Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Network Sonar Discovery Enhancement

Feature Request Description:

-It would be best if there's a way to setup the Network Sonar Discovery to query multiple IP addresses so we can have the discovery result in less time.

-This can help organizations which monitors massive number of devices let's say /16 subnets.

Environment:

Core (Future release)

Find more posts tagged with

Status: None

Comments

cnorborg

Took me a minute to figure out what your saying. Your looking to increase the number of devices that Network Sonar is simultaneously working on at given time manually?

It actually does do multiple things at once, quite a bit actually. It will initially do ICMP pings and SNMP queries of >all< the IP addresses in a given subnet. Based on what it gets back, it will do more stuff.

The problem is, if you are scanning a /16, or over 65K IP addresses, with the SNMP timeout set at the default of 3000ms (or 3 seconds), if half of those IP's are open that would 27 hours of waiting on those SNMP queries to come back, and that doesn't include the 1 retry it might do by default, so 54 hours of waiting on nodes that aren't there. And I'll bet that in a /16 you have less than 50% utulization, so increase that amount based on your actual "fill rate" of the IP's with devices that are discoverable. This doesn't include if you're also checking for WMI and such. So, you're talking about days of busy-work that its doing to find nodes. Are you also scheduling it every day or two? If so, odds are one discovery might not get done before the next kicks off...

Adjusting the timers can help a lot. On most networks, SNMP devices will respond much quicker than 3000ms. And, quite simply, if you want to scan a /16 and increase the # of nodes it queries at one time by a factor of 4, break it down into 4 smaller networks (/18's) and have it scan those at the same time. The problem is, your going to start slowing things down quite a bit by doing it this way. SW has put a lot of effort into getting Discovery to work as fast as it can without bogging the system down, scheduling multiple discoveries at the same time can cause performance issues.

mesverrum

I agree with @cnorborg , I have set up solarwinds at companies with tens of thousands of servers but if the only method you have of tracking your hardware is blindly scanning entire /16's then you really have more of an operational problem than a tools problem.

The sheer amount of time it takes to touch on that many addresses is impractical and to load the system up with a discovery that can optimistically take 2 entire days at a time is setting you up for failure in that new users are going to come in with complaints like "I just stood up my system and told it to scan my network and the next day it's still running? Is something broken?"

You also run into a serious question about sorting through what it finds once the discovery is done. How are you going to effectively sort through and decide what nodes to add in if you get 20,000 results back in the same batch? Even worse when you go to the interfaces tab and have to pick through 100k interfaces in one sitting.