Submit a ticketCall us
Home > Success Center > User Device Tracker (UDT) > General information on Layer 3 polling in UDT

General information on Layer 3 polling in UDT

Table of contents
Created by Matthew Lamb, last modified by MindTouch on Jun 23, 2016

Views: 1,550 Votes: 1 Revisions: 6


This article goes over how UDT gathers IP addresses within a production environment.


UDT version 2+


UDT conducts 2 types of polling on switches and routers: Layer 2 and Layer 3 polling. 

Layer 2 polling pulls the bridge and link information from the switch level devices. This is to gather the MAC addresses attached to the ports for endpoint information. Endpoint information through Layer 2 is gathered per switch, which means if you want all the endpoints on your switches, you have to monitor all the switches.


Layer 3 polling however, does not have to be gathered for every layer 3 capable device, only for a select few. When UDT polls a layer 3 device such as a router, it's asking for the ARP data cached on that device for IP routing. Since a router can handle routing for numerous switches and inbound\outbound traffic, the ARP data can contain MAC information and attached IPs from many endpoints, not just those attached directly to the router.


UDT gathers that ARP data and compares the MAC information to the current endpoint MACs stored in the database. It then matches the IPs up with those MACs to provide the IP addresses for your endpoints. Hostname retrieval is then based off a reverse lookup to the DNS server the host UDT server is set to use to resolve the IPs into hostnames.


When it comes to what devices and how it gets this data, UDT uses SNMP to gather 2 RFC standard OIDs for ARP data:

ipNetToMediaTable =

ipNetToPhysicalTable =


Essentially, any device capable of communicating through SNMP and able to provide the ARP data off those OIDs can be used as a Layer 3 device for the ARP data. Typically, it's best for UDT to poll the Layer 3 data from core routers or edge routers only. Switches are usually not needed unless it is a layer 3 switch capable of routing and storing the ARP data in the same way. User discretion will best determine this.


For more information on how to enable\disable layer 3 polling on a node in UDT, you can read it here.

For information on why you are missing IP information in UDT, you can reference these two articles:

ARP missing from VRF

Layer 3 polling being disabled





Last modified