Observability User Guide

The total number of bytes an endpoint or application received.

The total number of bytes an endpoint or application transmitted.

A client is an endpoint that initiates the TCP connection by sending a SYN packet.

Client latency is the round-trip time between the server sending a TCP packet and the client acknowledging the packet as observed by the monitoring point.

A TCP connection error is any failure in establishing, maintaining, or closing a TCP connection.

The total number of connections that have successfully completed a three-way TCP handshake (SYN-SYNACK-ACK).

The number of packets received by an endpoint with the same sequence number as a previously received packet.

The number of packets transmitted by an endpoint with the same sequence number as a previously transmitted packet.

An endpoint is a server, client, or peer as identified by a unique IP address.

The percentage of inbound connection attempts that failed to complete a three-way TCP handshake (SYN-SYNACK-ACK) where the host is a server.

The percentage of outbound connection attempts that failed to complete a three-way TCP handshake (SYN-SYNACK-ACK) where the host is a client.

The total number of FIN packets received for the specific endpoint or application.

The total number of FIN packets transmitted for the specific endpoint or application.

The number of missing packets with gaps in the TCP sequence numbers that are observed between two consecutive packets received by an endpoint.

The number of missing packets with gaps in the TCP sequence numbers that are observed between two consecutive packets transmitted by an endpoint.

A host refers to the endpoint, such as a server or client, that serves as the reference point for analysis. It clarifies the direction in which a specific metric is observed. Every connection goes from the host to the peer. Terminologies like Transmit (Tx), Receive (Rx), outbound, and inbound are always interpreted from the host's perspective. For instance, an outbound connection refers to the host sending data, while an inbound connection means the host is receiving data.

The total number of inbound connections that have successfully completed a three-way TCP handshake (SYN-SYNACK-ACK) where the host is a server.

The maximum number of TCP sessions that are currently open where the host is a server.

A session where the host, acting as a server, does not successfully receive any data. A connection was established, but no data transfer occurred during the session.

A location is a user-defined group of endpoints that identify a physical location within your network topology. Locations can be nested, where one location is entirely contained within another, such as a data center rack, a hospital floor, or a specific building within a campus.  To define Locations, use the Locations analytics label in the cClear UI.

The maximum number of received flows by a host as observed by a monitoring point.

The maximum number of transmitted flows by a host as observed by a monitoring point.

ZWins are the number of TCP packets with a window size of zero, indicating that the server has reached its maximum capacity to process data. This is a signal for the peer to pause or stop sending data until the server has sufficient memory or resources to process the incoming data.

The number of SYNACK packets received by the endpoint where the corresponding initial SYN packet is missing or not detected.

The number of SYN packets transmitted by the endpoint where the corresponding SYNACK packet is not received.

A monitoring point is the location in the network where the monitoring stack captures packets, typically a TAP, SPAN port, or remote SPAN such as ERSPAN, VXLAN, or GRE tunnel. Each monitoring point is uniquely identified by a combination of a cStor and a packet brokering port, such as 'Hoboken FW1 External'. Sources for this identifier include VLANs, cVu ports, or GENEVE VNI. To define monitoring points, use the Monitoring Points analytics label in the cClear UI.

Network latency is the response time as measured between the client’s initial connection request (SYN packet) and the server’s response (SYN-ACK packet), as observed by the monitoring point.

The total number of outbound connections that have successfully completed a three-way TCP handshake (SYN-SYNACK-ACK) where the host is a client.

The maximum number of TCP sessions that are currently open where the host is a client.

A session where the host, acting as a client, does not successfully transmit any data. A connection was established, but no data transfer occurred during the session.

The total number of packets an endpoint or application received.

The total number of packets an endpoint or application transmitted.

A peer is a collection of endpoints on the other end of a monitoring point from the entity being monitored, such as a client or server.

Peer client latency is the round trip time between the server sending a TCP packet and the client acknowledging the packet as observed by the monitoring point.

Peer network latency is the response time as measured between the client’s initial connection request (SYN packet) and the peer server’s response (SYN-ACK packet) as observed by the monitoring point.

Peer server latency is the round-trip time between the client sending a TCP packet and the peer server acknowledging the packet as observed by the monitoring point.

A protocol is the combination of TCP or UDP and a port number used to identify a specific application, also known as a network application. For example, DNS uses port 53, and HTTPS uses port 443. To define protocols, use the Protocols analytics label in the cClear UI.

The number of reset (RST) packets received for the specific endpoint or application.

The number of reset (RST) packets transmitted for the specific endpoint or application.

The total number of packets received with a lower than expected sequence number, indicating the packet is a retransmission of a previously sent packet.

The total number of packets transmitted with a lower than expected sequence number, indicating the packet is a retransmission of a previously sent packet.

A server is an endpoint that receives a SYN packet from a client and responds with a SYN-ACK packet.

Server latency is the round-trip time between the client sending a TCP packet and the server acknowledging the packet, as observed by the monitoring point.

A service is a user-defined group of endpoints and, optionally, specific ports that have a singular purpose in the network. This grouping can also be used to define subsets of the network that are managed by specific teams or groups, enabling clear ownership and responsibility.  To define Services, use the Services analytics label in the cClear UI.

The total number of SYN-ACK packets received for the specific endpoint or application where the host is a client.

The total number of SYN-ACK packets transmitted for the specific endpoint or application where the host is a server.

The number of attempted connections to the endpoint that failed to complete the three-way TCP handshake (SYN-SYNACK-ACK).

The number of connections the endpoint attempted to establish that failed to complete the three-way TCP handshake (SYN-SYNACK-ACK).

The total number of SYN packets received for the specific endpoint or application where the host is a server.

The total number of SYN packets transmitted for the specific endpoint or application where the host is a client.

Tags are indexed key-value pairs in the InfluxDB data structure that record metadata. They are used in the dashboard table to categorize and filter data.

The total data in bits per second transmitted or received by the endpoint or application calculated over the resolution of the dashboard.

The total data in bits per second received by the endpoint or application calculated over the resolution of the dashboard.

The total data in bits per second transmitted by the endpoint or application calculated over the resolution of the dashboard.

The number of TCP packets the host has received with a window size of zero from the peer. This indicates that the peer has reached its maximum capacity and cannot process more incoming data. This is a signal for the host to pause or stop sending data until the peer has sufficient memory or resources to process the incoming data.

The number of TCP packets the host has transmitted with a window size of zero. This indicates the host has reached its maximum capacity and cannot process more incoming data. This is a signal for the peer to pause or stop sending data until the host has sufficient memory or resources to process the incoming data.