Network topology mapping sounds simple until you have 500 devices spread across 3 datacenters and 12 regional offices. Suddenly you need automated discovery, because manually drawing connections is madness. This guide explains what tools actually do topology mapping, how they discover relationships, and which ones are worth your time.

What Is Network Topology Mapping?

Topology mapping automatically discovers which devices connect to which, then visualizes those relationships. Instead of a list of 500 routers with no context, you see a diagram:

ISP Border Router (1.1.1.1)
    └─ Regional Router 1 (1.1.2.1)
        ├─ Access Switch 1 (1.1.2.10)
        │   ├─ PoE Switch (1.1.2.20)
        │   └─ WiFi AP (1.1.2.30)
        └─ OLT (1.1.2.40)
            ├─ ONT Customer 1 (1.1.3.1)
            └─ ONT Customer 2 (1.1.3.2)

This hierarchy helps operations teams understand failure scope. If the OLT goes down, you immediately see which customers lose service.

Discovery Mechanisms

LLDP (Link Layer Discovery Protocol)

LLDP is the open standard for advertising device identity to neighbors. It works on Ethernet layer 2—even if IP routing is broken, LLDP still talks.

How it works:

• Device X sends multicast LLDP frames every 30 seconds
• Nearby devices on the same switch/segment receive the frame
• Frame contains: device ID, management IP, port description, capabilities

LLDP OIDs for SNMP polling:

# Neighbor table (which devices connect to which ports)
lldpRemoteChassisId      1.0.8802.1.1.2.1.3.2.0
lldpRemotePortDesc       1.0.8802.1.1.2.1.3.7.1.3
lldpRemoteSystemName     1.0.8802.1.1.2.1.3.3.0

Enable LLDP on MikroTik:

/interface ethernet switch set all lldp=yes
/snmp set enabled=yes

Pros:

• Works on any modern switch (Cisco, Arista, HP, MikroTik, etc.)
• Zero configuration once enabled
• Low bandwidth (LLDP frames are ~200 bytes, every 30 seconds)

Cons:

• Only discovers directly connected devices (L2 neighbors)
• Doesn’t show across IP hops
• Some budget gear doesn’t support it

CDP (Cisco Discovery Protocol)

CDP is Cisco’s proprietary version of LLDP. It’s older and less reliable, but still widely used on legacy Cisco equipment.

Enable CDP on Cisco:

Switch(config)# cdp run
Switch(config)# interface GigabitEthernet 1/0/1
Switch(config-if)# cdp enable

vs LLDP:

• CDP is Cisco-only; LLDP is universal
• CDP updates every 60 seconds; LLDP every 30 seconds
• LLDP is the future; CDP is legacy

If you have choice, always pick LLDP.

ARP Table (Indirect Discovery)

ARP tables don’t show direct physical links, but they show which devices have recently communicated on the same network segment. By analyzing ARP neighbors across all devices, you can infer which segments are connected.

How it works:

1. Poll ARP tables from all routers: 1.3.6.1.2.1.3.1.1
2. If Router A and Switch B both appear in the same ARP neighbor set, they’re likely on the same segment
3. Build a graph from ARP correlations

Pros:

• Works on devices with old/no LLDP support
• Passive discovery (no extra configuration)

Cons:

• Unreliable for sparse networks (low ARP traffic = missing links)
• Can’t distinguish direct vs indirect connections
• Prone to false positives (broadcast segments)

SNMP Walk (Device Table Inspection)

Some tools (NetBox, Zabbix) walk the device’s own interface table to find connected ports, then cross-reference with ARP tables. Manual, but effective for custom topologies.

# Get all interfaces and neighbors
snmpwalk -v 2c -c public DEVICE 1.3.6.1.2.1.31.1.1.1

Manual/API-based

Tools like Nautobot and NetBox have APIs that let you programmatically register devices and connections. You control the topology; discovery is secondary.

Tools That Actually Map Topology

1. YAD (Yet Another Dude)

Discovery method: SNMP neighbor polling, manual topology editor

Topology features:

• Drag-drop map editor (like The Dude)
• Color-coded device status (green = up, red = down)
• Zoom to sub-networks
• SNMP-based neighbor discovery (limited)

Limitations:

• No automatic LLDP parsing
• Doesn’t auto-discover across IP boundaries
• Best for <200 devices

Best for: ISPs who want The Dude’s visual interface without Windows pain.

# YAD topology via web UI: Add Device → Set neighbors manually or import YAML

2. LibreNMS

Discovery method: LLDP/CDP walk + ARP correlation

Topology features:

• Auto-discovers LLDP neighbors, builds map on demand
• Shows L2 and L3 topology separately
• Color-coded by device type (router, switch, firewall)
• Clickable per-device neighbor list
• Generates Graphviz visualizations

Example LLDP discovery:

# LibreNMS auto-discovers this on every poll:
Device1 port eth0 → Device2 port eth1
Device2 port eth2 → Device3 port eth3
# Builds topology: Device1 ←→ Device2 ←→ Device3

Best for: ISPs with 100–2000 devices who need accurate L2 maps.

3. Zabbix with Network Map Module

Discovery method: Template-based, ARP correlations, custom scripts

Topology features:

• Define maps in UI or API (manual)
• Icon library (routers, switches, servers, clients)
• Trigger-based color changes (device down = red icon)
• Limited auto-discovery (mostly manual)

Limitations:

• Doesn’t auto-discover like LibreNMS
• Maps are more “status dashboard” than “topology”
• Better for monitoring than discovery

Best for: Large enterprises with complex multi-site layouts who want status overlays.

4. NetBox + Nautobot

Discovery method: API + manual DCIM (Data Center Inventory Management)

Topology features:

• Graph UI showing all connections
• Manual entry (you define relationships, graph auto-renders)
• Integration with Ansible/Terraform (source of truth for topology)
• REST API for programmatic updates

Limitations:

• Zero auto-discovery (you populate everything)
• Designed for DCIM, not ISP monitoring
• Steep learning curve (enterprise tool)

Best for: Large enterprises with Ansible infrastructure who want single source of truth.

5. Prometheus + Custom Scraper

Discovery method: Service discovery (Kubernetes, static files, API)

Topology features:

• No native topology mapping
• You build custom Grafana dashboards showing relationships
• Works best with app-level metrics (not SNMP)

Best for: Cloud-native environments, not ISP networks.

Comparison: LLDP, CDP, and ARP Discovery

ISP Use Case: Building a Complete Network Map

You’re an ISP with 50 customer locations. Each has a CPE device (MikroTik hEX or similar). You want to know which CPE connects to which regional hub.

Step 1: Enable LLDP on Core Devices

# On each Regional Hub (MikroTik RB4011):
/interface ethernet switch set all lldp=yes
/snmp set enabled=yes community=public

# On each Customer CPE (MikroTik hEX):
/interface ethernet switch set all lldp=yes
/snmp set enabled=yes community=public_customer

Step 2: Deploy LibreNMS with Auto-Discovery

docker run -d \
  -e DB_HOST=mysql \
  -e DB_NAME=librenms \
  -e DB_USER=librenms \
  -e DB_PASS=PASSWORD \
  -p 8080:80 \
  librenms/librenms

Step 3: Add Devices to LibreNMS

Via web UI: Add all 50 hubs + 50 CPEs. LibreNMS polls SNMP and builds LLDP map.

Step 4: View Topology

LibreNMS automatically discovers:

• CPE1 port ether1 ↔ Hub1 port ether10
• CPE2 port ether1 ↔ Hub1 port ether11
• CPE3 port ether1 ↔ Hub2 port ether15

You get a visual map with zero manual topology entry.

Common Pitfalls

1. LLDP Not Enabled

Symptom: “LibreNMS sees devices but no topology.” Fix: Check /interface ethernet switch lldp on MikroTik, show lldp on Cisco.

2. SNMP v1 vs v3 Mismatch

LibreNMS uses SNMP v3 for security; your devices only support v1/v2c. Fix: Configure v2c on your devices, set LibreNMS community string.

3. Topology Shows Wrong Connections

Often due to unmanaged switches (no SNMP, no LLDP). Unmanaged switches are invisible. Fix: Replace with managed switches, or use ARP-based discovery as fallback.

4. Too Many Devices = Topology Too Complex

If you have 5000 devices, a full topology graph is useless (can’t read it). Fix: Filter by site, device type, or VLAN. Use hierarchical layouts instead of flat graphs.

Conclusion

For ISPs and MSPs:

• If you have 50–500 devices and use modern switches: Deploy LibreNMS. LLDP auto-discovery will save you weeks of manual mapping.
• If you have <100 devices and want simple visual monitoring: Use YAD with manual topology. Faster deployment, less overhead.
• If you have 500+ devices: Use LibreNMS or Zabbix. At this scale, automated discovery pays for itself.
• If you’re in DCIM/enterprise space: Consider NetBox + Nautobot for source-of-truth topology.

LLDP is your friend. Enable it everywhere, and your monitoring tool will thank you.

Deploy YAD with topology mapping → yetanotherdude.io
Single binary, drag-drop editor, SNMP discovery included.