Network Topology Mapping via Probing Frames
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for discovering the layer-2 topology of local area networks (LANs) are hindered by the need for administrative privileges and knowledge, and they fail with unmanaged switches and networks that implement MAC filtering.
Innovation Solution
The system identifies network switches and host systems, refreshes host addresses, allows them to expire from all switches except one, and then transmits probing frames to map the network topology without relying on management protocols or MAC address spoofing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If traditional SNMP-based methods are used to discover layer-2 topology, then topology information can be gathered, but administrative privileges and knowledge are required
Solution Approach 1:
The system enables unprivileged administrators to discover topology by having the network infrastructure (switches) automatically respond to probe frames. The switches themselves provide the topology information through their forwarding behavior rather than requiring active cooperation from managed devices via SNMP.
Solution Approach 2:
Probe frames serve as intermediaries to extract topology information. Instead of directly querying switches via SNMP, the system sends probe frames that traverse the network and whose forwarding paths reveal the topology structure without requiring switch management interfaces.
2Loss of information
If MAC address spoofing is used to infer layer-2 topology, then topology information can be obtained, but it fails in networks with MAC filtering
Solution Approach 1:
Instead of actively spoofing MAC addresses to probe the network, the system inverts the approach by sending probe frames with legitimate source addresses and observing which hosts receive them. The topology is inferred from the forwarding behavior of switches rather than from MAC address manipulation.
Solution Approach 2:
The patent replaces the mechanical approach of MAC address spoofing with a protocol-based approach using Ethernet frame forwarding. Instead of manipulating address fields to probe topology, the system uses the natural frame forwarding mechanism of switches to reveal topology through observation of frame delivery patterns.
3Loss of information
If probe frames are transmitted to all hosts simultaneously, then complete topology can be mapped, but network traffic and processing overhead increase
Solution Approach 1:
The topology discovery process is segmented into multiple phases: initial probe transmission, response collection, and iterative refinement. Instead of transmitting probes to all hosts at once, the system progressively discovers topology by examining responses and focusing subsequent probes on unresolved portions of the network.
Solution Approach 2:
The system uses periodic probe transmissions at controlled intervals rather than continuous probing. Probe frames are sent at specific time intervals, allowing the network to return to normal traffic patterns between discovery operations, thus minimizing overall network overhead while still gathering complete topology information.
Data Source
AI summary
A computer-implemented method for mapping network topologies may include (1) identifying a network including a plurality of network switches and a plurality of host systems, (2) identifying a host system within the plurality of host systems connected to the network via a network switch within the plurality of network switches, (3) refreshing an address of the host system within the network switch, (4) allowing the address of the host system to expire from each network switch within the plurality of network switches except the network switch, (5) transmitting a probing frame from a probing host system within the plurality of host systems to the address of the host system, (6) identifying a subset of host systems within the plurality of host systems that received the probing frame, and then (7) mapping a topology of the network based on the identified subset. Various other methods, systems, and computer-readable media are also disclosed.