How to find the network devices nobody declared
To find the network devices nobody declared, compare what your known devices see around them with your inventory: every CDP or LLDP neighbour that is not in the inventory is a candidate. A device that announces nothing will not show up that way, which is where a sweep of the management subnets comes in. NacTrack lists those neighbours on the Devices page at every collection, and the Discovery module can crawl outward from seeds or subnets.
What you need
- Module required: inventory.
- Permission required: view_inventory.
- Neighbours seen over CDP or LLDP by any collected device. The active crawl needs the discovery module and the run_discovery permission.
In NacTrack
- 1
Open Inventory, then Devices, then the Discovered tab
The Discovered tab lists devices seen as LLDP or CDP neighbours but not present in the managed inventory, with their name, IP, platform, capability, the device and port they were seen from, and how many collections saw them. A neighbour already known by host name, short name or IP is not listed.
Screen: app.nactrack.com/devices
- 2
Add the ones you want to manage
Add New Device opens the device form pre-filled with the neighbour's IP and a guessed vendor. It needs the right to create devices.
Screen: app.nactrack.com/devices
- 3
Crawl further with Discovery
Under Inventory, Discovery starts from seed addresses, subnets or the existing inventory, logs in with the credential vaults you choose, reads each device's neighbours and follows them up to a hop limit. The run sorts what it found into reachable, unreachable, authentication failed, unrecognised and already in inventory, and exports to Excel, PDF or CSV.
Screen: app.nactrack.com/discovery
By hand, without NacTrack
On every known switch and router, run "show cdp neighbors detail" and "show lldp neighbors detail" on Cisco, "display lldp neighbor" on Huawei VRP, and keep the neighbour names and addresses. Remove the ones already in your inventory; what is left is the list to chase.
For devices that announce nothing, sweep the management subnets for addresses that answer and are not in the inventory, then log in to identify them. Expect firewalls, unmanaged switches and appliances to be the usual finds.
What this view does not tell you
- Neighbour-based discovery cannot see a device that announces nothing: CDP and LLDP turned off, or a vendor that does not run them. Those only appear through a subnet sweep, and only if they answer.
- Access points, IP phones and neighbours that advertise no capability are left out of the Discovered tab on purpose. There is no detection from ARP or MAC tables of hosts that are not network devices.
- The crawl identifies a device only if it can log in. A subnet sweep stops at 1024 hosts by default, and only one discovery run per tenant can be active at a time.
Further reading
Network discovery: find the devices nobody declared
Find and inventory the devices nobody declared, starting from a single entry point and following the neighbours outward, hop by hop.
How-to guideHow to get a network diagram from CDP and LLDP
Build a layer 2 network diagram from the CDP and LLDP tables of every device, export it to PNG, SVG, PDF or drawio, and know what it cannot see.
How-to guideHow to find which switch and port a MAC address is on
A user reports a problem and all you have is a MAC address. Search every MAC table at once and get the device, the interface and the VLAN.