Ethernet Topology Discovery: A Survey <s> II. MOTIVATIONS <s> How can you determine what the Internet or even an intranet looks like? The answer is, of course, to draw it on screen. Once you can see the data succinctly, it becomes much easier to understand. The drawing itself can help locate bottlenecks and possible points of failure. Where is that newly acquired subsidiary connected? Which business units have connections to business partners? More important, visual displays of networks have another dimension-color. Color is an easy way to display link use, status, ownership, and network changes. <s> BIB001 </s> Ethernet Topology Discovery: A Survey <s> II. MOTIVATIONS <s> Knowledge of the up-to-date physical topology of an IP network is crucial to a number of critical network management tasks, including reactive and proactive resource management, event correlation, and root-cause analysis. Given the dynamic nature of today's IP networks, keeping track of topology information manually is a daunting (if not impossible) task. Thus, effective algorithms for automatically discovering physical network topology are necessary. Earlier work has typically concentrated on either: (a) discovering logical (i.e., layer-3) topology, which implies that the connectivity of all layer-2 elements (e.g., switches and bridges) is ignored; or (b) proprietary solutions targeting specific product families. In this paper, we present novel algorithms for discovering physical topology in heterogeneous (i.e., multi-vendor) IP networks. Our algorithms rely on standard SNMP MIB information that is widely supported by modern IP network elements and require no modifications to the operating system software running on elements or hosts. We have implemented the algorithms presented in this paper in the context of a topology discovery tool that has been tested on Lucent's own research network. The experimental results clearly validate our approach, demonstrating that our tool can consistently discover the accurate physical network topology in time that is roughly quadratic in the number of network elements. <s> BIB002 </s> Ethernet Topology Discovery: A Survey <s> II. MOTIVATIONS <s> Accurate network topology information is important for both network management and application performance prediction. Most topology discovery research has focused on wide-area networks and examined topology only at the IP router level, ignoring the need for LAN topology information. Recent work has demonstrated that bridged Ethernet topology can be determined using standard SNMP MIBs; however, these algorithms require each bridge to learn about all other bridges in the network. Our approach to Ethernet topology discovery can determine the connection between a pair of the bridges that share forwarding entries for only three hosts. This minimal knowledge requirement significantly expands the size of the network that can be discovered. We have implemented the new algorithm, and it has accurately determined the topology of several different networks using a variety of hardware and network configurations. Our implementation requires access to only one endpoint to perform the queries needed for topology discovery. <s> BIB003 </s> Ethernet Topology Discovery: A Survey <s> II. MOTIVATIONS <s> Effective reasoning about system attacks and responses requires a comprehensive model that covers all aspects of the system being analyzed, from network topology and configuration, to specific vulnerabilities, to possible adversary capabilities and possible attacks. A comprehensive model can be used as the basis for real-time attack/response simulations "what if" course of action analysis, policy simulation and debugging, and more. This paper describes the Checkmate security model and illustrates how this model can be used as the basis for a tool that performs effective security analysis on real-world networks. <s> BIB004 </s> Ethernet Topology Discovery: A Survey <s> II. MOTIVATIONS <s> Security analysis should take advantage of a reliable knowledge base that contains semantically-rich information about a protected network. This knowledge is provided by network mapping tools. These tools rely on models to represent the entities of interest, and they leverage off network discovery techniques to populate the model structure with the data that is pertinent to a specific target network. Unfortunately, existing tools rely on incomplete data models. Networks are complex systems and most approaches oversimplify their target models in an effort to limit the problem space. In addition, the techniques used to populate the models are limited in scope and are difficult to extend. This paper presents NetMap, a security tool for network modeling, discovery, and analysis. NetMap relies on a comprehensive network model that is not limited to a specific network level; it integrates network information throughout the layers. The model contains information about topology, infrastructure, and deployed services. In addition, the relationships among different entities in different layers of the model are made explicit. The modeled information is managed by using a suite of composable network tools that can determine various aspects of network configurations through scanning techniques and heuristics. Tools in the suite are responsible for a single, well-defined task. <s> BIB005 </s> Ethernet Topology Discovery: A Survey <s> II. MOTIVATIONS <s> Many tools let you view traffic in real time, but real-time monitoring at any level requires significant human and hardware resources, and doesn't scale to networks larger than a single workgroup. It is generally more practical to archive all traffic and analyze subsets as necessary. This process is known as reconstructive traffic analysis, or network forensics. In practice, it is often limited to data collection and packet-level inspection; however, a network forensics analysis tool can provide a richer view of the data collected, allowing you to inspect the traffic from further up the protocol stack? The IT industry's ever-growing concern with security is the primary motivation for network forensics. A network that has been prepared for forensic analysis is easy to monitor, and security vulnerabilities and configuration problems can be conveniently identified. It also allows the best possible analysis of security violations. Most importantly, analyzing a complete record of your network traffic with the appropriate reconstructive tools provides context for other breach-related events. <s> BIB006 </s> Ethernet Topology Discovery: A Survey <s> II. MOTIVATIONS <s> Simulations are an important tool in network research. As the selected topology often influences the outcome of the simulation, realistic topologies are needed to produce realistic simulation results. We first discuss the different types of topologies and present our collection of real-world topologies that can be used for simulation. We then define several similarity metrics to compare artificially generated topologies with real world topologies. We use them to find out what the input parameter range of the topology generators of BRITE, TIERS and GTITM are to create realistic topologies. These parameters can act as a valuable starting point for researchers that have to generate artificial topologies. <s> BIB007 </s> Ethernet Topology Discovery: A Survey <s> II. MOTIVATIONS <s> This work addresses the problem of layer 2 topology discovery. Current techniques concentrate on using SNMP to query information from Ethernet switches. In contrast, we present a technique that infers the Ethernet (layer 2) topology without assistance from the network elements by injecting suitable probe packets from the end-systems and observing where they are delivered. We describe the algorithm, formally characterize its correctness and completeness, and present our implementation and experimental results. Performance results show that although originally aimed at the home and small office the techniques scale to much larger networks. <s> BIB008 </s> Ethernet Topology Discovery: A Survey <s> II. MOTIVATIONS <s> Knowledge of the up-to-date physical topology of an IP network is crucial to a number of critical network management tasks, including reactive and proactive resource management, event correlation, and root-cause analysis. Given the dynamic nature of today's IP networks, keeping track of topology information manually is a daunting (if not impossible) task. Thus, effective algorithms for automatically discovering physical network topology are necessary. Earlier work has typically concentrated on either 1) discovering logical (i.e., layer-3) topology, which implies that the connectivity of all layer-2 elements (e.g., switches and bridges) is ignored, or 2) proprietary solutions targeting specific product families. In this paper, we present novel algorithms for discovering physical topology in heterogeneous (i.e., multi-vendor) IP networks. Our algorithms rely on standard SNMP MIB information that is widely supported by modern IP network elements and require no modifications to the operating system software running on elements or hosts. We have implemented the algorithms presented in this paper in the context of the NetInventory topology-discovery tool that has been tested on Lucent's own research network. The experimental results clearly validate our approach, demonstrating that our tool can consistently discover the accurate physical network topology with reasonably small running-time requirements even for fairly large network configurations. <s> BIB009 </s> Ethernet Topology Discovery: A Survey <s> II. MOTIVATIONS <s> Network forensics is a new approach for the network security, because the firewall and IDS cannot always stop and discover the misuse in the network. Once the system is compromised, the forensics and investigation always after the attacks and lose some useful instant evidence. The integrated analysis of the log and audit system and network traffic can lead to an efficient navigation of the traffic. The current network forensics approaches only focus on the network traffic capture and traffic replay, which always result in the performance bottleneck or forensics analysis difficulties. However, the adaptive capture without lose the potential sensitive traffic and real time investigation are seldom discussed. In this paper, we discuss the frameworks of distributed agent-based real time network intrusion forensics system, which is deployed in local area network environment. Some novel approaches for network forensics are discussed for the first time, such as network forensics server, network forensics database, network forensics agents, forensics data integration and active real time network forensic. <s> BIB010 </s> Ethernet Topology Discovery: A Survey <s> II. MOTIVATIONS <s> This paper presents Atlas,a system that facilitates the automated capture of IPv6 network topology information from a single probing host.It describes the Atlas infrastructure and its data collection processes.We also present some initial results from our probing of the 6Bone,currently the largest public IPv6 network.The results illustrate the effectiveness of the probing algorithm and also identify some trends in prefix allocation and routing policy. <s> BIB011
Network topology information can be valuable in a variety of situations; it can be used for network administration (including fault-detecting and avoiding BIB008 BIB002 , network inventory and planning BIB002 BIB009 , protocol and routing algorithm development  , performance prediction BIB003 and monitoring as well as accurate network simulation BIB007 . From a network security perspective, topology information can find application in threat detection BIB004 , network monitoring BIB005 , network access control  and forensic investigations BIB006 BIB010 . Manual network mapping is becoming increasingly difficult BIB001 (if not impossible BIB011 ) due to the size and dynamic behavior of networks. Automatic topology discovery tools and algorithms will therefore play an important role in network security, management and administration. Research efforts concerned with physical topology discovery have focused mainly on cooperative network environments BIB008 where it is assumed that network elements are intelligent and can be queried for topology related information.