An Algorithm for Building an Enterprise Network Topology Using Widespread Data Sources

Transcription

1 An Algorithm for Builing an Enterprise Network Topology Using Wiesprea Data Sources Anton Anreev, Iurii Bogoiavlenskii Petrozavosk State University Petrozavosk, Russia {anreev, Abstract A lot of network management tasks epen on the escription of the network topology. However, the lack of stanar methos of the network elements etection, couple with the incompleteness an heterogeneity of the available topology ata, complicate the network topology iscovery process. In these conitions, formal moels an methos of topology iscovery are require. Contribution of the paper is an algorithm for automate enterprise network topology iscovery base on a previously evelope graph moel an criteria for builing graph elements. The propose algorithm is capable of ealing with incomplete heterogeneous ata about network topology as well as with the presence in the network of uncooperative evices. The paper also evaluates the algorithm an provies the testing results. I. INTRODUCTION Communication infrastructures of moern network service proviers (NSP) are complex multilayer systems that inclue a large number of evices (switches, routers) an internal links. Most wiesprea NSP are misize enterprises that provie services to their own employees an, possibly, to a limite number of smaller enterprises. Such networks, containing up to a thousan of evices an up to ten thousan of network computers, are the subject of this stuy. A lot of network management tasks in the enterprise networks, such as capacity planning an root cause analysis, require a complete an etaile escription of both logical an physical network topology. Such escription coul be use to solve a wie range of problems: performance analysis an topology scaling [1], ensuring reliability of the network topology an reucing the number of internal connection [2], etc. Due to the large sizes of the network proucing an maintaining such escription manually is very ifficult. Therefore arises the problem of the automation of the topology iscovery process [3], [4], [5], [6], [7], [8], [9]. Solving this problem is ifficult because of a number of issues. The network topology exploration is complicate by the lack of support of stanar tools for etecting elements of the network environment an connections between them (e. g. Link Layer Discovery Protocol) by most of the network equipment. This leas to the nee for an analysis of heterogeneous ata sources incluing those that are not specifically esigne for network iscovery (ARP cache, Aress Forwaring Tables). Data collection an analysis is complicate by the iversity in moes of implementation of the network evice software by venors an by the possibility of ata incompleteness or incorrectness ue to network iversity an ata obsolescence. Moreover, lack of access to certain evices (hosts an servers, transparent switches an hubs) leas to a nee to make a number of assumptions about their properties an connections. The network topology escription is commonly represente as a graph, vertices of which represent network evices, their ports an en points of ata transmission protocols, an eges represent hierarchy an ata exchange connections. To solve the problem of network topology iscovery automation, the authors previously have evelope a generalize graph moel of an enterprise network s physical, link, an network layers topology [10]. Base on this moel, five criteria of the network element interconnection etection were evelope an mathematically proven. These criteria coul be use with the most wiesprea heterogeneous ata sources on a network topology, such as Aress Forwaring Tables (AFT), cache of ARP, CDP, LLDP, STP an its extension (RSTP, MSTP). The goal of this paper is evelopment, implementation, testing an evaluation of an algorithm for automate builing an enterprise network topology base on the moel an criteria from [10] as well as a number of new criteria provie in this paper. A. Organization of the paper The rest of this paper is organize as follows. The next section provies a short escription of the relate work. Section III shortly escribes the graph moel of an enterprise network topology from [10]. Section IV escribes the propose algorithm of network topology graph builing. Section V contains escription of the algorithm properties an its testing. Section VI conclues the paper. II. RELATED WORK Existing algorithms of graph builing are base on one ata source an escribe only a limite set of topology properties at a given network layer. For example, algorithms from [4], [5] buil graph using AFT an the algorithms from [6] using Spanning Tree Protocol ata. These algorithms are incapable of working in networks that inclue IEEE 802.1Q virtual local area networks (VLAN). Authors of [7], [8], [9] propose algorithms of network topology graph builing in presence of VLAN, however, these algorithms require AFT completeness close to 100 percent an a small number of inaccessible evices. Furthermore, [7] provies no result of testing, an [8] uses empirical criteria for connection etection that have no formal proof. The algorithm ISSN

2 in [9] oes not ifferentiate between physical an logical connections, so there is no possibility to consier ifferent VLANs separately in the resulting graph. III. A GRAPH MODEL OF THE NETWORK TOPOLOGY Let us provie a short escription of the moel from [10] for the purposes of using its elements in a escription of the network topology graph builing algorithm. All elements of the evelope moel will be presente using the sample network (Fig. 1), which consists of three IP-subnetworks containing one workstation each. Each subnetwork is implemente within a separate VLAN. The isolation of the broacast omains by VLANs is one by two switches, to which the workstations are physically connecte. The router interfaces proviing connections between the subnetworks are also physically connecte to the switches. Fig. 1. VLAN: The layout of the sample network A. Physical layer Let us take a nonempty finite set of network evices D. A set of all ports of any evice D we will call P an a set of all of the ports of all of the evices P. For any D, a set P is nonempty an finite. For any two 1, 2 D, P 1 P 2 =. Let us efine the association relation between the ports an the evices A (1) in such a manner that (p, ) A (1) an (, p) A (1) when an only when p P, D, an p P. The relation A (1) is binary, symmetric an irreflexive. On the given set P, let us take a physical connection relation L (1), which is binary, symmetric, transitive an irreflexive. Two ports p 1,p 2 P that are associate with ifferent evices are L (1) -relate if they are connecte by the same ata transmission meia. A graph of the physical layer of the sample network (that was introuce in the Fig. 1) is presente in the Fig. 2. On this graph, squares represent evices an circles represent ports. B. Link layer Let us efine a finite set of labels VID N 0, which correspon to the VLAN ientifiers that use in network. In purpose of link layer ata transmission using one or more (in case of link aggregation) physical ports each evice D creates link layer interface (u, v) where u P, v VID. A set of all link interfaces is note as I (2). For an interface i =(u, v) let us efine set VID i = {v}. In a case when a Fig. 2. p 23 1 p 11 p 21 2 p 24 p 32 3 p 22 p 52 p 25 p 31 p 33 4 p 41 p 51 5 p 53 p 61 6 Eges: A (1) L (1) Graph of the physical layer of the sample network evice associate with the ports from the set u oes not support the VLAN technology, VID i = {0}. Let us efine the association relation between link interfaces an evices as A (2), so that (i, ) A (2) an (, i) A (2) if an only if i = (u, v), D an for all p u accomplishes (p, ) A (1). The relation A (2) is binary, symmetric an irreflexive. A set of all link interfaces associate with a certain evice we will call I (2). Two evice can communicate at the link layer via not blocke (e. g. with a STP) link interfaces, ports of which are connecte on a physical layer. On the set I (2), let us efine the link layer connection relation L (2) so that two not blocke link interfaces i 1 =(u 1,v 1 ) I (2) 1, i 2 =(u 2,v 2 ) I (2) 2, associate with ifferent evices, are L (2) -relate, if p 1 u 1, p 2 u 2 exist, where (p 1,p 2 ) L (1). The relation L (2) is binary, symmetric, transitive an irreflexive. On the set I (2), let us look at the commutation relation F (2), which is binary, symmetric, transitive an irreflexive. The interfaces that are F (2) -relate to each other must be associate with the same evice an be ifferent. Let us interpret the relation F (2) as the following: the configuration of a evice provies for a possibility to forwar transit ata frames between two ifferent link layer interfaces (i 1,i 2 ) F (2). A graph of the link layer of the sample network is presente in the Fig. 3. Vertices representing link interfaces are epicte as ellipses with ports an VLAN ientifiers (refer to Fig. 2) note insie. Let us take a look at a graph Ĝ(2) = I (2),F (2) L (2). The presence of a path between the link layer interfaces in this graph correspons to the possibility of their communication at the link layer either irectly or via a chain of switching evices. As such, the sets of vertices of connecte components of the graph Ĝ(2) turn out to be the broacast omains of the network. Partition of the set I (2), each element of which represents one broacast omain, will be calle BD. For an ege-simple path in the graph Ĝ(2) that oes not have two consecutive commutation eges, we will use the term link layer path. Accoring to the IEEE 801.1D stanar, there cannot be more than one link layer path between any two link layer interfaces in the graph

3 p 23, 1 p 31, 1 1 p 11, 0 p 21, 1 2 p 24, 2 p 32, 2 3 p 25, 3 p 33, 3 1 i 11,n 1,h 1 i 31,n 1,h 2 3 i 32,n 2,h 3 i 33,n 3,h 4 p 22, 2 p 22, 3 p 52, 2 p 52, 3 4 p 41, 0 p 51, 2 5 p 53, 3 p 61, 0 6 i 61,h 3,h 6 i 41,n 2,h Eges: A (2) F (2) L (2) Eges: A (3) F (3) L (3) Fig. 3. Graph of the link layer of the sample network Fig. 4. Graph of the network layer of the sample network Property 1. In the link layer graph, between two link layer interfaces, a link layer path exists if an only if the interfaces belong to the same broacast omain. C. Network layer Let us introuce a set of ientifiers of all the network s IP-subnets N. For each subnet n N, there is a finite set of all possible ientifiers of the subnet s hosts H n. To transmit an receive ata packets at the network layer via link interfaces, the OS of each evice D creates a network interface (S, n, h), where S I (2), n N, h H n. Let us call a set of all of the network interfaces of all network s evices I (3). Let us efine the association relation between network interfaces an evices A (3) so that (t, ) A (3) an (, t) A (3) if an only if t =(S, n, h) I (3), D an for all i S, (i, ) A (2) is accomplishe. The relation A (3) is binary, symmetric an irreflexive. On the set I (3), let us efine the network layer connection relation L (3) so that two network interfaces t 1 = (S 1,n 1,h 1 ) I (3) an t 2 =(S 2,n 2,h 2 ) I (3), associate with ifferent evices, are L (3) -relate to each other if n 1 = n 2 an exist b BD, i 1 S 1, i 2 S 2 so that i 1,i 2 b. The relation L (3) is binary, symmetric, transitive an irreflexive. In each subnet there may be evices (routers) that can forwar transit atagrams between all connecte subnets. Let us look at the routing relation F (3) on the set I (3) that is binary, symmetric, transitive an irreflexive. The interfaces that are F (3) -relate to each other must be associate with the same evice. Let us interpret the relation F (3) as the following: the configuration of a evice D provies for a possibility of atagram transmission between two network layer interfaces (t 1,t 2 ) F (3). A graph of the network layer of the sample network is presente in the Fig. 4. Vertices representing network interfaces are epicte as rectangles with link interfaces, subnet ientifiers an host ientifiers efining each interface note insie. There i 11 =(p 11, 1), i 12 =(p 12, 2), i 13 =(p 13, 3), i 21 =(p 21, 0), i 51 =(p 51, 0), i 61 =(p 61, 0). The structure of any given network can be escribe with a connecte unirecte graph G = V,E the network topology graph in which the set of vertices is V = D P I (2) I (3) an the set of eges is E = A (1) L (1) A (2) F (2) L (2) A (3) F (3) L (3). The network topology graph oes not contain loops an multiple eges, it may, however, contain cycles. D. Link layer reachability sets Within the network, one link layer interface is reachable from another link layer interface if the first interface is an enpoint for ata transmission at the link layer for the secon interface. We will use the term reachability path for a link layer path in which the first an the last eges are not commutation eges. On the set I (2), we will introuce a reachability relation so that i 1 i 2 if from i 1 to i 2 in the graph G exists a reachability path. In this case we will say that i 2 is reachable from i 1. The relation is binary, symmetric an irreflexive. We will say that a port p P is reachable from an interface i 1 I (2) if exists such an interface (u, v) I (2) reachable from i 1 for which p u. For each i I (2), we will introuce a set RS i I (2) that inclues all interfaces reachable from i. The set of interfaces reachable from the interfaces that are F (2) -relate to the i, we will efine as CRS i. Most ata sources provie information about reachability of the network s ports from the network s interfaces. Following the efinition of reachability an the Property 1, in orer for a port p to be reachable from an interface i 1, it is necessary that the interface i 1 =(u 1,v 1 ) an some i 2 =(u 2,v 2 ) (where p u 2 ) belong to the same broacast omain. If there are no ata as to whether the reachable port belongs to a VLAN, we will assume that either v 1 = v 2 (if it is known that the evice supports VLAN) or v 2 =0. IV. AN ALGORITHM OF NETWORK TOPOLOGY GRAPH BUILDING The algorithm of the network topology graph builing process base on the ataset receive uring network evice polling consists of four stages: 1) polling of network evices an obtaining from them ata on the structure of the network using SNMP (or

4 other satisfying tool) an storing these ata for further processing; 2) builing graph fragments that escribe the evices (with their ports an interfaces), existence of which follows irectly from the results of the input ata analysis; 3) builing reachability sets for existing link interfaces using the input ataset an inferring missing recors in them; 4) builing link layer connection eges base on the analysis of the reachability sets, as well as builing physical an network layer connection eges base on the efinitions of the moel. Aitionally, this stage inclues inference of the evices, ata about which are missing from the network input ata. A. Data collection The ata necessary for builing a network topology graph is possible to obtain from Management Information Bases (MIB) of the network evices using Simple Network Management Protocol (SNMP). SNMP protocol is a stanar ata access tool for network equipment an is enable for use by efault. The ata on the network ports is available in stanar IF-MIB an inclues their assigne MAC-aresses, names, banwith an type: Ethernet, virtual, aggregate etc. Data on VLANs incluing their names an tables of portto-vlan assignment is available, epening on the venor, in ifferent MIBs. Stanar MIBs are Q-BRIDGE-MIB an SMON-MIB. On Cisco Systems evices, there coul also be CISCO-VTP-MIB an CISCO-VLAN-MEMBERSHIP-MIB. Data on IP-subnets an network interfaces is available in IP-MIB or RFC1213-MIB an inclues subnet aresses an masks, along with corresponence of IP-aresses to evice interfaces. The source of ata on the contacts within broacast omains is the evice s Aress Forwaring Table (AFT), which is maintaine for every port of the switch an contains every MAC-aress that appear as a source of ata frames receive on this port. AFT are available in BRIDGE-MIB an Q- BRIDGE-MIB. The source of ata on the contacts within IP-network is Aress Resolution Protocol (ARP) cache which contains corresponence of IP-aresses to MAC-aresses within broacast omain along with a number of interface through which these aresses are reachable. Cache is available in RFC1213-MIB an IP-MIB. During the work of the Spanning Tree Protocol (STP), network evices etermine their irect neighbors, ata on which (MAC-aresses an port numbers) is being store in BRIDGE-MIB. Cisco Discovery Protocol (CDP) an Link Layer Discovery Protocol (LLDP) are esigne to be use exclusively for network topology iscovery. Devices that support these protocols sen frames with ata about themselves through all their ports in preetermine time intervals. These ata are store by neighboring evices in CISCO-CDP-MIB an LLDP-MIB. Data on routing coul be obtaine from IP-MIB, OSPF- MIB, BGP-MIB etc. Data on link aggregation is available in IEEE8023-LAG- MIB, CISCO-LAG-MIB, etc. These ata inclue escriptions of aggregate interfaces on the link layer (MAC-aress etc.) an sets of aggregate physical ports. Network evice polling is one by using SNMP an IP-aresses on the conition that authorization parameters are known. When all IP-aresses are known then the ata collection process is trivial: sequential polling of the evices an saving the collecte ata. However, if the full set of manageable evices is unknown an the network polling is conucte from a single known noe (e. g. the central router), it is necessary to iscover foreign IP-aresses an poll them as well. In this case, uring polling of some evices, it is necessary to istinguish an poll previously unvisite IParesses. Main sources of foreign aresses are cache of ARP, LLDP, CDP an routing tables. The following algorithm 1 polls network evices an accumulates IP-aresses. Input ata for this algorithm is the initial list IPs with IP-aresses for polling. Output ata is the CData list with the retrieve atasets. Algorithm 1 Cumulative algorithm of ata collection Visite= IPs CData = while IPs o ip = first element of IPs Remove ip from IPs if ip Visite then Continue Put ip into Visite if Device with aress ip is accessible then ata = ata from evice with aress ip oip s = own IP-aresses of evice from ata sip s = sie IP-aresses from ata A elements of oip s to Visite A elements of sip s to IPs A ata into CData en while return CData Computational complexity analysis for the algorithm 1 an further algorithms will be provie in section V-A. B. Graph vertex builing The input ata for the vertex builing process are the atasets receive from the network evices uring the first stage of the algorithm. The process can be ivie into two steps. The first step inclues creation of vertices escribing evices that have provie information about themselves along with information about their environment. From that ata is erive the information about the evice itself, its ports, link an network interfaces, association, commutation an routing eges

5 An the secon step inclues creation of vertices for evices that have not provie ata about themselves but existence of which is irectly erive from the ata receive from other evices. It is possible to iscover such evices using ata on the link an network layers interactions: AFT, routing tables, cache of ARP, CDP, LLDP, STP. CDP an LLDP cache provie names of neighboring evices an their ports along with their IP an MAC aresses. STP cache provies MAC aresses of neighboring ports an their belonging to VLAN. Using AFT an ARP cache it is possible to fin MAC an IP aresses of neighboring an remote evices along with their belonging to VLAN. During the secon step of this stage it is possible to create vertices escribing such evices as hosts, servers an evices that o not support SNMP or have enie access to themselves (e. g. evices from foreign aministrative omains). C. Reachability set builing The input ata of the stage of builing reachability sets is the incomplete graph built uring the previous stage an the atasets receive uring the first stage. Initial filling out of the sets is conucte using ata form sources escribe in the section IV-A. During this process it is require to etermine the interface corresponing to the reachability ata of the current evice as well as a reachable remote interface, using methos that epen on a particular ata source. As a result for every existing link layer interface i I (2) there will be create a potentially empty reachability set RS i. The next step of this stage is the process of inferring ata of reachability sets possibly containing incomplete ata. The algorithm 2 escribes the inference process using the methos from section III-D. Algorithm 2 Reachability set inference repeat Foun = false for all i 1 I (2) o for all i 2 RS i1 o if i 1 / RS i2 then A i 1 into RS i2 for all i 3, for which (i 2,i 3 ) F (2) o for all i 4 RS i3 o if i 4 / RS i1 then A i 4 into RS i1 if i 1 / RS i4 then A i 1 into RS i4 until Foun The algorithm 2 is execute while at least one pair of previously unknown to be reachable interfaces is foun. After this algorithm is execute, the reachability sets will contain all recors that are possible to etect with the provie ataset an known link layer interfaces an commutation eges. D. Graph ege builing The input ata from the ege builing stage is the graph with vertices built uring the previous stages an the reachability sets of link layer interfaces. Let us provie a number of the ege builing criteria that were prove in [10]. Criterion 1. If from an interface i 1 I (2) only one interface i 2 I (2) is reachable an RS i2 = CRS i1 {i1}, then (i 1,i 2 ) L (2). Criterion 2. If two interfaces i 1 an i 2 are reachable from each other, an RS i1 = CRS i2 {i 2 } an RS i2 = CRS i1 {i1}, then (i 1,i 2 ) L (2). Criterion 3. If two ports p 1 an p 2 are L (1) -relate, then exist such VLAN ientifier v VID p1 VID p2 an u 1 P, u 2 P so that p 1 u 1 an p 2 u 2, an link interfaces i 1 = (u 1,v), i 2 =(u 2,v) that are not blocke, then (i 1,i 2 ) L (2). Using the criteria 1 3 it is possible to search an buil the link layer connection eges L (2) with the knowlege of reachability sets or physical layer topology. Criterion 4. If two link interfaces i 1 =(u 1,v 1 ) an i 2 = (u 2,v 2 ) are L (2) -relate, then for each p 1 u 1 exists such p 2 u 2, so that (p 1,p 2 ) L (1) an vice versa. With the knowlege of the link layer topology, the criterion 4 allows to seek an buil the physical layer connections L (2). Criterion 5. If for two net interfaces t 1 =(S 1,n,h 1 ) an t 2 =(S 2,n,h 2 ) exist link interfaces i 1 S 1 an i 2 S 2 that belong to the same broacast omain, then (t 1,t 2 ) L (3). With the knowlege of the link layer topology, the criterion 5 allows to seek an buil the network layer connection eges L (3). Let us provie a new criterion of F (2) commutation ege etection in aition to the existing criteria set. Criterion 6. If for evice D an two reachable from each other link layer interfaces i 1 an i 2 it is true that: 1) i 3 I (2) is reachable from i 1, i 4 I (2) is reachable from i 2 ; 2) from i 1 an i 2 there are no reachable interfaces from I (2) other than i 3 an i 4 respectively; 3) from interfaces in F (2) relation with i 1 or i 2 there are no reachable interfaces that are associate with ; then i 3 an i 4 are F (2) -relate. Proof: Following to proposition 3 from [10], the interfaces i 3 an i 4 are locate on the reachability path

6 w =(i 1,...,i 3,...,i 4,...,i 2 ). Following to the efinition of reachability, subpaths w 1 =(i 1,...,i 3 ) an w 2 =(i 4,...,i 2 ) of path w have L (2) eges from both ens. As i 3 an i 4 are associate with the same evice, they cannot be L (2) -relate with each other. Let us suppose that they are not F (2) relate. Then subpath w 3 =(i 3,...,i 4 ) of path w must pass through one more interface i 5 I (2) because i 3 an i 4 are alreay inclue in L (2) eges in subpaths w 2 an w 3 an they coul be F (2) -relate only with interfaces from I (2). To be certain, let us say that (i 3,i 5 ) F (2). Then following to the efinition of a link layer path, the subpath w 4 =(i 5,...,i 2 ) of path w coul not start with F (2) ege. But then path w 4 satisfies the efinition of reachability path an i 5 i 2 which contraicts the conitions of the criterion. So then, (i 3,i 4 ) F (2). Detection of a new commutation ege may lea to inference of new reachability ata between link layer interfaces. This may lea to etection of new connection eges. Taking this into account let us provie the following algorithm 3 of graph ege builing. Algorithm 3 Ege builing Foun = false repeat Foun = false Call algorithm 2 for all i 1 I (2) o for all i 2 I (2) \{i 1 } o if For i 1 an i 2 one of criteria 1,2,3 is true an (li 1,li 2 ) / L (2) then A (i 1,i 2 ) to L (2) if D such that (i 1,),(i 2,) A (2) an (i 1,i 2 ) / F (2) then for all i 3 RS i1 o for all i 4 RS i2 o if For i 3 an i 4 criterion 6 is true then A (i 1,i 2 ) to F (2) for all p 1 P o for all p 2 P \{p 1 } o if For p 1 an p 2 criterion 4 is true an (p 1,p 2 ) / L (1) then A (p 1,p 2 ) to L (1) until Foun Detection of network layer connection eges will not impact on the search for other graph eges an vertices, so the search for these eges coul be conucte with the algorithm 4 after the algorithm 3 is execute. Algorithm 4 L (3) ege builing for all t 1 I (3) o for all t 2 I (3) \{t 1 } o if For t 1 an t 2 criterion 5 is true an (t 1,t 2 ) / L (3) then A (i 1,i 2 ) to L (3) Once the algorithms 3 an 4 finish their work, the graph will contain all eges between the existing vertices that are possible to etect using the input ataset on the conition that there are no evices that have not been foun uring the vertex builing process. E. Borer evice builing Possible incompleteness of the input ata or presence in the network of uncooperative evices that are o not provie ata about themselves may lea to ambiguous situations uring the network topology graph builing process. In such situations reachability sets inicate the presence of previously unirecte graph eges or vertices but it is impossible to buil such elements using any of the criteria provie earlier. Fig. 5 provies an example of network topology where ambiguous situation may appear. In the ambiguous situation of the first type, evice 2 (gray) is uncooperative an unknown an existence of the link interfaces i 2, i 3, i 4 is unknown. Reachability set of the interface i 1 contains two elements: i 5 an i 6. Devices 3 an 4 are also uncooperative an it is known only that RS i5 = RS i6 = {i 1 } RS i0 following the reachability relation properties. Such situation coul appear if 2 is a transparent switch or hub an 3 an 4 are hosts. Fig i 0 1 i 1 i 2 2 An example of an ambiguous situation In the ambiguous situation of the secon type, evice 2 is uncooperative but known an it is unknown if the link interfaces i 3, i 4 exist. Reachability set of the interface i 1 contains three elements: i 2, i 5 an i 6. Devices 3 an 4 are also uncooperative an it is known only that RS i5 = RS i6 = {i 1 } RS i0 following the reachability relation properties. Such situation coul appear if SNMP-access to 2 is unavailable an 3 an 4 are hosts. Let us propose a metho of resolution of such ambiguous situations. Let us note that ata sources use for reachability set construction shoul not be viewe as equal. Data of CDP, LLDP an STP escribes connections with irect neighbors. AFT an ARP cache provies ata on reachability that oes not necessarily escribe irect connections. Herewith AFT an STP cache provies ata on VLAN while others o not. i 3 i 4 i 5 i

7 To categorize the reachability ata, let us introuce the concept of reachability recor priority. Let us efine set RSS of orere pairs of link layer interfaces so that (i 1,i 2 ) RSS, if i 1,i 2 I (2) an i 1 i 2. For each interface i I (2) let us efine set RSS i RSS so that (a, b) RSS i it is true that a = i, b RS i. Let us also efine a function PR: RSS N using the following rule with epenence on certain ata source: 0, source RS inference 1, source ARP PR((i 1,i 2 )) = 2, source AFT 3, source CDP or LLDP 4, source STP Let us name function PR as a reachability priority. Knowing this priority allows us to ifferentiate reachability ata sources an use this knowlege to resolve ambiguous situations. If ata on reachability between two interfaces is foun using several ata sources then the source with highest priority is chosen. Let us take the first type of ambiguous situations. We assume that for all r RSS i1 it is true that PR(r) < 3. Let us name evice 2 as a borer hub an efine criterion of such situation etection. Criterion 7. If RS i1 > 1 an r RSS i1 it is true that PR(r) < 3 an also i RS i1 it is true that RS i = {i1} CRS i1 then interface i 1 along with every interface i RS i1 are connecte with borer hub. This situation will be resolve as follows (base on the example from Fig. 5): creation of evice 2, interface i 2 I (2) 2 connecte with i 1, interfaces i 3 an i 4 connecte with i 5 an i 6 respectively. Let us take the secon type of ambiguous situations. We assume that there exists r 1 RSS i1 for which PR(r 1 ) >= 3 an for all r RSS i1 \{r 1 } it is true that PR(r) < 3. Let us name evice 2 as a borer switch an efine criterion of such situation etection. Criterion 8. If RS i1 > 1, there exists r 1 RSS i1 for which PR(r 1 ) 3 an r RSS i1 \{r 1 } it is true that PR(r) < 3 an also i RS i1 it is true that RS i = {i 1 } CRS i1, then interface i 1 along with every interface i RS i1 are connecte to borer switch. This situation will be resolve as follows (base on the example from Fig. 5): connection of interface i 2 I (2) 2 to i 1, creation of interfaces i 3 an i 4 connecte with i 5 an i 6 respectively. The algorithm 5 escribes a metho of resolving ambiguity of both types with possibility that the connection to borer evice is passing through several VLANs. The algorithm 5 returns an inicator of success of ambiguity resolution. After this algorithm is execute, every known ambiguous situation of the first an the secon types will Algorithm 5 Borer ambiguity resolving Foun = false for all p P for which p 1 P :(p 1,p) L (1) o LEAF 1 = {i 1 = (u, i) I (2) : p u an for i 1 criterion 7 is true} LEAF 2 = {i 1 = (u, i) I (2) : p u an for i 1 criterion 8 is true} if LEAF 1 or LEAF 2 then if LEAF 1 then if LEAF 2 then leaf = FIRST(LEAF 2 ) i 2 = i RS leaf for which PR((i 1,i)) 3 2 = D that is associate with i 2 else Create 2 an a to D for all i 1 LEAF 1 LEAF 2 o i 2 = i RS i1 for which PR((i 1,i)) 3 if i 2 = NULL then Create an a to I (2) interface i 2, for which VID i2 = VID i1 A (i 1,i 2 ) to L (2) an (i 2, 2 ) to A (2) for all i RS i1 o Create an a to I (2) interface i 3, for which VID i3 = VID i A (i, i 3 ) to L (2) an (i 3, 2 ) to A (2) return Foun be resolve. Missing F (2), L (1) an L (3) eges coul be iscovere an built with use of algorithms 3 an 4 For simplicity of the algorithm 5 the following moment is omitte from it. During the creation of new ports an interfaces of borer evices, it is necessary to take into account connections within ifferent VLANs: if the evice is connecte to a borer evice through several link layer interfaces then for new interfaces of this borer evice the set of ports shoul be equal. F. General algorithm The algorithm 6 escribes a general process of builing a network topology graph an inclues all four stages. The input ata for this algorithm are sets of IP-aresses for ata collection process an the output is a network topology graph. V. EVALUATION AND TESTING A system for automate network topology graph builing base on the propose algorithm has been implemente in Java platform with use of Java, Kotlin an Groovy languages. It has 4591 lines of coe

8 Algorithm 6 General algorithm of network topology graph builing Call algorithm 1 an put result to CData Buil graph vertices using CData Initialize reachability sets using CData repeat Call algorithm 3 for ege builing Call algorithm 5 an put result to r until r = true Call algorithm 4 for L (3) ege builing A. Computational complexity To estimate the (asymptotic) time complexity of this entire evelope algorithm of the network topology graph builing let us consier each of its stages iniviually. During the first stage (algorithm 1) the poll of unique IP-aresses is one with purpose of ata obtaining. Each unique IP-aress correspons to a single network interface an must be visitie manatory. So the time complexity of the algorithm 1 coul be estimate as Θ( I (3) ). The secon stage (vertex builing) inclues hanling the ataset obtaine uring the first stage an creating corresponing vertices. The complexity of this coul be estimate as Θ( CData ), where CData is the output set of the ata collecte with algorithm 1. Construction of the reachability sets using ata on remote evices is one uring the thir stage of the algorithm. For every element of ata about remote evices every interface is being checke to establish a conformity. Thus the time complexity of initial reachability set construction coul be estimate as Θ(N I (2) ) where N is an amount of ata items about remove evices. The algorithm 2 is use for reachability set inference. During each of its iterations every link layer interface is hanle, for which, in turn, reachable interfaces are hanle. Then all interfaces F (2) -relate to the latter are hanle, an then all reachable from them interfaces are hanle. Therefore, the time complexity of each iteration coul be estimate as O( I (2) 4 ). The iterations are run until at least one previously unknown recor in reachability set is foun. The maximum amount of such recors is C 2 (a number of two-element I (2) combinations). Note that Cn 2 n! = 2!(n 2)! = n2 n 2, which is asymptotically close to n 2. Further we will use n 2 as an asymptotic equivalent of Cn. 2 Therefore the time complexity of the algorithm 2 coul be estimate as O(C 2 I (2) I(2) 4 )= O( I (2) 6 ). However, in most cases most of the previously unknown recors are foun uring first or secon iteration so time complexity coul also be estimate as Ω( I (2) 4 ). The fourth stage of the algorithm is builing of graph eges. It starts with the call of the algorithm 3 so let us estimate the complexity of its iterations which start with the call of the algorithm 2. Next the search for L (2) eges is one using criteria 1, 2, 3 uring which a comparison of reachability sets of two interfaces is one. The time complexity of each criterion test coul be estimate as O( I (2) ) since complexity of set comparison is O(N) where N is the set size. Next, for each interface, a search for F (2) eges is one using criterion 6. The complexity of this criterion test is O( I (2) ) since it requires hanling reachability sets of taken interfaces. The whole complexity of the stage of F (2) ege search coul be estimate as O( I (2) 3 ) since it requires hanling pairs of reachable interfaces an testing criteria for them. Therefore the time complexity of this joint stage of search for L (2) an F (2) eges coul be estimate as O( I (2) 5 ). However, if most of the F (2) eges were foun uring input ata hanling or reachability sets are near to be complete (then F (2) ege is foun uring first iteration) then this stage complexity coul be estimate as Ω( I (2) 3 ). Next the search for L (1) eges is one within the algorithm 3. Every pair of ports is examine with criterion 4. The time complexity of testing this criterion is O( VID ) because every interface base on the current port is being consiere an Ω(1) since criteria coul be prove uring the first iteration. The entire stage of L (1) ege search is coul be estimate as O( P 2 VID ) an Ω( P 2 ). Iterations of the algorithm 3 are execute while at least one L (1), L (2) or F (2) ege is foun. Consiering that the amount of L (2) ege is significantly larger than L (1) (in case when VLAN spans whole network L (2) = L (1) VID ) an not iscovere previously F (2) eges (most of them are iscovere on vertex builing stage) the maximal number of iterations coul be estimate as C 2 since eges are inirecte. An I (2) the minimal number of iterations is 1 if no eges were foun an 2 if most eges were foun uring the first iteration. Therefore the complexity of the entire algorithm 3 is coul be estimate as O(C 2 I (2) ( I(2) 6 + I (2) 5 + P 2 VID )) = O( I (2) 8 + I (2) 7 + I (2) 2 P 2 VID ) =O( I (2) 8 ) an Ω(1 ( I (2) 4 + I (2) 3 + P 2 )) = Ω( I (2) 4 ). The next step of the algorithm is iscovery an resolution of ambiguous situations using the criteria 7 an 8. The complexity of each of these criteria coul be estimate as O( I (2) ) because uring testing with these criteria it is require to examine reachability sets of a given interface. In algorithm 5, for every port, the search for interfaces matching the criteria 7 or 8 is one. New evices an eges are create after that. Therefore, the time complexity of this algorithm coul be estimate as Θ( P VID I (2) ). As a result, the time complexity of a single iteration of the main cycle of the algorithm 6 coul be estimate as O( I (2) 8 + I (2) P VID ) = O( I (2) 8 ) an Ω( I (2) 4 + I (2) P VID ) =Ω( I (2) 4 ). Iterations of the main cycle of the algorithm 6 are one while at least one ambiguous situation is iscovere an resolve. Such situations are resolve on the base of ports, therefore the maximal amount of possible ambiguous situations coul be estimate as P an the minimal amount is 0. After resolving all ambiguous situations, the search for L (3) eges using the criterion 5 an the algorithm 4 begins. With criterion 5, every pair of link layer interfaces is examine to see whether they are in the same broacast omain. Following to the property 1, two interfaces are in the same broacast omain if there is a link layer path between them. It is possible to fin such path with epth-first search that has the complexity

9 O( I (2) + L (2) + F (2) ), which, ue to the link layer graph properties, coul be rewritten as O( I (2) ). Thus, the time complexity of testing the criterion 5 coul be estimate as O( I (2) ), an the overall complexity of the algorithm 4 is O( I (2) 3 ). Due to the low time complexity of the ata collection, vertex builing, reachability set construction an L (3) eges builing, the general complexity of the algorithm 6 coul be estimate by the complexity of the main cycle of this algorithm, which coul be estimate as O( P I (2) 8 ) an Ω( I (2) 4 ). B. Data presence influence The algorithm uses ata from network evices which coul have only a limite set of information about other evices: their names, MAC-aress an name of one of its ports, one IParess. Therefore, to work successfully the algorithm requires to have an SNMP access to all possible service evices. If this conition is not achieve, the graph will not be totally accurate. Moreover, as has been note in [4], [10], the ata obtaine from evices coul be incomplete or inaccurate. Despite the ability of the algorithm for ata inference, it is not possible to obtain a completely accurate graph in some cases. In the best case scenario, when a network contains no uncooperative service evices an ata between all evices are consistent an complete, then the graph built by the algorithm exactly matches the true network topology graph. But this case is unlikely. To explore the impact of ata incompleteness on the graph builing process, we use a network topology graph generator as well as imitate ata from the graph evices. Generate ata was use to buil a graph with the algorithm an after that the newly built graph was compare with the original graph. During this research the following parameters were change: the size of the generate graph, the number of VLANs, an the AFT completeness. All service network evices were consiere as cooperative uring the graph generation process. The AFT completeness for a certain interface is consiere to ba a containment of every recor on every foreign interface with which it is possible to exchange ata on link layer from the current interface. During their ata generation, the esire completeness was set in the range from 0 to 1. This rate was use as a possibility of certain recor inclusion for AFT of a certain interface. For borer switches that have irectly connecte hosts, the recors about these hosts have been inclue anyway. The iagram on Fig. 6 was built as a result of 2250 tests with a ata generator. It shows epenency of the average rate of correctly iscovere physical layer connection eges on the rate of the AFT completeness. Brighter columns here represent an average part of iscovere connections between service evices, an arker columns represent the part of total set of connections. Following the provie ata, we can conclue that for the test conitions use, the number of correctly iscovere physical layer eges is close to 100% when the AFT completeness is at 60% an more. Also, when the AFT completeness is low Fig. 6. Depenency of the average number of iscovere eges on the AFT completeness it is still possible to iscover more than 80% of eges between service evices ue to ata inference. C. Testing in real enterprise network This algorithm was teste in the network of Petrozavosk State University (PetrSU) which provie some of its service evices for iscovery. There was one router Cisco 7600, four layer 3 switches (which is able to route ata between VLANs) Cisco 3750 an Cisco 3850, six ifferent Cisco layer 2 switches. The network ha 101 VLANs configure. For every VLAN there was an iniviual IP-subnet. Moreover, the network containe a lot of uncooperative switches, hosts an servers. The primary ata sources on interconnections in this network appeare to be CDP, STP an AFT. There was no support for LLDP in this network while ARP cache was impossible to use in presence of VLAN for a reachability set construction. Data about uncooperative service evices was obtaine using CDP. During the iscussion with the network aministrators of PetrSU it was confirme that the built graph completely matche the structure of the explore network segment an its surrounings. Influence of particular ata sources on the accuracy of a graph builing process was also stuie uring tests in the network of PetrSU. Table I provies the number of iscovere graph elements epening on the ata sources use. First column contains a list of consiere sets of graph elements. Here Leaf-1 an Leaf-2 enote ambiguous situations of first an secon type respectively. The secon column represents the amount of iscovere elements when all available ata sources were use. Since it has been confirme that the built graph is correct, the secon column represents the actual amount of graph elements. The thir column represents the number of iscovere elements using all ata sources but without reachability set inference using algorithm 2. Columns 4 6 represent the number of iscovere elements using one particular ata source each: CDP, STP, AFT. The seventh column represents the number of iscovere elements with the use of AFT but without reachability set inference. Base on the ata collecte uring this stuy, we can conclue that most of the connections coul be foun using only AFT. However, to obtain a more accurate graph it is necessary to use other ata sources as well. CDP an STP ata provie an ability to iscover connections only with

10 TABLE I. Data sources ELEMENTS FOUND DEPENDING ON THE SOURCES USED All All without RS inference CDP STP AFT AFT without RS inference D P L (1) I (2) L (2) F (2) I (3) L (3) F (3) Leaf Leaf service evices an o not provie any information about hosts. Aitionally, using reachability set inference is highly important for builing accurate graphs. VI. CONCLUSION The escription of the logical an physical topology of the enterprise network is require for many network management tasks. The problem of automation of builing such escription in form of a graph is complicate ue to the size an complexity of the network as well as the incompleteness an heterogeneity of available ata about network topology. Thereby, to solve this problem, utilization of formal moels an methos of the network topology builing is require. The algorithm for builing an enterprise network topology graph provie in this paper is base on the formal graph moel of the network topology as well as the mathematically proven criteria of graph element iscovery an methos of missing ata inference from [10]. During the process of eveloping this algorithm, aitional criteria for the iscovery of commutating evices, not provie in [10], were esigne an proven. The algorithm tests escribe in this paper show high accuracy of the network topology graph builing even when ata is incomplete. This, as well as the polynomial time complexity of the algorithm proven in this paper, shows that the algorithm is suitable for use in practice. In the future the authors plan to evaluate the actual time complexity an performance of the algorithm when builing the topology of real life networks. REFERENCES [1] S. Ravinran, C. Huang, K. Thulasiraman, A ynamic manage VPN service: architecture an algorithms, 2006 IEEE International Conference on Communications. 2006, Vol. 2, pp [2] L. Sivakumar, J. Balabaskaran, K. Thulasiraman, S. Arumungam, Virtual topologies for abstraction service for IP-VPNs th International Telecommunications Network Strategy an Planning Symposium (Networks). 2016,pp [3] Y. Breitbart, M. Garofalakis, C. Martin, R. Rastogi, S. Seshari, A. Silberschatz, Topology iscovery in heterogeneous IP networks, INFOCOM Nineteenth Annual Joint Conference of the IEEE Computer an Communications Societies. Proceeings. IEEE. 2000, Vol. 1. pp [4] H. Gobjuka, Y. Breitbart, Ethernet topology iscovery for networks with incomplete information, Networking, IEEE/ACM Transactions on vol. 18, no. 4. pp [5] Y. Sun, Z. Shi, Z. Wu, A iscovery algorithm for physical topology in switche ethernets, Local computer networks, th anniversary. the IEEE conference on. IEEE, pp [6] M.-H. Son, B.-S. Joo, B.-C. Kim, J.-Y. Lee, Physical topology iscovery for metro ethernet networks, ETRI Journal vol. 4, no. 27. pp [7] H. Gobjuka, Topology iscovery for virtual local area networks IN- FOCOM, 2010 Proceeings IEEE. 2010, pp [8] L. Zichao, H. Ziwei, Z. Geng, M. Yan, Ethernet topology iscovery for virtual local area networks with incomplete information, Network infrastructure an igital content (ic-nic), th IEEE international conference on pp [9] M. Xiaobo, Y. Tingting, An algorithm of physical network topology iscovery in multi-vlans, TELKOMNIKA vol. 14, no. 3A. pp [10] A. A. Anreev, A. S. Kolosov, A. V. Voronin, I. A. Bogoiavlenskii, A graph moel of the topology of physical, link an network layers of an enterprise network, Proceeings of the 19th Conference of Open Innovations Association FRUCT. 2016, pp