SkylarOne Topology Intelligence

Hello Isaac,

Skylar One collects LLDP and CDP data via SNMP. We collect data from the LLDP-MIB for LLDP and the CISCO-CDP-MIB for CDP. Neighbor information is collected from these OIDs and processed, and there are specific OIDs for parent devices and children devices that define this relationship.

Antonio Andres

Principal Technical Support Engineer | ScienceLogic

Skylar One detects parent/child relationships from CDP and LLDP.

Here's how the platform picks which device is the parent and which is the child:

Collection and processing. Data Collectors poll routers, switches, and bridges every two hours over SNMP and pull neighbor information from the standard CDP and LLDP MIBs. The Topology Crunch process on the central database runs on a similar cadence and converts the raw neighbor data into device relationship records. A new CDP or LLDP relationship can take up to four hours to appear after a device is added or connectivity changes.

Parent vs. child in Skylar One 12.5.4 and later. The rule is straightforward. The parent is the device the neighbor data was collected from. The child is the reported neighbor. This applies regardless of device type.

Behavior in earlier versions. In 12.3.x the parent was always the router or switch, with the other device deemed the child. Upgrading to 12.5.4 or later provides an improved and consistent collected-from behavior.

On the roadmap. A backlog initiative will give users explicit control over parent/child orientation, so customers can override the default when their topology model calls for it. Release timing has not been determined yet.

One-way relationships. When only one side runs CDP or LLDP, a CDP-enabled switch reporting a wireless access point for example, the network device that did the collecting is the parent with a specific interface identified, and the non-CDP/LLDP device is the child with no interface on its side.

• Note: The Enhanced Processing setting under System > Settings > Behavior must be enabled, with per-device-class or per-device opt-in. Available in 12.5 and later.

Where customers see the result.

• Registry > Networks > Device Relationships
  • filterable by type, including CDP, LLDP, L2, L3, and ARP.
  • Relationships also appear on the Relationships tab in the Device Investigator
  • Devices get drawn automatically in Maps, and feed topology-based event correlation.

Can you share the specific OID which tells the parent and child

Hello Isaac,

The OIDs we use to collect LLDP data is listed in this KB article here https://support.sciencelogic.com/s/article/19885. 

We do not have ab equivalent article for CDP at the moment, but the OIDs for CDP are listed in the CISCO-CDP-MIB. The specific OIDs are:

• cdpCacheAddressType: .1.3.6.1.4.1.9.9.23.1.2.1.1.3
• cdpCacheAddress: .1.3.6.1.4.1.9.9.23.1.2.1.1.4
• cdpCacheDevicePort: .1.3.6.1.4.1.9.9.23.1.2.1.1.7

Antonio Andres

Principal Technical Support Engineer | ScienceLogic

Hi Tony,

This tells in general what we are collecting for CDP and LLDP , not about how SL1 is detecting which is parent and child . 

Hello Isaac,

Skylar One leverages the local/remote architecture of LLDP to define who the parent and child is, so data in the local OIDs are attributed to the “parent” and the remote OIDs are attributed to the “child”. CDP work identically to LLDP, except the local/remote information is stored in the cdpCacheTable table. 

Antonio Andres

Principal Technical Support Engineer | ScienceLogic

Hi Tony,

 Assume you have device A which has the local port info and declared as parent and also it gives the lldp remote device b data. So here Device A is parent and B child.

Now device B also has the local port info and declared as parent and also it gives the lldp remote device A data. So here Device B is parent and A is child.

A circular method is happening.