Method and system for collecting topology information

1. A method comprising:

receiving, by a first sensor of a network, a stream of packets,

identifying, by the first sensor, a topology trace packet in the stream of packets,

the topology trace packet including:

a destination address, and

a second sensor ID, of a second sensor of the network, in a payload of the topology trace packet,

modifying, by the first sensor, the topology trace packet to include a first sensor ID, of the first sensor, in the payload,

sending, by the first sensor and after modifying the topology trace packet, the topology trace packet to the destination address,

forming, by the first sensor, a report that includes the first sensor ID, the second sensor ID, and Time-To-Live (TTL) data, and

sending, by the first sensor, the report to a topology manager to provide the topology manager with information about spatial relation between the first sensor and the second sensor.

2. The method of claim 1 , further comprising:

providing, by the first sensor and to the topology manager, network addresses of devices adjacent to the first sensor.

3. The method of claim 1 , further comprising:

capturing a plurality of packets at the first sensor,

sending copies of the plurality of packets to the topology manager, and

forwarding the plurality of packets to destination addresses associated with the plurality of packets.

4. The method of claim 1 , wherein the TTL data includes a time-to-live (TTL) value of the topology trace packet for enabling the topology manager to calculate a distance between the first sensor and the second sensor.

5. The method of claim 1 , wherein the report further includes a MAC source address of the topology trace packet.

6. The method of claim 1 , wherein the first senor and the second sensor are addressless devices.

7. The method of claim 1 , wherein sending the report to the topology manager includes using a source IP address of the topology trace packet.

8. The method of claim 1 , further comprising:

capturing a control packet conforming to a control protocol, and

sending at least a portion of the control packet to the topology manager to provide the topology manager with information about remote devices.

9. The method of claim 8 , wherein the control protocol is one of an ICMP Router Discovery Protocol, a Link Layer Discovery Protocol, a Logical link control protocol, a Cisco Discovery Protocol, a Link Aggregation Control Protocol (LACP), a Port Aggregation Protocol (PAgP), or an Enhanced Interior Gateway Routing Protocol (EIGRP).

10. The method of claim 8 , further comprising:

sending, by the first sensor, a router discovery solicitation message to obtain the information about remote devices.

11. The method of claim 1 , further comprising:

receiving, by the first sensor, requests from the topology manager to start topology filtering.

12. The method of claim 1 , further comprising:

receiving the report at the topology manager, and

constructing a partial topology representation based on information obtained from the report.

13. The method of claim 1 , further comprising:

receiving, by the topology manager, a plurality of reports that include the report, and

combining, by the topology manager and based on the plurality of reports, partial topology representations to form a combined topology representation of the network.

14. The method as defined in claim 1 , wherein the report includes information regarding a number of hops between the first sensor and the second sensor.

15. A non-transitory computer-readable medium storing instructions, the instructions comprising:

one or more instructions that, when executed by a first sensor of a network, cause the first sensor to:

receive a stream of packets,

identify a topology trace packet in the stream of packets,

the topology trace packet including:

a destination address, and

a second sensor ID, of a second sensor of the network, in a payload of the topology trace packet,

modify the topology trace packet to include a first sensor ID, of the first sensor, in the payload,

send, after modifying the topology trace packet, the modified topology trace packet to the destination address,

form a report that includes the first sensor ID, the second sensor ID, and Time-To-Live (TTL) data, and

send the report to a topology manager to provide the topology manager with information about spatial relation between the first sensor and the second sensor.

16. A system comprising:

a first sensor being associated with a first sensor ID and configured to:

receive a stream of packets;

identifying a topology trace packet in the stream of packets,

the topology trace packet including;

a destination IP address, and

a second sensor ID, of a second sensor, in a payload of the topology trace packet,

modify the topology trace packet to include the first sensor ID in the topology trace packet,

send, after modifying the topology trace packet, the topology trace packet to the destination IP address,

form a repot message that includes the first sensor ID, the second sensor ID, and Time-To-Live (TTL) data, and

send the report message to a topology manager.

17. The system of claim 16 , where the topology manager is configured to:

receive a plurality of report that includes the report message,

form, based on the plurality of reports, a topology representation of a network based on sensor IDs obtained from the reports,

the sensor IDs including the first sensor ID and the second sensor ID.

18. The system of claim 16 , where, when identifying the topology trace packet, the first sensor is configured to:

identify a pattern in the topology trace packet,

determine that the pattern matches an authentication pattern stored in a memory of the first sensor, and

identify the topology trace packet based on determining that the pattern matches the authentication pattern.

19. The non-transitory computer-readable medium of claim 15 , where the one or more instructions to modify the topology trace packet comprise:

one or more instruction that, when executed by the first sensor, cause the firs sensor to:

modify the payload of the topology trace packet without modifying a header of the topology trace packet.

20. The non-transitory computer-readable medium of claim 15 , where the one or more instructions further cause the first sensor to:

determine a TTL value of the topology trace packet, and

determine the TTL data based the TTL value.