NacTrack
FRGet the demo
Product

Give it one switch. It finds the rest.

NacTrack walks the CDP and LLDP neighbours outward, hop by hop, until nothing new turns up. On an estate never fully listed, it usually finds devices nobody had.

Free network audit
app.nactrack.com/discovery/runs/demo-discovery-20260801-210507
A completed discovery sweep: 58 devices found, grouped by subnet

How the crawl works

  1. 1

    One starting point

    A single known device is enough, usually a core switch. The crawl starts there.

  2. 2

    Reading the reported neighbours

    CDP and LLDP give, port by port, the identity and management address of what is plugged in opposite. Every unknown neighbour becomes a candidate.

  3. 3

    Connection attempt

    The candidate is reached with the supplied credentials. The outcome is classified: reachable and recognised, reachable but authentication refused, unreachable, or recognised but platform not supported.

    That distinction is what matters. Telling an unreachable device from one whose password is wrong is what makes the result usable.

  4. 4

    Recursion, then stop

    Each adopted device is queried in turn. The crawl stops when no new neighbour appears.

The crawl

What one starting device reaches

And the device it does not reach, on the same drawing. The limit is more useful than the promise when you are deciding whether to trust the result.

Discovery crawl from one seed device, and a device the crawl cannot reachOn the left, the seed device you supply. It reports three neighbours, which report four more, and the crawl spreads that way. At the bottom right, detached and dashed, a device no line reaches: it announces neither CDP nor LLDP, nobody reports it, and the crawl therefore cannot find it.SeedWHAT YOU GIVE ITREPORTED NEIGHBOURSTHEIR NEIGHBOURSNot seenA device that announces neither CDP nor LLDP isreported by nobody. No line reaches it, which isprecisely what happens: the crawl cannot find it.
  • SeedWHAT YOU GIVE IT
  1. REPORTED NEIGHBOURS3
  2. THEIR NEIGHBOURS4
  • Not seenA device that announces neither CDP nor LLDP is reported by nobody. No line reaches it, which is precisely what happens: the crawl cannot find it.

The complement is a sweep of a management address range, which finds what neighbours do not report. The two methods together are worth more than either alone.

app.nactrack.com/discovery/runs
The devices a sweep found, with vendor, model and software version
A finished sweep, seen through what it brought back: 58 devices, each with its address, the number of hops from the starting point, the vendor, the model, the software version and the serial. Nokia, Cisco, Huawei, Juniper, Aruba, Arista, Dell, Fortinet and F5 in one table.
In practice

What discovery actually turns up

On an estate never fully inventoried, the crawl almost always turns up devices missing from every list.

  • A floor switch installed during building work.
  • A workshop box nobody thinks of as network equipment.
  • A spare plugged in and forgotten.
  • An acquired site whose estate was never taken over.
  • Those are exactly the ones that cause trouble: old, often past support, rarely hardened.
  • The crawl also reports the failures. A reachable device whose authentication fails is a device whose credentials you have lost.
The limits

The limits of the method

The crawl follows reported neighbours. A device that announces neither CDP nor LLDP is not seen by its neighbour, so it is not discovered this way. That covers some firewalls, unmanaged hardware, and anything behind a third party carrier.

A discovered estate is therefore never guaranteed complete. The complement is a sweep: a management address range can be walked to reach what the neighbour graph did not reveal.

  • One starting point is enough
  • Failures classified by cause
  • Manual adoption of what is found
  • Replays on demand or on a schedule
  • Complemented by sweeping a range

Find what your inventory is missing

Free network auditAll modules