devices detected the neighboring network device;

wherein the rank, within the list of unidentified inventory, for the neighboring network device is higher when a greater number of devices of the plurality of network devices detect the neighboring network device than when a fewer number of devices of the plurality of network devices detect the neighboring network device;

wherein the rank indicates that the neighboring network device has a greater likelihood than one or more other network devices identified by the list of unidentified inventory that the neighboring network device should be included in a network inventory;

wherein the method is performed by one or more computing devices.

2. The method of claim 1, further comprising, for each selected network device of the plurality of network devices:

determining whether data collected from the selected network device includes a set of device identifiers for a set of neighboring network devices;

determining which neighboring devices of the set of neighboring devices are unidentified network devices by comparing each device identifier of the set of device identifiers to the one or more device identifiers of the known network devices.

3. The method of claim 2, further comprising:

for each unidentified network device, determining whether a corresponding device identifier for the unidentified network device has been added to the list of unidentified inventory;

if the corresponding device identifier has not been added to the list of unidentified inventory, adding the corresponding device identifier to the list of unidentified inventory.

4. The method of claim 3, further comprising:

adding a device identifier for the selected network device that detected the unidentified network device to a list of devices that have detected the unidentified network device.

5. The method of claim 3, further comprising:

generating a respective score for each unidentified network device;

wherein the respective score is based, at least in part, on how many selected network devices of the plurality of network devices detected the unidentified network device.

6. The method of claim 5, further comprising if the corresponding device identifier has already been added to the list of unidentified inventory, updating the respective score for the unidentified network device by incrementing the respective score.

7. The method of claim 5, further comprising sorting the list of unidentified inventory based on the respective score for each unidentified network device on the list of unidentified inventory.

8. The method of claim 5, further comprising:

determining whether the unidentified network device sent a syslog message;

in response to determining that the unidentified network device sent a syslog message, updating the respective score for the unidentified network device by incrementing the score.

9. The method of claim 2, wherein data collected from the selected network device includes Cisco Discovery Protocol (CDP) or Link Layer Discovery Protocol (LLDP) data.

10. The method of claim 2, wherein data collected from the selected network device includes topology data from a topology table of the selected network device.

11. A non-transitory computer-readable storage medium comprising one or more sequences of instructions which when executed cause performing:

receiving data that was collected from a plurality of network devices;

wherein the data includes at least one device identifier for a neighboring network device of at least one network device of the plurality of network devices;

comparing the at least one device identifier for the neighboring network device to one or more device identifiers of known network devices;

in response to determining that the at least one device identifier for the neighboring network device does not match a device identifier for the known network devices, adding the at least one device identifier to a list of unidentified inventory;

generating a score for the neighboring network device based, at least in part, on how many devices of the plurality of network devices detected the neighboring network device;

determining a rank, within the list of unidentified inventory, for the neighboring network device based, at least in part, on the score and how many devices of the plurality of network devices detected the neighboring network device;

wherein the rank, within the list of unidentified inventory, for the neighboring network device is higher when a greater number of devices of the plurality of network devices detect the neighboring network device than when a fewer number of devices of the plurality of network devices detect the neighboring network device;

wherein the rank indicates that the neighboring network device has a greater likelihood than one or more other network devices identified by the list of unidentified inventory that the neighboring network device should be included in a network inventory.

12. The non-transitory computer-readable medium of claim 11, further comprising instructions which when executed cause, for each selected network device of the plurality of network devices:

determining whether data collected from the selected network device includes a set of device identifiers for a set of neighboring network devices;

determining which neighboring devices of the set of neighboring devices are unidentified network devices by comparing each device identifier of the set of device identifiers to the one or more device identifiers of the known network devices.

13. The non-transitory computer-readable medium of claim 12, further comprising instructions which when executed cause:

for each unidentified network device, determining whether a corresponding device identifier for the unidentified network device has been added to the list of unidentified inventory;

if the corresponding device identifier has not been added to the list of unidentified inventory, adding the corresponding device identifier to the list of unidentified inventory.

14. The non-transitory computer-readable medium of claim 13, further comprising instructions which when executed cause:

adding a device identifier for the selected network device that detected the unidentified network device to a list of devices that have detected the unidentified network device.

15. The non-transitory computer-readable medium of claim 13, further comprising instructions which when executed cause:

generating a respective score for each unidentified network device;

wherein the respective score is based, at least in part, on how many selected network devices of the plurality of network devices detected the unidentified network device.

16. The non-transitory computer-readable medium of claim 15, further comprising instructions which when executed cause if the corresponding device identifier has already been added to the list of unidentified inventory, updating the respective score for the unidentified network device by incrementing the score.

17. The non-transitory computer-readable medium of claim 15, further comprising instructions which when executed cause sorting the list of unidentified inventory based on the respective score for each unidentified network device on the list of unidentified inventory.

18. The non-transitory computer-readable medium of claim 15, further comprising instructions which when executed cause:

determining whether the unidentified network device sent a syslog message;

in response to determining that the unidentified network device sent a syslog message, updating the respective score for the unidentified network device by incrementing the score.

19. The non-transitory computer-readable medium of claim 12, wherein data collected from the selected network device includes Cisco Discovery Protocol (CDP) or Link Layer Discovery Protocol (LLDP) data.

20. The non-transitory computer-readable medium of claim 12, wherein data collected from the selected network device includes topology data from a topology table of the selected network device.