Submit a ticketCall us

AnnouncementsAre You “Flying Blind?”

When it comes to your complex IT infrastructure, you want to ensure you have a good grasp of what’s going on to avoid any fire drills that result from guesswork. Read our white paper to learn how proactively monitoring your IT environment can help your organization while giving you peace of mind.

Get your free white paper.

Home > Success Center > User Device Tracker (UDT) > UDT - Knowledgebase Articles > General information on Layer 3 polling in UDT

General information on Layer 3 polling in UDT

Table of contents
Created by Matthew Lamb, last modified by Nigel on Sep 10, 2018

Views: 2,157 Votes: 1 Revisions: 8


This article goes over how UDT gathers IP addresses within a production environment.


UDT version 2+


UDT conducts 2 types of polling on switches and routers: Layer 2 and Layer 3 polling. 

Layer 2 polling pulls bridge and link information from the switch level devices. This is to gather the MAC addresses attached to the ports for endpoint information. Endpoint information through Layer 2 is gathered per switch, which means if you want all the endpoints on your switches, you have to monitor all the switches.

Layer 3 polling, however, does not have to be gathered for every layer 3 capable device, only a select few. When UDT polls a layer 3 device such as a router it is asking for the ARP data cached on that device for IP routing. Since a router can handle routing for numerous switches and inbound/outbound traffic, the ARP data can contain MAC information and attached IPs from many endpoints, not just those attached directly to the router.

UDT gathers the ARP data and compares the MAC information to the current endpoint MACs stored in the database. It then matches the IPs with those MACs to provide the IP addresses for your endpoints. Hostname retrieval is then based on a reverse lookup to the DNS server that the host UDT server uses to resolve IPs into hostnames.

When it comes to what devices and how it gets this data, UDT uses SNMP to gather two RFC standard OIDs for ARP data:

    ipNetToMediaTable =

    ipNetToPhysicalTable =

Essentially, any device capable of communicating through SNMP and able to provide the ARP data from these OIDs can be used as a Layer 3 device for the ARP data. However it is best for UDT to poll the Layer 3 data from core routers or edge routers only. Switches are usually not needed unless they are layer 3 switches capable of routing and storing the ARP data in the same way. User discretion will best determine this.

For more information on how to enable/disable Layer 3 polling on a node in UDT, see Verify Layer 3 polling in UDT.

For information on why you are missing IP information in UDT, see the following two articles:





Last modified