Skip to main content

Observability User Guide

4.6. Protocols workflow

This drill-down workflow is designed to analyze network performance by utilizing both well-known protocols and your custom protocols configured using analytics labels. It includes eleven dashboards organized across four hierarchical levels, drilling down from the Protocols Overview dashboard to the more detailed Troubleshooting dashboards. Dashboards in this workflow can traverse up, down, and across to switch views and perspectives on the same data set. Zoom out by using the browser's back button or navigate laterally to dashboards with the same level of detail but from different perspectives, such as endpoints, monitoring points, or services. To learn more, see Navigate the workflows.Navigate the workflows

The following diagram gives you an overview of the different dashboards and their hierarchical relationship:

explore_protocols_workflow_diagram_noshadow.png

The following information summarizes each level of the workflow:

Protocols Overview

The Protocols Overview is the top level of the Explore Protocols workflow. Here, all of your protocols that have been active for the last 24 hours are listed.

Using a time-series database, metrics such as throughput, network latency, server latency, client latency, connections, and the percentage of connection failures for each protocol are visualized and analyzed in real-time. The default metric displayed on the graph is throughput.

Level 1

The Level 1 dashboard is designed to help determine whether performance issues exist for an individual protocol. It compares metrics across various aspects of each protocol, such as monitoring points, endpoints, and services. The default metric displayed on the graph is throughput.

Metrics for throughput, network latency, server latency, client latency, connections, and the percentage of connection failures are displayed.

One variable for Resolution is available at the top of the dashboard. To learn more about this variable, see Dashboard variables.

Level 1 dashboards include:

  • Protocol by Monitoring Points

  • Protocol by Endpoints

  • Protocol by Services

  • Monitoring Point by Protocols in the Monitoring Points workflow

  • Service by Protocols in the Service Latency workflow

Level 2

Level 2 dashboards help isolate the part of the network that is having a problem. You select a specific protocol and examine metrics at a distinct monitoring point, endpoint, or service associated with that protocol. The default metrics displayed on the graph are throughput Tx and throughput Rx.

Metrics for throughput Tx, throughput Rx, network latency, server latency, client latency, failure % - inbound connections, inbound connections, failure % - outbound connections, and outbound connections are displayed.

One variable for Resolution is available at the top of the dashboard. To learn more about this variable, see Dashboard variables.

Level 2 dashboards include:

  • Protocol and Monitoring Point by Endpoints

  • Protocol and Endpoint by Monitoring Points

  • Protocol and Service by Endpoints

Level 3

The Level 3 dashboard, Troubleshooting Protocols (Endpoint Summary), is used to troubleshoot issues for a protocol at specific endpoints. If the IP address is known, you can start troubleshooting directly from this dashboard. As a starting point, it provides various metrics such as throughput Tx, throughput Rx, packets Tx, packets Rx, bytes Tx, bytes Rx, maximum flows Tx, maximum flows Rx, and server or client latency. The default metric displayed on the graph is throughput Tx. Additional metrics are grouped to help troubleshoot different types of observed issues. To learn more, see Metrics for advanced analysis.

Five variables are available at the top of the dashboard: Endpoint, IP Protocol, Protocol, cStor, and Resolution. To learn more about these variables, see Dashboard variables.

PCAP files can be downloaded for a particular endpoint from the cStor Download tag or a specified range using the cPacket Capture panel. To learn more, see Capture packet data.

Level 4

The Level 4 dashboard, Troubleshooting Protocols (Endpoint Conversations), is utilized for advanced and targeted analysis of a specific data point or narrow time range. An on-demand fetch of the analytics is always required using the cPacket Analytics panel. To learn more, see On-demand analytics collection.

Seven variables are available at the top of the dashboard: Endpoint, Peer, IP Protocol, Protocol, cStor, Resolution, and Include Excluded Services. To learn more about these variables, see Dashboard variables.

See Level 3 for metric and packet capture information.

In this section:

A protocol is the combination of TCP or UDP and a port number used to identify a specific application, also known as a network application. For example, DNS uses port 53, and HTTPS uses port 443. To define protocols, use the Protocols analytics label in the cClear UI.

An endpoint is a server, client, or peer as identified by a unique IP address.

A monitoring point is the location in the network where the monitoring stack captures packets, typically a TAP, SPAN port, or remote SPAN such as ERSPAN, VXLAN, or GRE tunnel. Each monitoring point is uniquely identified by a combination of a cStor and a packet brokering port, such as 'Hoboken FW1 External'. Sources for this identifier include VLANs, cVu ports, or GENEVE VNI. To define monitoring points, use the Monitoring Points analytics label in the cClear UI.

A service is a user-defined group of endpoints and, optionally, specific ports that have a singular purpose in the network. This grouping can also be used to define subsets of the network that are managed by specific teams or groups, enabling clear ownership and responsibility.  To define Services, use the Services analytics label in the cClear UI.

The total data in bits per second transmitted or received by the endpoint or application calculated over the resolution of the dashboard.

Network latency is the response time as measured between the client’s initial connection request (SYN packet) and the server’s response (SYN-ACK packet), as observed by the monitoring point.

Server latency is the round-trip time between the client sending a TCP packet and the server acknowledging the packet, as observed by the monitoring point.

Client latency is the round-trip time between the server sending a TCP packet and the client acknowledging the packet as observed by the monitoring point.

The total number of connections that have successfully completed a three-way TCP handshake (SYN-SYNACK-ACK).

A TCP connection error is any failure in establishing, maintaining, or closing a TCP connection.

The total data in bits per second transmitted by the endpoint or application calculated over the resolution of the dashboard.

The total data in bits per second received by the endpoint or application calculated over the resolution of the dashboard.

The percentage of inbound connection attempts that failed to complete a three-way TCP handshake (SYN-SYNACK-ACK) where the host is a server.

The total number of inbound connections that have successfully completed a three-way TCP handshake (SYN-SYNACK-ACK) where the host is a server.

The percentage of outbound connection attempts that failed to complete a three-way TCP handshake (SYN-SYNACK-ACK) where the host is a client.

The total number of outbound connections that have successfully completed a three-way TCP handshake (SYN-SYNACK-ACK) where the host is a client.

The total number of packets an endpoint or application transmitted.

The total number of packets an endpoint or application received.

The total number of bytes an endpoint or application transmitted.

The total number of bytes an endpoint or application received.

The maximum number of transmitted flows by a host as observed by a monitoring point.

The maximum number of received flows by a host as observed by a monitoring point.