Network Mapping and Documentation Template: Topology, IP Table, VLANs and Device Inventory

The short version: Network mapping means discovering what is on your network and recording it in a small set of documents you keep up to date: a topology diagram, an IP address table, a VLAN list, a device inventory, and a pointer to where credentials are stored. Start with a scan and a walk of the cabling, draw one logical and one physical diagram, and review the lot on a fixed schedule. Never write real passwords in the documents.

This guide is for IT managers and engineers who need to document a small or mid-sized office network, or who inherited one with no records. After reading it you will have a template for each document, a method to fill it in, and a review routine.

Network mapping: what it covers

Network mapping is two jobs. Discovery finds out what is really there. Documentation records it in a form that other people can use. A map that nobody can read, or that is out of date, is worse than none because it gets trusted.

Keep two views apart:

1. Physical topology: where devices are and how they are cabled. Wikipedia describes physical topology as the placement of network components, including device location and cable installation (checked 28 October 2026).
2. Logical topology: how traffic flows, regardless of the cabling: VLANs, subnets, routing and firewall zones. The same source notes the two can differ, for example a physical star that behaves as a logical bus.

You need both. The physical view helps when someone has to find a port. The logical view helps when someone has to find why two systems cannot talk.

The five documents you need

1. Topology diagrams (logical and physical)
2. IP address table
3. VLAN and subnet list
4. Device inventory
5. Credentials and access policy (a policy, not the secrets)

Add a sixth if you have it: a circuit and supplier list for internet lines, with account references and support contacts.

Step 1: Discover what is on the network

1. Start from the edge. Log in to the firewall and router and note the WAN links, public IP addresses, NAT rules and VPN tunnels.
2. Walk the core. On each managed switch, record its model, firmware version, management IP, uplinks and port usage. Most switches can export their MAC address table and neighbour discovery information (LLDP or the vendor's equivalent), which shows what is plugged in where.
3. Read the DHCP server. The lease list shows active clients and the scopes in use.
4. Scan the subnets. Run a ping sweep or a scanner from a machine inside each VLAN. The ARP cache on a Windows machine gives a quick list of neighbours, but it only shows hosts that machine has recently talked to, so run the ping sweep first and do not treat it as a full scan:

arp -a
Get-NetNeighbor -AddressFamily IPv4 | Sort-Object IPAddress

1. Check the wireless controller or access point list for names, locations, SSIDs and the VLAN of each SSID.
2. Walk the site. Compare what the tools show with what you can see in the server room, the comms cabinets and the floor. Photograph each rack and cabinet.
3. Mark the unknowns. Anything on the network that nobody can explain goes on a list to investigate. Do not unplug it before you know what it does.

Scanning only finds what answers. Printers asleep, devices that block ping and equipment on a separate network will not show up, so the walk matters.

Step 2: Draw the diagrams

Logical diagram. Show one box per subnet or VLAN, the gateway for each, the firewall zones, the routing between them and the internet and VPN links. Label each box with the VLAN ID and subnet. Keep it to one page.

Physical diagram. Show each site, each cabinet or rack, the switches in it, and the uplinks between switches and to the firewall. Label links with the port on each end and the cable type (copper or fibre).

Drawing tips:

1. Use one tool and one symbol set, and keep the source file, not just an exported picture.
2. Show only what a reader needs. Put detail in the tables, not on the drawing.
3. Put a title, the date and the author on every diagram.
4. Use the same names on the diagram, in the tables, on the device label and in monitoring.

Step 3: The templates

Copy these as lists or spreadsheet columns. Fill in your own values. The sample values are placeholders.

IP address table

One row per address or range:

1. Subnet: 10.10.20.0/24
2. VLAN ID and name: 20, Staff
3. Gateway: 10.10.20.1
4. DHCP range: 10.10.20.100 to 10.10.20.250
5. Static range: 10.10.20.2 to 10.10.20.99
6. DNS servers: the addresses clients are given
7. Purpose and owner: who decides what goes in
8. Notes: reservations, exceptions

For static devices, add a row per device: IP, hostname, MAC address, device type, location, owner, and the date last confirmed.

VLAN list

1. VLAN ID and name
2. Purpose: staff, guest Wi-Fi, servers, voice, printers, cameras, management
3. Subnet and gateway
4. Where it exists: which switches and trunk ports carry it
5. Firewall rules: what it may reach and what may reach it
6. Wi-Fi SSID mapped to it, if any

Device inventory

One row per device:

1. Hostname and asset tag
2. Type and role: firewall, core switch, access switch, access point, server, NAS, printer, UPS
3. Make, model and serial number
4. Location: site, room, rack and U position
5. Management IP
6. Firmware or software version and the date checked
7. Warranty or support end date and the contract reference
8. Power source: which UPS or circuit
9. Owner or support contact
10. Backup of configuration: where it is stored and the last backup date

Port and cable record

For each patch panel or switch, record port number, what is connected, the VLAN, and the label on the cable. This is the document people use most when a desk is moved.

Circuit and supplier list

1. Provider, service type and bandwidth
2. Circuit ID and account number
3. Public IP addresses
4. Support number and escalation contact
5. Contract end date

Credentials: what to write down and what not to

Never put real passwords, keys or recovery codes in a diagram, spreadsheet or wiki page.

1. Record where credentials live, such as the name of the password vault and the folder, not the secrets.
2. Record who may access them, and who approves access.
3. Record the account type for each device: named admin accounts, a break-glass account, or a vendor account.
4. Record rotation: when a password was last changed and when it is due.
5. Keep the vault under access control and audit, with MFA on it, and make sure at least two people can reach it.
6. Treat the documentation itself as sensitive. A complete network map helps an attacker. Limit who can read it.

Keeping it up to date

1. Update on change. Make the documentation step part of the change record: no change is closed until the diagram and tables are updated.
2. Review on a schedule. A monthly check of the inventory against what monitoring sees, and a full review each quarter, are reasonable starting points.
3. Compare tool output with the document. A scan that finds an address the table does not list is a finding to follow up.
4. Version the files and note the date of the last review on the first page.
5. Name an owner for each document.

If your network is monitored, the monitoring tool's device list is a good cross-check. For what a monitoring and operations team looks at, see the network operations center guide and the list of what to monitor. If the network was never documented and you want an independent baseline, see our IT assessment and audit service.

Common mistakes

1. One giant diagram. Split it into a logical page, a physical page and per-site pages.
2. Documentation that lives only in one person's head or laptop. Store it in a shared, backed-up place.
3. Passwords in the spreadsheet. Put a pointer to the vault instead.
4. Not recording the version and date, so no one knows how old a diagram is.
5. Trusting a scan alone. Scans miss sleeping or hidden devices. Walk the site.
6. Different names in different places. Choose a naming standard and apply it everywhere.
7. No one owns the update. Add it to the change process.

How to check it worked

1. A new engineer can find a given user's port, VLAN and switch from the documents alone.
2. Every device on a fresh scan appears in the IP table, or is on the list of unknowns with a date.
3. Every device in the inventory is reachable or is marked as retired.
4. The diagram matches the firewall's interface list and the switch trunk configuration.
5. Someone other than the author has followed the documents for a test task and found no gaps.

FAQ

What is network mapping?

Network mapping is discovering the devices, connections and address ranges on a network and recording them as diagrams and tables, so that you can see how the network is built and troubleshoot it.

Which tool can be used for network mapping?

Typically a combination: the firewall, switch and DHCP records, a subnet scanner, the monitoring system's discovery, and a diagramming tool for the drawing. Choose tools your team will keep using, and cross-check the output with a physical walk.

How can I see my network map?

Check whether your monitoring or network management tool draws one from discovery data. If not, build it from switch neighbour tables, the ARP cache and the DHCP lease list, then draw it in a diagram tool.

What is the best network mapping tool for Windows?

It depends on your size and whether you also want monitoring. Look for discovery by SNMP and LLDP (not ping alone), export of its data to CSV or another open format, and scheduled rescans that show what changed. The documents must outlive the tool. We do not rank products here.

Next step

If you want the documentation built and kept current as part of day-to-day IT operations, see our managed services.

Sources checked 28 October 2026: Wikipedia, "Network topology" (en.wikipedia.org/wiki/Network_topology).