Dashboards

The Overview dashboard gives you a quick initial overview of what is happening on your network by displaying the interfaces involved, who is talking to whom, and how much.

The flow diagram is a visual representation of the relationships between interfaces, which helps you to easily identify the top talkers. Clicking an IP address in this diagram creates a dashboard filter, resulting in the dashboard only displaying data involving this IP address.

The network traffic charts displaying bandwidth usage and number of new flows over time are a great way to identify potential time ranges of interest. Clicking and dragging on either chart zooms in on the selected time range.

The list of flows displays all of the flows in the analysis database within the selected time range and matching eventual filters. Clicking the download button next to a flow allows you to download this specific flow for further packet analysis. Clicking an IP address in the list of flows navigates to the Host Details dashboard, for further analysis of the metadata associated with this address.

Where the Overview dashboard shows who is talking to whom, the Application Overview dashboard shows what they are talking about.

The data in this dashboard is categorized by application type, and by application. The graph can be changed to display latency, flow count, and payload size. This dashboard is a great starting point when analyzing application issues. It gives a clear overview of which components may be slowing your applications down. It can also help finding unexpected services, and services consuming too much bandwidth.

Provides an overview of recorded VoIP sessions, with the possibility to dig down on SIP and RTP metrics and details.

The VoIP Sessions table provides a complete view of detected sessions with cross-correlation between control and data traffic. From this table, selecting a specific VoIP session is possible, allowing inspection of session-specific details in the various dashboard sections.

The call flow is visualized in VoIP and SIP flow diagrams, to help get a better overview of the call details. The dashboard also provides MOS scores for a quick indication of call quality.

This dashboard provides an overview of HTTP traffic, to help monitor HTTP application traffic, distinguish between different return codes, see each different flow, and filter on them.

The Local Assets dashboard lists speaking interfaces present in the local network, based on the canonical private IP address ranges (RFC 1918 & RFC 4193). It helps to keep track of devices in the local network, and also unveil potentially unwanted devices. The bandwidth usage for the selected time range and filters is displayed on a chart. The DHCP host names of devices are displayed whenever possible. Clicking an IP address in the list navigates to the Host Details dashboard for that address.

The Microburst dashboard provides an overview of traffic microbursts measured on the IOTA interfaces. The dashboard automatically selects the two interfaces as inbound and outbound and displays the microburst data for each of them separately in a chart.

This dashboard can be used to get a general overview of microburst events and intensity, and then drill down on the time range where a microburst higher than usual was detected. The benefit of this dashboard is the ability to detect and filter on intense, short living microburst spikes that may not be visible on dashboards displaying average traffic volume, which helps identify buffer overflow issues. When the user has discovered the impacted time range, they can move to a different dashboard to perform further troubleshooting.

The Modbus Overview dashboard displays Modbus protocol message distribution over time, allowing you to troubleshoot industrial networks which contain Modbus traffic. The servers and clients that are part of the Modbus network are listed in a table.

This dashboard provides an overview of TLS-encrypted connections and whether they are considered safe, weak, or unsafe, based on the TLS version and cipher used. Connection information can be sorted and filtered to visualize and identify potentially problematic connections.

This dashboard gives an overview of TCP-related statistics, such as client IP, server IP, host names, iRTT, and more, such as an analysis of TCP connection completeness. Various graphs are available, providing different perspectives on the TCP traffic and offering full diagnostics of the TCP protocol.

You can easily filter on common TCP-related attributes via the filter menu. Color coding of TCP analysis states helps give an at-a-glance view of the data transmission process.

The Bandwidth dashboard provides an overview of the traffic bandwidth measured on the IOTA interfaces. The dashboard automatically selects the two interfaces as inbound and outbound and displays the bandwidth data for each of them separately in a chart.

This dashboard can be used to get a general overview of bandwidth usage over time, and then drill down on the time ranges where peaks of bandwidth usage have occurred. When the user has discovered an impacted time range, they can move to a different dashboard to perform further troubleshooting.

The DNS Overview dashboard gives you an overview of DNS queries over time, top servers, and top queries by type.

This dashboard helps troubleshooting starting from a specific domain and then following the associated flows. This gives a general idea of how your queries are spread out over time.

The Host Details dashboard is available every time an IP address is clicked. This dashboard provides a deep-dive into network activity specific to the filtered IP, and all the metrics you can use to analyze network issues based on geolocation, TCP data, protocol and application information, and flows.

The Flow Details dashboard is accessible by clicking the Inspect (🔍) button on any of the flow tables located in various dashboards. This visualization is useful for inspecting the details of one specific traffic flow. The top-right diagram will display the different protocol headers used in the communication and their main fields. On the left side, there are more in-depth details on packets exchanged inside the communication flow. The dashboard also provides traffic metrics like total payload, bandwidth usage, and the number of packets.

When a capture & analysis session is started, it will appear in this dashboard. This makes it easy to review or go back to an earlier session instantly. It’s also possible to find different analysis sessions by time.

A “session” represents a self-standing correlation domain. A timeout determines whether captured and analyzed data is still part of the current session, or if it belongs in a new session.