Network Inventory Detection via Neighbor Profiling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network management systems struggle to detect and manage unidentified inventory in large and complex networks, often leading to devices being overlooked due to changes in management standards or lack of initial configuration, and invasive methods like ping sweeps are not effective and can trigger security alarms.
Innovation Solution
A system that collects data from network devices using a network collector, compares device identifiers, and uses profiling techniques based on neighbor relationships, topology data, and syslog messages to identify and score potentially unidentified devices, incrementing scores based on detection by multiple devices and syslog activity, and generates a report for network administrators.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Difficulty of detecting and measuring
If invasive search methods like ping sweeps are used to detect missing devices, then device detection capability is improved, but security alarm triggers and network disruption increase
Solution Approach 1:
The patent uses existing network traffic and intermediary devices (network collectors, syslog servers) as mediators to detect unidentified devices. Instead of direct probing, the system leverages traffic patterns, CDP/LLDP neighbor information, and syslog messages that naturally flow through the network to identify devices indirectly, avoiding security alarms while maintaining detection effectiveness
Solution Approach 2:
The system enables network devices to self-identify through mechanisms like CDP and LLDP protocols that automatically exchange neighbor information. Devices essentially advertise their own presence and relationships to the network collector without requiring external discovery attempts, eliminating the need for invasive scanning while improving detection accuracy
2Reliability
If comprehensive network device tracking is implemented, then inventory completeness is improved, but system complexity increases
Solution Approach 1:
The network collector is designed as a universal platform that performs multiple functions: collecting CDP/LLDP neighbor data, processing syslog messages, maintaining device inventories, and detecting unidentified devices. By consolidating these diverse functions into a single system, the patent achieves comprehensive inventory tracking without proportionally increasing overall system complexity
Solution Approach 2:
The system performs preliminary actions by continuously collecting and storing network device information, neighbor relationships, and syslog data in advance. This pre-established database of known devices enables rapid identification of unidentified inventory when discrepancies are detected, simplifying the overall process compared to reactive discovery methods
Data Source
AI summary
Techniques are disclosed for detecting unidentified inventory in a network. In one embodiment, data that was collected from a plurality of network devices is received. The data includes at least one device identifier for a neighboring network device of at least one network device of the plurality of network devices. The at least one device identifier for the neighboring network device is compared to one or more device identifiers of known network devices. In response to determining that the at least one device identifier for the neighboring network device does not match a device identifier for the known network devices, the at least one device identifier is added to a list of unidentified inventory.