NETWORK TOPOLOGY MAPPER

STATEMENT REGARDING FEDERAL RIGHTS This invention was made with government support under Contract No. W-7405-ENG-36 awarded by the U.S. Department of Energy. The government has certain rights in the invention.

FIELD OF THE INVENTION

The present invention relates generally to communication networks, and, more particularly, to network topology reconstruction.

BACKGROUND OF THE INVENTION

Communication networks are often modeled as an open system interconnected seven layer reference model. Layer 3 (network layer, e.g., routers) and Layer 2 (data link layer, e.g., switches, bridges, and hubs) are particularly important layers with respect to overall network performance and vulnerability. Layers 2 and 3 are further characterized by the "topology" of the layer, i.e., a set of devices and the connections between them. Knowledge of the topography of a layer is of particular importance in network management tasks such as failure analyses and isolating locations in a network that have been infected by worms propagated over the internet. Topology discovery has been studied at various levels, including layer 2

Ethernet topology discovery, to provide a capability to reconstruction layer topology of an existing network. There have been several discovery algorithms studied for recovering layer 2 Ethernet topologies from information collected from simple network management protocols (SNMP). Breitbart, et al., "Topology Discovery in Heterogeneous IP Networks," Proceedings of IEEE INFOCOM, 2000, pp. 265-274, take the approach of assuming all nodes are connected and then identifying contradictory information. Lowekamp et al., "Topology Discovery for Large Ethernet Networks," Proceedings of ACMSIGCOMM, Aug. 2001 , pp. 237-248, uses a similar approach with a focus

on incomplete (not fully propagated) forwarding tables. Most recently, Bejerano, et al., "Physical Topology Discovery for Large Multi-Subnet Networks," Proceedings of IEEE INFOCOM, 2003, provide more complex algorithms with a guarantee of recovering all available information from the raw data. David T. Stott, "Layer-2 Path Discovery Using Spanning Tree Mibs," Tech. Rep. ALR-2002-004, Mar. 2002, teaches an approach that uses SNMP access to the results of the Spanning Tree Protocol that is run on each switch.

Topology reconstruction may be used to determine quality of service problems that might arise from the deployment of internet protocol (IP) telephony on actual networks. The ability to reconstruct topologies also may be used extensively in commercial network management systems.

Various objects, advantages and novel features of the invention will be set forth in part in the description which follows, and in part will become apparent to those skilled in the art upon examination of the following or may be learned by practice of the invention. The objects and advantages of the invention may be realized and attained by means of the instrumentalities and combinations particularly pointed out in the appended claims.

SUMMARY OF THE INVENTION In accordance with the purposes of the present invention, as embodied and broadly described herein, the present invention includes a method for discovering the topology of a network. A list of switches that comprise the network is formed and the MAC address cache for each one of the switches is determined. A list of insiders is formed for every pair of switches. It is determined whether the insider for each pair of switches is a graph edge and adjacent ones of the graph edges are determined. A symmetric adjacency matrix is formed from the graph edges to represent the topology of the data link network.

In another aspect of the present invention, the MAC tables of switches of an acyclical interconnected network are fully propagated. At least one edge in the interconnected network that directly or indirectly connects first and second switches on first and second ports, respectively, is discovered. First vertices

seen from the first switch are determined from ports other than the first port using a MAC cache in the first switch of the edge. Second vertices seen from the second switch are determined from ports other than the second port using a MAC cache in the second switch of the edge. The first vertices are propagated to the MAC cache of the second switch and the second vertices are propagated to the MAC cache of the first port. The above steps are repeated for all other edges recovered from the interconnected network, and the entire process is repeated until the MAC tables in the switches are fully propagated.

BRIEF DESCRIPTION OF THE DRAWINGS

The accompanying drawings, which are incorporated in and form a part of the specification, illustrate embodiments of the present invention and, together with the description, serve to explain the principles of the invention. In the drawings:

FIGURE 1 is an exemplary network to illustrate the process of the present invention.

FIGURE 2 is a flow chart of the process of the present invention. FIGURE 3 is an exemplary schematic to illustrate propagation characteristics of the process.

DETAILED DESCRIPTION

In the high-level architecture of a data communication system, a set of routers is configured to supply data in, e.g., the form of Netflow or Lightweight Flow Accounting Protocol (LFAP), to a central collection point. In practice a detailed knowledge of network topology for either one subnet of switches, or the like, or several adjacent subnets connected through the routers, is crucial. There are several important reasons for that: general management and administration, security, and network optimization. For large organizations that manage hundreds of computers on their complex network, the actual topology is complicated and changes with time even without any physical change in cabling or wiring. In a typical subnet of a computer network, there are a variety of hosts, e.g., routers, computers, and the like, that are physically attached to switches either directly or through hubs. The switches provide communication through the subnet as well as route the traffic bound to the outside of the subnet to one or several subnet routers.

In the case of switched Ethernet, a medium address control (MAC) table on each switch will represent the table of some of the MAC addresses of computers, routers and switches on the subnet and the corresponding tags of physical ports on a switch that sees those MACs. A switch looks at the destination address of each data frame received on a link, and then, based on information contained in the switch, the switch forwards the frame only onto the link, or links, where the destination MAC address exists. The switch can contain this information in a MAC address look-up table. For practical implementation of the algorithm herein, it is assumed that the actual topology of a communication network does not have cycles, i.e., more than one path from a switch to a router. This is a reasonable assumption due to the conventional use of the spanning tree protocol to avoid cycles among Ethernet switches.

Figure 1 is an exemplary illustration of the problem stated above. A subnet is provided with switches, marked by the letters from a to g, computer hosts marked xθ through x9, and router R connecting this subnet to the Internet. The switch port numbers (or port tags) are also illustrated.

If, at some given moment of time, each of the switches has in its MAC cache the information about all of the computers on the subnet, it is called a "fully propagated" graph. For this example, for a fully propagated graph, each switch a-g will have a MAC address cache that might look like the one presented in Table 1.

TABLE 1

The goal then is to find the algorithm that will recover the topology of the network from the MAC tables from all the switches on the subnet. With reference to Figure 2, the following computer implemented process determines the topology of a network data link according to the present invention: forming a list of switches that comprise the network 10; determining the MAC address cache for each one of the switches 12;

determining for each pair of switches from the MAC address caches the remaining switches that see the pair of switches 14; determining for each pair of switches the remaining switches that see one of the pair of switches on a first port and the second one of the pair of switches on a second port 16; forming a list of insiders (see below) for every pair of switches 18; determining whether the insider for each pair of switches is a graph edge 22; determining adjacent ones of the graph edges 24; forming a symmetric adjacency matrix from the graph edges to represent the topology of the data link network 26; determining from the MAC address caches each switch having a port that sees a host or a router but does not see any other switch on that port 28; and determining the network data link connections to hosts and routers forming a full network 32.

To explain the algorithm it is convenient to introduce definitions here. Switch a sees switch b and denotes it as a → b if the MAC table of switch a has a record of switch b. The port number on switch a which sees b is denoted as P _a (b). Using the example in Table 1 , f) 4 f and P _b (f) = 103.

Now, assume a fully propagated (means each switch has information about all hosts and switches on the network), acyclic graph, i.e., a graph with only one path from a switch to any router. For any two vertices (switches, hosts, routers, etc.) s _/ , s,- of the graph, there is a path that connects these vertices and visits some number of other vertices along the way. Define insiders as the set of vertices that belong to that path and denote it as l(s _\ , sj. It is obvious that I(SJ, s _j ) = I(S _] , s _\ ) for an acyclic graph. The length or number of edges in the path between two nodes is denoted as L(l( s _\ , s\)).

Returning to the example in Figure 1 , l(d, a) = {c, b}, L(l(d, a)) = 3, l(d, b) = {c}, l(e, c) = 0. The symbol £ denotes the set of all edges in a graph, where an edge is a path connecting adjacent vertices. The vertices of the graph are the switches.

In accordance with one aspect of the present invention, the present exemplary process provides a solution:

1. Form the list of switches for the network of interest.

2. For all switches in the list investigate all of their possible pairs s,- and s;. This can be done by forming the double loop (steps 14 and 16 shown in Figure 2) over the list of switches.

3. For every pair of switches s,- and sj form the list of the insiders l(Sj, S _j ) (see algorithm below).

4. If S _/ → SJ and sj —> s,- and l(s,, sj) = 0, then there exists a graph edge e = (s _h S _j ).

5. If s; → SJ and s _j → s,- and l(s _h sj) = f s _k } (or L(I(S ₁ , S _j )) = 2), then it can be concluded that there are two adjacent edges in the graph (s _h srf, fs _f c S _j ) e E. Here, S _k is some other switch and adjacent means directly connected to both s;, and S ₇ -. 6. If S; → S _j and s/ → S ₁ and L(l( s _/ , S _j )) > 3, then it is impossible to unambiguously conclude about the path structure connecting vertices s,- and s/.

7. From the set of all recovered edges E = {(...), ... , (...)} form a symmetric adjacency matrix M.

The adjacency matrix represents direct links between communicating components. The matrix elements are usually set to value of one if there is direct link between the components and zero if otherwise. For example, if switch si is directly connected to switch sj then My = 1 and , M ₁ ,- = 1 ; if they are not then M _y = M _j , = 0. The matrix represents all the communication links and hence is the network topology map. The adjacency matrix can be easily used to construct the topological graph representing the network(s). Table 2 below shows the adjacency matrix for the example depicted in Figure 1.

TABLE 2

From the example shown in Figure 1 , it can be seen that, for the algorithm to work, a method is needed to find the way to determine the insider's path between any two vertices. Fortunately, it is rather easy to do if information about switch ports is known, and that information is available from the MAC tables. Indeed, for any two vertices (switches) s,- and s,- , the following algorithm is presented:

1. Obtain MAC cache addresses over the list of all switches. Exclude S _/ and s,- from that list and check the port connections to determine which switches from the rest of the list see s,- and s/. This is done by checking the MAC tables of each remaining switch to determine if there are records of s,- and SJ in those tables.

2. If switch s _/< sees s _/ on one port and sees switch s/ on another port or P _Sk (Sj) ≠ P _Sk (s _j ), then S _k belongs to the path between s _/ and s,- or s _k e

1(Sj, Sj). If, on the other hand P _Sk (s\) ⁼ Pskfa), then Sk ø l(s _h Sj). In this case, if S _k was in I(SJ, S _j ), then there would be a cycle in the graph, which would violate the initial assumption.

The recovery of the full network topology and not just the graph layout for the switches implies the recovery of all other hosts and router(s) that belong to the subnet. Given the fact that the topology of the switch layout is now known, the positions of all other hosts can be estimated quite easily. In fact it will take no more then n ² operations, where n is the number of hosts on the subnet, to recover the positions on the graph of all other hosts and/or routers. If the

location of a particular host x,- on the graph is of interest, all that is needed is to check all n MAC tables for the ports which see the host Xj. The procedure is as follows.

1. Initiate a SNMP software query to obtain the MAC cache addresses from the MAC tables for each switch.

2. If for some switch s/ there is a MAC table that shows that computer x,- is seen on some port and, at the same time, there is some other switch, say, s^ , visible from the same port, i.e., P(xJ = P(S _k ), then Xj is not directly connected to Sy. If there is a switch that sees x,- and does not see any other switches on the same port, this switch has direct link to the computer X ₁ .

The position of the router(s) on the graph can be determined in the same way the position of any other hosts is determined.

It is the convention to represent a network as an undirected tree graph and to associate the position of the router on the graph with the head of the tree. Hence, the total amount of operations required to recover the full network topology is the sum of order n ³ operation for the recovery of the topology of switches and n ² operation to recover the positions of n hosts. The algorithm presented above makes use of the information about the ports and takes advantage of this information to make the whole procedure for estimating the graph a straightforward procedure.

Fully propagated MAC tables are needed for the above algorithms to work without ambiguity. In practice, the MAC tables may not be fully propagated and usually due to switch timeouts or other engineering constraints the MAC tables contain only partial information about hosts and switches. Taking the assumption that communication algorithms, like spanning-tree and the like, form acyclic communication graphs, routing information can be artificially propagated and the algorithm used in an iterative way to form fully propagated artificial MAC tables for use in the process shown in Figure 2. For example, consider Figure 3. At least one edge of the interconnect can be recovered using the process shown in Figure 2; e.g., it is determined that nodes a and 6 are directly or indirectly connected using port 1 on a and port 3 on b, then the routes to all of the other vertices (switches) and hosts connected to those switches that b can

reach on ports not equal to 3 are propagated to a. In this example, a will be given routes to x, y, and z on its port 1 and b will acquire routes to u, v, and w on its port 3. The actual MAC tables are modified with the information that was inferred from the fact that at least one communication link was recovered. It is interesting to notice that if, for example, switch a and switch b have another switch or switches sitting on some path that connects a and b, the tables could still be propagated as long as it is reliably determined that there is a path between a and b.

The route propagation algorithm is repeated until the topology converges and there are no new routes to propagate. A fully propagated graph for a network of n nodes implies that each node knows about each other node for a total of n forwarding entries. Starting with a network containing a minimum of 3 entries (2 to determine a path between two nodes plus at least one entry to propagate), and assuming a conservative maximum of 1 entry added per iteration, the number of iterations this algorithm will run can be loosely bound by no more than n ² . In practice, more than 3 iterations have rarely been required before convergence.

For the practical implementation of the algorithm, one needs to get access to the MAC tables on the switches. To accomplish the task one would either get the list of switches from his or her network administrator or run available scanning tools (e.g. nmap) to discover active hosts and then attempting SNMP requests to all discovered devices.

To support dynamic networks with frequent changes of hosts and switches, a scanning tool is often run first to discover switches. As a side-effect, this invokes also the updates of the MAC caches on switches. The SNMP requests are then sent to collect the MAC tables. From MAC tables the complete tree is recovered using the algorithms presented above.

The topology discovery software was implemented in C++ using extensively the STL library (Standard Template Library is part of ANSI/ISO C++ standard and is provided by the C++ compiler vendors). The switch manager is written in Python. The Net-SNMP package (a descendent of the UC Davis and CMU SNMP code bases) was used to implement a mμlti-threaded version of

snmpwalk to collect information from the subnet switches simultaneously. The overall time that it takes to get the map of a full 24 subnet is of the order of 1 minute.

The foregoing description of the invention has been presented for purposes of illustration and description and is not intended to be exhaustive or to limit the invention to the precise form disclosed, and obviously many modifications and variations are possible in light of the above teaching. The embodiments were chosen and described in order to best explain the principles of the invention and its practical application to thereby enable others skilled in the art to best utilize the invention in various embodiments and with various modifications as are suited to the particular use contemplated. It is intended that the scope of the invention be defined by the claims appended hereto.