Network map and replay
Where the globe shows the outside, the network map shows the inside: which devices exist, which of them are talking, and through what.
The map
Section titled “The map”Devices are grouped into a cloud per VLAN, with the position stable across loads — the layout comes from a seed per VLAN, so the map you learn is the map you come back to. That single property is the difference between a diagram you can build a mental model of and a picture that reshuffles every time.
| Element | Encodes |
|---|---|
| Node size | Bytes in the last hour |
| Edge | A flow in the last 60 seconds — nothing older draws an edge |
| Particle rate on an edge | Packet rate |
| Particle direction | Data direction |
| Outer shell | External destinations, grouped by network, labelled with country |
| Centre node | The firewall, because every inter-VLAN flow physically goes through it |
Navigation is an orbit camera: scroll to zoom, double-click a cluster to enter it. Focus dims rather than hides — everything outside the current focus stays visible as a ghost, so you never lose the context of where you are looking.
Following one device
Section titled “Following one device”Click a device and the camera moves to it and circles slowly; the rest of the graph dims and the particles on its edges brighten. Click one of its edges and a side panel lists the flows of that relationship: services, bytes, first and last seen.
For an external flow the panel shows the path — device, VLAN gateway, firewall, uplink, destination network and country — with the evidence for each hop attached. That is the useful form of “what is this device doing”: not a number, but the chain of observations that produced it.
There is a follow mode that keeps the camera on a device and fades in new edges as they appear.
Replay
Section titled “Replay”A time slider along the bottom, with a freely chosen range and playback from 1× to 60×. It applies to the globe and the map equally.
The graph rebuilds from the flows in the window: arcs grow and vanish with the flows, and incidents appear at the moment they were raised. Every incident has a play action that sets the window and the focus device for you, which is usually the fastest way to understand one.
Replay is reconstructed from durable evidence, not from a cached animation. Two consequences:
- The maximum graph window is 24 hours, and the maximum flow-list window is 31 days. Those are bounds on a query, not on your retention.
- Replaying a window never changes anything. It does not delete an existing incident just because a replay produced no new evaluation.
Reconnecting
Section titled “Reconnecting”The live stream is cursor-based. If your browser loses the connection, it resumes from its last event and the server rebuilds the intervening changes from durable telemetry — including the removals that happened while you were disconnected, which is the part a naive reconnect gets wrong.
If the gap is too large, the stream says so explicitly and the client fetches a fresh snapshot. A routine stream lease expiring simply ends the stream, and the client reconnects: it is not reported as lost state.