IOTA Network Probe

Where the Overview dashboard shows who is talking to whom, the Application Overview dashboard shows what they are talking about. The data in this dashboard is categorized by application type, and by application. The graph can be changed to display latency, flow count, and payload size. This dashboard is a great starting point when analyzing application issues. It gives a clear overview of which components may be slowing your applications down. It can also help finding unexpected services, and services consuming too much bandwidth.

Provides an overview of recorded VoIP sessions, with the possibility to dig down on SIP and RTP metrics and details. The VoIP Sessions table provides a complete view of detected sessions with cross-correlation between control and data traffic. From this table, selecting a specific VoIP session is possible, allowing inspection of session-specific details in the various dashboard sections. The call flow is visualized in VoIP and SIP flow diagrams, to help get a better overview of the call details. The dashboard also provides MOS scores for a quick indication of call quality.

This dashboard provides an overview of HTTP traffic, to help monitor HTTP application traffic, distinguish between different return codes, see each different flow, and filter on them.

The Local Assets dashboard lists speaking interfaces present in the local network, based on the canonical private IP address ranges (RFC 1918 & RFC 4193). It helps to keep track of devices in the local network, and also unveil potentially unwanted devices. The bandwidth usage for the selected time range and filters is displayed on a chart. The DHCP host names of devices are displayed whenever possible. Clicking an IP address in the list navigates to the Host Details dashboard for that address.

The Modbus Overview dashboard displays Modbus protocol message distribution over time, allowing you to troubleshoot industrial networks which contain Modbus traffic. The servers and clients that are part of the Modbus network are listed in a table.

This dashboard provides an overview of TLS-encrypted connections and whether they are considered safe, weak, or unsafe, based on the TLS version and cipher used. Connection information can be sorted and filtered to visualize and identify potentially problematic connections.

This dashboard gives an overview of TCP-related statistics, such as client IP, server IP, host names, iRTT, and more, such as an analysis of TCP connection completeness. Various graphs are available, providing different perspectives on the TCP traffic and offering full diagnostics of the TCP protocol. You can easily filter on common TCP-related attributes via the filter menu. Color coding of TCP analysis states helps give an at-a-glance view of the data transmission process.

The DNS overview dashboard gives you an overview of DNS queries over time, top servers, and top queries by type. This dashboard helps troubleshooting starting from a specific domain and then following the associated flows. This gives a general idea of how your queries are spread out over time.

The Host Details dashboard is available every time an IP address is clicked. This dashboard provides a deep-dive into network activity specific to the filtered IP, and all the metrics you can use to analyze network issues based on geolocation, TCP data, protocol and application information, and flows.

The Flow Details dashboard is accessible by clicking the Inspect (🔍) button on any of the flow tables located in various dashboards. This visualization is useful for inspecting the details of one specific traffic flow. The top-right diagram will display the different protocol headers used in the communication and their main fields. On the left side, there are more in-depth details on packets exchanged inside the communication flow. The dashboard also provides traffic metrics like total payload, bandwidth usage, and the number of packets.

When a capture & analysis session is started, it will appear in this dashboard. This makes it easy to review or go back to an earlier session instantly. It’s also possible to find different analysis sessions by time. A “session” represents a self-standing correlation domain. A timeout determines whether captured and analyzed data is still part of the current session, or if it belongs in a new session.