Core View Components

The views in the Core section of the portal feature a consistent layout built around of set of standard components that, while customizable, are fundamentally similar from page to page. The following topics provide a detailed look at these common components:

• Parameter Controls
• Tabbed Graph
• Traffic Table

The parameter controls, located at the top of the page (below the title bar) set the parameters of the query whose results are displayed in the page's graph and table. These controls are covered in the following topics:

• Filters Control
• Aggregate Selector
• Metric Selector
• Time Range Selector

The Filters control enables you to apply filters that narrow the traffic covered by the query results displayed in the graph and table on a given aggregate or detail page. On the Devices aggregate page, for example, by default the results would show all traffic — within the time range specified with the Time Range Selector — that is related to all devices. With the filter control you can specify one or more filters that result in the graph and table being updated to show only a subset of the traffic.

Filters are applied by selecting a dimension and then selecting the value you want to filter on. You can further refine the results by choosing additional dimension/value pairs. When no filters are applied, "No filters applied" appears on the Filters control. If one or more filters are applied, the number of applied filters is displayed (for example, "1 filter applied").

Note: The Filters control is not present on the details pages for Assets (e.g. pages in the Devices, Interfaces, and Sites modules).

Available filters currently include:

• ASN: The origin ASN associated with the source/destination IP of the flow.
• Next Hop ASN: The BGP next-hop IP address, either IPV4 or IPv6, for the source/destination IP of the flow (see About BGP).
• Provider: The name of a provider, identified by Kentik using Provider Classification, via which traffic from a given externally facing interface reaches the Internet.
• AS Path: The BGP ASPATH for the flow’s source/destination IP.
• BGP Community: The set of BGP communities associated with the flow’s source/destination IP.
• Site Country: The name of a country in which your organization has sites; enables the grouping, with a single dimension, of traffic from all sites in a given country.
• Country: A two-letter country code associated with the source/destination IP of the flow (see Geolocation Dimensions).
• Region: The full-text English name of the region (state or province, e.g. “California”) associated with the source IP of the flow.
• City: Full-text English name of the city (e.g. “San Francisco”) associated with the source IP of the flow.
• Site: The name of a specific user-defined physical location (e.g. a data center) to which you can assign one or more devices (see About Sites).
• Device: The name of a network asset such as a router, switch, or host (see Supported Device Types).
• Interface Name: The vendor-defined name (e.g. “GigabitEthernet0/1”) of the device interface (physical or logical) through which flow ingressed/egressed.
• Interface Description: A user-provided description (e.g. “Connected to upstream ISP”) of the device interface (physical or logical) through which flow ingressed/egressed.
• Application: The name of a service, determined based on the factors described in About Applications.
• Protocol: An IP protocol number. When Protocol is chosen as the filter type, protocol names and numbers are listed in the Select value menu.
• Port: Layer 4 source/destination port (e.g. 80, 443).
• Connectivity Type: The role of an interface in the overall network, such as transit, ix, paid peering, etc. (see Connectivity Type Attribute).
• Network Boundary: An interface classification attribute that designates a given interface as internal (no direct connection outside the your network) or external (see Network Boundary Attribute).
• INET Family: The address family of the flow, either 4 (IPV4) or 6 (IPv6).

Note: Some of the filters listed above aren't available in all views.

The Filters control popup opens when you click on Filters in the parameter controls. The popup contains the following UI elements:

• Dimension selector: A drop-down menu from which you can choose the dimension of the filter (see Filters Control Dimensions).
• Value selector: A drop-down menu from which you can choose a value to filter on. The available values vary depending on the dimension. To narrow the list, enter text into the filter field at top.
• Remove: An X at the right side of each filter in the list; click to remove the filter.
• Add a Filter: Adds a new filter for which you can specify dimension and value.

To filter the results in the table:

1. On an aggregate page (e.g. Core » Network Explorer » Services), click the Filters control, then click Add a Filter in the resulting popup. The popup will expand to include the full set of filtering controls (see Filters Control Popup).
2. Choose a dimension (e.g. Country) from the drop-down Dimensions menu.
3. Choose the value you want to use to filter the results (e.g. Russian Federation). The filter will be applied and the graph and table will automatically update to show only traffic from or to Russia.
4. To add another filter, click Add a Filter again, then choose a dimension (e.g. Protocol) and a value (e.g. UDP). The filter will be applied and the graph and table will automatically update to show only UDP datagrams from or to Russia.

The Aggregate Selector is used to choose the calculation by which traffic data displayed in the graph and table is aggregated:

• Average: Calculates the top-X based on average traffic volume over the specified time range.
• 95th Percentile: Calculates the top-X based on the time slice whose volume was at or below 95% of the time-slices within the aggregation period.
• Maximum: Calculates the top-X based on the time-slice whose volume was the highest of all time-slices within the aggregation period.

A metric is a combination of a unit (e.g. a bit) with a method of calculation (e.g. average) and a unit of time (e.g. one second) to create a quantifiable measurement (average bits/second). The measurements are made on network traffic and used for counts, rankings (e.g. in a top-X list), and thresholds (e.g. in alerting). The following metrics are available from the Metric selector:

• Bits/s: Bits per second.
• Packets/s: Packets per second.
• Flows/s: Flows per second.

The time range selector sets the duration, looking back from the current time, covered by the query whose results are displayed in the graph and table. The following time ranges are available:

• Last 5 minutes
• Last 15 minutes
• Last hour
• Last 3 hours
• Last 6 hours
• Last 1 day
• Last 2 days
• Last 3 days
• Last week
• Last 2 weeks

The tabbed graph is covered in the following topics:

• About the Tabbed Graph
• Tabbed Graph UI
• Tabbed Graph Actions

Located toward the top of the page on aggregate and detail views (see Network Explorer Views), the tabbed graph presents visualizations (see Stacked Area Chart) of the results returned from the query specified with the Parameter Controls. The traffic data that is plotted in the graph corresponds to the current page, e.g. on the Devices aggregate page the data pertains to traffic on all devices, while on a Device detail page the traffic pertains to an individual device.

The graph is tabbed to allow you to quickly see various subsets of the data. In most situations (see notes below), the available tabs show data for the following types of traffic:

• Total: The sum of traffic in all of the subsets below.
• Internal: Traffic whose origin and destination are both within your network.
• Inbound (not on Interfaces views): Traffic entering from somewhere outside your network.
• Outbound (not on Interfaces views): Traffic leaving to somewhere outside your network.
• Ingress (Interfaces views only): Traffic coming into a device.
• Egress (Interfaces views only): Traffic going out of a device.

Notes:
- The traffic represented by some of the above tabs may in certain situations represent an insignificant portion of overall traffic. A given tab may not present if there is insufficient traffic to display.
- The division of traffic into the subsets described above is based on the Network Boundary attribute assigned to interfaces during Interface Classification (see Classification Overview).
- Each flow is counted only once. For example, traffic that has been counted as inbound upon entering your network is not counted again as internal as it transits the network or as outbound when it leaves the network.

The tabbed graph UI includes the following elements:

• Tab indicator: A blue bar displayed at the top of the graph indicates the current tab.
• Traffic information: The following information is show above the graph for each of the data sets (Total, Inbound, Outbound, etc.) that has a tab in the graph:
  - Color indicator: Shows the color used to represent the traffic data in the graph (e.g. cyan for Total, orange for Inbound, green for Outbound), thereby serving as a legend.
  - Traffic label: Indicates the type of traffic (Total, Inbound, Outbound, etc.), which is also the name of the tab.
  - Current volume: The current volume of the traffic, expressed in the currently chosen metric.
  - Historical volume: The percent change in volume from the same traffic 7 days ago. An increase in volume will be indicated with a green up arrow; a decrease will be indicated with a red down arrow.
• Graph: A visualization of the data specified with the Parameter Controls. The X axis corresponds to the Time range setting and the Y axis corresponds to the Metric setting. The components plotted in the graph depending on the tab:
  - Total tab: The graph plots Total, Inbound, and Outbound traffic.
  - Inbound/Outbound tabs: The graph plots the top-X components that make up the overall traffic corresponding to the tab. On the Devices aggregate page, for example, if the tab is Inbound then the areas of the stacked area chart each represent inbound traffic on one of the top-X devices listed in the table below.
  Note: On Interfaces views the Inbound/Outbound tabs are replaced with Ingress/Egress tabs (see Tabbed Graph Tabs).
• View in Explorer: Opens Data Explorer for further exploration of the device’s traffic. The Data Explorer controls will be set to query about the traffic shown on the current tab of the graph.

The following actions will change the display of the graph:

• Change tab: The default tab is Total. To change to a different tab, click on the Traffic information (see Tabbed Graph UI) for a different tab.
• Zoom in: To zoom in on a given area, click in the graph and drag horizontally. The graph will rescale to show only the time range you selected by dragging, and a Zoom out button will appear at the upper right of the graph. Click the button to undo the zoom.
• Solo a plot: In the legend below the graph, hover over the label for one plot. The other plots will be muted.
  Example: In the legend on the Total tab, hover over Inbound. The total line and the area for Outbound will be muted, making it easier to see just the Inbound traffic.
• Hide a plot: To hide the display of an individual area plotted on the graph, click on the corresponding label or color swatch in the legend. Click again to toggle the plot back on.
  Example: In the legend on the Total tab, click on Outbound. The area for Outbound will be hidden.
• Display point-in-time values: To display values for all plots at a specific point in the time range, hover over the graph at that point. The resulting popup will display the date, time, and traffic data values.
  Example: Hover at any point within the graph on the Total tab. The popup will show what the total, inbound, and outbound volume was at that point in the time range.

The Traffic Table is covered in the following topics:

• About the Traffic Table
• Traffic Table UI
• Table Common Columns
• Customize Tabs Dialog

Like the tabbed graph, the traffic table presents the results returned from the query specified with the Parameter Controls (traffic over the current time range, expressed in the current metric, and calculated with the current aggregation). Rather than a visualization, however, the data is presented as a top-X table. The data shown in the rows of the table vary depending on the type of the current page:

• Aggregate page table: If the table is on an aggregate page then each row corresponds to an individual instance of the network entity whose traffic data is being aggregated on the page. The rows are ordered according to traffic volume (top-X).
  Example: On the Devices aggregate page, each Kentik-registered device in your network is represented as a row in the table.
• Details page table: If the table is on a details page (or on the Traffic Overview page), the table is tabbed. Each tab corresponds to a dimension by which traffic data can be ranked (top-X). A Customize button at the top right of the table allows you to choose the dimensions for which a tab will be displayed (up to eight). The table columns shown for each tab vary depending on the dimension.
  Note: For a list of dimensions for which traffic data can be displayed in a tabbed table, see

The traffic table includes the following UI elements:

• Tabs (detail pages only): Up to eight tabs, each of which contains a table for one dimension. The current tab is indicated in blue text and with a blue underline. To view the table for a different dimension, click the name of that dimension.
• Customize button (detail pages only): Opens the Customize Tabs Dialog (click anywhere outside the popup to close it).
  Note: For information about a specific dimension that is listed in the dialog as being available for tabbed tables, see Dimensions Reference.
• Dimension table: Each tab contains a table for one dimension. What each table row represents varies depending on the type of table:
  - Aggregate page (untabbed table): The rows always correspond to the subject of the page itself. On the Devices aggregate page, for example, each row corresponds to one device, with the left-most column listing the names of those devices and the other columns providing information about those devices.
  - Details page (tabbed table): The rows correspond to the dimension of the current tab. On the details page for an individual Device, for example, the table in the Applications tab lists the applications with traffic on that device. Each row corresponds to one application, with the left-most column listing the names of those applications and the other columns providing information about those applications.
• Table columns: The columns in a table vary depending on the type of table:
  - Aggregate page (untabbed table): The columns include the Table Common Columns as well as additional columns providing relevant information, which vary depending on the page (Devices aggregate has different additional columns than Sites aggregate or Applications aggregate).
  - Details page (tabbed table): The table on a given tab will include the Table Common Columns as well as a column for the dimension corresponding to the tab.
  Note: On Interfaces pages the Inbound/Outbound columns are replaced with Ingress/Egress.
• Show Top 50 Results: This link (bottom left of table) expands the table to show rows for the top 50 results (based on total volume of traffic). The link appears only when there are more than 50 results to display.

The following traffic volume columns are common to the Traffic Table on both aggregate pages and details pages:

• Internal: Traffic whose origin and destination are both within your network.
• Inbound: Traffic entering from somewhere outside your network.
• Outbound: Traffic leaving to somewhere outside your network.
• Total: The sum of Internal, Inbound, and Outbound traffic.

Notes:
- The Total column is not shown on aggregate views for Sites, Devices, or Interfaces.
- On Interfaces views the Inbound/Outbound columns are replaced by Ingress/Egress.

The popup Customize Tabs dialog enables you to configure the display of tabs in the Traffic Table. The dimensions available for tabs are a subset of the dimensions available for group-by and filtering in Data Explorer. For a given Kentik customer, these dimensions will be the same in all instances of the dialog, but they may vary over time depending on what types of devices you currently have registered with Kentik.

The dialog includes the following UI elements:

• Choose tabs: Use the checkbox to the left of each dimension name to select up to eight dimensions for which you'd like to display tabs.
• Order tabs: Using the handles to the left of the checkboxes, click and drag the dimensions into the desired tab order.

Note: For information about a specific dimension that is listed as being available for tabbed tables, see Dimensions Reference.