Rezuma,
I would use the OSI model. Define what it was layer 1. That is, all the phys conn'ity between the active devices on your net. This includes cable runs between server rooms and wiring closets. This will take the longest but is the most often ignored becuase it is the most tedious.
Move up to layer 2, document collision domains, STP instances etc. Move to layer 3, document broadcast domains, subnets and routing instances, include which routing protocol, interface IP addr etc.
Once you have documented layers 1-3 and understand the "Network" infrst, you can start looking at the "client/Server" infrst. There are many tools available, but you probably won't have the budget to spend 10k on audit or packet analysis tools. Get all this info from the active equip', arp tables, cross ref'd with forw'ing tables, note the routing tables etc. DHCP scopes are also useful.
Ensure that you have a complete picture of each layer before you look at the next. If you don't have an accurate pict of layer 1, any info you collect about layers 2-3 will be flawed. That cable you thought ran the length of the blding is actually two cables connected with an old bridge that is hidden in the ceiling space and also happens to be your STP root bridge. Disconnect that and your network will stop. Be methodical and take the time that is neccesary. I audited a 2500 desktop site, with 80 servers in a farm, by myself, working 12 hours a day for 4 days of the week and it took me nearly 3 months. Becuase I could trust nothing the client said as he had not conducted a reliable audit using a sound methodology.It turned out he had two STP instances running, which explained why his network stopped working when he disconnected an "unused" segment.
Never trust what the client says, if he was to be trusted you wouldn't be needed in the first place. Collect your raw data and the use it to produce node lists, physical and logical diagrams.
Hope this helps.
Steve
