OTT Service Tracking

The OTT Service Tracking workflow is covered in the following topics:

• About OTT Service Tracking
• OTT Service Tracking Page
• OTT Overview Tab
• OTT Capacity Tab
• Service Category Details
• Service Provider Details
• Service Details Pages

A high-level look at Kentik's OTT Service Tracking module is provided in the following topics:

• OTT Service Tracking Overview
• Kentik OTT Engine
• OTT Service Tracking Metrics
• OTT Service Tracking Access

The OTT Service Tracking workflow enables you to track traffic for the various categories of OTT services reaching your subscribers (video, gaming, social media, etc.), to see top-X breakdowns of OTT providers in each category, and to drill down into traffic details for individual services and providers. These capabilities are vital for engineering leaders and network strategists at eyeball ISPs as they work to plan and maintain reliable, performant, and cost-effective transport of content to their subscribers.

The OTT Service Tracking workflow is enabled by True Origin, Kentik's OTT service tracking engine, which evaluates and correlates traffic to identify sources of OTT traffic coming to your network via OTT services. The traffic is broken down by three OTT dimensions (OTT Service Name, OTT Service Type, and OTT Provider Name) and details are extracted for each detected instance of each dimensions type (i.e. for each service, each service type, and each service provider).

The source of the metrics presented in the OTT Service Tracking module varies depending on the context in which the metrics are presented:

• The values (e.g. traffic bitrates) exposed in the Capacity tabs of the OTT module are based on SNMP OID Polling and (unless otherwise stated) represent maximum bitrates (not average or 95 percentile), meaning the bitrate during the time-slice (see Table Time-slicing) with the highest volume of traffic during the currently selected time range.
• All other traffic values are based on flow data (e.g. NetFlow) from flow records that are classified (see OTT Classification Values) by matching to DNS based on source/destination IPs (see Using True Origin).

Access to OTT Service Tracking depends on the edition and plans in your organization's Kentik license (see About Licenses). If the module isn't included in your Kentik license you'll see a notification that the workflow is not enabled for your account. To enable access to the module, contact Customer Support.

The OTT Service Tracking page includes the following main sections and controls:

• Configure Thresholds: A button that opens the Configure Thresholds Dialog, enabling you to set the percent of interface utilization that will cause capacity to be in Warning or Critical state.
• Time Range: A selector at the top right from which you choose the duration, back from the present, for which traffic information is calculated and displayed (last day, last week, last 2 weeks, last month).
• Share: A drop-down menu with two options for sharing the information on this page:
  - Download as PDF: Export a PDF of the current state of the page. Kentik will prepare the report and display a notification indicating that the report is ready. When you click the provided link your browser will handle the download to your local machine.
  - Email Report: Opens an Email Report dialog in which you provide the name and email address of a recipient, as well as a subject line and a message for the email itself. Once you've entered the requested information, click the Send button to send the email.
• Tab heads: Two tab heads, one for each tab of the page (click to switch tabs):
  - Overview (default): Information about the categories, providers, and services that make up the OTT service traffic on your organization's network over a user-specified time range (see OTT Overview Tab).
  - Capacity: Information, by OTT service category, about the utilization (in relation to capacity) of the interfaces on the devices on your organization's network that handle traffic related to OTT services (see OTT Capacity Tab).

The Configure Thresholds dialog enables you to set the points at which utilization for a given interface, expressed as a percent of that interface's capacity (SNMP derived), will be considered elevated to a status of Warning or Critical. A dual-slider control sets the following:

• Warning threshold (left slider): The percent of capacity above which traffic volume will trigger a status of Warning. Interfaces above the Warning threshold (but below the Critical threshold) will be indicated in orange on the Capacity tab.
• Critical threshold (right slider): The percent of capacity above which traffic volume will trigger a status of Critical. Interfaces above the Critical threshold will be indicated in red on the Capacity tab.

The Overview tab of the OTT Service Tracking page is covered in the following topics:

• OTT Overview UI
• Total OTT Traffic
• Top Categories List
• Top Providers List
• Top Services Table

The Overview tab of the OTT Service Tracking page includes the following main sections and controls:

• Total OTT Traffic pane: A high-level view of the OTT services used on your network (see Total OTT Traffic).
• Top Categories list: A table listing OTT service categories ranked by their traffic volume on your network over the selected time range. Each row provides information about an OTT Service Type represented in your traffic (see Top Categories List).
• Top Providers list: A table listing OTT service providers ranked by their traffic volume on your network over the selected time range. Each row provides information about an OTT Service Provider represented in your traffic (see Top Providers List).
• Top Services table: A list, in order of per-service traffic volume, of the services associated with the traffic coming into your network (see Top Services Table).

The Total OTT Traffic pane, which gives a high-level view of the OTT services provided via your network, includes the following elements:

• OTT engine: Information about the current state of our OTT engine, including:
  - Number of services;
  - Number of providers;
  - Number of categories;
  - Last OTT engine update.
• OTT bitrate: The maximum bitrate, based on flow data, of all types of OTT traffic over your network during the currently selected time range.
• Bar chart: A visual breakdown based on the extent to which Kentik was able to classify your traffic (identify OTT dimensions) according to the classifications in OTT Classification Values. Each segment is labeled with the percent it represents of the total traffic as well as its bitrate.

The Top Categories list is a table listing your organization's top-8 categories (service types) of OTT services, ordered by traffic bitrate (max reported by SNMP). Each table row presents the following information for each category:

• Ranking: The position, based on traffic bitrate, of this category in your organization's ranking of OTT service categories.
• Expand/Collapse: Toggles the visibility of a table listing the top-X services whose service type matches this category. The table includes the service logo, name, and max SNMP-reported bitrate during the currently selected time range. Click a name to go to the details page for that provider.
• Service Type: The name of the service type, e.g. video, gaming, social, etc. Click the type to go to a details page for that category (see Service Details Pages).
• Traffic volume: The maximum volume of traffic matching the service type over the time range.
• Traffic trend: The percent change in traffic volume for this service type over the time range.
• Traffic chart: A sparkline chart illustrating fluctuations over the time range in your volume of traffic matching this service type.

The Top Providers list is a table listing your organization's top-8 providers of OTT services, ordered by traffic bitrate. Each table row presents the following information for each provider:

• Ranking: The position, based on traffic bitrate, of this provider in your organization's ranking of OTT service providers.
• Expand/Collapse: Toggles the visibility of a table listing the top-X services from this provider. The table includes the service logo, name, and max SNMP-reported bitrate during the currently selected time range. Click a name to go to the details page for that service.
• Service Provider: The name of the Service Provider, e.g. Microsoft, Netflix, Google, Sony, etc. Click the name to go to a details page for that provider (see Service Provider Details).
• Traffic volume: The volume of traffic transported to your network by the service provider.
• Traffic trend: The percent change in traffic volume for this service provider over the time range.
• Traffic chart: A sparkline chart illustrating fluctuations over the time range in your volume of traffic matching this service provider.
• Logo: The logo of this provider.

The Top Services table lists, in order of max SNMP-reported bitrate, the services associated with the traffic coming into your network. The table may be filtered using the Classification Types drop-down (see OTT Classification Values).

The columns of the table provide the following types of information:

• Traffic sparkline: A visual representation of traffic volume for the service over the time range, so you can quickly scan for peaks indicating traffic events.
• OTT Service: The name of the service, which may or may not be known depending on the classification. Click the name to go to a details page for that service (see Service Details Pages).
• OTT Service Type: If the service is classified as Provider-only or Pending then unknown; otherwise the type (category) of the service. Click the name to go to a details page for that service type (see Service Category Details).
• OTT Service Provider: If the service is classified as Pending then unknown; otherwise the provider of the service. Click the name to go to a details page for that provider (see Service Provider Details).
• Classification: The OTT classification of the service by the Kentik engine (see OTT Classification Values).
• Max Gbits/s: The traffic volume from the CDN via this service during the interval (aggregation step; see Time Rounding) with the highest traffic volume.
• Max Unique Dst IPs: The number of unique destination IPs via this service during the interval (aggregation step) with the highest count of destination IPs.
• Max Mbits/s per dst ip: Calculated by computing the bitrate per IP for each interval (aggregation step) and comparing to find the highest result.

Note: The intervals (aggregation steps) used to calculate the above maximum values vary depending on the currently selected time range (see OTT Service Tracking Page), with a longer time range resulting in longer intervals.

The Classification column shows the extent to which Kentik has been able to classify the OTT Service Name, OTT Service Type, and OTT Provider Name (represented in KDE as Application Context and Security dimensions). The state of this classification for a given service is indicated with the following values:

• Full: We identified OTT Service Name, OTT Service Type, and OTT Provider Name.
• Provider-only: Only the OTT Provider can be identified with certainty, because the provider simultaneously offers multiple OTT services under a single hostname to the same subscriber destination IP from the same server.
• Pending: Assigned to hostnames that generate a lot of traffic but for which we haven’t yet been able to establish a matching pattern for an OTT service. Bucketing these hostnames separately enables True Origin to continue evaluating this traffic for patterns, which enables the engine to learn to capture more and more OTT services.
• Unknown: We were unable to identify OTT Service Name, Type, or Provider because no match was found between DNS queries/responses, hostname patterns, and flow source/destination IPs.

The Capacity tab of the OTT Service Tracking page shows you the health (utilization vs. capacity) of the interfaces over which your network carries the traffic that Kentik has classified as OTT (see OTT Classification Values). The tab is structured as a series of panes that each corresponding to an OTT service type. Each pane includes the following UI elements:

• Category (service type): The type of OTT service detailed in this pane. Click the category name to go to a details page for that category (see Service Category Details).
• Health indicator: One lozenge for each health status found in the interfaces carrying traffic that is classified as belonging to this service category. Each lozenge indicates the number of interfaces whose status corresponds to the color of the lozenge: green for Healthy, orange for Warning, or red for Critical.
• Treemap: One treemap diagram for each individual service in the category. The individual areas within each treemap represent the interfaces used for that service. If a service uses more than one interface the size of the areas in its treemap will represent the relative volume (max bitrate during the currently selected time range) of the traffic for that service that is going over the various interfaces. The color of each interface's area corresponds to the interface's health as defined by the thresholds specified with the Configure Thresholds Dialog.
  Note: Click the heading for a treemap to go to the details page for that service (see Service Details Pages).

In its default state the panes of the Capacity tab show treemaps only for those services in which greater than 25% of traffic is coming from over-utilized interfaces. To show treemaps for all services, switch off the Hide healthy services switch.

The details page for an individual service type provides detailed information about the traffic of that service type coming to your network. The UI for these pages includes the following elements:

• Time Range: See OTT Service Tracking Page.
• Share: See OTT Service Tracking Page.
• Top Services by Traffic: Information about traffic on the top OTT services matched by the Kentik OTT engine to this service category:
  - Total traffic: The combined maximum bitrate, during the currently selected time range, of all of this category's OTT services.
  - Traffic by service: A horizontal bar chart showing the maximum bitrate of each of this category's services.
• Services: A table listing the services of this service category that are transporting traffic to your network. The columns of the table provide the following information:
  - Sparkline: A visual representation of traffic volume for the service over the currently selected time range.
  - Service: The name of the service. The name is a link to a details page for that service (see Service Details Pages).
  - Provider: The name of the provider of the service. The name is a link to a details page for that provider (see Service Provider Details).
  - Max: The max traffic bitrate for the service.
  - Traffic by Connectivity Type: A breakdown of the max traffic bitrate for each service by connectivity type (see Connectivity Type Attribute).

The details page for an individual OTT service provider shows detailed information about the OTT traffic on the services coming to your network from that provider. The UI for these pages includes the following elements:

• Time Range: See OTT Service Tracking Page.
• Share: See OTT Service Tracking Page.
• Top Services: Information about traffic on the top OTT services matched by the Kentik OTT engine to this provider:
  - Total traffic: The combined maximum bitrate, during the currently selected time range, of all of this provider's OTT services.
  - Traffic by service: A horizontal bar chart showing the maximum bitrate of each of this provider's services.
• Traffic by Connectivity Type: A breakdown (bar chart) by connectivity type of your traffic from this provider (see Connectivity Type Attribute), measured at the time of peak traffic volume within the currently selected time range.
• Traffic analytics: A Sankey diagram detailing the paths by which the traffic attributed to this OTT service provider is reaching your network.
• Services: A table listing the services provided by this OTT service provider that are transporting traffic to your network. The columns of the table provide the following information:
  - Sparkline: A visual representation of traffic volume for the service over the currently selected time range.
  - Service: The name of the service. The name is a link to a details page for that service (see Service Details Pages).
  - Service Type: The name of the category of the service. The name is a link to a details page for that category (see Service Category Details).
  - Max: The max traffic bitrate for the service.
  - Traffic by Connectivity Type: A breakdown of the max traffic bitrate for each service by connectivity type (see Connectivity Type Attribute).

The details pages for individual OTT services are covered in the following topics:

• Service Details UI
• Service Details Overview
• Service Connectivity Details
• Service Subscribers Details
• Service Capacity Details
• Capacity Treemap
• Per-device Capacity

The details page for an individual service provides detailed information about the traffic coming to your network from that service. The UI for these pages includes the following elements:

• Time Range: See OTT Service Tracking Page.
• Share: See OTT Service Tracking Page.
• Service details tabs: The information about the service is presented on the following four tabs:
  - Overview: Basic information about the traffic plus information that provides context on how this service compares with others (see Service Details Overview).
  - Connectivity: Details about how the traffic for this service reaches your network (see Service Connectivity Details).
  - Subscribers: Details on the unique destination IPs consuming traffic related to this service (see Service Subscribers Details).
  - Capacity: Details about the utilization and health of the interfaces via which the traffic for this service comes into your network (see Service Capacity Details).

The Overview tab of the details page for individual services includes the following main UI elements:

• Type: An indicator showing the category of the service (Video, Gaming, Social, etc.).
• Provider: An indicator showing the name of the OTT service provider that provides this service.
• Logo: The logo of the service or the service's provider.
• Total Inbound + Embedded: The max bitrate (SNMP) during the currently selected time range.
• Offload: The percentage of this service's traffic that comes from embedded caches, measured at the time of peak traffic volume within the time range.
• Traffic by Connectivity Type: A breakdown (bar chart) by connectivity type of your traffic for this service (see Connectivity Type Attribute), measured at the time of peak traffic volume within the currently selected time range.
• Rankings: How the peak traffic volume of this service compares to that of other services:
  - Service by volume: How this service compares overall to your other OTT services.
  - Service in category: How this service compares to other services within the same service category.
  - Service by provider: How this service compares to other services provided by the same OTT service provider.

The Connectivity tab of the details page for individual services includes the following main UI elements:

• Traffic by Connectivity Type: A breakdown (bar chart) by connectivity type of your traffic for this service (see Connectivity Type Attribute), measured at the time of peak traffic volume within the currently selected time range.
• Breakdown: A tabbed chart that shows the traffic for this service from the following perspectives:
  - Source CDN: The commercial name of a CDN used by this service, which is derived from the source IP of traffic attributed to the service (see About Provider Classification).
  - Connectivity: The connectivity type of the traffic for this service (see Connectivity Type Attribute).
  - Providers: The provider via which the interfaces with traffic from this service connect to the Internet (see About Provider Classification).
  - Sites: The sites in your organization's network in which there are devices/interfaces handling traffic from this service (see Manage Sites).
• Digital Supply Chain: A Sankey diagram illustrating the path via which traffic for this service comes from its source AS to your network.

The Subscribers tab of the details page for individual services includes the two panes covered in the topics below. When measuring subscribership for a given OTT service, Kentik's True Origin engine uses the metric Max Unique Count of Destination IPs (computed from flow data; see Metrics from All Devices) as a proxy for subscriber IPs.

This pane, which presents information related to the unique destination IPs consuming traffic related to this service, includes following controls and displays:

• Compare with Category leader: A checkbox used to modify the Traffic chart to either include (default) or exclude traffic from the service in the same category as this service that has the highest traffic volume.
  Note: Not present if this service is the category leader.
• Show total category traffic: A checkbox used to either include (default) or exclude a plot on the chart that represents the total traffic volume for this category.
• Daily Subscribers: The average number of unique destination IP addresses per day to which content for the service was delivered during the currently selected time range, plus the percent change in that number.
• Avg Performance Per Subscriber: The total average bitrate over the currently selected time range divided by the number of unique destination IP addresses to which content for the service was delivered during that time range.
• Subscribers chart: A chart showing the count of unique destination IPs that consumed traffic related to this service over the currently selected time range. Depending on the settings of the checkboxes above, the subscriber counts for the category leader and for the category as a whole may also be plotted. Hover over the chart at any point in the time range to see the count at that time.
• Ranking: The position, based on subscriber count, of this service compared to other OTT services in the same category.

This pane, which shows various breakdowns of the bitrate per subscriber for this OTT service over the selected time range, includes following controls and displays:

• Breakdown by: A drop-down from which you select the analysis that will be charted. The resulting charts may be single-level or dual-level (see Charts below).
• Swap levels (arrows icon): This button, shown only when the Breakdown by setting calls for dual-level charting, allows you to swap levels (e.g. switch from "Site then Provider" to "Provider then Site").
• Aggregate on: A drop-down from which you select the aggregation (max, 95th percentile, or average) used to calculate the bitrate for the time slices in the currently selected time range.
• Charts: One or more line charts (depending on the Breakdown by setting) showing the bitrate per subscriber over the currently selected time range:
  - Single-level chart: If Breakdown by is set to a single-level value (Site, Provider, or Connectivity Type) there will be a single chart with a plot for each instance of the selected chart subject (e.g. for each site when the setting is Site).
  - Dual-level charts: If Breakdown by is set to a dual-level value (e.g. "Site then Provider") then there will be an individual chart for each of the top-level entities (e.g. each site) on which the lines for the lower-level entities (e.g. providers) are plotted.

Notes:
- Bitrates are per subscriber WAN IP (computed from flow data), so multiple subscribers within the same household will be counted as one.
- The Avg/95p/Max bitrates shown in the charts are the bitrates one would see in Data Explorer for each unique destination IP (exclusive of IPs for embedded caches) on traffic filtered to include only Network Boundary = External OR Connectivity Type = Embedded Cache.

The Capacity tab of the details page for individual services includes the following main UI elements:

• Capacity treemap: A treemap diagram for the service in which the individual areas each represent an interface used for that service (see Capacity Treemap).
• Per device capacity analysis: A series of panes, one for each device, that provide information about the utilization of the interfaces on the device that carry traffic for this service (see Per-device Capacity).

The capacity treemap represents the interfaces via which users in your organization's network consume traffic related to a given service. If a service uses more than one interface the size of the areas in its treemap will represent the relative volume (max bitrate during the currently selected time range) of the traffic for that service that is going over the various interfaces. The color of each interface's area corresponds to the interface's health as defined by the thresholds specified with the Configure Thresholds Dialog (see Capacity Treemap).

Upon hover over a block in the treemap a popup will appear with the following information:

• Device name: The name of the device on which the interface exists.
• Site: The site in your organization's network in which the interface's device is located (see Manage Sites).
• Bitrate: The max bitrate (during the currently selected time range) of the traffic for this service on this interface.
• Interface name: The name of the interface.
• Interface description: The description (from SNMP unless edited within Kentik) of the interface.
  Note: If the description for a logical interface has been derived from a parent interface it will be labeled "Inherited from physical."
• Connectivity type: The connectivity type of the traffic for this service (see Connectivity Type Attribute).
• Provider: The provider via which the interface connects to the Internet (see About Provider Classification).
• Utilization chart: A meter showing the peak utilization of this interface (all traffic) as a percent of capacity.

The Per-device Capacity Analysis section includes a pane for each device that handles traffic for this service. Each device pane includes the following UI elements:

• Device name: The name of the device on which the interface exists. Click the name to expand the pane, revealing a list of the device's interfaces.
• Bar chart: A horizontal bar in which the interfaces on this device are grouped into color-coded segments that each represent a status (Healthy = green, Warning = orange, Critical = red). The length of each segment represents the combined volume of traffic related to this service on the interfaces with the corresponding status.
• Traffic volume: The peak bitrate during the currently selected time range of traffic on this device related to the service.
• Interfaces: A list of the interfaces on this device that carry traffic related to this service (see Service Interfaces List).

A device's list of interfaces carrying traffic for a given service includes the following UI elements for each interface:

• Expand/Collapse: Click to toggle the visibility of the Interface Traffic Charts.
• Bitrate: The max bitrate (during the currently selected time range) of the traffic for this service on this interface.
• Interface name: The name of the interface.
• Interface description: The description (from SNMP unless edited within Kentik) of the interface.
  Note: If the description for a logical interface has been derived from a parent interface it will be labeled "Inherited from physical."
• Connectivity type: The connectivity type of the traffic for this service (see Connectivity Type Attribute).
• Provider: The provider via which the interface connects to the Internet (see About Provider Classification).
• Utilization chart: A meter showing the peak utilization of this interface (all traffic) as a percent of capacity.

The visibility of the interface traffic charts is controlled by the expand/collapse toggle in the Service Interfaces List. The charts show different breakdowns of traffic on the interface over the currently selected time range:

• Interface Traffic & Capacity: A plot of the entire traffic of the interface (not just the service-related traffic) over the currently selected time range.
• Subscribers: A plot of the number of unique destination IPs for the service found in the traffic on this interface.
• AVG Mbps / unique subscriber: A plot of the bitrate of service-related traffic on this interface over the currently selected time range divided by the number of unique destination IP addresses to which content for the service was delivered during the time range.