Auto-discovery Reporter (10701)

The Auto-discovery Reporter publishes the network inventory and topology that NFO builds through SNMP discovery: a list of discovered devices and the physical and logical connections between them. Use it to feed an up-to-date network map into your SIEM or analytics platform without maintaining the topology by hand.

Functionality

This module emits two kinds of events: discovered devices (nfc_id=20701) and the connections between them (nfc_id=20702). Connections are derived from multiple discovery sources (neighbor protocols such as LLDP and CDP, Layer 2 bridge tables, Layer 3 IP forwarding, and routing-protocol adjacencies such as BGP and OSPF), and reported with a con_source field identifying where each connection came from.

Parameters

Reporting Frequency

Parameter Name	Description	Default
Report devices	Frequency of reporting devices	3600 sec
Report device connections	Frequency of reporting device connections	3600 sec

Reported Data

Parameter Name	Description	Notes
Devices	List of devices sent as events	Click SNMP auto-discovery to configure; view last updated timestamp and perform other actions
Device connections	List of device connections sent as events	Click SNMP auto-discovery to configure; view last updated timestamp and perform other actions

---

Syslog/JSON Message Fields

Devices (nfc_id=20701)

Field Name	Description	Type	Example / Notes
nfc_id	Message type identifier	string	nfc_id=20701
nfo_hostname	Hostname of the reporting NFO instance	string	e.g. NFO-Beta
site	Site identifier of the reporting NFO instance	string	e.g. SFO1
mgmt_ip	SNMP management IP address	IPv4 address or IPv6 address	Primary device identifier. e.g. 172.31.31.73
device_group	Device group	string	Semicolon-separated. e.g. Cisco Router;Cisco;Router
device_type	Device type	string	e.g. router, firewall, switch
sysObjectID	SNMP sysObjectID	string	e.g. 1.3.6.1.4.1.9.1.619
sysName	SNMP sysName	string	e.g. Cisco2801
sysLocation	SNMP sysLocation	string	e.g. NetFlow Logic AWS Demo
capabilities	Device capabilities	string	Comma-separated. e.g. wlanAccessPoint,router,telephone
status	Device status	string	e.g. Up
error_msg	Error message from SNMP polling	string	Present when polling fails
id	Unique device ID	number

Device Connections (nfc_id=20702)

Field Name	Description	Type	Example / Notes
nfc_id	Message type identifier	string	nfc_id=20702
nfo_hostname	Hostname of the reporting NFO instance	string	e.g. NFO-Beta
site	Site identifier of the reporting NFO instance	string	e.g. SFO1
mgmt_ip	Source device main IP address	IPv4 address	Primary join key to 20701 device list. e.g. 172.31.24.19
device_type	Source device type	string	Avoids join to 20701 when present. e.g. switch
sysName	Source device sysName	string	Avoids join to 20701 when present. e.g. EX4100
src_ip / src_ip6	Source interface IP address	IPv4 address or IPv6 address	May differ from mgmt_ip on multi-interface devices. e.g. 172.31.24.19
ifIndex	Source interface SNMP index	number	e.g. 2
ifName	Source interface name	string	Optional, may be missing. e.g. ens5
dest_mgmt_ip	Destination device main IP address	IPv4 address	Optional, may be missing or equal to dest_ip (e.g. some LLDP sources or IP_FORWARDING). e.g. 172.31.16.1
dest_ip / dest_ip6	Destination interface IP address	IPv4 address or IPv6 address	e.g. 172.31.16.1
dest_ifIndex	Destination interface SNMP index	number	Optional, destination index may not be known. e.g. 0
con_source	Connection discovery source	string	LLDP, CDP, BRIDGE, IP_FORWARDING, NEXT_HOP, BGP, OSPF

note

con_source identifies how each connection was discovered. LLDP, CDP, and BRIDGE are Layer 2 sources; IP_FORWARDING, NEXT_HOP, BGP, and OSPF are Layer 3. BGP and OSPF connections are discovered only on Layer 3 devices and are disabled by default; enable them with the Enable BGP peer discovery and Enable OSPFv3 neighbor discovery options on the SNMP Management Settings tab.