Switch Topology

Platform

The runZero switch topology report draws a graph of the switches and routers on your network and shows how they interconnect. It also shows which assets connect to each switch.

Generating the switch topology report

Once you have topology data, open the switch topology report.

The initial view is a graph of network switches, with the links between them drawn as lines. Beneath each switch is a count of the known assets detected with that switch as their upstream network connection.

You may also see a count of unmapped assets. These are assets inferred from MAC addresses found in the topology data that aren’t known to belong to any scanned asset. The Unmapped MACs report lists unmapped MACs in tabular form.

The bottom of the page shows the total number of assets in the graph and the total number of unmapped MACs.

The report attempts to lay out the graph sensibly. You can drag nodes around to make it clearer.

Clicking a switch node opens a pop-up window with more information about it, including a link to the switch’s asset details and a link to a list of its unmapped assets.

Double-clicking a node expands it to show the individual assets connected to it. Clicking an asset opens a pop-up window with a link to its asset details.

Filtering the switch topology report

The switch topology report can display only a limited number of assets. To focus on the assets you care about, use the filter box at the top of the report page. It accepts search strings in the standard runZero search language, so you can filter to a subnet with a search string such as cidr:10.1.6.0/24.

Use the drop-down to switch quickly between sites.

Buttons in the filter box collapse or expand all of the switch nodes at once.

The Export view button renders the graph as currently displayed to a PNG file and downloads it.

Limitations of the switch topology report

The switch topology report may not always be entirely accurate, because the data runZero can gather is limited.

When SNMP data is available, runZero pulls a snapshot of it from each device at scan time, then builds the topology from that. In complicated environments, a single infrequent snapshot is often not enough to show the complete picture, and links may end up missing. Only recent SNMP data is used: if a device has not been scanned in the last 9 days, its SNMP topology data is ignored.

Without SNMP information, runZero attempts to compute topology from which switch claims to have seen the MAC, which may not be the nearest access switch. The algorithm looks for the port with the fewest shared MACs to find the best match, but that depends on the switch cache timeouts and how the switch was scanned, so the graph may show links that don’t exist as direct physical connections.

Cisco Catalyst devices

SNMPv3 on Cisco Catalyst devices will not let you pull the bridge port information runZero needs unless you enable per-VLAN access.

SNMP v3 access to VLAN ARP/FDB tables requires this access rule:

Even with this rule in place, runZero has to send a separate SNMP request for every VLAN, which can significantly slow down scans with SNMP enabled on a network with many Catalyst devices. For more on gathering SNMP data during scans, see Scanning with SNMP.