Insights Reference

Kentik's Insights engine analyzes traffic and synthetic test results to extract useful information that can be presented to users. These insights are categorized into the following families:

• Capacity Planning
• Edge
• Geolocation
• Hybrid Cloud
• Network Health
• Protect
• Service Provider
• Synthetics
• Traffic

Note: For more information about insights and the Insights module of the Kentik portal, see Insights.

Insights in the Capacity Planning family evaluate trends in interface traffic volume relative to capacity, as reported by SNMP. The insights are based on the thresholds set in your organization's capacity plans, which are configured in the Capacity Planning workflow (see Capacity Plan Thresholds). A Capacity Planning insight notifies you that, based on current utilization trends, the interfaces assigned to a given plan are approaching or exceeding the limits of their capacity as defined by the plan's Warning and Critical thresholds.

This family includes the following insights:

Assuming that present trends continue, the number of months before traffic volume on this plan's interfaces will exceed interface capacity is less than the Warning or Critical threshold setting for Runout.

• Evaluation: Projected runout vs. runout threshold settings.
• Dimensions: Interface
• Metric: Bits/s In and Bits/s Out
• Data sources: SNMP

Traffic volume on this plan's interfaces is greater as a percent of capacity than the Warning or Critical threshold setting for Utilization.

• Evaluation: Utilization vs. utilization threshold settings.
• Dimensions: Interface
• Metric: Bits/s In and Bits/s Out
• Data sources: SNMP

For comparison insights in the Edge family, we evaluate traffic volume through your infrastructure and notify you of changes related to top-X rankings. The primary dimensions we evaluate are ASN and sites. The conditions evaluated for a given dimension include:

• Changes in individual or overall traffic volume.
• Changes in the composition of the top 10 set.
• Changes in top 10 ranking.

Note: For the insights in this family, the metrics displayed in the Statistics Pane (see Insight Details Page) include bitrate over the most recent 7-day period and percent change from the prior period.

This family includes the following insights:

Identifies significant bit rate changes to your peering traffic.

• Evaluation: Most recent 24-hour period vs. prior 24-hour period.
• Dimensions: None
• Filters: Connectivity Type = IX, Free PNI, Paid PNI
• Metric: Bits per second
• Data sources: All traffic

Identifies significant week-over-week changes to the top 10 Destination ASNs in the traffic through the edge of your network. The conditions evaluated for major changes include traffic volume for one or more ASNs, the makeup of the top 10 ASN set, and changes in top 10 ranking. Metrics are provided for bitrate over the most recent 7-day period and percent change from the prior period.

• Evaluation: Most recent 7-day period vs. prior 7-day period.
• Dimensions: Destination ASN
• Filters: Simple Traffic Profile = Through
• Metric: Bits per second
• Data sources: All traffic

Identifies significant week-over-week changes to the top 10 Source ASNs in the traffic through the edge of your network. The conditions evaluated for major changes include traffic volume for one or more ASNs, the makeup of the top 10 ASN set, and changes in top 10 ranking. Metrics are provided for bitrate over the most recent 7-day period and percent change from the prior period.

• Evaluation: Most recent 7-day period vs. prior 7-day period.
• Dimensions: Source ASN
• Filters: Simple Traffic Profile = Through
• Metric: Bits per second
• Data sources: All traffic

Identifies significant week-over-week changes to traffic through a specific site.

• Evaluation: Most recent 7-day period vs. prior 7-day period.
• Dimensions: Site
• Filters: Simple Traffic Profile = Through
• Metric: Bits per second
• Data sources: All traffic

For insights in the Geolocation family, we evaluate traffic volume to or from your infrastructure (on-prem and/or cloud) and notify you of changes related to top-X rankings. The dimensions we evaluate include city, region, and country (e.g. a given country moving into or out of the top-10 countries). The conditions evaluated for a given dimension include:

• Changes in individual or overall traffic volume.
• Changes in the composition of the top 10 set.
• Changes in top 10 ranking.

Note: For the insights in this family, the metrics displayed in the Statistics Pane (see Insight Details Page) include bitrate over the most recent 7-day period and percent change from the prior period.

This family includes the following insights:

Identifies significant week-over-week changes to the top 10 cities in the traffic inbound to your infrastructure (on-prem and/or cloud). The conditions evaluated for major changes include traffic volume for one or more cities, the makeup of the top 10 cities set, and changes in top 10 ranking.

• Evaluation: Most recent 7-day period vs. prior 7-day period.
• Dimensions: Source City
• Filters: Simple Traffic Profile = Inbound
• Metric: Bits per second
• Data sources: All traffic

Identifies significant week-over-week changes to the top 10 cities in the traffic outbound from your infrastructure (on-prem and/or cloud). The conditions evaluated for major changes include traffic volume for one or more cities, the makeup of the top 10 cities set, and changes in top 10 ranking.

• Evaluation: Most recent 7-day period vs. prior 7-day period.
• Dimensions: Destination City
• Filters: Simple Traffic Profile = Outbound
• Metric: Bits per second
• Data sources: All traffic

Identifies significant week-over-week changes to the top 10 countries in the traffic inbound to your infrastructure (on-prem and/or cloud). The conditions evaluated for major changes include traffic volume for one or more countries, the makeup of the top 10 countries set, and changes in top 10 ranking.

• Evaluation: Most recent 7-day period vs. prior 7-day period.
• Dimensions: Source Country
• Filters: Simple Traffic Profile = Inbound
• Metric: Bits per second
• Data sources: All traffic

Identifies significant week-over-week changes to the top 10 countries in the traffic outbound from your infrastructure (on-prem and/or cloud). The conditions evaluated for major changes include traffic volume for one or more countries, the makeup of the top 10 countries set, and changes in top 10 ranking.

• Evaluation: Most recent 7-day period vs. prior 7-day period.
• Dimensions: Destination Country
• Filters: Simple Traffic Profile = Outbound
• Metric: Bits per second
• Data sources: All traffic

Identifies significant week-over-week changes to the top 10 regions in the traffic inbound to your infrastructure (on-prem and/or cloud). The conditions evaluated for major changes include traffic volume for one or more regions, the makeup of the top 10 regions set, and changes in top 10 ranking.

• Evaluation: Most recent 7-day period vs. prior 7-day period.
• Dimensions: Source Region
• Filters: Simple Traffic Profile = Inbound
• Metric: Bits per second
• Data sources: All traffic

Identifies significant week-over-week changes to the top 10 regions in the traffic outbound from your infrastructure (on-prem and/or cloud). The conditions evaluated for major changes include traffic volume for one or more regions, the makeup of the top 10 regions set, and changes in top 10 ranking.

• Evaluation: Most recent 7-day period vs. prior 7-day period.
• Dimensions: Destination Region
• Filters: Simple Traffic Profile = Outbound
• Metric: Bits per second
• Data sources: All traffic

For insights in the Hybrid Cloud family, we evaluate traffic volume to, from, or in your cloud infrastructure and notify you of changes related to top-X rankings. The dimensions we evaluate include applications, cloud services, and regions (e.g. a given region moving into or out of the top-10 regions). The conditions evaluated for a given dimension include:

• Changes in individual or overall traffic volume.
• Changes in the composition of the top 10 set.
• Changes in top 10 ranking.

Note: For the insights in this family, the metrics displayed in the Statistics Pane (see Insight Details Page) include bitrate over the most recent 7-day period and percent change from the prior period.

This family includes the following insights:

Identifies significant week-over-week changes to the top 10 cloud services in the traffic outbound from your infrastructure (on-prem and/or cloud). The conditions evaluated for major changes include traffic volume for one or more cloud services, the makeup of the top 10 cloud service set, and changes in top 10 ranking. Metrics are provided for bitrate over the most recent 7-day period and percent change from the prior period.

• Evaluation: Most recent 7-day period vs. prior 7-day period.
• Dimensions: Destination Cloud Service
• Filters: Simple Traffic Profile = Outbound
• Metric: Bits per second
• Data sources: All traffic

Identifies significant week-over-week changes to the top 10 cloud services in the traffic inbound to your infrastructure (on-prem and/or cloud). The conditions evaluated for major changes include traffic volume for one or more cloud services, the makeup of the top 10 cloud service set, and changes in top 10 ranking. Metrics are provided for bitrate over the most recent 7-day period and percent change from the prior period.

• Evaluation: Most recent 7-day period vs. prior 7-day period.
• Dimensions: Inbound Cloud Service
• Filters: Simple Traffic Profile = Inbound
• Metric: Bits per second
• Data sources: All traffic

Identifies significant week-over-week changes to the top cloud service traffic. The conditions evaluated for major changes include traffic volume for one or more cloud services, the makeup of the top cloud service set, and changes in rankings. Metrics are provided for bitrate over the most recent 7-day period and percent change from the prior period.

• Evaluation: Most recent 7-day period vs. prior 7-day period.
• Dimensions: Traffic Origination and Traffic Termination
• Filters: Traffic Profile = [Inside to Cloud, Cloud to Inside, Multi Cloud]
• Metric: Bits per second
• Data sources: All traffic

Identifies significant week-over-week changes to the top AWS Regions in the traffic inbound to your on-prem infrastructure. The conditions evaluated for major changes include traffic volume for one or more AWS Regions, the makeup of the top AWS Region set, and changes in AWS Region ranking. Metrics are provided for bitrate over the most recent 7-day period and percent change from the prior period.

• Evaluation: Most recent 7-day period vs. prior 7-day period.
• Dimensions: Source AWS Region
• Filters: Cloud Provider = AWS. Traffic Profile = Cloud to Inside
• Metric: Bits per second
• Data sources: All traffic

Identifies significant week-over-week changes to the top AWS Regions in the traffic inbound to your AWS infrastructure. The conditions evaluated for major changes include traffic volume for one or more AWS Regions, the makeup of the top AWS Region set, and changes in AWS Region ranking. Metrics are provided for bitrate over the most recent 7-day period and percent change from the prior period.

• Evaluation: Most recent 7-day period vs. prior 7-day period.
• Dimensions: Destination AWS Region
• Filters: Simple Traffic Profile = Inbound. Cloud Provider = AWS.
• Metric: Bits per second
• Data sources: All traffic

Identifies significant week-over-week changes to the top AWS Regions in the traffic outbound from your on-prem infrastructure. The conditions evaluated for major changes include traffic volume for one or more AWS Regions, the makeup of the top AWS Region set, and changes in AWS Region ranking. Metrics are provided for bitrate over the most recent 7-day period and percent change from the prior period.

• Evaluation: Most recent 7-day period vs. prior 7-day period.
• Dimensions: Destination AWS Region
• Filters: Cloud Provider = AWS. Traffic Profile = Inside to Cloud
• Metric: Bits per second
• Data sources: All traffic

Identifies significant week-over-week changes to the top AWS Regions in the traffic outbound from your AWS infrastructure. The conditions evaluated for major changes include traffic volume for one or more AWS Regions, the makeup of the top AWS Region set, and changes in AWS Region ranking. Metrics are provided for bitrate over the most recent 7-day period and percent change from the prior period.

• Evaluation: Most recent 7-day period vs. prior 7-day period.
• Dimensions: Source AWS Region
• Filters: Simple Traffic Profile = Outbound. Cloud Provider = AWS.
  Metric: Bits per second
• Data sources: All traffic

Identifies significant week-over-week changes to the top AWS Regions and AWS Subnets in the traffic outbound from your AWS infrastructure. The conditions evaluated for major changes include traffic volume for one or more AWS Regions and AWS Subnets, the makeup of the top AWS Regions and AWS Subnets set, and changes in AWS Regions and AWS Subnets ranking. Metrics are provided for bitrate over the most recent 7-day period and percent change from the prior period.

• Evaluation: Most recent 7-day period vs. prior 7-day period.
• Dimensions: Source AWS Region, Source AWS Subnet
• Filters: Simple Traffic Profile = Outbound. Cloud Provider = AWS.
  Metric: Bits per second
• Data sources: All traffic

Identifies significant week-over-week changes to the top AWS Regions pairs in the traffic outbound from your AWS infrastructure. The conditions evaluated for major changes include traffic volume for one or more AWS Regions pairs, the makeup of the top AWS Regions pairs set, and changes in AWS Regions pairs ranking. Metrics are provided for bitrate over the most recent 7-day period and percent change from the prior period.

• Evaluation: Most recent 7-day period vs. prior 7-day period.
• Dimensions: Source AWS Region, Destination AWS Region
• Filters: Simple Traffic Profile = Internal. Cloud Provider = AWS.
  Metric: Bits per second
• Data sources: All traffic

Identifies significant week-over-week changes to the top 10 applications in the traffic to and from your on-prem and cloud infrastructure. The conditions evaluated for major changes include traffic volume for one or more applications, the makeup of the top 10 application set, and changes in top 10 ranking. Metrics are provided for bitrate over the most recent 7-day period and percent change from the prior period.

• Evaluation: Most recent 7-day period vs. prior 7-day period.
• Dimensions: Application
• Filters: Traffic Profile = [Inside to Cloud, Cloud to Inside]
• Metric: Bits per second
• Data sources: All traffic

Identifies significant week-over-week changes to the top AWS Gateways in the traffic inbound to your on-prem (inside) infrastructure. The conditions evaluated for major changes include traffic volume for one or more AWS Gateways, the makeup of the top AWS Gateway set, and changes in AWS Gateway ranking. Metrics are provided for bitrate over the most recent 7-day period and percent change from the prior period.

• Evaluation: Most recent 7-day period vs. prior 7-day period.
• Dimensions: Gateway Type
• Filters: Traffic Profile = Cloud to Inside. Cloud Provider = AWS
• Metric: Bits per second
• Data sources: All traffic

Identifies significant week-over-week changes to the top AWS Gateways in the traffic inbound to your on-prem infrastructure. The conditions evaluated for major changes include traffic volume for one or more AWS Gateways, the makeup of the top AWS Gateway set, and changes in AWS Gateway ranking. Metrics are provided for bitrate over the most recent 7-day period and percent change from the prior period.

• Evaluation: Most recent 7-day period vs. prior 7-day period.
• Dimensions: Gateway Type
• Filters: Traffic Profile = Cloud to Outside. Cloud Provider = AWS
• Metric: Bits per second
• Data sources: All traffic

Identifies any use of an Internet Gateway for Cloud Internal traffic.

• Evaluation: Most recent 7-day period vs. prior 7-day period.
• Dimensions: Gateway Type
• Filters: Traffic Profile = Cloud Internal. Cloud Provider = AWS
• Metric: Bits per second
• Data sources: All traffic

Insights that call attention to possible problems on your network such as unexpectedly low or high traffic bitrates or flows per second.

This family includes the following insights:

Identifies a device whose current traffic volume is significantly higher than what's normal for that device.

• Evaluation: Most recent hour vs. same hour of the day for the last two weeks.
• Dimensions: Device
• Metric: Bits per second
• Data sources: All traffic

Identifies significant week-over-week changes to the flow count in the traffic data you are sending to Kentik.

• Evaluation: Most recent 7-day period vs. prior 7-day period.
• Dimensions: None
• Metric: Flow Count
• Data sources: All traffic

Identifies a device that typically sends Kentik more than 5 flows per second but is currently sending less than or equal to 5 fps.

• Evaluation: None
• Dimensions: None
• Metric: Flow Count
• Data sources: All traffic

Identifies a large number, significantly above normal, of TCP RST packets headed outbound from an individual Source IP address.

• Evaluation: Most recent hour vs. same hour of the day for the last two weeks.
• Dimensions: Source IP Address
• Filters: Source Network Boundary = Internal, Destination Network Boundary = External, Protocol = TCP, TCP Flags = RST.
• Metric: Flow count
• Data sources: All traffic

Identifies a large number, significantly above normal, of TCP RST packets headed outbound from all Source IP addresses.

• Evaluation: Most recent hour vs. same hour of the day for the last two weeks.
• Dimensions: Source IP Address
• Filters: Source Network Boundary = Internal, Destination Network Boundary = External, Protocol = TCP, TCP Flags = RST.
• Metric: Flow count
• Data sources: All traffic

Evaluates, once daily, the SNMP interface input bit rate, identifies sudden and sustained increases in interface utilization, and correlates the SNMP data with flow data for the same interface to determine the most likely cause of the increase.

• Evaluation: Interface utilization at any point during the last day vs. a percent of interface capacity.
• Dimensions: Interface
• Metric: Bits per second
• Data sources: All traffic

Evaluates, once daily, the SNMP interface input bit rate, identifies sudden and sustained decreases in interface utilization, and correlates the SNMP data with flow data for the same interface to determine the most likely cause of the decrease.

• Evaluation: Interface utilization at any point during the last day vs. a percent of interface capacity.
• Dimensions: Interface
• Metric: Bits per second
• Data sources: All traffic

Insights in the Protect family inform you about threats to network availability and security so that you can take action to defend your network.

This family includes the following insights:

Identifies significant day-over-day changes to the top 10 conversations to botnets in the traffic outbound from your infrastructure (on-prem and/or cloud). The conditions evaluated for major changes include traffic volume for one or more botnets, the makeup of the top 10 botnets set, and changes in top 10 ranking.

• Evaluation: Most recent 24-hour period vs. prior 24-hour period.
• Dimensions: Destination Botnet
• Filters: Simple Traffic Profile = Outbound
• Metric: Bits per second
• Data sources: All traffic

For insights in the Service Provider family, we evaluate traffic volume to, from, or in your service provider infrastructure and notify you of changes related to top-X rankings. The primary dimensions we evaluate are OTT related (e.g. a given OTT Service moving into or out of the top-10 services). The conditions evaluated for a given dimension include:

• Changes in individual or overall traffic volume.
• Changes in the composition of the top 10 set.
• Changes in top 10 ranking.

Note: For the insights in this family, the metrics displayed in the Statistics Pane (see Insight Details Page) include bitrate over the most recent 7-day period and percent change from the prior period.

This family includes the following insights:

Identifies significant week-over-week changes to the top 10 OTT Service Categories in the traffic entering your network. The conditions evaluated for major changes include traffic volume for one or more categories, the makeup of the top 10 ASN set, and changes in top 10 ranking. Metrics are provided for bitrate over the most recent 7-day period and percent change from the prior period.

• Evaluation: Most recent 7-day period vs. prior 7-day period.
• Dimensions: OTT Service Category
• Filters: Src Network Boundary = External or Src Connectivity Type = Embedded Cache
• Metric: Bits per second
• Data sources: All traffic

Identifies significant week-over-week changes to the top 10 OTT Services in the traffic entering your network. The conditions evaluated for major changes include traffic volume for one or more services, the makeup of the top 10 ASN set, and changes in top 10 ranking. Metrics are provided for bitrate over the most recent 7-day period and percent change from the prior period.

• Evaluation: Most recent 7-day period vs. prior 7-day period.
• Dimensions: OTT Service
• Filters: Src Network Boundary = External or Src Connectivity Type = Embedded Cache
• Metric: Bits per second
• Data sources: All traffic

The Synthetics family of insights analyzes the performance of specific Synthetic agents as well as the relationship between test latency and the hop count in the path between an agent and a target. Unlike flow-based insights, these insights don't appear in the Insights list on the Insights Page. Instead they are presented in the Test Control Center on the Insights tab of a Test Details Page or Subtest Details Page.

This family includes the following insights:

This insight analyzes tests that report increased latency and examines changes in the hop count between the source agent and the test target. Because longer latency is often correlated with an increase in the number of hops to the target, the chart in this insight shows the relationship between the test latency and the number of hops, which rapidly identifies a key factor that contributes to poor performance.

• Evaluation: Last two weeks vs. last 24 hours
• Dimensions: Latency, calculated distance, and the hop count in the test path
• Metrics: msecs, hop count, kilometers

This insight analyzes trends in test performance against the previous week, and highlights changes in performance over the last 24hrs. This can help highlight the direction of performance trends over time (degrading or improving).

• Evaluation: Previous week vs. latest 24 hours
• Dimensions: Latency, packet loss, variability
• Metrics: msecs, bits/sec

For insights in the Traffic family, we evaluate traffic volume to or from your infrastructure (on-prem and/or cloud) and notify you of changes related to top-X rankings. The dimensions we evaluate include applications, protocols, and ASNs (e.g. a given AS moving into or out of the top-10 ASes). The conditions evaluated for a given dimension include:

• Changes in individual or overall traffic volume.
• Changes in the composition of the top 10 set.
• Changes in top 10 ranking.

Note: For the insights in this family, the metrics displayed in the Statistics Pane (see Insight Details Page) include bitrate over the most recent 7-day period and percent change from the prior period.

This family includes the following insights:

Identifies significant week-over-week changes to the top 10 applications in the traffic inbound to your infrastructure (on-prem and/or cloud). The conditions evaluated for major changes include traffic volume for one or more applications, the makeup of the top 10 application set, and changes in top 10 ranking.

• Evaluation: Most recent 7-day period vs. prior 7-day period.
• Dimensions: Source Application
• Filters: Simple Traffic Profile = Inbound
• Metric: Bits per second
• Data sources: All traffic

Description: Identifies significant week-over-week changes to the top 10 applications in the traffic outbound from your infrastructure (on-prem and/or cloud). The conditions evaluated for major changes include traffic volume for one or more applications, the makeup of the top 10 application set, and changes in top 10 ranking.

• Evaluation: Most recent 7-day period vs. prior 7-day period.
• Dimensions: Destination Application
• Filters: Simple Traffic Profile = Outbound
• Metric: Bits per second
• Data sources: All traffic

Identifies significant week-over-week changes to the top 10 protocols in the traffic inbound to your infrastructure (on-prem and/or cloud). The conditions evaluated for major changes include traffic volume for one or more protocols, the makeup of the top 10 protocols set, and changes in top 10 ranking.

• Evaluation: Most recent 7-day period vs. prior 7-day period.
• Dimensions: Source Protocol
• Filters: Simple Traffic Profile = Inbound
• Metric: Bits per second
• Data sources: All traffic

Identifies significant week-over-week changes to the top 10 protocols in the traffic outbound from your infrastructure (on-prem and/or cloud). The conditions evaluated for major changes include traffic volume for one or more protocols, the makeup of the top 10 protocols set, and changes in top 10 ranking.

• Evaluation: Most recent 7-day period vs. prior 7-day period.
• Dimensions: Destination Protocol
• Filters: Simple Traffic Profile = Outbound
• Metric: Bits per second
• Data sources: All traffic

Identifies significant week-over-week changes to the top 10 ASNs in the traffic inbound to your infrastructure (on-prem and/or cloud). The conditions evaluated for major changes include traffic volume for one or more ASNs, the makeup of the top 10 ASN set, and changes in top 10 ranking.

• Evaluation: Most recent 7-day period vs. prior 7-day period.
• Dimensions: Source AS Number
• Filters: Simple Traffic Profile = Inbound
• Metric: Bits per second
• Data sources: All traffic

Identifies significant week-over-week changes to the top 10 ASNs in the traffic outbound from your infrastructure (on-prem and/or cloud). The conditions evaluated for major changes include traffic volume for one or more ASNs, the makeup of the top 10 ASN set, and changes in top 10 ranking.

• Evaluation: Most recent 7-day period vs. prior 7-day period.
• Dimensions: Destination AS Number
• Filters: Simple Traffic Profile = Outbound
• Metric: Bits per second
• Data sources: All traffic

Identifies significant bit rate changes to your total traffic.

• Evaluation: Most recent 24-hour period vs. prior 24-hour period.
• Dimensions: None
• Metric: Bits per second
• Data sources: All traffic

Identifies significant week-over-week changes to traffic inbound to a specific site.

• Evaluation: Most recent 7-day period vs. prior 7-day period.
• Dimensions: Site
• Filters: Simple Traffic Profile = Inbound
• Metric: Bits per second
• Data sources: All traffic

Identifies significant week-over-week changes to traffic outbound from a specific site.

• Evaluation: Most recent 7-day period vs. prior 7-day period.
• Dimensions: Site
• Filters: Simple Traffic Profile = Outbound
• Metric: Bits per second
• Data sources: All traffic

Identifies significant week-over-week changes to IPv6 traffic anywhere in your network.

• Evaluation: Most recent 7-day period vs. prior 7-day period.
• Dimensions: None
• Filters: Simple Traffic Profile = None
• Metric: Bits per second
• Data sources: All traffic