Submit a ticketCall us

WebinarDatabase Roundtable – Expert Database Professionals Feel Your Pain

In this video broadcast, Head Geek™ Tom LaRock is joined by Karen Lopez, Tim Chapman, and David Klee. They’ve known each other for many years, so this discussion was like four friends getting together to talk data and databases. They discussed diagnostic data collection, common performance root causes, reactive tuning versus proactive, and more. Join us for an engaging discussion on these topics! Plus, Tom LaRock will be available to answer your questions live.

Register now.

Home > Success Center > User Device Tracker (UDT) > UDT - Knowledgebase Articles > General information on Layer 3 polling in UDT

General information on Layer 3 polling in UDT

Table of contents
Created by Matthew Lamb, last modified by Nigel on Sep 10, 2018

Views: 1,878 Votes: 1 Revisions: 8


This article goes over how UDT gathers IP addresses within a production environment.


UDT version 2+


UDT conducts 2 types of polling on switches and routers: Layer 2 and Layer 3 polling. 

Layer 2 polling pulls bridge and link information from the switch level devices. This is to gather the MAC addresses attached to the ports for endpoint information. Endpoint information through Layer 2 is gathered per switch, which means if you want all the endpoints on your switches, you have to monitor all the switches.

Layer 3 polling, however, does not have to be gathered for every layer 3 capable device, only a select few. When UDT polls a layer 3 device such as a router it is asking for the ARP data cached on that device for IP routing. Since a router can handle routing for numerous switches and inbound/outbound traffic, the ARP data can contain MAC information and attached IPs from many endpoints, not just those attached directly to the router.

UDT gathers the ARP data and compares the MAC information to the current endpoint MACs stored in the database. It then matches the IPs with those MACs to provide the IP addresses for your endpoints. Hostname retrieval is then based on a reverse lookup to the DNS server that the host UDT server uses to resolve IPs into hostnames.

When it comes to what devices and how it gets this data, UDT uses SNMP to gather two RFC standard OIDs for ARP data:

    ipNetToMediaTable =

    ipNetToPhysicalTable =

Essentially, any device capable of communicating through SNMP and able to provide the ARP data from these OIDs can be used as a Layer 3 device for the ARP data. However it is best for UDT to poll the Layer 3 data from core routers or edge routers only. Switches are usually not needed unless they are layer 3 switches capable of routing and storing the ARP data in the same way. User discretion will best determine this.

For more information on how to enable/disable Layer 3 polling on a node in UDT, see Verify Layer 3 polling in UDT.

For information on why you are missing IP information in UDT, see the following two articles:





Last modified