OTT Service Tracking

Kentik's OTT Service Tracking module is covered in the following topics:

• About OTT Service Tracking
• Enable OTT DNS Collection
• OTT Service Tracking Page
• OTT Overview Tab
• OTT Capacity Tab
• OTT Configuration Page
• Service Category Details
• Service Provider Details
• Service Details Pages

The following topics provide an introduction to Kentik's OTT Service Tracking:

• OTT Service Tracking Overview
• OTT Service Tracking Access
• Kentik OTT Engine
• OTT Service Tracking Metrics

The OTT Service Tracking workflow allows you to monitor traffic across different OTT service categories (e.g., video, gaming, social media), view top-X provider breakdowns, and explore detailed traffic for specific services and providers. This is crucial for engineering leaders and network strategists at eyeball ISPs to ensure reliable, efficient, and cost-effective content delivery to subscribers.

Using Kentik's OTT Service Tracking workflow requires the following:

• Enabling Access: Contact Customer Success (see Customer Care) to enable your organization to access OTT Service Tracking features.
• Deploying DNS Taps: Taps should be deployed on every possible DNS used by subscribers (see Enable OTT DNS Collection).
  - Taps can be deployed directly or via a DNS port span from the connected router using promiscuous mode.
  - Taps allow Kentik to map source and destination IPs against hostnames from the OTT service dictionary.
  - The more DNS coverage, the more accurate the OTT identification process

The OTT Service Tracking module, powered by Kentik's True Origin engine, identifies OTT traffic sources by evaluating and correlating traffic. It categorizes traffic into three dimensions: OTT Service Name, OTT Service Category (i.e., service type), and OTT Provider Name, extracting details for each.

Metrics in the OTT Service Tracking module vary by context:

• Capacity tab values (e.g., traffic bitrates) are based on SNMP OID Polling, showing maximum bitrates during the highest traffic time range (see Table Time-slicing).
• Other traffic values are derived from flow data (e.g., NetFlow), classified via DNS matching based on IPs (see OTT Classification Values and Using True Origin).

Using OTT Service Tracking requires a Kentik agent that taps into DNS traffic on your network and uses it to enrich flow data, allowing you to detect the OTT services being consumed by your subscribers.

The process for enabling OTT DNS collection is summarized as follows:

1. Deploy Kentik Universal agents on host machines in your network (see Deploy the Universal Agent).
2. Install and enable the DNS OTT Tap capability on each agent (see Agent Capabilities).

The OTT Service Tracking page includes the following main sections and controls:

• Breadcrumbs: Navigate back to higher levels within the Kentik portal.
• Share: Opens the Share dialog (see Sharing via the Share Dialog) for sharing options.
• Actions: Export visual reports (PDF) of the page’s content. A notification appears when the PDF is ready to download.
• Favorite: Add the page to Favorites in the portal search (see Portal Search Tabs).
• Configure: Access the OTT Service Tracking Configuration page (see OTT Configuration Page) for Thresholds (see OTT Thresholds Tab) and Advanced Filtering (see OTT Advanced Filtering Tab).
• Time Range: Select the duration for traffic information display (Last Day, Last Week, Last 2 Weeks, Last 30 Days).
• Display Area Tabs:
  - Overview (default): Shows OTT service traffic categories, providers, and services (see OTT Overview Tab).
  - Capacity: Displays interface utilization by OTT service category (see OTT Capacity Tab).

The Overview tab of the OTT Service Tracking page is covered in the following topics:

• OTT Overview UI
• Total OTT Traffic
• Top Categories List
• Top Providers List
• Top Services Table

The Overview tab of the OTT Service Tracking page includes:

• Total OTT Traffic pane: Provides a high-level view of OTT services on your network (see Total OTT Traffic).
• Top Categories list: Ranks OTT service categories by traffic volume over the selected time range (see Top Categories List).
• Top Providers list: Ranks OTT service providers by traffic volume over the selected time range (see Top Providers List).
• Top Services table: Lists services by traffic volume associated with incoming network traffic (see Top Services Table).

The Total OTT Traffic pane provides a high-level view of OTT services on your network, including:

• OTT engine: Details on the current state of the OTT engine, including the number of services, providers, categories, and the last update time.
• OTT bitrate: The maximum bitrate of all OTT traffic types during the selected time range.
• Bar chart: A visual breakdown of traffic classification (see OTT Classification Values), showing percentage and bitrate for each segment.

The Top Categories list displays your organization's top 8 OTT services categories by traffic bitrate (max reported by SNMP). Each row includes:

• Ranking: The position based on traffic bitrate.
• Expand/Collapse: Toggle to view the top X services in this category, including logo, name, and max SNMP-reported bitrate. Click a name for service details.
• Category: The name of the service category (e.g., video, gaming, social). Click for category details (see Service Category Details).
• Traffic volume: The max traffic volume for the category in the selected time range.
• Traffic trend: The percent change in traffic volume for the category during the time range.
• Traffic chart: A sparkline showing traffic volume fluctuations for the category during the time range.

The Top Providers list displays your organization’s top 8 OTT service providers, ranked by traffic bitrate. Each row includes:

• Ranking: The position based on traffic bitrate.
• Expand/Collapse: Toggle to view the top X services from the provider, including logo, name, and max SNMP-reported bitrate. Click a name for service details.
• Service Provider: The Service Provider name (e.g., Microsoft, Netflix). Click a name for provider details (see Service Provider Details).
• Traffic volume: The traffic volume transported by the provider.
• Traffic trend: The percent change in traffic volume over the time range.
• Traffic chart: A sparkline showing traffic fluctuations over the time range.
• Logo: The provider's logo.

The Top Services table ranks services by max SNMP-reported bitrate, showing traffic entering your network. You can filter using the Classification Types field.

The table includes the following columns:

• Traffic sparkline: The visual traffic volume over time, highlighting peak traffic events.
• OTT Service: The service name, clickable for details (see Service Details Pages). May be unknown based on classification.
• OTT Service Category: The service category (i.e., service type), clickable for details (see Service Category Details). Displays “unknown” if classified as Provider-only or Pending.
• OTT Service Provider: The provider of the service. If the service is classified as Pending, it displays as “unknown”. Click the provider name to view details (see Service Provider Details).
• Classification: The OTT classification by Kentik (see OTT Classification Values).
• Max Gbits/s: The highest traffic volume from the CDN during the interval.
• Max Unique Dst IPs: The highest count of unique destination IPs during the interval.
• Max Gbits/s per dst ip: The highest bitrate per IP during the interval.

Notes:
- Aggregation steps (intervals) vary with the selected time range (see OTT Service Tracking Page); longer ranges mean longer intervals.
- Click View in Data Explorer to open Data Explorer with pre-set controls.

The Classification column indicates how well Kentik has identified OTT Services, categorized as follows:

• Full: OTT Service Name, OTT Service Category, and OTT Provider Name are identified.
• Provider-only: Only the OTT Provider is identified, as multiple services share a hostname.
• Pending: High-traffic hostnames without a matching OTT service pattern, allowing True Origin to learn and classify more services.
• Unclassified: No identification of OTT Service Name, Type, or Provider due to lack of matching DNS or IP patterns.

The Classification Types field displays a lozenge for each selected OTT service classification types (see OTT Classification Values):

• If no types are selected, all classification types are listed.
• Click the field to select the type from the popup.
• Remove a type by clicking the X in its lozenge.

The Capacity tab on the OTT Service Tracking page displays the health (utilization vs. capacity) of interfaces carrying OTT-classified traffic (see OTT Classification Values). Key elements include:

• Hide healthy services: A switch at the top right:
  - On (default): Shows treemaps only for services with over 25% traffic from over-utilized interfaces.
  - Off: Displays treemaps for all OTT services.
• Service category panes: Each pane corresponds to an OTT service category (see OTT Service Category Panes).

Each pane includes the following UI elements:

• Category: The OTT service type. Click a name to view details (see Service Category Details).
• Health indicator: Lozenges show interface health status: green (Healthy), orange (Warning), or red (Critical).
• Service name: Lists individual services. Click a name for details (see Service Details Pages).
• Treemap: Diagrams for each service, showing interface usage and health status by area size and color.

Accessed via the Configure button on the OTT Service Tracking page, this page lets you set OTT thresholds and advanced filtering. Topics include:

• OTT Configuration Page UI
• OTT Thresholds Tab
• OTT Advanced Filtering Tab
• OTT Taps Tab

The OTT Service Tracking Configuration page includes the following UI elements:

• Breadcrumbs: Navigate your current location within the Kentik portal and return to higher levels by clicking a breadcrumb.
• Favorite: A star next to the page title to add this page to the Favorites tab in portal search (see Portal Search Tabs).
• Tabs: Three tabs for configuring OTT Service Tracking:
  - Thresholds: Set interface utilization thresholds (see OTT Thresholds Tab).
  - Advanced Filtering: Configure OTT workflow filtering (see OTT Advanced Filtering Tab).
  - OTT Taps: View agents with taps enabled, deploy new Universal Agents (see OTT Taps Tab).

The Thresholds tab lets you set utilization points for an interface, expressed as a percentage of its capacity, to trigger Warning or Critical statuses.

• Warning threshold (left slider): Sets the percentage above which utilization triggers a Warning status, shown in orange on the Capacity tab.
• Critical threshold (right slider): Sets the percentage above which utilization triggers a Critical status, shown in red on the Capacity tab.
• Save: Click to save changes; unsaved changes will be lost if you navigate away.

The OTT Tabs tab displays the list of agents with the DNS OTT Tap capability deployed in your organization and provides a button to launch the wizard to Deploy an OTT DNS Tap.

• Filter: Filters the agent list based on a text search.
• Deploy an OTT DNS Tap (button): Opens the wizard to deploy a Universal Agent with the DNS OTT Taps capability (see Deploy the Universal Agent).
• Agent List (table): Lists agents with the DNS OTT Taps capability enabled (if any) and includes the following columns:
  - Agent Status: The agent's status (e.g., "Up").
  - Name: The agent's name.
  - Agent Version: The agent's software version.

Note: You can also view and install new Universal Agents via Settings » Universal Agents, accessible from the portal's main nav menu.

Access the details page for a service category from the OTT Service Tracking page by clicking a category in the Top Categories List or the OTT Service Category column in the Top Services Table. This page provides detailed traffic information for that category coming to your network.

The service category details page includes these UI elements:

• Share: Opens the Share dialog to share the current view (see Sharing via the Share Dialog).
• Actions: Export a PDF report of visualizations and tables. A notification appears when the PDF is ready to download.
• Favorite: Add the page to Favorites in portal search (see Portal Search Tabs).
• Category Name: Displays the current category.
• Time Range: Select the duration for traffic data display (last day, last week, last 2 weeks, last 30 days).
• Services by Total Traffic: Shows top services' traffic info (see Top Category Services).
• Services by Max bits/s: Lists services by traffic bitrate (see Category Services by Bitrate).

The Top Services by Total Traffic pane includes the following elements:

• Total traffic: Displays the combined max bitrate of all OTT services in this category for selected time range.
• Traffic by service: A bar chart illustrating the max bitrate for each service in this category.
• View in Data Explorer: A button linking to Data Explorer with the same traffic data pre-set.

The Services by Max bits/s table lists services in this category transporting traffic to your network, with these columns:

• Sparkline: Visual traffic volume over the selected time range.
• OTT Service: The service name, linked to its details page (see Service Details Pages).
• OTT Provider: The provider name, linked to its details page (see Service Provider Details).
• Max: Maximum traffic bitrate for the service.
• Traffic by Connectivity Type: A breakdown of the max bitrate by connectivity type (e.g., Embedded, IX, Free Peering. See Understanding Connectivity Types).

Access a service provider's details page from the OTT Service Tracking landing page by clicking a provider in the Top Categories List or the OTT Service Provider column in the Top Services Table. This page offers detailed traffic information from that provider to your network.

The service category details page includes these UI elements:

• Share: Opens the Share dialog to share the current view (see Sharing via the Share Dialog).
• Actions: Export the page as a PDF report with visualizations and tables. A notification appears when the PDF is ready to download.
• Favorite: Star icon to add the page to Favorites in portal search (see Portal Search Tabs).
• Provider Name: Displays the provider's name.
• Time Range: A selector for traffic data duration (last day, last week, last 2 weeks, last 30 days).
• Top Services by Total Traffic:
  - Total traffic: Shows combined max bitrate for the provider's OTT services.
  - Traffic by service: Bar chart of max bitrate per service.
• Traffic by Connectivity Type: A bar chart with segments for each connectivity type (see Understanding Connectivity Types), showing percentage and volume.
• Traffic analytics: A Sankey diagram of traffic paths. Includes a button to view in Data Explorer with the same traffic data pre-set.
• Provider Services by Max bits/s: Lists the services from this provider that transport traffic to your network, sorted by maximum bitrate (see Provider Services by Bitrate).

The Provider Services by Max bits/s table lists the services from this provider that are transporting traffic to your network. The table includes the following columns:

• Sparkline: Visual traffic volume over the selected time range.
• OTT Service: The service name, linked to its details page (see Service Details Pages).
• OTT Service Category: The category name, linked to its details page (see Service Category Details).
• Max: Maximum traffic bitrate for the service.
• Traffic by Connectivity Type: A breakdown of max traffic bitrate for each service by connectivity type (e.g., Embedded, IX, Free Peering. See Understanding Connectivity Types).

The Details pages for individual OTT services are covered in the following topics:

• Service Details Access
• Service Details UI
• Service Details Overview
• Service Connectivity Details
• Service Subscribers Details
• Service Capacity Details
• Capacity Treemap
• Per-device Capacity

To access the details page for an individual OTT service from the OTT Service Tracking landing page, click the service name in any of these locations:

• OTT Service column of the Top Services Table
• Under an expanded provider in the Top Providers List
• Under an expanded category in the Top Categories List

The Details page for a service provides information for traffic entering your network from that service. Key UI elements include:

• Breadcrumbs: Navigate your location within the Kentik portal.
• Share: Opens the Share dialog (see Sharing via the Share Dialog).
• Actions: Export a PDF report of the page's visualizations and tables. A notification appears when the PDF is ready to download.
• Favorite: Star icon to add the page to Favorites in portal search (see Portal Search Tabs).
• Time Range: Select the duration for traffic data display (last day, last week, last 2 weeks, last 30 days).
• Service Details tabs: Four tabs with service information (see Service Detail Tabs).

Service information is organized into four tabs:

• Overview: Basic traffic info and service comparison context (see Service Details Overview).
• Connectivity: How traffic reaches your network (see Service Connectivity Details).
• Subscribers: Unique destination IPs consuming traffic (see Service Subscribers Details).
• Capacity: Interface utilization and health (see Service Capacity Details).

The Overview tab of the details page for individual services includes:

• Category: Indicates service type (e.g., video, gaming, social).
• Provider: Shows the OTT service provider's name.
• Logo: Displays the service or provider's logo.
• Total Inbound + Embedded: The max bitrate (SNMP) for the selected time range.
• Offload: The percentage of traffic from embedded caches at peak volume.
• Traffic by Connectivity Type: A bar chart showing traffic breakdown by connectivity type at peak volume (see Understanding Connectivity Types).
• Rankings: Compares peak traffic volume:
  - Service by volume: Rank among all OTT services.
  - Service in category: Rank within the same category.
  - Service delivered by provider: Rank among services from the same provider.

The Connectivity tab of a service details page includes:

• Traffic by Connectivity Type: A bar chart showing connectivity types (see Understanding Connectivity Types), each labeled with type, traffic percentage, and volume at peak traffic time.
• Breakdown: A tabbed chart displaying traffic from various perspectives (see Service Traffic Breakdown).
• Digital Supply Chain: A Sankey diagram illustrating the traffic path from source AS to your network.

The tabbed Breakdown chart displays service traffic from these perspectives:

• Source CDN: The commercial CDN name from the source IP (see About Provider Classification).
• Connectivity: The type of traffic connectivity (see Connectivity Type Attribute).
• Providers: The internet connection provider (see About Provider Classification).
• Sites: Network sites with devices/interfaces handling the traffic (see Sites).

Use the View in Data Explorer button to explore the same traffic in Data Explorer.

The Subscribers tab on the service details page includes the Overall Subscribership and Performance Analysis panes. When measuring subscribership for an OTT service, Kentik's True Origin engine uses the Max Unique Count of Destination IPs as a proxy for subscriber IPs (see Metrics from All Devices).

This pane provides details on unique destination IPs consuming traffic for this service, featuring:

• Compare with Category leader: A checkbox to include (default) or exclude traffic from the category's top service. Not shown if this service is the leader.
• Show total Category traffic: A checkbox used to either include (default) or exclude a plot of total category traffic.
• Daily Subscribers: The average daily unique destination IPs receiving content, with percent change.
• Avg Performance Per Subscriber: The average bitrate divided by unique destination IPs over the selected time range.
• Subscribers chart: Displays unique destination IP counts over time. May include category leader and total category counts based on checkbox settings. Hover for specific counts.
• Ranking list: The service's rank by subscriber counts within its category. Click to view service details.

This pane displays bitrate breakdowns per subscriber for an OTT service over a selected time range, featuring:

• Breakdown by: Choose analysis type (single-level or dual-level) for charting.
• Swap levels: Swap chart levels (e.g., "Site then Provider" to "Provider then Site") for dual-level charts.
• Aggregate on: Select aggregation method (Average, 95th Percentile, or Maximum) for bitrate calculation.
• Charts:
  - Single-level: One chart per selected subject (e.g., Site, Provider).
  - Dual-level: Individual charts for top-level entities with plots for lower-level entities.
• View in Data Explorer: Opens Data Explorer with the same traffic settings.

Notes:
- Bitrates are calculated per subscriber WAN IP, counting multiple subscribers in the same household as one.
- The Avg/95p/Max bitrates in charts reflect those in Data Explorer for each unique destination IP, excluding IPs for embedded caches, with traffic filtered to Network Boundary = External OR Connectivity Type = Embedded Cache.

The Capacity tab on service details page includes:

• Capacity treemap: Displays a treemap where each area represents an interface used by the service (see Capacity Treemap).
• Per device capacity analysis: Shows panes for each device, detailing interface utilization for the service (see Per-device Capacity).

The treemap illustrates interfaces through which users consume service-related traffic. For services using multiple interfaces, each block's size indicates its traffic volume share (max bitrate for the selected time range). Block colors reflect interface health based on thresholds set in the OTT Thresholds Tab.

Hovering over a treemap block reveals a popup with:

• Device name: The name of the device. Click to view Core Details (see Core Details Pages).
• Site: The network site of the device (see Sites).
• Bitrate: The max traffic bitrate for the selected time range.
• Interface name: The name of the interface. Click to view Core Details (see Core Details Pages).
• Interface description: SNMP-based description, labeled "Inherited from physical" if derived.
• Connectivity type: The traffic connectivity type (see Connectivity Type Attribute).
• Provider: The internet connection provider (see About Provider Classification).
• Utilization chart: A peak utilization meter as a percent of capacity.

The Per-device Capacity Analysis pane includes a section for each device handling traffic for the service, featuring:

• Device name: The name of the device. Click to expand and reveal the device's interfaces.
• Bar chart: Displays interfaces grouped by health status (Healthy = green, Warning = orange, Critical = red), based on overall utilization. Segment length reflects the traffic volume for the service.
• Traffic volume: Shows the peak bitrate for the service during the selected time range.
• Interfaces: An expandable list of interfaces carrying traffic for the service (see Service Interfaces List).

The table lists interfaces carrying service traffic, with each expandable row containing:

• Expand/Collapse: Toggle to show/hide Interface Traffic Charts.
• Bitrate: The max bitrate for the service for the selected time range.
• Interface name: The name of the interface.
• Interface description: The SNMP-based description, or "Inherited from physical" if derived.
• Connectivity type: The type of the service traffic connectivity (see Understanding Connectivity Types).
• Provider: The internet connection provider (see About Provider Classification).
• Utilization chart: A meter showing peak utilization, traffic volume, and capacity.

In the Service Interfaces List, use the expand/collapse toggle to show/hide line charts for each interface. These charts display:

• Interface Traffic & Capacity: Total traffic on the interface for the selected time range.
• Subscribers: The number of unique destination IPs for the service on this interface.
• AVG Mbps / unique subscriber: The bitrate of service-related traffic divided by the number of unique destination IPs during the time range.