Submit a ticketCall us

WebinarUpcoming Webinar: How Help Desk and Remote Support Pays for Itself

Learn how help desk software can simplify ticketing management, allow you to track hardware and software assets, and accelerate the speed of IT support and service delivery. Gain insights on how remote support tools allow your IT team to maximize their efficiency and ticket resolution by expediting desktop troubleshooting, ultimately helping keep end-users happy and productive.

Register here.

Home > Success Center > User Device Tracker (UDT) > UDT - Knowledgebase Articles > General information on Layer 3 polling in UDT

General information on Layer 3 polling in UDT

Table of contents
Created by Matthew Lamb, last modified by Nigel on Jul 09, 2018

Views: 1,668 Votes: 1 Revisions: 7


This article goes over how UDT gathers IP addresses within a production environment.


UDT version 2+


UDT conducts 2 types of polling on switches and routers: Layer 2 and Layer 3 polling. 

Layer 2 polling pulls bridge and link information from the switch level devices. This is to gather the MAC addresses attached to the ports for endpoint information. Endpoint information through Layer 2 is gathered per switch, which means if you want all the endpoints on your switches, you have to monitor all the switches.

Layer 3 polling, however, does not have to be gathered for every layer 3 capable device, only a select few. When UDT polls a layer 3 device such as a router it is asking for the ARP data cached on that device for IP routing. Since a router can handle routing for numerous switches and inbound/outbound traffic, the ARP data can contain MAC information and attached IPs from many endpoints, not just those attached directly to the router.

UDT gathers the ARP data and compares the MAC information to the current endpoint MACs stored in the database. It then matches the IPs with those MACs to provide the IP addresses for your endpoints. Hostname retrieval is then based on a reverse lookup to the DNS server that the host UDT server uses to resolve IPs into hostnames.

When it comes to what devices and how it gets this data, UDT uses SNMP to gather two RFC standard OIDs for ARP data:

ipNetToMediaTable =

ipNetToPhysicalTable =

Essentially, any device capable of communicating through SNMP and able to provide the ARP data from these OIDs can be used as a Layer 3 device for the ARP data. However it is best for UDT to poll the Layer 3 data from core routers or edge routers only. Switches are usually not needed unless they are layer 3 switches capable of routing and storing the ARP data in the same way. User discretion will best determine this.

For more information on how to enable/disable Layer 3 polling on a node in UDT, see Verify Layer 3 polling in UDT.

For information on why you are missing IP information in UDT, see the following two articles:





Last modified