Network Topology 5.3.2 — five reports, five bugs

The last two releases didn’t come from a plan, they came from the inbox. Five people described what their map was drawing wrong. Three sent screenshots, two sent SNMP walks that proved their switches were fine and the module wasn’t.

A ghost called F8

One map had an unknown node named “F8” hanging off five switches, with FC, F4 and BC next to it. The answer was sitting in the item names: Aruba switches answer the CDP cache with the neighbour’s MAC instead of its name. The module cut that at the first space, and two hex digits were all that survived.

The ugly name wasn’t really the problem. Everything whose MAC started with the same byte ended up in one node, so the map drew a distribution point that doesn’t exist, wired to switches that have nothing to do with each other.

MACs stay whole now. And when the same port also reports a proper name over the other protocol, both rows are recognised as the same cable. A link plus a ghost becomes one link.

Port counters that were there all along

One reporter walked both of his switches and proved that lldpRemLocalPortNum lines up with ifIndex — the exact thing our hint text blamed. He was right, the hint was wrong.

The module only looked for interface items with “Octets” in the key. His are called net.if.in[24], the shape used by eight official Zabbix templates, among them Cisco Catalyst 3750V2, Nexus 9000, pfSense and OPNsense. So the links estimated from host totals while the real counters sat right there. They get read now, and the hint text names both conditions instead of one.

One IP, two customers

A service provider with several tenants on one map got a link to a foreign tenant. 192.168.1.10 exists in every second private network, and the address table only remembered the last host it read. The edge looked like any other, 60 points of confidence, nothing in the quality tab.

Now the same rule applies as for short names: several candidates, no edge, and an entry that names all of them.

A host called 1402

Name a host with nothing but digits and you got a blank page and “Unexpected end of JSON input” in the browser. PHP turns a numeric key into an int, and the function that strips the domain refuses one under PHP 8. The request died halfway through. It turned up in a test for an entirely different bug, two days before the report came in.

Two new tags

nt:uplink = dell-sw-01:Gi1/0/8 for anything that can’t report a neighbour — a UPS, a PDU, a printer. The tag draws the edge and hangs the counters of that exact port on it: traffic, errors, discards, speed.

nt:lldp = SW-CORE-OLD for hosts whose name on the wire isn’t the one in Zabbix. Renamed devices, an inventory name against a config name. Without it the neighbours report something Zabbix has never heard of, and the map draws a ghost right beside the host they mean.

Ghosts in three steps, and they stop pretending

The ghost toggle now goes off, network gear only, all. The middle one is the useful one: on an access switch with 48 ports most ghosts are desktops, and they bury the unmonitored switch next to them.

The detail panel also used to show a green “Normal” and empty CPU, memory and ping rows for a device that isn’t monitored at all. The tooltip did the same and even fetched history for it. Both now say not monitored and show what is actually known: which protocol saw it, who reported it, MAC, capabilities, vendor.

The rest

Reset and Clear in the filter looked like they did nothing, because both end up looking like a fresh page load and the map helpfully restored the last selection. The cluster toggle saved your choice but kept saying “auto”. Ghosts piled up on one spot and pushed saved layouts aside. And from 5.3.1, which never got a post of its own: TP-Link JetStream switches leave the TimeMark out of the neighbour index, so discovery found nothing there at all — reported, with the fix attached, by lechu2375.

Where it runs

Zabbix 7.0 LTS and 7.4, AGPL-3.0, no build tools needed. This release was verified on 7.0.30 and 7.4.14. Updating from 5.3.x: replace the files, reload php-fpm, hard-reload the page once. No scan directory, no template change.

Thanks to Shazral, bartlomiejfornalczyk, lechu2375 and the one who mailed me his map. Four of those five bugs I would not have found without your screenshots and walks.