The Circles page displays traffic flowing between different parts of the network.
Topics:
- How is the circles chart constructed?
- How do I navigate the network hierarchy?
- How do I select the information displayed on the chart?
- How do I display information on items in the chart?
- How do I create a filter to select specific flows?
See Also:
How is the circles chart constructed?
This representation of traffic flows shows end-host addresses as black dots, arranged into circles according to the Cluster setting. The top traffic flows between these addresses is shown as lines, where the thickness of the line indicates the traffic volume, and the color indicates the procotol.
How do I navigate the network hierarchy?
The Filter bar at the top of the screen provides a way to navigate through the network hierarchy (see File>Configure to see how to group network devices). At the top level, a list of Zones is shown, once you have selected a zone, the view will drill down to only show information from the selected zone, and a list of Groups will appear. Select a group and the view will drill down to only show the information from the selected group and a list of Agents will appear. Finally if you select an agent, its Interfaces will be shown. Click on the links at any level in the path and you will move back up the tree to that level. Click on the Show Map button to view a map of the selected part of the network (see Sentinel:Maps>Layer 2). If a single agent has been selected an Agent Details button will appear. Click on the button to see detailed information about the agent (see Sentinel:Search>Agent/Interface). Finally, if a single interface is selected an Explore button will appear. Click on the button to see long term trends for the interface (see Sentinel:Report>Explore).
How do I select the information displayed in the chart?
The following Filter settings are available:
- Host This button allows you to select traffic for a selected address. Any address that has been clicked on or entered on the Sentinel:Search>Host page during this session will be offered in the list. If you want to filter on an address that is not in the list, navigate to the Sentinel:Search>Host page, enter the address, and then come back to this page afterwards.
- Protocol This button allows you to add a filter to show only traffic for a selected protocol. Any protocol that has been clicked on or entered on the Sentinel:Search>Protocol page during this session will be offered in the list. If you want to filter on a protocol that is not in the list, navigate to the Sentinel:Search>Protocol page, enter the protocol, and then come back to this page afterwards. Some common protocol filters are always included here for convenience.
- Cluster This option controls the way hosts are grouped into circles.
- Label This option is used to automatically label elements within the chart.
- Units This option controls the width scaling of the lines in the chart, either scaling by Frames/second or Bits/second.
- Date select a date, Today will track most recent data.
- Time selects the hour at the start of the Interval, Now will track most recent data.
- Interval select the number of minutes of data to display. The interval starts from the specified Time, or if Time is set to Now displays an interval going back from the current minute.
- Where is used for custom filtering of the flows (see How do I create a filter to select specific flows?).
How do I display information on items in the chart?
- Single-click on a node, cluster (white box) or flow to show it's identifying label.
- To zoom in, use mouse wheel or click right-button and select Zoom In menu option.
- To zoom out again, use mouse wheel or click right-button and select Zoom Out menu option.
- To pan, hold down left-button and drag mouse.
- To drill down and search on a node or flow, double-click on it (or on it's label).
- To drill down and search on a protocol, double-click on its legend item at the top.
How do I create a filter to select specific flows?
The Where box is used to filter traffic queries so that only selected traffic is shown. A filter expression can be entered directly into the input box. Clicking on the OK button applies the filter. Clicking on the Clear button will remove the filter.
An easier way to construct filters is to click on the Edit button to display additional inputs used to construct the filter expression. The first input consists of a selection box containing attributes that can be compared, a selection box containing comparison operators and an input area to specify that values to be compared to the selected attribute. Clicking the Add button appends the comparison to the current filter. There are also boolean operator buttons (& and |) and bracket buttons that can be used to combine comparison expressions to form more complex filters. The filter builder only enables buttons and inputs when they are allowed in the filter expression that is being constructed. Once the desired filter has been constructed, click on the OK button to apply it.
Note: If you just want to filter on a Host or Protocol then it is easier to set the Host and Protocol filters, rather than constructing a Where filter.
A basic filter expression consists of the name of an attribute, an operator and a set of comma separated values. The allowed operators are:
- = equals
- != not equals
- ~ matches a reqular expression
- !~ does not match a regular expression
Expressions can be combined using brackets and the boolean operators:
- & boolean AND
- | boolean OR
The following examples illustrate typical where filters:
- ipsource = 10.1.1.23
- ipdestination != 10.0.0.0/24,10.0.1.0/24
- serverport = TCP:80,TCP:81,TCP:8080-8088
- sourcezone ~ research.*
- ipsource = 10.0.0.1 & ipdestination = 10.0.0.2
- ipsource = 10.0.0.1 & (sourceport = TCP:80 | destinationport = TCP:80)
- sourcezone = EXTERNAL | destinationzone = EXTERNAL
Note: The special zone EXTERNAL refers to addresses that aren't contained in any of the CIDRs specified using File > Configure.
WARNING Care should be taken if a value in a filter expression contains any of the following special characters: (, ), &, |, !, =, ~, ",', \, comma or space. If the value contains any of these characters then the whole value string can be enclosed in single or double quotes, or the special characters can be individually escaped with a \. The following examples show different ways of using the value "Research & Development" in filters:
- serverzone = "Research & Development", Sales
- clientzone = 'Research & Development'
- sourcezone = Research\ \&\ Development
- serverpath = ">>Research & Development>Data Center"
Note: Special characters typically occur because they are used in Zone or Group names when configuring Traffic Sentinel (see File>Configure). Care should be taken when filtering on zone, group or path attributes.