Interface Admin

The management of device interfaces in the Kentik Detect portal is discussed in the following topics:

• About Interfaces
• Interfaces Page
• Interface Admin Dialogs
• Add or Edit Interface

Each interface on a Kentik-registered device (see About Devices) is an individual object with its own properties. The interfaces themselves and the values of their properties are typically discovered via SNMP polling (see SNMP OID Polling), but Kentik also allows manual setting of interface information in the following ways (see Add or Edit Interface):

• Interfaces may be added manually (e.g. when SNMP polling is not enabled on the device).
• The SNMP-discovered values of interface properties may be manually overridden.

Unless otherwise filtered, the Interface List on the Interfaces page shows both SNMP-discovered and manually added interfaces. The information in the row of an SNMP-discovered interface is based on the following:

• Flow reporting: The Status Flow indicator and the upper-line values in the Traffic In and Traffic Out cells are based on flow data reported to Kentik Detect via flow records (NetFlow, sFlow, IPFIX, etc.).
• SNMP reporting: The lower-line values in the Traffic In and Traffic Out cells are based on flow data collected by SNMP polling.

For manually added interfaces, the information in the Interface List is based only on flow reporting.

The Interfaces page is home to the Interface List, which is a table that lists all of the interfaces on a given Kentik-registered device and provides information on each of those interfaces. The Interfaces page is covered in the following topics:

• Accessing the Interfaces Page
• Interfaces Page UI
• Interface List
• Flow SNMP Mismatch

You can get to the Interfaces page in either of the following ways:

• Choose Admin from the Kentik navbar, then Interfaces from the sidebar at left.
• In the Device List, click the View Interfaces icon in the row of the device whose interfaces you want to see.

The Interfaces page includes the following UI elements:

• Device selector: A drop-down menu that lists your organization’s Kentik-registered devices. Choose the device whose interfaces you want to see in the Interface List.
• Filter field: Filters the Interface List to show only rows containing the entered text in one of the following columns: Connectivity Type, SNMP IP, Description, Name, IP, Network Boundary, or Boundary ASNs.
• Show selector: A drop-down menu from which you can choose different criteria that can be used to narrow the interfaces shown in the Interface List:
  - All: all interfaces on the current device;
  - With Flow: devices currently sending flow to Kentik;
  - Manually Added: see Adding an Interface;
  - Classified: interfaces that have been classified with Interface Classification;
  - Unclassified: interfaces that haven’t yet been classified;
  - Overridden: interfaces whose SNMP-discovered properties have been manually overridden in Kentik.
• Show button: Switches between showing two partially overlapping sets of columns for the table:
  - Traffic/Stats: See Traffic/Stats Columns.
  - Classification: See Classification Columns.
• Add Interface button: Links to an Add Interface dialog (see Adding an Interface) where you can manually register an interface for the device currently shown in the Device selector.
• Interface List: A table listing the interfaces on the currently selected device (see Interface List).

The Interface List is a table that lists all of the interfaces on the device currently shown in the Device selector and shows current information about each interface based on flow and SNMP data reported to Kentik.

Note: To see additional information about a given interface, click anywhere in the row for that interface, which opens a Edit Interface dialog in which you can review and edit settings (see Editing an Interface).

The table is made up of rows that each represent an interface. Click on a column heading to sort the list (ascending or descending). The specific columns shown depend on the Show button (see Interfaces Page UI).

The following columns are included whether the Show button is set to Traffic/Stats or Classification:

• SNMP ID: Interface ID as defined in the device itself and retrieved via SNMP.
  Note: Routers must be configured to persist SNMP interface IDs across reboots.
• Name: The name string defined in the device itself and retrieved via SNMP.
• Description: The description string defined in the device itself and retrieved via SNMP.
• IP: The IP address for this interface.
  Note: The IP address is not reported for manually created interfaces.
• Capacity: The maximum capacity in mbps as reported by SNMP.
• View Interface Chart: Opens the Current and Historical Traffic Dialog.

The following columns are included only when the Show button is set to Traffic/Stats:

• Status Flow In/Out: This indicator shows whether NetFlow has been detected within the last 10 minutes at either the ingress or egress collection points for the interface:
  - If no flow has been detected, the indicator is a light gray disc.
  - If flow has been detected, then the indicator is a checkmark: green if the flow was detected only at the ingress collection point, yellow if it was detected only at the egress collection point, and red if it was detected at both the ingress and egress collection points.
• Traffic In: These indicators show whether inbound traffic (traffic entering a port) has been detected on the interface within the last 10 minutes, either from flow data (upper line in the cell) or SNMP data (lower line):
  - If no traffic data of a given type (flow or SNMP) has been detected then the indicator on the corresponding line (upper or lower) will be a gray disc.
  - If traffic data has been detected, the indicator will be a checkmark and the reported flow volume will be indicated in mbps. For flow (upper line) the checkmark will always be green. For SNMP (lower line) the checkmark will be green unless the SNMP-reported traffic volume differs from the flow-reported volume by more than 20% (see Flow SNMP Mismatch), in which case the indicator will be red.
• Traffic Out: Same as for the Traffic In column, except for outbound traffic (traffic leaving a port).

The following columns are included only when the Show button is set to Classification:

• Boundary ASNs: The ASNs of the autonomous systems to which — so far as Kentik is able to determine based on traffic and BGP data — an edge (External) interface is connected. If there’s more than one AS, the percent of traffic for each is also indicated.
• Network Boundary: The network boundary value assigned to the interface by interface classification (see Network Boundary Attribute).
• Connectivity Type: The network boundary value assigned to the interface by interface classification (see Connectivity Type Attribute).
• Provider: The provider value assigned to the interface by provider classification (see About Provider Classification).

If a value in the Interface List has been specified manually (rather than SNMP-discovered) it will be underlined in red. If you hover over a red-underlined value a popup will be displayed that includes the manually specified value, the SNMP-discovered value (if any), and a Reset button:

• If there is an SNMP-discovered value, the Reset button will restore that value.
• If there’s no SNMP-discovered value, the Reset button will set the value to blank.

The Current and Historical Traffic dialog, opened via the View Interface Chart button, displays a multi-axis chart showing the traffic across the interface, both historically and over the last 24 hours. Inbound traffic is plotted as positive and outbound traffic is plotted as negative.

The dialog includes the following UI elements:

• Close buttons: To close the dialog, click the X in the upper right corner or the Close button at lower right.
• View Type: A drop-down menu used to set the type of visualization used for the graph (defaults to Line Chart); for descriptions of the options see Chart View Types.
• Chart: The visualization of traffic (using the current view type).
• View in Explorer button: Opens Data Explorer for further exploration of the device’s traffic. The sidebar will be set so that query results will show the same traffic that is shown in the dialog.

As noted above, the Traffic In/Out columns of the Interface List may show a difference between flow-reported traffic volume (upper indicators) and SNMP-reported traffic volume (lower indicators). If the difference is greater than 20 percent and either the flow-reported volume or the SNMP-reported volume is greater than 50 mbps, then the checkmark in the status column will be red instead of green. While this alerts users to the possibility of an issue, it does not mean that there actually is an issue. The following are examples of common scenarios in which there may be a difference between the flow and SNMP traffic data:

• If the network has a number of ports on a router that talk between each other on the same subnet (i.e. switched vs. routed), that inter-port traffic will be counted in SNMP traffic but not in flow traffic, resulting in a percentage difference that reflects the topology of the network and does not indicate a problem.
• If there is a mismatch between the flow sampling rate configured on a router and the sample rate entered when that router is registered in Kentik (i.e. router is configured for a sample rate of 2048 but sample rate in Kentik device setup is 1024), then the Traffic status column will report low but the SNMP status column (which isn’t subject to sampling factor) will be correct. To correct the mismatch, change the settings on the router itself or in the Device Details dialog of the Kentik portal.
• If the router is overloaded it will drop flow records, which will be reflected in the flow indicators (upper) but not in the SNMP indicators (lower). You may be able to reduce the extent to which a router drops flow records by changing that router’s flow sampling rate (see Flow Sampling; note that this involves a change to both the router’s configuration and the device settings in Kentik Detect). You may also wish to contact the router vendor for optional flow export mechanisms/accelerators.

Adding or editing an interface via the Kentik portal involves specifying information in the fields of the interface admin dialogs, which are covered in the following topics.

• About Interface Dialogs
• Interface Dialogs UI
• Interface Field Definitions
• Getting an Interface Index

Note: Interfaces can also be added and edited with the Device API.

The Kentik portal uses interface admin dialogs to collect the information needed to retrieve flow and SNMP data from the interface. The required information is entered into the fields of either of the following dialogs:

• Add Interface when registering a new interface with Kentik.
• Edit Interface when editing an already registered interface.

Note: Some fields that are editable when adding an interface are read-only when editing an interface.

The Add Interface and Edit Interface dialogs share the same layout and the following common UI elements:

• Close button: Click the X in the upper right corner to close the dialog. All elements will be restored to their values at the time the dialog was opened.
• Remove button (Edit Interface dialog only): Remove the interface from your organization’s collection of Kentik-registered interfaces. This button is only present if the interface being edited was manually added.
• Cancel button: Cancel the add interface or edit interface operation and exit the dialog. All elements will be restored to their values at the time the dialog was opened.
• Add Interface button (Add Interface dialog only): Save settings for the new interface and exit the dialog.
• Save button (Edit Interface dialog only): Save changes to interface settings and exit the dialog.

Interface admin dialogs contain the fields shown in the following table.

Notes:
- Fields in the Edit Interface dialog for SNMP-discovered interfaces are populated with SNMP-polled values that may be manually overridden.
- Fields will include a Reset button at right whenever their current value differs from their “original” value. For SNMP-discovered interfaces the button will restore the field to its SNMP-polled value. For manually added interfaces the value is reset to blank and a new value must be specified.

An interface index (ifIndex) is required in order to add an interface manually. The way to determine the correct value depends on the kind of interface:

• Interface on an kprobe host:
  - Get from Data Explorer: You can find this value in Data Explorer using a query whose device is the kprobe host that the interface is on, and whose dimensions are Source:Interface and Destination:Interface. The value will be shown in the Key column at the left of the resulting table.
  - Derive from kprobe: Use a CLI to determine the interface that kprobe is configured to track, and to get the MAC address of that interface. The interface index is the decimal value of the last two octets of that MAC address.
• Interface on a router or switch:
  - Device-specific commands: Log onto the device with a CLI and retrieve the interface index (ifIndex) with the device-specific command shown in the table below.
  - SNMP walk: If your device isn’t shown in the table below, you can SNMP-walk the IF-MIB, mapping interface names (IF-MIB::ifName.<ID>) to displayed IDs (IF-MIB::ifIndex.<ID>).
  Note: Routers must be configured to persist SNMP interface IDs across reboots.

Device-specific commands to retrieve ifIndex:

Device interfaces can be added or edited on the Interfaces page, which is covered in the following sections:

• Adding an Interface
• Editing an Interface

Note: Interfaces can also be added and edited with the Device API.

Interfaces and kprobe hosts that are not configured for SNMP are not automatically detected by Kentik Detect and must be added manually.

To add an interface:

1. Go to the Interfaces page (see Accessing the Interfaces Page).
2. From the Device selector, choose the device whose interface you want to add.
3. Click the Add Interface button. The Add Interface dialog will open.
4. In the dialog that appears, enter the Name, Capacity, Interface Index (see Getting an Interface Index), and Description for the interface. See Interface Field Definitions.
5. Click the Add Interface button to save the interface and return to the Interfaces page.

Settings can be edited for both SNMP-discovered interfaces and manually added interfaces. This enables you to override SNMP-discovered values within Kentik rather than being required to modify your existing systems. For example, if your interface descriptions have been populated automatically by code that you can’t or prefer not to modify, you can edit those descriptions manually.

To edit an interface:

1. Go to the Interfaces page (see Accessing the Interfaces Page).
2. From the Device selector, choose the device whose interface you want to add.
3. On the Interfaces page, click in the row of the interface that you want to edit. The Edit Interface dialog will open.
4. In the Edit Interface dialog, edit the interface fields that you want to change (see Interface Field Definitions).
5. To save changes, click the Save button.

Notes:
- To delete a manually added interface, click Remove at lower left.
- In the Interfaces List, a value that has been manually overridden will be underlined in red.