Network Map Creation Wizard

This wizard will help you create new network maps and automatically draw connection lines that imitate network cables on the map. The wizard uses 2 methods for searching network devices:

1. Scanning IP range
This method allows to spot the maximum number of devices. It features the following advantages :

• High scanning speed (up to 16 addresses/sec.*)
• Recognition of diverse hardware types: printers (local and network), switches, hubs, servers, database servers, routers, WiFi access points, etc.
• Combination of several efficient network hardware search methods (ICMP ping, scanning a series of TCP ports, ARP requests).
• Retrieving data from hardware via SNMP (switches, printers, WiFi, etc.)
• Automatically building network map by drafting over data received from switches .
• Automatic retrieving of additional information on found hosts (IP and MAC addresses, NIC manufacturer, DNS name, OS type, connected printers, descriptions.)
• Scanning several IP ranges at once.
• When found devices are placed on the map, they are automatically scheduled for specific automatic checks.

2. Importing from Network Neighborhood
This method works somewhat faster than the other one; however, not all devices are guaranteed to be found. Moreover, using this method the program will not be able to build the network map automatically. Still, it will automatically place found computers to groups, depending on workgroups and domain names the computers belong to.

Importing from Network Neighborhood does not involve difficulties.

What we are to learn in detail is scanning IP range.

1. On the first step (Fig. 1) we set the IP range to be scanned. In the fields Starting IP address and Ending IP address enter the range of IP addresses to be scanned. To automatically detect the range of IP addresses applicable to your network, select the current network interface card. Once the address fields are filled, click on the Add -> button, and the selected range will be added to the list of IP ranges to be scanned. To Delete a range from the list, simply click on the corresponding button. Tick off the IP ranges on the list that are to be scanned.

Fig. 1: The Network Map Creation Wizard - Step 1.

2. On the second step, we set the scanning method and parameters (Fig. 2). The wizard uses 3 ways to find devices connected to network:

• ICMP ping
• Scanning TCP ports (learn more about the system limitations on scanning remote TCP ports)
• ARP request

Fig. 2: The Network Map Creation Wizard - Step 2.

For ICMP ping you can set the number of packets to be sent. To scan TCP ports, define the list of ports, by which the devices can be found on the network. The most common open ports in Microsoft networks are 139 (NetBIOS), 21 (FTP), and 80 (HTTP). When selecting the port scanning method, please keep in mind that in the majority of cases firewalls will treat your actions as probable attacks and will enforce the corresponding measures. ARP requests are attempts to detect the MAC by the device's IP address. If the MAC address is obtained successfully, the wizard will add the found IP address to the search results list.

For all scanning methods you must set the Response timeout, which defines, for how long the wizard will wait for response from the host being scanned.

If you have print servers or networked printers in your network, you can find them as well. The search function can also find printers connected to computers locally.

The wizard can automatically find all servers, database servers in your network, obtain other useful information on found computers (OS type, comment, etc.) To enable retrieving that additional information, select the option Get additional data on hosts via NetBIOS. This function will work only if the NetBIOS protocol is allowed on your computer and in other computers in your network.

If in your network you have devices with an active SNMP agent, the wizard will inform you on that and will display the description for those devices. Such active SNMP agents help the wizard to detect a more diverse range of hardware types. Thus, for example, by the obtained via SNMP information, the wizard can identify switches, hubs, routers, printers, WiFi access points, wireless routers, etc. Besides, using such data received from switches, the wizard can automatically draw the connections map for devices in the network by laying the defined lines on the map. When searching for hardware with an active SNMP agent, the wizard attempts to connect to the next address using the defined community names (Community). Those names can be listed in the Community strings field, separated with commas. The most commonly used community names set by default are public, private, rmon. If you are positive your hardware has other names, please define them in the list.

If you already know IP addresses of your switches and their SNMP community strings, select the Retrieve connection tables from switches option and specify IP addresses of the switches with the strings. This will raise chances of successful drawing network diagram with links between switches and hosts. If this option is turned off, the program will try to detect switches automatically during the scan (if the Search SNMP devices option is checked).

3. When all the parameters are set, the wizard launches the actual scanning. Hosts found during the scanning will be added to the search results list (Fig. 3).

Fig. 3: The Network Map Creation Wizard - Step 3.

After the scanning is finished, the type of a found device can be modified directly in the results window. To modify a device type, select the record to be modified (multiple select is allowed) and then open the context menu. On that menu, select the desired device type.

You can have the program place only selected devices on the map by tick those devices on the list. The buttons Select All, Selected, and Invert Selection will help you with the selection of multiple devices.

Click the Report button to export all scanned information to a CSV file.

4. On the final step (Fig. 4), the wizard will prompt you to enter a name for the file to save the new map to. Before placing found devices on the map, you can set these advanced parameters:

Fig. 4: The Network Map Creation Wizard - Step 4.

Cut DNS suffix for getting host name when placing device on map. The wizard attempts to use devices' specific DNS names as labels for the icons. Such names often have the so-called suffix; e.g., mary.dep1.orgname.com. When this option is selected, the label by the icon will appear as mary.

You can specify, what the wizard is to Use as host address: device's IP address or its DNS name. For networks with the dynamic IP address allocation, select DNS name, for this attribute in this case will remain constant. For networks with static IP addresses you can select using device's IP address as the name.

To add local printers on map, select the corresponding option. However, keep in mind that not all printers found by the wizard are the actual devices. Also, the same local printer can have several names, which the wizard interprets as several different printers. So, once the map is generated, you will need to make the adjustment by deleting the redundant local printer icons.

When you click Finish, the wizard will draw the new map, add found devices on it, when possible – draw the connection lines, and assign object-specific checks. Then the map will be automatically saved to the specified file and will be available for the further use. Whenever it is necessary, you can improve the map manually and then save the changes to file.

What to do if connection lines between devices are not drawn? (SNMP issues)

*How to configure optimal scanning settings
The perfect choice of search parameters depends on your network configuration, availability and functioning of the necessary protocols. In particular, to detect hosts in a local area network with bandwidth of 100 Mbps and higher, sufficient will be 2 ping packets and 100-500 ms response. In the case with TCP ports, it is worth noticing that the greater number of ports you specify on the list, the longer the application will search for hosts in the network. The best way to go around this is to set 2-3 most common ports through which the application can find Windows stations and servers; those include 139, 21 and 80th (NetBIOS, FTP, HTTP).

Searching for network printers is a different story. This procedure takes quite a bit of time, and therefore it should not be run if you are SURE that there are no such printers in your network. Otherwise, you would have to wait for the completion of that procedure. The completion will be indicated by the appearance of the network scanning progress bar in the network scanning wizard window. The reason why the procedure is so slow is because it searches for network printers BEFORE launching the primary scanning procedure (which is performed with a large number of threads running simultaneously, unlike with searching for printers).

This is also true for obtaining additional information on hosts through NetBIOS. If the NetBIOS protocol is disabled in your network, no such information can be retrieved, and the application will spend quite a bit of time on that attempt (hence the feeling that the application is “frozen”). Searching for network switches is done in the multithreaded mode. However, if you specify a large number of possible community string values, that will also slow down the scanning process. Hence, if you have set the scanning parameters, and the application is scanning too slow or, even worse, completely "frozen" – go ahead and disable some of those parameters (first, disable network printer search and then disable obtaining additional information through NetBIOS) and try launching the scanning procedure again.