In one embodiment, a computing device (e.g., border router or network management server) transmits a discovery message into a computer network, such as in response to a given trigger. In response to the discovery message, the device receives a unicast reply from each node of a plurality of nodes in the computer network, each reply having a neighbor list of a corresponding node and a selected parent node for the corresponding node. Based on the neighbor lists from the replies and a routing protocol shared by each of the plurality of nodes in the computer network, the device may create a reference topology for the computer network, and based on the selected parent nodes from the replies, may also determine a current topology of the computer network. Accordingly, the device may then compare the current topology to the reference topology to detect anomalies in the current topology.