Incremental and targeted auto-discovery of network devices
View Patent ↗A method and/or system is configured to improve the results of an auto-detection of network devices based on the causes of detection failures in preceding runs of the auto-detection process. As each device that is believed to be in the network is found to be undiscovered, the identification of the device and information regarding the cause(s) of non-discovery are stored. Prior to the next auto-detection run, one or more of the discovery parameters are modified, based on the causes associated with the undiscovered devices. The extent to which the discovery parameters are modified is preferably based on the apparent stability of the network, or upon the detection of changes to the network.
1. A method comprising:
at a first time:
commencing a discovery process on a network analysis system using a first set of discovery parameters, the discovery process being configured to discover a plurality of discovered devices on a network, and to provide an identification of at least one undiscovered device on the network and a corresponding at least one cause associated with not discovering the undiscovered device,
storing the identification of the at least one undiscovered device and corresponding at least one cause in a memory, and
terminating the discovery process, and
at a second time:
retrieving the identification of the at least one undiscovered device and corresponding at least one cause from the memory,
modifying the first set of discovery parameters based on the at least one cause, to provide a second set of discovery parameters,
commencing the discovery process on the network analysis system at a second time using the second set of discovery parameters to discover the at least one undiscovered device, and
providing one or more reports based on the at least one undiscovered device.
2. The method of claim 1 , wherein the second time is separated from the first time by at least a day.
3. The method of claim 1 , wherein the modifying of the first set of discovery parameters is based on a classification of the network.
4. The method of claim 3 , wherein the classification is selected from a set of at least two of: dynamic, static, and transitional.
5. The method of claim 1 , wherein the cause is selected from a set of: exclusion, and failure to respond.
6. The method of claim 1 , wherein, if the cause is exclusion, one or more sources of the exclusion is stored in the memory.
7. The method of claim 6 , wherein the modifying of the first set of discovery parameters is based on a classification of the network and the one or more sources of exclusion.
8. The method of claim 7 , wherein the classification is selected from a set of at least two of: dynamic, static, and transitional.
9. The method of claim 6 , wherein the one or more sources of exclusion include one or more of:
included address list,
excluded address list,
included vendor list,
excluded vendor list, and
hop limit parameters.
10. The method of claim 6 , wherein, if the cause is failure to respond, one or more sources of belief that the undiscovered device is on the network is stored in the memory.
11. The method of claim 1 , wherein, if the cause is failure to respond, one or more sources of belief that the undiscovered device is on the network is stored in the memory.
12. The method of claim 11 , wherein the modifying of the first set of discovery parameters is based on a classification of the network and the one or more sources of belief.
13. The method of claim 12 , wherein the classification is selected from a set of at least two of: dynamic, static, and transitional.
14. The method of claim 11 , wherein the one or more sources of belief includes one or more of:
ARP (Address Resolution Protocol) table,
IP (Internet Protocol) subnet sweep,
routing table subnet sweep,
routing table next hop, and
neighbor discovery.
15. The method of claim 1 , including identifying one or more target segments of the network and modifying the first set of discovery parameters based on the one or more target segments.
16. The method of claim 15 , including querying one or more devices for configuration data, comparing the configuration data to prior configuration data to identify configuration changes, and identifying the one or more target segments based on the configuration changes.
17. The method of claim 15 , including receiving user input and identifying the one or more target segments based on the user input.
18. A system comprising:
a processor that is configured to communicate with devices on a network to identify discovered devices and undiscovered devices, and
a memory that is configured to store an identification of each undiscovered device and a corresponding at least one cause associated with a lack of discovery of the undiscovered device on the network,
wherein the processor is further configured to:
retrieve the identification of at least one undiscovered device and the corresponding at least one cause from the memory,
modify a first set of discovery parameters associated with the lack of discovery of the undiscovered device on the network based on the corresponding at least one cause, to provide a second set of discovery parameters, and
communicate with one or more of the devices on the network to discover whether the at least one undiscovered device is on the network, based on the second set of discovery parameters.
19. The system of claim 18 , wherein the processor is configured to modify the first set of discovery parameters based on a classification of the network.
20. The system of claim 19 , wherein the classification is selected from a set of at least two of: dynamic, static, and transitional.
21. The system of claim 18 , wherein the cause is selected from a set of: exclusion, and failure to respond.
22. The system of claim 18 , wherein, if the cause is exclusion, the processor is configured to store one or more sources of the exclusion in the memory.
23. The system of claim 22 , wherein the processor is configured to modify the first set of discovery parameters based on a classification of the network and the one or more sources of exclusion.
24. The system of claim 23 , wherein the classification is selected from a set of at least two of: dynamic, static, and transitional.
25. The system of claim 22 , wherein the one or more sources of exclusion include one or more of:
included address list,
excluded address list,
included vendor list,
excluded vendor list, and
hop limit parameters.
26. The system of claim 18 , wherein, if the cause is failure to respond, the processor is configured to store one or more sources of belief that the undiscovered device is on the network in the memory.
27. The system of claim 26 , wherein the processor is configured to modify the first set of discovery parameters based on a classification of the network and the one or more sources of belief.
28. The system of claim 27 , wherein the classification is selected from a set of at least two of: dynamic, static, and transitional.
29. The system of claim 26 , wherein the one or more sources of belief includes one or more of:
ARP (Address Resolution Protocol) table,
IP (Internet Protocol) subnet sweep,
routing table subnet sweep,
routing table next hop, and
neighbor discovery.
30. The system of claim 18 , wherein the processor is configured to modify the first set of discovery parameters based on one or more identified target segments of the network.
31. The system of claim 30 , wherein the processor is configured to detect changes at one or more devices on the network and to identify the one or more target segments based on the changes.
32. The system of claim 30 , wherein the processor is configured to receive user input and to determine the identified target segments based on this input.
33. A non-transitory computer readable medium that is configured to store a program that is configured to cause a processor to:
retrieve an identification of at least one undiscovered device and corresponding at least one cause associated with not discovering the at least one undiscovered device from a memory,
retrieve a first set of discovery parameters used by a discovery process that failed to discover the at least one undiscovered device,
modify the first set of discovery parameters based on the at least one cause, to provide a second set of discovery parameters,
execute the discovery process using the second set of discovery parameters to discover the at least one undiscovered device, and
provide one or more reports based on the at least one undiscovered device.
34. The medium of claim 33 , wherein the program is configured to cause the processor to modify the first set of discovery parameters based on a classification of the network.
35. The medium of claim 34 , wherein the classification is selected from a set of at least two of: dynamic, static, and transitional.
36. The medium of claim 33 , wherein the cause is selected from a set of: exclusion, and failure to respond.
37. The medium of claim 33 , wherein, if the cause is exclusion, the program is configured to cause the processor to store one or more sources of the exclusion in the memory.
38. The medium of claim 37 , wherein the program is configured to cause the processor to modify the first set of discovery parameters based on a classification of the network and the one or more sources of exclusion.
39. The medium of claim 38 , wherein the classification is selected from a set of at least two of: dynamic, static, and transitional.
40. The medium of claim 37 , wherein the one or more sources of exclusion include one or more of:
included address list,
excluded address list,
included vendor list,
excluded vendor list, and
hop limit parameters.
41. The medium of claim 33 , wherein, if the cause is failure to respond, the program is configured to cause the processor to store one or more sources of belief that the undiscovered device is on the network in the memory.
42. The medium of claim 41 , wherein the program is configured to cause the processor to modify the first set of discovery parameters based on a classification of the network and the one or more sources of belief.
43. The medium of claim 42 , wherein the classification is selected from a set of at least two of: dynamic, static, and transitional.
44. The medium of claim 41 , wherein the one or more sources of belief includes one or more of:
ARP (Address Resolution Protocol) table,
IP (Internet Protocol) subnet sweep,
routing table subnet sweep,
routing table next hop, and
neighbor discovery.
45. The medium of claim 33 , wherein the program is configured to cause the processor to modify the first set of discovery parameters based on one or more identified target segments of the network.
46. The medium of claim 45 , wherein the program is configured to cause the processor to detect changes at one or more devices on the network and to identify the one or more target segments based on the changes.
47. The medium of claim 45 , wherein the program is configured to receive user input and to determine the identified target segments based on this input.