Network map and replay
Where the globe shows the outside, the network map shows the inside: which devices exist, which of them are talking, and through what.
The map
Section titled “The map”Devices are grouped into a cloud per VLAN, with the position stable across loads — the layout comes from a seed per VLAN, so the map you learn is the map you come back to. That single property is the difference between a diagram you can build a mental model of and a picture that reshuffles every time.
| Element | Encodes |
|---|---|
| Node size | Bytes in the last hour |
| Edge | A flow in the last 60 seconds — nothing older draws an edge |
| Particle rate on an edge | Packet rate |
| Particle direction | Data direction |
| Outer shell | External destinations, grouped by network, labelled with country |
| Centre node | The firewall, because every inter-VLAN flow physically goes through it |
Navigation is an orbit camera: scroll to zoom, double-click a cluster to enter it. Focus dims rather than hides — everything outside the current focus stays visible as a ghost, so you never lose the context of where you are looking.
Local noise
Section titled “Local noise”Broadcast, multicast and link-local traffic — DHCP renewals, mDNS and SSDP discovery, IGMP, OSPF — is not a conversation with a peer, so the map does not draw it as one. Those groups are hidden by default; the Show local noise switch in the layer card draws them as one grouped node per class, with the number of hidden nodes in brackets. The outer shell of external destinations never contains them, whatever the switch says. See address classes.
Following one device
Section titled “Following one device”Click a device and the camera moves to it and circles slowly; the rest of the graph dims and the particles on its edges brighten. Click one of its edges and a side panel lists the flows of that relationship: services, bytes, first and last seen.
For an external flow the panel shows the path — device, VLAN gateway, firewall, uplink, destination network and country — with the evidence for each hop attached. That is the useful form of “what is this device doing”: not a number, but the chain of observations that produced it.
There is a follow mode that keeps the camera on a device and fades in new edges as they appear.
Replay
Section titled “Replay”A time slider along the bottom, with a freely chosen range and playback from 1× to 60×. It applies to the globe and the map equally.
The graph rebuilds from the flows in the window: arcs grow and vanish with the flows, and incidents appear at the moment they were raised. Every incident has a play action that sets the window and the focus device for you, which is usually the fastest way to understand one.
Replay is reconstructed from durable evidence, not from a cached animation. Two consequences:
- The maximum graph window is 24 hours, and the maximum flow-list window is 31 days. Those are bounds on a query, not on your retention.
- Replaying a window never changes anything. It does not delete an existing incident just because a replay produced no new evaluation.
Reconnecting
Section titled “Reconnecting”The live stream is cursor-based. If your browser loses the connection, it resumes from its last event and the server rebuilds the intervening changes from durable telemetry — including the removals that happened while you were disconnected, which is the part a naive reconnect gets wrong.
If the gap is too large, the stream says so explicitly and the client fetches a fresh snapshot. A routine stream lease expiring simply ends the stream, and the client reconnects: it is not reported as lost state.