[Discuss] Network Traffic Visualization

[Tom Metro]

Daniel C. wrote:
> - What problems do you have that a visualization tool could help
> solve?

Here's the use case that inspired the original thread: If you notice
something out of the ordinary happening with your network - slowness,
increased ping times, whatever - how do you determine what is happening?

Traditionally we turn to very narrowly focused tools that spit out a
specific number. This provides a very 1-dimensional view of what is
happening.

Generally, our networks are black boxes, and we have little insight as
to what is really happening. Bad things (both intentionally malicious
and inadvertent misconfiguration) could be happening, and we're unaware
of it.

The ideal is perhaps to consider the fantasy depiction of networks by
Hollywood where the hero trivially pulls up a visual representation of
their network and is easily able to spot the intruder's activity. It's
about time some of that absurdity became reality.


> - What do you need to see in order to solve the problem(s)?

Broadly speaking, some sort of overview representation, with the ability
to drill down (i.e. look at specific hosts or protocols) interactively.


> - Do you have any preference for how you see it?
> ...single window that you check on occasionally,
> but is otherwise minimized?

Most likely a tool that is consulted on an as-needed basis. (Presumably
this tool would be layered on top of a network monitoring infrastructure
which would include rules to trigger alerts when recognized anomalies
occurred. Alerts are more effective than expecting someone to be
constantly watching the visualization.)


> - What workflows are currently in place to tackle the problems that
> could be improved by having access to a visualization tool?

As mentioned above, there are a number of existing tools to help with
diagnosing network problems and spotting optimization opportunities, but
they typically show you only a few metrics at a time, and require the
use if multiple tools to get a fuller picture.

 -Tom

-- 
Tom Metro
Venture Logic, Newton, MA, USA
"Enterprise solutions through open source."
Professional Profile: http://tmetro.venturelogic.com/