Exploring Physical Network Topologies Using ntopng

Posted · Add Comment

ntop tools are known for monitoring network traffic. However this traffic has to flow on physical networks and thus it is important to understand the physical network layout. LLDP (Link Layer Discovery Protocol) is a network protocol used to dynamically build network topologies and identify network device neighbours. In the latest ntopng dev build (that will be merged in the next v4 stable) we have enhanced the SNMP monitoring capabilities with LLDP support.

if your SNMP devices have LLDP enabled, ntopng now polls this information and build an adjacency graph similar to the one below.

You can click on nodes (they represent SNMP devices) to zoom on the specific device, or to drag and zoom using the mouse as you would do with force directed graphs. You can click on the Topology menu item to see a detailed adjacency view and identify device neighbours and connection ports.

In order to see a full meshed topology you need to configure all your SNMP devices in ntopng so they could be periodically polled and the adjacency graph created.

Thanks to this new development you can map a monitored host to a physical port, and now you can depict how this port is connected (for instance at layer-2 that is invisible to tools such as traceroute) to the rest of the network.