Real-Time Visual Analytics – Part 1: Network Mapping

What Are “Real-Time Visual Analytics”?

With this post, we kick off a 3-part series in which we explore real-time visual analytics with ad hoc troubleshooting as a primary use case. But, before we go too far, a fair question would be – “what do we mean by real-time visual analytics?”. We use this terminology in reference to network analytic data that is immediately accessible in “real-time” and presented in a graphical, “visual” format intended to accelerate analysis, decision-making and troubleshooting. In this series of three posts, we look at end-user networking mapping, the Graphic Workbench feature of NetSpyGlass and NetSpyGlass’s integration with Grafana. We get things started in this Part 1 post with a look at network mapping.

Types of Maps

One of the first things we’ll want to address is to define the types of maps that can be created with NetSpyGlass. At a very high level, these maps fall into the following (2) broad categories:

• network maps created with Python scripts by admin users
• network maps created with graphical user interface (GUI) tools by non-admin users

Network Maps Generated by Python Script

Maps created with Python scripts will be the topic of a future standalone blog post due to the scope of the subject matter involved. For this post, however, an important takeaway is that script-generated maps support creating a hierarchical view of network topology (if desired) with the ability to “drill down” into successively more detailed views of network topology. This “drill down” capability is achieved by having scripts construct maps where the highest level view of the map contains graphical elements (or icons) that each represents a complete map of specific parts of the network topology. These kinds of maps enable any user to vertically and horizontally navigate complex hierarchical network topologies with ease. Although NetSpyGlass users with administrative permissions create these kinds of maps, once created they are available for use by any user.

A key benefit of maps generated by Python scripts is the degree of automation they enable. Once the script has been created, map generation can be programmatically triggered by events or according to a preset schedule. A particularly valuable workflow is to use scripts to algorithmically recognize elements that have been added to the network since the script was created and to automatically incorporate those new elements into the map’s graphical display. The powerful automation capabilities of scripting complement the ad hoc and instant gratification of maps created manually using the NetSpyGlass GUI which we discuss in the following section.

Network Maps Generated by GUI

Conversely, maps created by (non-admin) end-users using tools available within the NetSpyGlass graphical user interface (GUI) are not hierarchical. Instead, these types of maps provide immediate access to network elements such as devices, interfaces and connections. These maps are quick and easy to create right within the NetSpyGlass GUI in a browser. These types of maps are well-suited for situations where the user wants to investigate a specific network element, interface or connection, or any specific grouping of network elements in real-time.

One of the key benefits of these types of maps is the ad hoc, real-time and dynamic troubleshooting workflows that they enable. Maps can be created instantly within any part of the network topology and then saved for later use, shared with other users or discarded if not needed anymore. Users are provided with powerful tagging, filtering, and selection criteria that enable very precise targeting of network elements for detailed analysis. Our focus for the remainder of this post will be on these GUI-generated maps, beginning in the next section with an overview of how to create them with NetSpyGlass.

Building a New Map Using NetSpyGlass’s Map Editor (GUI)

As shown in the adjacent figure, the NetSpyGlass user interface hosts a number of buttons along the left side of the interface that (when clicked) take the user to the workspace corresponding to the button label.

Clicking the “Maps” button takes the user to the Maps Workspace where they can then open the NetSpyGlass Map Editor to begin building a new map. Clicking the “Edit Map” button opens the Map Editor dialog box. The real heavy lifting when creating a new map takes place in the Map Editor dialog box. It is here that the user defines the map they want to create by applying filter criteria to:

• Devices: names, addresses, tags
• Interfaces: names, tags

Network devices and interfaces that match the filter settings can be previewed without closing the Map Editor dialog box by simply clicking the “Preview” button in the lower right corner of the dialog box.

The Map Editor – A Closer Look

Although very clean and simple in appearance, the Map Editor enables users to very easily create network maps that are simple and specific or maps of arbitrary high complexity. As shown in the adjacent figure, Tags that are applied to Devices and Interfaces during network discovery are readily available as filter criteria in the Map Editor. Regular expressions can be used in Device Name and Interface Name fields for a very precise selection of network elements to include (or exclude) from the map.

The Map Editor applies a logical ‘AND’ operator to the Device and Interface parameters entered as filter criteria. This is in addition to the logical ‘AND’ and logical ‘OR’ operators which can be applied to an unlimited number of Device and Interface Tags. The adjacent figure, for example, illustrates the application of a logical ‘AND’ operator to Device Tags – “Role” and “Metro”. The Map Editor also lets the user know the number of devices found in the network that match the filter settings. In addition to selecting network elements to build the map, the Editor also enables users to easily include in the map devices that are “Connecting” or “Adjacent” to devices satisfying the filter criteria. Once the user is satisfied with the map, they can give it a name and save it.

Using the Map After Building It

Once a map has been created, it can be used for network planning, performance monitoring, troubleshooting and much more. We’ll take a very brief look at just a few of the ways to use a map once created.

Applying Filters to an Existing Map
With just a click, NetSpyGlass users can access the Map Filter which hosts a dialog box similar to the Map Editor discussed above. Refer to the adjacent figure for a basic overview of the steps involved.

Map Layout Management
The map layout manager enables users to optimize the visual presentation of the map. “Auto Layout” triggers an algorithm to seek optimal placement of network elements. See the adjacent figure.

Overlay Monitoring Data Directly on a Map
Overlaying monitoring data directly on a network map enables users to “see” the data in the context of the network. Any monitoring data in the system can be displayed. Again, see the adjacent figure for an overview of this feature..

Map Ownership and Sharing

When users create maps with NetSpyGlass’s Map Editor, the map “belongs” to that user and no other user is given automatic access to it. This means that only the user who created the map is able to view it with the sole exception of users with administrative permissions who are able to see all maps in the system. However, users who are authors of maps can very easily share their maps with other NetSpyGlass users by clicking the button to the immediate left of the “Map Edit” button inside the Maps Workspace.

In the Map Tiles view (shown in the adjacent figure), each tile is a thumbnail of a map. If a map has been shared, then it will have a small button highlighted to show its share status on its thumbnail as shown in the adjacent figure. This button appears on the map thumbnail as the user mouse hovers over each tile. Note that users with administrator permissions can view all maps of all users and can delete them as well as change their share status.

 

Map Ownership and Sharing

Summary

This post provides a “gentle” introduction to real-time visual analytics beginning with the network mapping features, tools and capabilities of the NetSpyGlass platform. The focus here was on using the Map Editor resident in the NetSpyGlass graphical user interface to build network maps. And, the most important takeaway is the ease and simplicity with which NetSpyGlass end users can create network maps and then immediately use them to obtain complete and detailed insight into what is actually happening in the network in real-time. Maps can be created in a matter of minutes with the ability to target any part of the network topology with powerful filtering applied to device names, addresses and tags as well as interface names and tags. Once created, a network map can be used for detailed analytic tasks by applying filters and by overlaying monitoring data directly onto the map. Maps can be shared among NetSpyGlass users and are automatically updated as changes occur in the network topology. In a future post, we will explore the historical mapping features available to NetSpyGlass users that provide a detailed chronological view of network state over any chosen time period.

Coming Up Next – Part 2: Graphic Workbench

In our next (Part 2) post, we take a look at the Graphic Workbench feature of NetSpyGlass which is also accessible from the GUI. What is most noteworthy about Graphic Workbench is that as a data browsing tool it enables users to construct simple and specific or quite detailed and complex queries. We will explore the various use cases for Graphic Workbench as a browsing and presentation tool for monitoring data.