1

I am trying to understand is it possible to discover Network topology with Flows. I know it is possible to do topology of SNMP ARP/*DP data but I am wondering maybe it is possible to get exact result from Flow data/probes?

Since sFlow,IPFIX and OpenFlow supports IEEE 802.3 and OpenFlow IEEE 802.1D, I thought it should be possible atleast with OpenFlow? Maybe I am wrong.

Improve this question

2 Answers 2

Reset to default
4

The problem with looking at flows is that you only see the source and destination, and nothing in between. Also, you only see flows that exist at the time you capture data. There may be other network segments that have no flows at the time you measure. You won't be able to detect them.

Improve this answer
2
  • Thanks for your input but looking into IPFIX functions (iana.org/assignments/ipfix/ipfix.xhtml) it should be able to pull MIB objects. Would that in theory mean I could pull e.g ARP data over IPFIX?
    – Gen
    Commented Apr 6, 2018 at 12:44
  • 2
    No, IPFIX is not a two way protocol like SNMP. You could (theoretically) configure the routers to export some MIB data, but at that point, you've already touched every device, so you already know the topology.
    – Ron Trunk
    Commented Apr 6, 2018 at 13:03
2

I'd suggest using LLDP/CDP (e.g. queried over SNMP) to discover the L2 and some of the L3 topology. Then your check the routers for routing table entries (also over SNMP or similar) for the rest of the L3 topology. Keep in mind that the L2 and the L3 topologies can be vastly different.

Flows only show traffic that's actually there, not traffic that might be. Additionally, you'd have to reverse engineer the topology behind the traffic.

If you don't want to programmatically discover a new topology it might actually be easier reading the routers' configurations - when it comes to policy-based routing and such you'll be lost without the configs.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.