Network Management

General information on Layer 3 polling in UDT

This article describes how User Device Tracker gathers IP addresses within a production environment.

First published date

10/12/2018 6:08 PM

Last published date

9/13/2022 11:08 PM

Overview

This article goes over how User Device Tracker gathers IP addresses within a production environment.

Product section

User Device Tracker

Resolution

UDT conducts 2 types of polling on switches and routers: Layer 2 and Layer 3 polling.

Layer 2 polling pulls bridge and link information from the switch level devices. This is to gather the MAC addresses attached to the ports for endpoint information. Endpoint information through Layer 2 is gathered per switch, which means if you want all the endpoints on your switches, you have to monitor all the switches.

Layer 3 polling, however, does not have to be gathered for every layer 3 capable device, only a select few. When UDT polls a layer 3 device such as a router it is asking for the ARP data cached on that device for IP routing. Since a router can handle routing for numerous switches and inbound/outbound traffic, the ARP data can contain MAC information and attached IPs from many endpoints, not just those attached directly to the router.

UDT gathers the ARP data and compares the MAC information to the current endpoint MACs stored in the database. It then matches the IPs with those MACs to provide the IP addresses for your endpoints. Hostname retrieval is then based on a reverse lookup to the DNS server that the host UDT server uses to resolve IPs into hostnames.

When it comes to what devices and how it gets this data, UDT uses SNMP to gather two RFC standard OIDs for ARP data:

ipNetToMediaTable = 1.3.6.1.2.1.4.22

ipNetToPhysicalTable = 1.3.6.1.2.1.4.35

Essentially, any device capable of communicating through SNMP and able to provide the ARP data from these OIDs can be used as a Layer 3 device for the ARP data. However it is best for UDT to poll the Layer 3 data from core routers or edge routers only. Switches are usually not needed unless they are layer 3 switches capable of routing and storing the ARP data in the same way. User discretion will best determine this.

For more information on how to enable/disable Layer 3 polling on a node in UDT, see Verify Layer 3 polling in UDT .

For information on why you are missing IP information in UDT, see the following two articles:

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third-party content at your own risk, and you will be solely responsible for the incorporation of the same if any.