Network Map

Applies To: Windows Server 2008

The Network Map is a tool that graphically displays the computers and other network devices that are present on your network. It is designed to allow you to see the path from your computer through the network to the Internet, and whether the Internet is currently available. It also allows you to see the path between your computer and a local device to which you are having problems connecting, and then invoke diagnostics to determine the cause of the connection problem. The Network Map also supports being connected to multiple networks, such as a home network as well as to a remote network through a dial-up connection. Both networks are displayed in the map.

The Network Map uses discovery protocols, such as Link-Layer Topology Discovery (LLTD) and the Function Discovery service in Windows to determine the devices that are attached to the network, and how they are interconnected.

The LLTD protocols and components allow one computer, with the collaboration of other computers on the network, to discover the link layer topology of the network and the devices that interconnect them. For more information, see Network and Sharing Center Group Policy Settings.

The following items can appear on a Network Map diagram:

  • Device. This is an endpoint on a network. It can be a computer or another hardware device, such a TCP/IP-connected camera or printer.

  • Link. This is the physical connection between two or more devices. It can be the Ethernet cable or the wireless association between a computer and a hub.

  • Infrastructure component. This is a piece in the middle of the network that connects other components and devices together, such as a hub, switch, or router.

Your computer, the one from which you requested the map, is always displayed in the upper-left corner; other devices appear underneath. Infrastructure components are to the right, and lines show the connections from the devices to the network infrastructure components and from there to other devices on the network. Information for each piece includes a description, an icon, and an indication of the current connectivity state. For wireless connections, the connectivity state indicator includes a representation of the wireless signal strength. If you hover the mouse over the device, additional information is displayed. Depending on the device type, this can include the TCP/IP configuration of the device, the SSID and security type of the wireless network to which it is connected, and the status of that device's network connectivity.

The following aspects of Network Map are discussed in this section.

  • Network Map architecture

  • Network Map scenarios

  • Administrative options

Network Map architecture

The following components make up the Network Map architecture.

LLTD Mapper

The following figure shows a block diagram of the LLTD Mapper.

Mapper service is implemented in the file LLTMapper.dll. The Mapper service is a Component Object Model (COM) object that is started on demand when invoked, and automatically stops when map cache entries expire (the default is 10 minutes). The Mapper service runs in the Network Service security context.

Mapper COM Server and Mapper COM Client API expose the COM application programming interfaces (APIs) to start and stop the mapping process, and retrieve the map.

Map Cache contains a cached copy of the last captured mapping data on a per network adapter basis. It exists only in memory, and does not persist.

Topology Objects Library contains the objects used to describe a link layer topology map, and is implemented in the LLTObjects.dll file. These objects are used by the Mapper service when building the topology map, by the map cache to store the map, and by the client components to manipulate the map. Such manipulations include transform operations, like changing which device is the root node.


Although it does not appear in this figure, the Network Map architecture also includes the Quality of Service (QoS) Client API, which implements the LLTD protocol extensions for running a network test. It exposes an API that allows the QoS Experiment Algorithms module to set up a network test session and send and receive network test packets.

LLTD Responder

The following figure shows a block diagram of the LLTD Responder.

Responder is implemented as a Network Driver Interface Specification (NDIS) protocol. When enabled on a client computer by the Group Policy settings that specify whether it can run on a Domain, Public, or Private network location type, it runs all the time, and responds to queries from LLTD Mapper components elsewhere on the network.

Network Map scenarios

The following diagram shows a typical home network layout, with several computers and other devices attached to each other through several infrastructure components, and to the Internet through a router.

The Network Map request uses the LLTD Mapper to communicate with the LLTD Responder on devices throughout the network. After the responses have been analyzed, the LLTD Mapper builds an internal tree structure in memory similar to the following diagram.

This map is then transformed to a view that is displayed to the user, where the devices appear in a vertical row on the left with the user's computer at the top, connected to infrastructure devices to the right of the devices, and eventually connected to the Internet on the far right of the diagram.

Administrative options

Administrative options for the Network Map include enabling or disabling the components and protocols required to make the Network Map work. The LLTD Mapper and the LLTD Responder can be disabled altogether, or configured to run only on a subset of the available location types. By default, the components only work on a network that is identified as a Private network location type. Group Policy settings allow an administrator to enable them to run on Domain or Public network location types, or disable them altogether. For more information, see "Configuring the Network Map" in the Network and Sharing Center Operations Guide (

Additional references