STP Topology on Netdata

Network Topology Mapping Explained

Wed, 24 Jun 2026 00:00:00 +0000

Network topology mapping is the process of discovering and visualizing how devices, endpoints, and services connect across a network. It captures both physical (Layer 2) relationships - which switch port links to which device - and logical (Layer 3) relationships - how subnets, routes, and autonomous systems reach each other. A topology map can range from a hand-drawn diagram to a live, continuously updated graph built from protocol data such as LLDP, CDP, ARP, FDB, OSPF, and BGP.

Network Topology Viewer

Tue, 23 Jun 2026 00:00:00 +0000

Netdata Network Topology Viewer maps live TCP/UDP connections between processes, containers, and endpoints, plus SNMP device fabric via LLDP, CDP, BGP, and OSPF.

Interface flapping: link up/down storms and their blast radius

Mon, 01 Jan 0001 00:00:00 +0000

Interface flapping is when a network interface oscillates rapidly between up and down states. Each transition generates a linkDown/linkUp trap pair, syslog entries, and an STP topology change notification. At low rates this is operational noise. At high rates it becomes a multi-layer failure: the trap receiver overflows, the syslog pipeline saturates, STP reconvergence flushes MAC tables across the VLAN, and the monitoring platform reports misleading availability because the poll interval is slower than the flap cadence.

Stale FDB/MAC tables: why endpoint location is wrong

Mon, 01 Jan 0001 00:00:00 +0000

Your topology platform says endpoint aa:bb:cc:dd:ee:ff is on switch port Gi1/0/24. Your security team sends someone to that port. The endpoint is not there. It moved hours ago, or it went offline, or it vMotioned to a different host. The FDB entry was stale and the platform presented it as current.

The Forwarding Database (FDB), also called the MAC address table or CAM table, maps MAC addresses to switch ports. Topology inference engines use FDB data, cross-referenced with ARP tables and CDP/LLDP neighbor data, to deduce where endpoints are physically connected. The inference is probabilistic. It degrades as input data freshness degrades.

STP topology-change storms: reconvergence cascades explained

Mon, 01 Jan 0001 00:00:00 +0000

A topology-change notification (TCN) is not itself a failure. STP generates one every time a non-edge port transitions up or down. That is normal during maintenance, link recovery, or device boot. The problem is what happens next. When TCNs fire repeatedly, or when a single TCN hits a large Layer 2 domain with thousands of MAC addresses, the protocol’s designed response becomes a self-inflicted traffic event.

The cascade is mechanical. Every switch that receives the topology-change flag shortens its MAC address aging timer from the default (typically 300 seconds) to the Forward Delay value (15 seconds by default). This forces unknown-unicast flooding until endpoints re-announce their MACs through normal traffic. In a VLAN with thousands of entries, that flooding saturates links, spikes latency, and consumes switch CPU. The blast radius is the entire broadcast domain, not the switch where the port flapped.