GB2361140A - Network management apparatus and method for identifying changes in addresses of devices on a network - Google Patents

Abstract

A network management apparatus and method determines the IP address of individual network devices on a known network, when a change occurs, for instance when a new device is connected to the network for the first time and assigned a new IP address, or when the IP address of an existing device on the network is changed. The method comprises receiving the physical (e.g. MAC) address of the network device, and sending a network management request to an appropriately determined managed network device, to retrieve management data containing both IP and MAC addresses. In a preferred embodiment, operating SNMP, the management data is retrieved from MIB tables in MIB-II or RMON2. The management data is received, and the IP address corresponding to the MAC address is extracted and stored, if present. If management requests are unable to retrieve the IP address RARP is tried.

Description

2361140 1 NETWORK MANAGEMENT APPARATUS AND METHOD FOR IDENTIFYING CHANGES

IN ADDRESSES OF DEVICES ON A NETWORK The present invention relates generally to an apparatus and method for the management of a iletwork, and more particularly to a network management apparatus capable of determining the topology of a network and method for such an apparatus.

The following description is concerned with a data communications network, and in particular a local area network (LAN) but has more widespread applicability to other managed communications systems including wide area networks (WANs) or wireless communications systems.

Networks typically comprise a plurality of computers, peripherals and other electronic devices capable of communicating with each other by sending and receiving data packets in accordance with a predefined network protocol. Each computer or other device on the network is connected by a port to the network media, which in the case of a LAN network may be coaxial cable, twisted pair cable or fibre optic cable. Each device on the network typically has hardware for media access control (MAC) with its own unique MAC address. Data packets are sent and received in accordance with the MAC protocol (e.g. CSMA/CD protocol as defined by the standard MEE 802.2, commonly known as Ethemet). Data packets transmitted using the MAC protocol identify the source 11AC address (i.e. the MAC address of the device sending the data packet) and the destination MAC address (i.e. the MAC address of the device for which the data packet is destined) in the header of the data packet.

A network is generally configured with core devices having a plurality of ports, which can be used to interconnect a plurality of media links on the network.

Such devices include hubs, switches and routers which pass data packets received at one port to one or more of its other ports, depending upon the type of device. Such devices can either be managed or unmanaged.

2 Managed devices have the capability of communicating with a network management station using a management protocol such as the SNMP (Simple Network Management Protocol), as described in more detail below. Whilst the following description is concerned with the SNMP management protoco the skilled person will appreciate that the invention is not limited to use with SNMP, but can be applied to managed network using other network management protocols.

Furthermore, managed devices are capable of monitoring data packets passing through their ports. For example, a managed device can learn the physical or MAC addresses of the devices connected to its ports by monitoring the source address of data packets passing through the respective ports, as explained in more detail below.

SNMP defines agents, managers and M1Bs (where NUB is Management Information Base), as well as various predefined messages and commands for data communication. An agent is present in each managed network device and stores management data, responds to managers' requests using the GETRESPONSE message and may send a TRAP message to the manager after sensing a predefined condition.

A manager is present within the network management station of a network and automatically interrogates the agents of managed devices on the network using various SNW commands such as GET and GETNEXT commands, to obtain information suitable for use by the network administrator, whose function is described below. A NUB is a managed "object" database which stores management data obtained by managed devices, accessible to agents for network management applications.

SNMP forms part of the TCP/IP protocol suite, which is a number of associated protocols developed for networks connected to the Internet also known as the World Wide Web.

It is becoming increasingly common for an individual, called the network administrator, to be responsible for network management, and his or her computer 3 system or workstation is typically designated the network management station. The network management station incorporates the manager, as defined in the SNNT protocol, i.e. necessary hardware, and software applications to retrieve data from MBs by sending standard SNW requests to the agents of managed devices on the network. The network management station then processes the retrieved data in order to provide the network administrator with useful information about the operation of the network. The data retrieved from the managed network devices is typically compiled and displayed on the visual display unit of the network management station for the network administrator to interpret.

Networks requiring network management are typically connected to the Internet (World Wide Web) to enable users of the network to download information from Internet sites and databases connected to the World Wide Web, and to send and receive e-mail messages.

As previously mentioned, networks connected to the Internet use protocols within the TCP/IP protocol suite. These protocols include Ping (Packet Internet Groper), IP (Internet Protocol), ARP (Address Resolution Protocol) and RARP (Reverse Address Resolution Protocol), as well as SNW, amongst many others.

To enable connection to the Internet, in the simplest example, a computer is provided with a modem which is connected to a telephone line, and has an address, known as an IP address, for sending and receiving email using the standard TCP/IP protocols. An IP address is a unique, 4 byte number, assigned for the purpose of communication using the TCP/IP protocols. In the case of a network, the network includes a server, which is connected via a router to an external media link such as a telephone or ISDN line. For example, an email server is used to receive incoming email messages, and forward them to the appropriate end station. In order for end stations to receive the correct email, each end station must have a unique IP address.

Thus, in a network connected to the Internet, each end-station or personal computer (PC) requiring Internet access must have both a MAC address and an IP address. In 4 addition, managed core devices which communicate using SNMP or other TCP/IP protocols, may also have an IP address.

Network management applications, therefore, conventionally use IP addresses to identify and labtl network devices. This is because the administrator needs to be able to identify network devices for both local and Internet communications.

A problem with the use of IP addresses to identify end-stations or PCs on a network is that the IP addresses associated with a network as a whole may change with time. For instance, if a new end-station is connected to the network, a new IP address may be added to the list of IP addresses for the network. Alternatively, the IP addresses of end-stations already connected to the network may change, for example due to DHCP lease expiration or due the reassignment of IP addresses by a DHCP server.

In the prior art, in order for the network administrator to keep his or her network map up-to-date, it is necessary to rediscover the complete network using the network management software application. This involves using SNNT commands to request data from all managed devices on the network, and processing the received data and is consequently both time-consuming and creates unnecessary data traffic, in the form of SNW messages, on the network.

The present invention aims to automatically provide the network administrator with up-to-date details of the IP addresses of end-stations or PCs connected to the network without the need for rediscovery of the complete network.

In accordance with afirst aspect, the present invention provides a method for determining an unknown IP address of a network device on a known network, the method comprising the steps of. receiving the physical address of the network device; and sending a network management request to a managed network device on the network for the retrieval of data containing both physical addresses and corresponding IP addresses for devices on the network.

In this way, a network administrator can use the method to determine the unknown IP addre'ss of an end-station or PC without the need for rediscovering the entire network.

In a preferred embodiment, the network is a local area network and the physical address is a MAC address, and preferably the step of sending a network management request comprises sending a standard SNW request to the managed network device Preferably the method uses the standard N1IB-11 to obtain the IP address, preferably from the nearest router to the network device. Alternatively, the method is uses the RMON2 N1IB to obtain the IP address, preferably from the nearest RMON2 compatible device to the relevant network device.

In the preferred embodiment, M13-II data from the nearest router is initially retrieved, and if the IP address cannot be obtained, the method additionally comprises the step of sending a second network management request to a managed network device operating RMON2 and retrieving address map table data from the RMON2 N1IB, and extracting the translation of the MAC address to the IP address from the retrieved address map table.

If the IP address cannot be extracted using the aforementioned steps, the method preferably further comprises the step of sending a RARP (Reverse Address Resolution Protocol) signal to a server device on the network to obtain the address mapping, if available.

6 In accordance with a second aspect, the present invention provides a computer program for carrying out the method according to the first aspect of the present invention.

In accordafice with a third aspect, the present invention provides a network management apparatus for carrying out the method in accordance with the first aspect of the present invention.

Further preferred features and advantages of the present invention will be apparent from the following description and accompanying claims.

An embodiment of the present invention will now be described, by way of example, with reference to the accompanying drawings in which:

Figure 1 shows a typical LAN network having a network management Station in accordance with a preferred embodiment of the present invention; Figure 2 shows a typical graphical representation or map of the network of Figure 1 on the display screen of the network management station of Figure 1; Figure 3 shows the network of Figure 1 with a new end-station added; Figure 4 shows a network map of the network of Figure 3, similar to that of Figure 2; Figure 5 is a block diagram showing the program steps implemented in a computer program for carrying out a method of obtaining the IP address of an unknown end-station in accordance with the present invention, and Figure 6 is a block diagram showing the program steps for determining if the IP address of an existing device on a network has changed.

7 Figure 1 shows a typical local area network 1 with access to the socalled World Wide Web or Internet. The network 1 operates various protocols within the TCP/IP protocol suite, as described above. The network 1 includes SNMP managed network devices including hubs 11 and 12, switch 7, email server 15 and router 9 connected together by media links 5. End stations, in the form of personal computers (PCs) 3 are provided for users, including management station 3A for the network administrator. The PCs 3 are unmanaged network devices. Each PC 3 is connected to a core managed device, such as hub 11, which in turn is connected to switch 7. Email server 15 together with a router 9 provide access to the World Wide Web over an ISDN line 17. The hub 11, switch 7, router 9 are managed devices which communicate management information with management station 3A using the SNMP protocol. The agent within each core managed network device monitors data traffic passing through its ports and stores the data thereby obtained in an appropriate location in a MIB. Typically, the MIB data is represented in the form of "conceptual tables" (called "MIB tables") as is well known in the art. A typical managed device may implement a number of MIBs for network management.

An example of a MIB containing network management data is MIBAI (formerly MIBA) defined by RFC 1213: Management Information Base for Network Management of TCP/IP Intemets. In the network 1, hub 11, switch 7 and router 9 store MIBAI data. Another NUB containing more complex management data is RMON2 (as defined in RFC 2021: Remote Network Monitoring Management Information Base) and in the network 1, only switch 7 stores RMON2 data.

Every device on a network has a MAC addresses which is a physical address corresponding to the device's unique hardware number. In addition, and as explained above, each device which sends or receives e-mail, needs Internet access or communicates using TCP/IP protocols must also have an Internet address, called an IP address, which is recognised by the TCP/IP protocols and allows inter alia the delivery of email messages to devices on the network from external sources. In the present network 1, all PCs 3 and 3A, hub 11, switch 7, router 9 and server 15 have an IP address.

Figure 2 shows a map of the network 1 shown in Figure 1. Such a network map is produced tising a conventional network management software application, such as the Transcene Network Supervisor application available from 3Com Corporation of Santa Clara, California, USA. Such a network management application "discovers" the network topology by interrogating the managed network devices on the network using the SNW protocol. The data received is then processed to determine the number and type of network devices on the network, and how they are linked together. This information is then used to produce a network map, as shown in Figure 2 which is displayed on the display screen of the network management station 3A when running the network management application. Thus, the network map shows the network devices, each represented by an icon indicative of the type of network device, and links, each represented by a line joining two of the device icons. Associated with each icon is a label identifying each network device.

This label typically comprises the IP address of the device or device type and/or the name of the device andlor the name of the user in the case of an endstation.

The network is typically discovered once by the SNW manager in a network management station, in accordance with conventional techniques which shall not be described herein, and the network map is stored in the management station memory.

Thereafter, the network map may be updated only at infrequent intervals. If, between updates, new devices are added to the network, or the IP addresses of existing devices on the network change, the network administrator will not have an up-to- date network map.

For example, suppose a new end-station 313 is added to the network 1 as shown in Figure 3. All of the managed network devices on network 1 are configured to send the standard N1IB II "Enk-up" S TRAP message when a new device is connected to one of its ports. Thus, as soon as the new end-station 3B is connected to 9 hub 11, hub 11 sends a "link-up" SNMP TRAP to the network management station 3A indicating that a new device has been connected. Thus, the network map shown in Figure 2 may be updated to show a new device on the network, as shown in Figure 4. However, the "Unk-up" SNW TRAP does not contain detailed information about the new device, and inparticular the IP address of the new endstation 3B and so the new device is presented on the map without a label.

In this situation, the network management station on receiving the "finkup" SNW TRAP from hub 11, automatically performs the following method in accordance with a preferred embodiment of the present invention, to determine the IP address of the new endstation 3B. It will be appreciated that the method could be performed in response to the administrator's command.

Firstly, the network management station determines the physical or MAC address of the new end-station 3B. This can be achieved in a number of conventional ways. For example, the manager can send an SNW GET request to the agent of the hub 11 to retrieve data in a MB, such as the standard "Port Address Tracking" MIB table as defined in RFC 1516: Definition of Managed Objects for IEEE 802. 3 Repeater Devices. The data returned by hub 11, in the form of a GET RESPONSE message, will contain the MAC address of the new endstation, which the management station 313 can then extract and store in memory.

As the skilled person will appreciate, there are many other suitable MIB tables which contain MAC addresses, and the MAC address of the newly connected endstation could be retrieved from any chosen NUB table. It will flirther be appreciated, that if the new endstation 311 were added to another type of managed network device, the MAC address of the new endstation 3B could be retrieved from MB tables associated with that type of device. For example, if the device were switch 7, data could be retrieved from the "Forwarding Database for Transparent Bridges" MIB table (as defined in RK 1493: Definitions of Managed Objects for Bridges).

Once the MAC address of endstation 3B has been determined by the network management station 3A, in accordance with the present invention, the JP address is then determined, in accordance with the following three method steps.

In step 1, the network management station 3A sends GET or GETNEXT requests to router 9 (in the case of a network having several routers, the nearest router to the new endstation 3B, as determined using knowledge of the network topology, e.g. the network map) to retrieve a standard 1P address translation" MB table. For example, the ipNetToMedia Table as defined in N1IB II. The network management station 3A receives the GET RESPONSE from the router 9 and determines whether the IP address corresponding to the previously determined MAC address of the new end-station 3B is present within the received data, and if so extracts and stores the IP address and uses this to identify the new endstation.

Alternatively, or if the response received in step 1 does not contain the IP address corresponding to the MAC address of the new endstation 3B, the network management station 3A performs step 2 which involves sending GET or GETNEXT requests to the switch 7, which is RMON2-capable (in the case of a network with several RMON2-compatible devices, the closest RMON2-capable device to the new end-station, as determined using the topology knowledgelnetwork map), to retrieve the standard RMON2 NUB "address map" table. The response includes the "address map" table, which provides the MAC to IP address mapping, thus enabling the IP address corresponding to the MAC address of the new endstation. 3B to be extracted by the network management station 3A and stored and subsequently used for identiffing the new endstation.

In the event that step 2 is unsuccessful or there are no RMON2-capable devices on the network, and the step 1 using N1IB41 is unsuccessfid, a final method step, step 3 is performed by the network management station 3A. In step 3, the network management station 3A sends a RARP (Reverse Address Resolution Protocol) signal speci the 11AC address of the new endstation 3B which signal 11 may be received by a RARP server. The RARP server, if present, may hold the translation of the MAC address to IP addresses in accordance with the RARP protocol and if so, responds with the IP address which the management station 3A can store in memory.

In addition to determining the IP addresses of newly added endstations, the network management station 3A, in accordance with the present invention, can determine the IP addresses of existing network devices when the IP addresses change.

In this situation, the MAC addresses of the network devices shown in Figure 1 are already known. The network management station 3A first needs to determine that the IP address of a device on the network has changed. In order to do this, the network management station periodically "Pings" A end-stations 3 on the network 1. Ping is a standard TCP/IP signal which sends an ICNIP echo request to a device using the IP address, and which produces an automatic response from an active destination device, an ICNIP echo reply. Ping is therefore conventionally used to detect the presence of an active device on a network. If no response is received within a predetermined time period (typically 1 second), this could indicate that the IP address specified by the Ping is no longer valid for the network. If a response is returned within the predetermined time period, then the network management station knows that the IP address specified in the Ping is a valid address for a device on the local network.

If no response is received to the Ping request within the predetermined time period, the network management station 3A then needs to determine whether this is due to a change in IP address or another factor. Other reasons for the lack a response to a Ping request may be that the endstation has been switched off or disconnected from the network. If the end-station is still connected to the network, then the lack of response may be due to a change in IP address. Thus, the network management station then carries out the following steps in order to determine whether the end station is still connected to the network.

12 The SNW manager within network management station 3A determines the nearest managed network device to the relevant end-station, and sends to it an SNW GET request. For example, if end-station 3C shown in Figure 1 does not respond to the Ping request from the network management station 3A, the network management station polls hub 11 to retrieve object data from the standard "port traffic" MB counters for port 3 of the hub 11. For example, the standard rptrMonitorPortReadableOctets could be used. The network management station 3A retrieves and stores the count data. After a predetermined time interval, the network management station 3A polls the hub 11 again to retrieve a further count for the same data object i.e. the same count. The manager then compares the two values, and if the count has increased in value, then the end-station is still connected to the network. If the count is unchanged, the network management station will need to periodically re poll the counter a predetermined number of times to be certain that the end-station has been disconnected. Typically, the period between each poll will be 1 minute and the minimum number of times the end-station should be polled before the manager is satisfied that the end-station has been disconnected is 3.

It will be appreciated that other MB counters can be polled to determine whether a device is still connected to a network. For instance, if the end-station is connected to a switch, the standard ifinOctets N1IB variable could be used. The skilled person will appreciate that many other NUB variables can be used to determine whether a device is connected to a network.

If the network management station 3A determines that the NUB counter value has increased, the endstation 3C is still connected to the network, and the management station 3A retrieves the existing MAC address for the endstation stored in its memory for subsequent steps.

The network management station then carries out the aforementioned method steps 1, 2 and 3, to determine the IP address corresponding to the MAC address.

13 It will be appreciated that it may not always be necessary for the network management station to carry out the above described steps to determine if a device is still connected to the network. For instance, if a "link-dowiV' SNNIP TRAP has been received relating to the link connected to the device which is not responding to Ping requests, and no slibsequent "link-up" SNUT TRAP has been received, then the device is not connected to the network and the above steps are not required.

The method of the present invention may usefiffly be implemented in a computer program for use in the network management station 3A. The steps of the computer program are illustrated in Figure 5.

In step 10 1, the program determines that there has been a change to the list of IP addresses of devices on the network. This may be through receiving an SNW TRAP signal from a managed network device, to indicate that a new device has been connected to that managed network device on the a network, and therefore a new IP address exists. Alternatively, the change may be detected by periodically monitoring NUB values in managed network devices which would change with changes in IP addresses. For instance MIB values such as ifOperStatus or rpMauMediaAvailable could be monitored. Alternatively the change could be detected by way of the program steps illustrated in Figure 6, as described below.

In step 102, the program determines the MAC address of the network device causing the change in IP address. As discussed above, this could be done, for hce, by reading standard N1IB tables with port-to-MAC address mapping. If the device having a changed 1P address is already on the network, the program extracts the MAC address from data already stored in the network management station.

In step 103, the program determines the nearest router to the relevant network device, for example, using the previously stored network map data, and retrieves data from an appropriate MB table in MIB-II of the router having MAC addresses and corresponding 1P addresses, as discussed above.

14 In step 104, the program determines whether the IP address of the network device corresponding to the MAC address determined in step 102 is present in the data retrieved in step 103, and if so stores the IP address in step 109. The program then ends at step 110.

If the IP address is not determined in step 104, the program continues with step 105 by determining the nearest RMON2-compatible device to the relevant network device and retrieving data from an appropriate MIB table in RMON2 having MAC addresses and corresponding IP addresses retrieves. For example, the standard "address map" NUB table in RMON2.

In step 106, the program determines if the NUB table retrieved in step 105 contains the IP address corresponding to the MAC address of the network device as determined in step 102. If the IP address is present, the program stores the IP address in step 109 and ends at step 110.

If the program determines in step 106 that the IP address is not present, the program continues with step 107 by sending a RARP signal for the retrieval of MAC to IP address mapping data from a RARP server.

If a response is received to the RARP signal, in step 108, the program receives the IP address, corresponding to the 11AC address detern-dned in step 102, in the response and saves the IP address in step 109. The program then ends at step 110.

It will be appreciated that the program steps do not need to be carried out in the specified order. For instance, it the network management station knows that the relevant network device is connected to an RMON2-compatible core device, steps and 106 might be carried out before steps 103 and 104. Alternatively, if the network management station knows that the RARP request is likely to be successfii4 eg from previous experience, it might carry out steps 107 and 108 first.

Figure 6 illustrates the steps of a computer program for determining whether the IP address of an existing device on a network has changed.

In step 20l,'the program periodically sends a Ping signal to an existing device on the network. It will be appreciated that whilst the program relates to just one network device, the program may simultaneously send Ping signals to all or selected devices on the network. Simultaneously with sending each Ping request, the program starts a clock.

In step 202, when the clock has run for a predetermined time interval, the program considers whether a response to the Ping signal has been received from the Tinge& device. If a response has been received, the corresponding IP address is valid, and the program ends at step 210. If no response isreceived, the program continues at step 203.

In step 203, the program determines a core device to which the relevant device is connected, using the stored network map data, and polls an appropriate counter for the relevant port of that core device to obtain a count of data packets passing through that port. For instance, a "port traflic" N1IB counter of a managed device could be used.

In step 204, the program receives the response and stores the count value.

In step 205, after a predetermined time interval, determined using the clock, the program re-polls the core device, as in step 203 and receives the new count value in step 206.

In step 207, the program compares the new count value with the previous count value. If in step 207, it is detern-dned that the count has increased, the device is still connected to the network, and the program continues with step 10 1 of Figure 6.

16 If the count has not changed, the program repeats steps 205 and 206 until the count value has remained the same for a flifther predetennined number of polls, for example five. Thus, in step 208, a counter is incremented by one, and in step 209 the program considers whether the counter has reached the predetermined number of five.

If the counter has reached five, the program ends at step 210. If the counter has not reached five, the program continues with step 205.

It will be appreciated that the program illustrated in Figure 6 will need to be run continuously or at regular intervals in order to ensure that the network map is kept up-to-date with any relevant changes in IP addresses on the network.

it will be appreciated that various modifications and changes can be made to the described ernbodiments. For instance the invention is not limited to use with the SNNT protocol or the retrieval of data from the exemplary NUB data objects and tables, Furthermore, it will be appreciated that not all of steps 1 to 3 are necessary for all networks.

Furthermore, although the embodiments have been described in relation to the retrieval of IP addresses, some network management systems may identify network devices using only physical addresses. In this case the method of the present invention is employed only to retrieve physical addresses for new devices added to the network.

It is intended to include such variations and modifications which fall within the scope of the invention as defined in the accompanying claims.

17

Claims (1)

1. CLAIMS:

   1. A method for determining an unknown IP address of a network device on a known network, the method comprising the steps of. receiving the physical address of the network device, and sending a network management request to a managed network device on the network for the retrieval of data containing both physical addresses and corresponding IP addresses for devices on the network.

   2. A method as claimed in claim 1, flather comprising the steps of receiving a response to the network management request, and searching for the IP address corresponding to the received physical address.

   3. A method as claimed in claim 1 or claim 2, further comprising the step of determining which managed network device on the network is nearest to said network device, wherein the step of sending comprises sending said network management request to said determined managed network device.

   4. A method as claimed in claim 1, 2 or 3, wherein the network is a local area network and the physical address is a MAC address, and wherein the step of sending comprises sending an SNNT request to the managed network device.

   5. A method as claimed in claim 4, wherein the managed network device is a router and the SNNT request specifies data in NUB-11.

   6. A method as claimed in claim 4 or claim 5, wherein the data in IYRB-II is retrieved from the ipNetToMedia Table.

   7. A method as claimed in claim 4, wherein the managed network device is an RMON2-compatible device and the SNW request specifies data in RMON2.

   18 8. A method as claimed in claim 7, wherein the data in RMON2 is retrieved from the address map MB table.

   9. A method as claimed in claim 5 or claim 6, further comprising the steps of. if the step of searching finds the IP address, storing the IP address in memory; otherwise, sending a second network management request to a further managed device on the network for the retrieval of data containing both physical addresses and corresponding IP addresses for devices on the network.

   10. A method as claimed in claim 9, wherein the step of sending a second request comprises sending an SNNT request to a managed network device wherein the SNW request specifies data in RMON2.

   A method as claimed in claim 7 or claim 8, finiher comprising the steps of.. if the step of searching finds the IP address, storing the IP address in memory; otherwise, sending a second network management request to a further managed device on the network for the retrieval of data containing both physical addresses and corresponding IP addresses for devices on the network.

   12. A method as claimed in claim 11, wherein the further managed device is a router and the step of sending a second request comprises sending an SNNT request to the nearest router wherein the SNW request specifies data in the ipNetToMedia Table in 1WBAL 13. A method as claimed in any one of claims 9 to 12, further comprising the steps of. receiving a response to the second network management request, and searching for an IP address corresponding to the received physical address.

   14. A method as claimed in claim 13, flirther comprising the step of. if the step of searching finds the IP address, storing the IP address in memory; otherwise, sending a RARP signal onto the network specifying the received physical address.

   19 15. A method as claimed in claim 14, flu-ther comprising the steps of. receiving a response to the RARP signal, and storing the received IP address corresponding to the received physical address of the network device.

   16. A method as claimed in any preceding claim, wherein, prior to the step of receiving the physical address, the method includes the steps of receiving an indication that a new device has been connected to the network; determining a managed device to which the new device is connected, and sending a request to the determined managed device for the physical address of the new device.

   17. A method as claimed in claim 16, wherein the step of receiving an indication that a new device has been connected to the network comprises receiving an SNNIP TRAP.

   is 18. A method as claimed in any one of claims 1 to 15, wherein prior to the step of receiving the physical address, the method includes the steps of. considering whether an IP address of an existing device on the network has changed, and if so, retrieving the physical address of that device from memory.

   19. A method as claimed in claim 18, wherein the step of considering whether an IP address of an existing device on the network has changed comprises the steps of.. sending a Ping signal to the existing device using the known IP address for the device; if a response is received, deter that the IP address has not changed, and if no response is received, considering whether the existing device is still connected to the network and is not switched ofFI 20. A method as claimed in claim 19, wherein the step of considering whether the existing device is still connected to the network comprises the steps of.. determining to which managed device on the network the existing device is connected, and periodically polling a counter of the determined core device for the port to which the existing device is connected, to obtain a count of data passing through that port, and, if the count increases, determining that the device is still connected to the network.

   21. A method as claimed in claim 20, wherein the step of periodically polling comprises the steps of. sending a first management signal to the determined core network device to retrieve count data from the counter; receiving and storing the response as a first count value; a predetermined time after sending the first signal, sending a second management signal to the determined core network device to retrieve the same count data from the counter; receiving and storing the response as a second count value; comparing the second count value with the first count value, and if the second count value is greater that the first count value determining that the device is still connected to the network.

   22. A method as claimed in claim 21, wherein, if the step of comparing finds the first and second count values are the same, the method flirther comprises the steps of.

   sending up to a predetern-dned number of further management signals to the determined core network device to retrieve the same count data from the counter; and, in each case, receiving and storing the count value and comparing it to the first count data, and if the received count value is greater than the first count value, determining that the device is still connected to the network, otherwise determining that the device has been disconnected.

   23. A method for determining an unknown IP address of a network device on a known network, substantially as hereinbefore described, with reference to, and as shown in, Figures 5 and 6 of the accompanying drawings.

   24. A computer readable medium comprising a program for carrying out the method of any one of claims 1 to 23.

   25. A network management apparatus for use in a network, the apparatus being capable of communicating with devices on the network using a network management 21 protocol, the apparatus storing previously determined data about the topology of the network, and comprising: a processor for determining that the IP address of a network device is unknown, and for selectively retrieving management data from a managed network device on the network, the management data containing both physical and IP addresses of devices on the network.

   26. An apparatus as claimed in claim 25, wherein the processor flirther compares received management data with the physical address of the network device received by the apparatus, and determines the presence of the IP address corresponding to the received physical address.

   27. An apparatus as claimed in claim 26, wherein if the processor determines that the IP address is present, the processor stores the IP address, and if the processor determines that the IP address is not present, the processor retrieves further management data from another managed network device, the flirther management data containing both physical and IP addresses of devices on the network 28. An apparatus as claimed in claim 25, 26 or 27, wherein the network is a local area network and the apparatus operates in accordance with SNNT, wherein the processor sends an SNNT requests to a selected managed network device to retrieve the management data.

   29. An apparatus as claimed in any one of eh-dim 25 to 28, wherein the processor determines the nearest managed network device to the network device, and retrieves management data therefrom.

   30. An apparatus as claimed in any one of chatims 25 to 29, wherein the processor further sends a RARP signal on to the network if the selectively retrieved management data does not contain the IP address, and if a response is received determining, and storing the IP address corresponding to the physical address for the network device.

   22 31. An apparatus as claimed in any one of claims 25 to 30, wherein the processor finiher determines whether an existing device on the network has changed its IP address.

   32. A network, management apparatus, substantially as hereinbefore described, with reference to the accompanying drawings.

   33. A method for determining an unknown address of a new device connected to a known network, the method comprising the steps of.. receiving an indication that a new device has been connected to the network; determining a managed device to which the new device is connected, and sending a request to the determined managed device for the physical address of the new device.

   34. A method as claimed in any one of claims 1 to 22, or claim 33, wherein the steps are carried out automatically, without user intervention.