Network Devices

The setup and management of devices in the Kentik portal is discussed in the following topics:

• About Devices
• Devices Page
• Device List
• Device Details
• Label Controls
• Device List Filters
• Device Settings Dialog
• Add or Edit Device

Notes:
- Devices may be set up during your organization's initial onboarding with Kentik; see Onboarding.
- If you would like assistance with any aspect of adding or managing a device, please contact us at Customer Support.

Devices are one of two main types of Data Sources in Kentik. Devices are classified as either routers (which includes hardware such as switches and firewalls) or hosts, which utilize Kentik's kprobe software host agent. Devices can send flow data to Kentik (e.g. NetFlow, sFlow, IPFIX), be polled by Kentik for SNMP data, and have BGP data from their routing tables read by Kentik. These various types of data from devices are correlated by Kentik, along with other data such as GeoIP, DNS, etc., into the time-series database at the heart of our backend, the Kentik Data Engine (KDE).

Enabling a device to send data to Kentik involves two main stages:

• Register a new device in the Kentik portal. Information about that process is included in this article (see Add or Edit Device).
• Configure the device itself to send flow:
  - If the device is a router or other networking hardware, see Router Configuration.
  - If the device is a host (via kprobe), see Host Configuration.

The Devices page of the Kentik portal may be reached by choosing Settings from the main navbar, then clicking on the Networking Devices card at top. All registered devices for a given customer are listed on the page, which includes the following main UI elements:

• Share (on SubNav): Opens the Share dialog to enable you to share the current view (see Sharing via the Share Dialog).
• Actions (on SubNav): A drop-down menu from which you can choose to export or subscribe to the current view:
  - Export: Export the page’s content as a visual report (PDF) or data table (CSV). A notification appears when the export is ready to download.
  - Subscribe: Opens the Subscription Dialog, which enables you to subscribe to regular reports from the page, either by choosing an existing subscription (combination of email address and schedule) or specifying a new one.
  - Unsubscribe: Opens the Unsubscribe dialog. Click the Subscription drop-down, select the subscription from which you’d like to unsubscribe, and click Unsubscribe.
  Note: Unsubscribe will only appear if you have an existing subscription for this page.
• Selection indicator: Indicates how many devices are currently selected in the Device list (see the Select column in Device List Columns). Label controls apply to the selected devices.
• Label controls: A set of buttons related to labels for devices in the list (see Label Controls).
• Add Device: A button that opens the Device dialog, where you set the device settings (see Device Settings Dialog).
• Device List: A table listing your organization’s devices (see Device List).
• Filters pane: A set of controls that enable you to filter the Device list (see Device List Filters).

The Device List is covered in the following topics:

• About the Device List
• Device List Columns
• Device List Actions

The Device List is a table that shows information about the listed devices as well as available actions. By default the list is ordered alphabetically by name (ascending). To change the sort order of the list, click on a heading to choose a sort column, and on the resulting blue up or down arrow to choose the sort direction (ascending or descending).

Each row of the Device list shows the device's values for each of the table's columns (see Device List Columns), as well as the actions available for the device (see Device List Actions). You can also show an extensive set of additional details about the device by clicking on the device's row, which slides out the Device Details drawer from the right of the page. If the drawer is already open and you click on the row for a different device then the details will be replaced with details for the new device. To close the drawer click anywhere outside of the Device list.

The columns displayed in the Device list depend on the settings in the Customize Columns popup (see Customize Device List). The following columns are available:

• Select (always present): A checkbox that selects this test for the purpose of clearing or applying labels (see Label Controls):
  Note: The checkbox in the heading row of the table toggles selection of the checkboxes in the individual device rows.
• Name: Indicates the following:
  - Name: Name of the device as specified when the device was registered or edited.
  - Type: An icon indicating the category of the device (router, host, etc.; see Supported Device Types).
• ID: The device's Kentik-assigned device ID.
• Status: A set of icons indicating what types of data Kentik is receiving from the device. Icons are present for the following types of data:
  - Flow: Indicates whether Kentik is receiving flow records from the device.
  - SNMP: Indicates whether Kentik is able to successfully poll the device for SNMP data.
  - BGP v4: Indicates whether Kentik is peering with the device to receive BGP v4 routing data.
  - BGP v6: Indicates whether Kentik is peering with the device to receive BGP v6 routing data.
  - ST: Indicates whether Kentik is able to successfully receive telemetry from the device.
• FPS Raw: The rate at which the device has been generating flow records over the last six hours (before any Kentik downsampling).
• FPS Sampled: The rate at which Kentik has been ingesting flow records from the device over the last six hours. This value is after any downsampling Kentik performs pursuant to the terms of the plan to which the device is assigned.
• BGP Prefixes: For devices whose Status column shows BGP enabled this column shows the IP v4 (top) and v6 (bottom) prefixes currently (within last 5 minutes) in the BGP routing table.
• Site: Shows the name of the site to which the device is assigned (see About Sites).
• IP Address: The IP address(es) from which the device sends data to Kentik.

Each user may choose which of the columns above are actually displayed to them in the Device list:

1. Click the Customize button at the upper right of the Device list.
2. In the resulting Customize Columns popup, use the checkboxes to specify the visibility of each column.
3. Click anywhere outside the popup to close it. The device list will reflect your column selections, which will be saved as part of your Kentik portal User Profile.

The following actions are available for each device in the Device list:

• Edit (not present when the device is archived): Opens an Edit Device dialog in which you can review and (in some cases) edit settings (see Edit a Device).
• Archive (file box with down arrow; not present when the device is archived): Opens a confirming dialog with which you can archive (deactivate) the device. If you proceed, an "Archived" label will be applied to the device in the Device list.
  Note: Flow and other data from an archived device will no longer be ingested into Kentik or included in aggregates or evaluations on any portal page or process, including Network Explorer, Insights, Hybrid Map, etc.
• Restore (file box with up arrow; only present when the device is archived): A button that opens a confirming dialog enabling you to restore an archived device to active status.
  Note: Archived devices cannot be restored when all of your organization's device licenses are already in use by active devices.
• Remove (trash icon; only present when the device is archived): Opens a confirming dialog with which you can permanently remove the device from your organization's collection of Kentik-registered devices.
  Note: Removing a device will remove all of the device's flow records from the KDE.

The Details pane appears in a drawer that slides out from the right of the page when you click on the device's row in the Device List. The pane contains the device-related information fields described in the topics below:

• Device General Details
• Device Flow Details
• Device Interface Details
• Device SNMP Details
• Device BGP Details
• Device ST Details
• Device Features

General information about the device:

• ID: The device's Kentik-assigned device ID.
• Name: Indicates the following:
  - Type: An icon indicating the category of the device (router, host, etc.; see Supported Device Types).
  - Name: Name of the device as specified when the device was registered or edited.
• Labels: The labels, if any, assigned to the device.
• View in Network Explorer: a button that takes you to the Details page for this device (see Core Details Pages).
• Manufacturer: Information about the device, obtained by SNMP polling, including the full name and version identification of the system’s hardware type, software operating-system, and networking software (see sysDescr in System Information OIDs).
• Description: The description string specified when the device was added or edited.
• Site: The site to which this device is assigned.
• Plan: The billing plan to which the device should be added (see About Plans).
• Kproxy Agents: The kproxy agents, if any, via which flow data is sent from the devices at this site to Kentik (see Kentik Proxy Agent).
• Sending IPs: IP address(es) from which the device sends flow.

Details related to the flow records sent from the device to Kentik (see Flow Overview):

• Flow: Indicates whether Kentik is receiving flow from the device. The indicator has the following states:
  - No Flow Detected (red): Displayed when no flow is detected from the device.
  - Direct flow detected (green): Flow is coming directly from a router.
  - Kentik Agent detected (green): Flow is coming via Kentik's kproxy software agent (see Kentik Proxy Agent).
• FPS (Sampled): The rate at which Kentik has been ingesting flow records from the device over the last six hours. This value is after any downsampling Kentik performs pursuant to the terms of the plan to which the device is assigned.
• FPS (Raw): The rate at which the device has been generating flow records over the last six hours (before any Kentik downsampling).
• Plan FPS: The maximum FPS supported by the plan to which this device is assigned.
• Flow Type: The format of the flow data, e.g. NetFlow v5, v9, IPFIX, or sFlow (see Flow Protocols).
• Sample Rate: The ratio of total flows per sampled flow (see Flow Sampling).

Details related to the interfaces on the device:

• Interfaces Classified: The number of classified interfaces, the total number of interfaces, and the percent of interfaces that have been classified (see About Interface Classification).
• View Interfaces: A button that takes you to the Interfaces page (Settings » Interfaces) where you can manage the interfaces on your devices (see Manage Interfaces).

Details related to SNMP polling of the device by Kentik (see SNMP OID Polling):

• SNMP status: Current status of SNMP polling, e.g. Detected or Not Detected.
• SNMP Polling (see SNMP Polling Intervals):
  - If Standard, SNMP polling is every 10 min for interface counters and 3 hours for descriptions.
  - If Minimal, interface polling is disabled and descriptions are polled every 6 hours.
• SNMP v3 Auth: Indicates whether v3 authentication for SNMP polling is on or off (see About SNMP V3).

Details related to BGP on the device (see BGP Overview):

• BGP status: Current status of BGP peering with the device, e.g. Established, Not Established, or Not Configured.
• BGP Prefixes: For devices with BGP enabled this indicator shows the number of prefixes currently (within last 5 minutes) in the BGP routing table.

Details related to streaming telemetry from the device to Kentik:

• Disabled (grey): Streaming Telemetry is not enabled in the device's Kentik settings.
• No ST detected (orange): Streaming Telemetry is enabled in the device's Kentik settings, but Kentik is not receiving telemetry from the device.
• ST Detected (green): Streaming Telemetry is enabled and Kentik is receiving telemetry.

Additional Kentik capabilities enabled on this device:

• CDN attribution: Enabled if the device is a host and its Contribute to CDN Attribution switch is on in the General tab of the Device Settings dialog (see Device General Settings).
• Flowspec: Enabled if the device's BGP Flowspec Compatible switch is on in the BGP tab of the Device Settings dialog.
• RTBH: Enabled if the device is assigned to an RTBH mitigation platform (see Configure Platform Devices).

Kentik's labeling feature enables you to create a label (essentially a property whose value is text) and apply it to one or more entities represented within the Kentik portal, creating a group that can be referenced collectively rather than individually (e.g. when filtering). The Devices page includes the following label-related controls, which apply to the currently selected devices in the Device list:

• Add/Edit Labels: A button that links to the settings page for Labels, where you can create or remove the labels that are available to apply to the selected devices.
• Clear Labels: Clear the labels that are applied to all currently selected devices.
• Apply Labels: A drop-down list of labels from which you can choose a label to apply to all currently selected devices.
• Select All (checkbox): A checkbox for toggling the selection state of all devices in the Device list:
  - If either no checkboxes in the list itself are checked or only some are checked then clicking this checkbox will select all checkboxes.
  - If all checkboxes in the list are checked, clicking this checkbox will deselect all checkboxes.

The Filters pane to the right of the Device list includes a set of filters that you can use to narrow the devices that appear in the list:

• Clear All (present only when one or more filters are specified): Click to clear all current filters.
• Filter field: Filters the Device List to show only rows containing the entered text in one of the following columns: Name, Site, or IP.
• Site field: Enter a site name to return the rows for all devices in a matching site.
• Flow Status: Click the checkboxes to include devices in the following categories (if none are checked all are included):
  - Direct flow: Devices for which flow is coming directly from a router or other network hardware.
  - Kentik Agent: Devices for which flow is coming via Kentik's kproxy software agent (see Kentik Proxy Agent).
  - No flow: Devices for which no flow is detected.
• SNMP status: Click the checkboxes to include devices based on the current status of SNMP polling, e.g. Detected or Not Detected.
• BGP status: Click the checkboxes to include devices based on the current status of BGP peering with the device, e.g. Established, Not Established, or Not Configured.
• Plan: Enter a billing plan to which the device is assigned (see Licenses).
• Label: Click the checkboxes to include devices based on label.
• Vendor: Click the checkboxes to include devices based on the vendor specified in the device's manufacturer (derived via SNMP polling).
• Type: Click the checkboxes to include devices of a given type (see Supported Device Types).
• Flow Type: Click the checkboxes to include devices based on the format of the flow data, e.g. NetFlow v5, v9, IPFIX, or sFlow (see Flow Protocols).

Adding or editing a device via the Kentik portal involves specifying information in the fields of the device admin dialogs, which are covered in the following topics.

• About Device Dialogs
• Device Dialogs UI
• About Device Fields
• Device General Settings
• Device Plan & Site Settings
• Device SNMP Settings
• Device ST Settings
• Device BGP Settings
• Device Integrations
• Device Config Info

Note: Devices can also be added and edited with the Device API.

The Kentik portal uses device admin dialogs to collect the information required for Kentik to connect with the device to receive flow, poll SNMP, and establish BGP peering (when applicable). The required information is entered into the fields of either of the following dialogs:

• Add Device when registering a new device with Kentik.
• Edit Device when editing an already registered device.

The Add Device and Edit Device dialogs share the same layout and the following common UI elements:

• Close button: Click the X in the upper right corner to close the dialog. All elements will be restored to their values at the time the dialog was opened.
• Tab selectors: Choose the tab to display (see tab-specific topics below).
• Remove button (Edit Device dialog only): Remove the device from your organization's collection of Kentik-registered devices.
• Cancel button: Cancel the add device or edit device operation and exit the dialog. All elements will be restored to their values at the time the dialog was opened.
• Add Device button (Add Device dialog only): Save settings for the new device and exit the dialog.
• Save button (Edit Device dialog only): Save changes to device settings and exit the dialog.

Each device admin dialog is broken into the tabs covered in the topics below, each of which is made up of a number of fields. The tabs that are visible at any given moment, and the fields on those tabs, varies depending on the type (router or host) of the device, and whether the device is being added or edited.

Until all required settings on a given tab are entered the tab name is preceded with a caution icon. Once a tab's fields are complete a tab-specific icon is displayed instead.

Notes:
- Some General tab fields that are editable when adding a device are read-only when editing a device.
- In addition to the fields used to enter information, the tabs of the device dialogs also include information used to configure a device to connect with Kentik (see Device Config Info).

The following table shows the elements in the main panes of the General Settings tab of the device admin dialogs:

In addition to the settings on the General tab, the device itself must be configured to send flow to Kentik, which requires the Kentik IP addresses to which flow should be forwarded by the device. These addresses vary depending on whether flow is sent to Kentik directly from the device or via an instance of kproxy, Kentik's proxy agent. The tabbed pane at the top of the General tab provides the IP addresses needed for these options:

• Direct: Provides the following information:
  - Kentik Ingest IP
  - Kentik Ingest UDP port
• Via kproxy: Provides the following information for the kproxy instance chosen from the Select a kproxy drop-down:
  - Kproxy Private IP
  - Kproxy port

The address specified with Sending IPs must be unique (not used by any other device in your organization) for any device sending flow data directly to Kentik. If, however, a device sends flow data via kproxy (see Kentik Proxy Agent) then an IP specified in the Sending IPs field may be the same as that of an already registered device so long as the following is true:

• The two devices do not use the same instance of kproxy.
• Both instances of kproxy specify a valid site ID using the -site_id parameter in the kproxy command line (see kproxy Proxy Agent Arguments).
• The value of -site_id for the two instances of kproxy is not the same.

Kentik currently supports devices in two broad categories:

• Routers, which include switches and firewalls.
• Hosts, which include cloud resources.

Devices in the two categories store and report traffic differently (see Device Type), and also have some differences in portal configuration settings, most notably a BGP tab for routers that is not present for hosts. The table below shows the types of devices currently available in the portal, including the category of each.

Note: In the Device API the above device types are referenced using the subtype values listed above.

Kentik uses the kprobe software host agent to generate network traffic data from hosts (see About kprobe). The sample rate for flow data generated by kprobe involves two settings:

• The --sample parameter of the kprobe Command Line. This CLI parameter is optional.
• The Sample Rate field of the Device General Settings tab of the Add Device or Edit Device dialog. This setting is required when a host device is registered in the portal.

The sample rate that is actually used is determined by the following:

• If the --sample parameter is included in the command line, the CLI-provided value takes precedence over the Sample Rate field value.
• If the --sample parameter is not included in the command line, the Sample Rate field value is used.

The table below shows the elements of the Plan & Site tab of the device admin dialogs.

Note: The available UI types are the same whether you are adding or editing a device.

When you click the Create a New Site button, the following fields are added to the Plan & Site tab to enable you to enter the information required to create a new site:

• Site Name: A name for the new site.
• Street Address: The physical location of the site given as a street address.
• Use an Existing Site: If you decide not to create a new site, click this button to hide the Configure Site fields and instead choose a site from the Site drop-down.

The table below shows the elements of the SNMP tab of the device admin dialogs.

Note: This tab is shown only when the device type is router. The available UI types are the same whether you are adding or editing a device.

In addition to the settings on the SNMP tab, SNMP polling must be configured on the device itself, which requires the IP address from which Kentik will poll the device. This IP is provided at the top of the SNMP tab.

The Streaming Telemetry tab of a device settings dialog contains the following UI elements:

• Enable Streaming Telemetry collection: A switch that turns on the collection of telemetry from the device.
• Destination IP Pane: Provides the following destination information used for ST configuration on the device itself:
  - Kentik Ingest IP: IP address to receive telemetry.
  - Kentik ST port: ST port to receive telemetry.
• Source IP Pane: The IP address from which the device itself should be configured to send streaming telemetry to Kentik.

The table below shows the elements of the BGP Settings tab of the device admin dialogs.

Notes:
- Settings can't be made on the BGP Settings tab unless the Billing Plan field (see Device Plan & Site Settings) is set to a plan that supports BGP (see Licenses).
- The available UI types are the same whether you are adding or editing a device.

When BGP Type is set to "Peer with device" and the Peering Address (IPv4 and IPv6) fields listed above are displayed, Kentik's IPv4 and IPv6 peering IPs will be displayed to the right of those fields. You'll need these IPs for BGP configuration on the device.

As flow records from devices are ingested into the Kentik Data Engine (KDE) they are enriched with BGP/routing information, a process that depends on matching each flow’s IP address against the BGP route received via the device's BGP sessions. As shown in the table below, the BGP Route Selection drop-down determines how this matching will be performed for both VRF and non-VRF interfaces.

The Device integrations tab is used to specify settings for integrations that are specific to an individual device. This tab is currently used only for Kentik Firehose (to specify the ktranslate instance to which the kflow from this device should be sent). For more information, see Firehose Data Sources.

In addition to internal Kentik settings for registered devices, the tabs of the Add Device and Edit Device dialogs include the following information needed when configuring routers:

• Kentik ingest IP (General Settings tab): The IP address at Kentik to which your router should be configured to send data.
• Kentik ingest UDP port (General Settings tab): The port at Kentik to which your router should be configured to send data.
• SNMP polling IPs (SNMP tab): The IPs from which your router should be configured to allow SNMP polling using the Community supplied in the router configuration.
• Peering Address (BGP Settings tab): The IPv4 and IPv6 addresses with which to peer devices for BGP (the devices must be in a plan that support BGP; see Licenses).

Devices are created and edited via the Devices page of the Kentik portal (choose Admin from the Kentik navbar, then Devices from the sidebar at left). The add/edit process is covered in the following sections:

• Add a Device
• Edit a Device
• Remove a Device
• Enable BGP

Note: Settings made in the topics below may also require changes to your device configuration (see Router Configuration or Host Configuration).

To add (register) a new Device:

1. Choose Settings from the main Kentik menu.
2. On the Settings page, click Network Devices.
3. Open the Add Device dialog by clicking the Add Device button at upper right.
4. On the General Settings tab, enter a name in the Name field.
5. Choose the Type (see Supported Device Types), which determines the settings fields that are displayed.
6. Specify the values of the remaining fields (see Device Settings Dialog).
7. Save the new device by clicking the Add Device button.

Notes:
- In addition to registering a device you must also configure the device itself to send flow records to Kentik; see Router Configuration or Host Configuration.
- For assistance walking through this process please contact Customer Support.

If you don't need to collect flow from a given device but you'd still like to poll the device for SNMP you can add an SNMP-only device. To do so, you'll need to be sure that kproxy is installed before performing the following steps (see kproxy Download and Install):

1. Follow the steps in Add a Device to register one or more new devices.
   Note: Remember to fill out the fields in the SNMP tab when following the steps above.
2. On the Devices page, copy the ID of each newly created device, which can be found at the top of the Device Details pane that opens when you click on a device's row in the table.
3. Run kproxy using the argument -bootstrap_devices with a comma separated list of the IDs for the devices created above:
   /usr/bin/kproxy -bootstrap_devices 104884,88726

Notes:
- For information on SNPM polling, see About SNMP Polling.
- For additional information on the different kproxy command line arguments, see kproxy CLI Reference and kproxy Proxy Agent Arguments.

To edit an existing Device:

1. Choose Settings from the main Kentik menu.
2. On the Settings page, click Network Devices.
3. In the Device List, click the edit icon in the row for the device that you'd like to edit, which will open the Edit Device dialog.
4. Edit the fields that you want to change (see Device Settings Dialog).
5. Save the changes by clicking the Save button.

Removing a device from your organization's collection of Kentik-registered devices will remove the device's flow records from your Kentik data. To remove a device:

1. Choose Settings from the main Kentik menu.
2. On the Settings page, click Network Devices.
3. In the Device List, click the Archive icon (file box with down arrow) in the row for the device that you'd like to remove.
4. In the resulting confirmation dialog, read the explanation so you fully understand the implications of archiving a device, the click the Archive button.
5. In the device's row of the Device List, the device will be tagged as "Archived" and the Edit and Archive buttons will be replaced with Restore (file box with up arrow) and Remove (trash icon) buttons. Click Remove.
6. In the resulting confirmation dialog, click Cancel to abort the device removal or Remove to complete the removal of the device.

To enable the collection of BGP data from a device:

1. Choose Settings from the main Kentik menu.
2. On the Settings page, click Network Devices.
3. In the Device List, click the edit icon in the row for the device that you'd like to edit, which will open the Edit Device dialog.
4. On the BGP Settings tab, choose “Peer With Device” from the drop-down BGP Type menu. Several new fields will appear on the page:
   - IPv4 Peering Address;
   - Ipv6 Peering Address;
   - ASN;
   - BGP MD5 Password.
5. Fill in these Device BGP Settings fields, then click Save.