Network Management

Best practices: NTM network discovery

This is to guide Solarwinds Network Topology Mapper (NTM) users with large networks, that performance during the discovery process is a bit sluggish. This must understand how the NTM discovery engine works and what goes on behind the scenes before displaying the network diagram.

First published date

10/24/2018 2:41 AM

Last published date

2/17/2022 6:59 PM

Overview

If you are mapping large networks with NTM, consider the following best practices for improving the NTM discovery performance. This article also explains how the NTM discovery engine works and what goes on behind the scenes before displaying the network diagram.

Product section

Network Topology Mapper

Resolution

NTM includes a sophisticated multi-level discovery engine, which uses a combination of protocols and goes through three distinct phases to discover every node on a network and to produce a highly accurate map:

  1. Node detection: Uses a combination of ICMP, SNMP and WMI protocols to detect devices.
  2. Polling: Uses a Poller to collect connection data using CDP, LLDP, Bridge table and also STP to detect the role of each node.
  3. Calculation: Uses a complex algorithm to calculate connectivity between nodes.

 

The following factors can slow down the discovery:

  • the size of the network being scanned
  • the choice of node detection protocols used for the scan
  • the number of hops specified for the scan
  • where the scan is being performed from

 

With all of that in mind, we have compiled the following recommendations to help you improve the performance of NTM as it discovers devices on your network.

 

The tradeoff between the discovery speed and the discovery size

Most NTM users try to discover their entire network on the first scan. However, if you have a network with more than 1200 nodes, you are in for a long wait and at the end of it, the map might look very cluttered. The smaller the range you define to scan, the faster you will receive the results and the easier it will be to interpret them.

If you are discovering your network at common frequencies, such as once a week or once a month, you can discover many class C networks.  If you need to run discoveries daily or if you need to complete the discovery fast, make your scans extremely small, such as 256 IPs or less.

 

Credentials priority

Place the most commonly used credentials at the top of the list, be it SNMP, WMI or VMWare to enhance the discovery.

Do not use any unnecessary credentials. The more credentials there are, the longer discovery will take.

 

Zero Hop Discovery

When prompted to provide the number of hops to use during the scan, use zero hops unless you are not finding all of your expected devices. The more hops the scan goes through, the longer it takes and zero usually gets them all.

 

Scanning Location

Scan with NTM from the same Management VLAN of your network to improve the speed of the discovery process. This reduces polling timeouts compared to scanning over VPN, dial-up or routing through another network.

 

Evening/Weekend Scanning

If you manage a large network or you see your network growing in the coming months, run the discovery process during evening hours or on weekends and have your map ready for Monday morning. Make sure you have entered the proper credentials into the discovery wizard. Make sure to test your credentials before beginning the discovery process and leaving the building.