Not sure why your diagram never matches reality? Network mapping tools build a map by combining several discovery methods, because no single protocol sees the whole network.
| Item | Value |
|---|---|
| ICMP | Identifies reachable devices and live IP addresses |
| SNMP | Discovers device identity, interfaces and system information |
| LLDP | Identifies directly connected neighbours across multi-vendor environments |
| CDP | Discovers neighbouring Cisco devices and their interfaces |
| Routing tables | Layer 3 view of routing paths, next hops and reachability |
These entries come from a vendor’s network mapping protocols guide. Vendor documentation and device behaviour can change, so check the source before you rely on it.
What network mapping tools actually do
A network map is a picture of devices and the links between them. Network mapping tools collect data from the network, then draw that picture so you do not have to maintain it by hand.
Hand-drawn diagrams go stale quickly. A tool that rediscovers the network can show what is connected today, not what was connected when someone last opened the drawing.
Mapping builds on inventory work. If you are still finding out what exists, start with network discovery tools, then use mapping to show how those devices connect.
Maps serve different jobs, and the job decides how much detail you need. Common uses include:
- Troubleshooting, where you trace the path between a failing device and its upstream switch.
- Documentation, where you keep a current record of what connects to what.
- Change planning, where you check what depends on a device before you take it offline.
- Onboarding, where a new colleague learns the layout in minutes rather than weeks.
Layer 2 maps show switches and their links, while Layer 3 maps show subnets and routers. Many tools draw both, and it helps to know which view you are looking at before you trust a conclusion.
The data sources behind a map
The guide linked above puts it plainly: “Since no single protocol can fully represent an enterprise network, modern mapping solutions combine multiple discovery methods to understand devices, connectivity, routing, and network structure.” Each source answers a different question.
- ICMP shows what is alive. As the guide says, “A device may respond to ICMP, confirming that it is reachable, but not where it connects.”
- SNMP describes each device and its interfaces, but “cannot, by itself, describe the network’s complete topology.”
- LLDP and CDP reveal who is plugged into whom. LLDP works across vendors, while CDP covers Cisco devices.
- ARP and MAC address tables help place endpoints on the network. ARP associates IP addresses with MAC addresses.
- Routing tables add the Layer 3 picture of paths and next hops.
Reading device data over SNMP means working with object identifiers. A SNMP MIB browser helps you see which values a device actually exposes when a map looks incomplete.
Why maps come out incomplete
Gaps are common, and they usually have a cause you can fix. The guide notes that “Restricted access, incomplete MIB implementations, or inconsistent device configurations can reduce discovery coverage.”
Neighbour discovery has its own limit: LLDP and CDP rely on neighbouring devices advertising their identities. If neighbour discovery is turned off on a switch, the link may have to be inferred from other data.
The guide says modern tools respond by correlating “SNMP, ARP tables, MAC address tables, routing information, and other discovery sources to reconstruct missing relationships.” In practice that means a link may be inferred rather than directly reported, so treat it as likely rather than certain.
Choosing a protocol mix for your network
Match the discovery stack to the size of your environment. The same guide recommends the following.
- Home labs and small networks: ICMP plus SNMP, which discovers live devices and builds a basic inventory.
- Small and mid-sized business networks: ICMP plus SNMP plus LLDP/CDP, which adds Layer 2 topology.
Larger networks add ARP, MAC tables and routing data to the mix. Enabling LLDP on managed switches and giving the tool read-only SNMP access are the two changes that usually improve a map most.
Mapping is one part of a wider toolset. For how it sits alongside monitoring and configuration tools, see this overview of network management software.
How one monitoring tool fuses the layers
Netdata’s documentation shows how the pieces fit in a real product. Its discovery methods page says it fuses these sources “per device into one live graph”.
The split of roles is worth copying in your own thinking about maps:
- LLDP and CDP give the links between devices.
- The forwarding database (FDB), meaning the MAC address tables of your switches, shows which MAC is seen on which port.
- ARP places the endpoints.
- STP marks which links are active.
- BGP and OSPF add the routing layer.
The same page describes LLDP as the vendor-neutral option, where each device advertises its chassis, port, system name and management address. CDP gives the same neighbour discovery on Cisco and Cisco-compatible gear, with extra detail such as platform, native VLAN and duplex.
Direct links versus inferred links
Good tools tell you how sure they are. Netdata’s map options include a default view with direct LLDP/CDP and managed STP links, plus a “High Confidence Inferred Map” and an “All Devices (Low Confidence)” view.
It also offers an “Infer strategy” setting, which reconstructs links the devices do not advertise directly, using the forwarding database and other data. This is the practical meaning of a confidence level on a map.
When you review a map, ask three questions:
- Which links came straight from a neighbour table?
- Which were worked out from MAC tables or spanning tree?
- Which devices appear with no links at all, and why?
An unlinked device is usually a sign of missing credentials or disabled neighbour discovery, not a missing cable.
What to look for in a tool
- Support for the protocols your devices actually speak, especially LLDP if you run mixed vendors.
- Scheduled rediscovery, so the map follows changes.
- A clear way to see which links were reported and which were inferred.
- Export options, so the map can feed documentation.
Test any candidate on a small segment first. Compare its map with what you know is cabled, and note which links it misses.
A simple workflow for a first map
- Start with a short list of subnets and a read-only SNMP credential for your managed devices.
- Run discovery and record how many devices answered compared with how many you expected.
- Turn on LLDP on the switches that show no neighbours, then rerun discovery.
- Review the links the tool marks as inferred and confirm a few against the cabling.
- Schedule rediscovery so the map keeps pace with moves and additions.
Keeping the map useful
A map earns its place when people trust it during an outage. That trust comes from knowing its age and its blind spots, so note when the last discovery ran and which segments it could not reach.
Treat unmanaged switches, hubs and virtual networks as likely gaps. They often forward traffic without advertising themselves, so the tool may draw one longer link where several short ones exist.
Finally, keep the credentials narrow. Read-only access is enough for mapping, and it limits the harm if a credential leaks.
Frequently asked questions
Is a network map the same as a network inventory?
Show answer
No. An inventory lists devices, while a map also shows the connections between them.
Why does my map miss some switches?
Show answer
Common causes are restricted access, incomplete MIB support or neighbour discovery being switched off on the device.
Do I need LLDP if I only run Cisco gear?
Show answer
CDP covers neighbouring Cisco devices, but LLDP identifies neighbours across multi-vendor environments, so it helps once other brands appear.
What does a low-confidence link mean?
Show answer
It means the tool worked the link out from other data, such as MAC address tables, rather than reading it from a neighbour table. Verify it against your cabling before acting on it.
Can SNMP alone draw a topology map?
Show answer
No. SNMP gives detailed device and interface data but cannot, by itself, describe the complete topology.
