📎Explore your Network

Observability Features

n.Scope Platform comes packed with network observability capacities, to help you explore the network data the n.Probes detects and send to the n.Scope central platform.

You can access Observability feature by clicking "View More" on the dashboard's Total Traffic graph, or using the Observability menu item, in the top nav bar of the interface.

Filters

Two main kinds of filters are available to help you navigate the large amount of network data the probes collect. Graphs' unit displayed and attached metrics can also be changed for analysis convenience.

1. Time-period Selector

Our exploration interface provides two main ways to limit the data displayed in graphs:

• By limiting the depth on a sliding time windows, starting at the moment the page is loaded.

  • Four options : Last 7 Days, last 72 hours, Last 24 hours, last hour.

• On a user-defined time window, not sliding

  • You can go back as far as data is available in the database

  • We do not provide a visual cue as if data is available on the selected time-period.

2. Network Object Filters

You can filter the displayed data on specific network objects. It is possible to filter by:

Filter	Description
IPv4 address	Source: IPs that are detected in the source field of sessions Destination: IPs that are detected in the destination field of sessions Bi-Directional: IPs that are detected in both source & destination fields of sessions
IPv6 address	Source: IPs that are detected in the source field of sessions Destination: IPs that are detected in the destination field of sessions Bi-Directional: IPs that are detected in both source & destination fields of sessions
Protocol	The actual protocol, as detected inside the session by the probes
Applications	The actual applications detected inside the session by the probes.
Port	TCP & UDP ports detected on the session, as observed in the traffic.
VLAN Numbers	802.1q VLAN Tag detected in the network frame header.
VXLAN Numbers	The VNID is detected in the network frame header.
MAC Address	When available, the Source, Destination or bi-directional MAC Address detected in the network frame header.
Sources	Sources in filters refer to Network Probes that have detected the traffic. This is a way to limit the displayed data to a particular part of the network observed.

Check out the supported protocols list.

3. Unit Selector

All graphs can be displayed in one of the following units:

• Bytes: the volume of Bytes that have transited on the network

• Session: the number of detected network sessions

• Packets: the number of packets that are transported on the network

Traffic Display

Observability graphs goal is to provide a way to explore your network's data through different visualisations of the data stored in our the Clickhouse Database.

Total Traffic

This graph displays an aggregate visualisation of the total trafic observed by the probes, given the current filters. The blue bars represent the current period defined in the data picker. The gray bars represent the previous same-sized time period for comparison.

You can isolate the data of a specific network host by filtering on its IP address. Same, you can get the total volume of trafic on a given protocol or application by filtering on it.

Multi-Protocols

This graph will display individual protocols present on the network traffic and their count of traffic during the selected time frame.

Multi-IPv4

This graph will display the aggregated performance by subnets.

We are going to expand the subnet feature in a future version. Let use know your interest on Slack or by droping an email at [e-mail]

Multi-Source

This graph display the traffic data aggregated by probes. In this graph, we call "Source" the n.Probes deployed in your network.

Relational Graphs

To ease data exploration, you can explore relation between network objects through two relational graphs.

Forcegraph

The Force Graph displays the IPv4 network nodes. Each nodes gets bigger based on the amount of traffic they exchanged during the time frame. Nodes are displayed based on the filters and time frame selected.

Nodes are links between themselves when network traffic match the filters selected.

This graph only displays private (RFC1918) IPv4 network nodes. All public network nodes are excluded.

Sankey

This graph displays the network traffic exchanged between internal nodes and/or Internet nodes, matching the filters set. The width of the band representing the traffic is larger when more traffic is exchanged.

Protopath

The Protopath is a tree displaying protocol encapsulation for OSI Layer 2 up to Layer 7. Each node size will depend on the amount of traffic generated by each protocol. The graph is filtered both on the timeframe and network object filter. Hovering on a node, you will get the volume of traffic detected for the protocol.