Skip to content

Network map and replay

Where the globe shows the outside, the network map shows the inside: which devices exist, which of them are talking, and through what.

Devices are grouped into a cloud per VLAN, with the position stable across loads — the layout comes from a seed per VLAN, so the map you learn is the map you come back to. That single property is the difference between a diagram you can build a mental model of and a picture that reshuffles every time.

Element Encodes
Node size Bytes in the last hour
Edge A flow in the last 60 seconds — nothing older draws an edge
Particle rate on an edge Packet rate
Particle direction Data direction
Outer shell External destinations, grouped by network, labelled with country
Centre node The firewall, because every inter-VLAN flow physically goes through it

Navigation is an orbit camera: scroll to zoom, double-click a cluster to enter it. Focus dims rather than hides — everything outside the current focus stays visible as a ghost, so you never lose the context of where you are looking.

Click a device and the camera moves to it and circles slowly; the rest of the graph dims and the particles on its edges brighten. Click one of its edges and a side panel lists the flows of that relationship: services, bytes, first and last seen.

For an external flow the panel shows the path — device, VLAN gateway, firewall, uplink, destination network and country — with the evidence for each hop attached. That is the useful form of “what is this device doing”: not a number, but the chain of observations that produced it.

There is a follow mode that keeps the camera on a device and fades in new edges as they appear.

A time slider along the bottom, with a freely chosen range and playback from 1× to 60×. It applies to the globe and the map equally.

The graph rebuilds from the flows in the window: arcs grow and vanish with the flows, and incidents appear at the moment they were raised. Every incident has a play action that sets the window and the focus device for you, which is usually the fastest way to understand one.

Replay is reconstructed from durable evidence, not from a cached animation. Two consequences:

  • The maximum graph window is 24 hours, and the maximum flow-list window is 31 days. Those are bounds on a query, not on your retention.
  • Replaying a window never changes anything. It does not delete an existing incident just because a replay produced no new evaluation.

The live stream is cursor-based. If your browser loses the connection, it resumes from its last event and the server rebuilds the intervening changes from durable telemetry — including the removals that happened while you were disconnected, which is the part a naive reconnect gets wrong.

If the gap is too large, the stream says so explicitly and the client fetches a fresh snapshot. A routine stream lease expiring simply ends the stream, and the client reconnects: it is not reported as lost state.