Overview

The overview is where a session starts. It answers one question at a glance: what is my network talking to right now, and is anything wrong?

The globe

A dark globe with your site as a single point and every active external connection as an arc from it, drawn in the direction of the data.

Element	Encodes
Arc thickness	Bytes
Arc colour	Live traffic — one colour, not a severity scale
Arc opacity	Raised by a high or critical incident on that path
Home point	Your configured site coordinates
Ring on an arc	A destination never seen before, held for ten seconds

The colour is worth a sentence, because it is a deliberate constraint rather than an oversight. Orange on the globe means “traffic is flowing”, not “this is bad”. A serious incident raises the opacity of an arc, never its hue, so the picture never turns into a threat-level map that is impossible to read at a glance.

Beside the globe sits a list of countries and networks with device counts and byte totals. Clicking an entry zooms the globe to it. The same Connections and countries sheet carries a Top destinations tile: the five largest external destinations of the window by bytes, with a link to the destinations page.

Only an address of class external is drawn or counted here. A broadcast or multicast group, a link-local or a private address is never an arc and never a country — see address classes.

The globe rotates slowly and stops on interaction. A quiet switch turns off rotation, particles and pulses entirely — for a wall display, or for a laptop without a GPU.

If the globe is empty

Three ordinary reasons, in order of likelihood:

1. No GeoIP databases. Without them the geo fields are null and the globe draws nothing, because it does not invent locations. See GeoIP.
2. No home coordinates. A tenant without configured coordinates has no origin to draw from.
3. No external traffic in the window. The default window is the last 15 minutes.

The incident rail

Down one side: the open incidents, sorted by score. Each card carries its title, severity, the affected devices, and a short summary. Clicking one opens the incident dialog without leaving the view, and the URL changes with it, so an incident is a link you can send to someone.

On a fresh installation this rail is empty on purpose. See the learning phase.

The data-state line

Always visible: how fresh the data is, and whether every source is delivering. It links into the system view.

This is not decoration either. A dashboard that looks the same whether or not it is receiving data is a dashboard that lies. If a source is stale, the overview says so before you draw any conclusion from what it is showing.

Bounds

The view is bounded so that it stays legible and cheap:

• at most 300 arcs on the globe, with the remainder aggregated per network,
• at most 500 nodes and 2,000 links in the network map,
• a total particle budget, above which small flows are drawn without particles.

When aggregation happens it is explicit in the data — a cluster node says how many members it stands for — rather than silently dropping the rest.

Updates arrive as deltas over a server-sent event stream: nodes and links are mutated rather than rebuilt, so the layout stays still while the data moves.

The URLs changed in 0.38

Since 0.38 every route and every query parameter of the dashboard is English. The old German paths redirect permanently (308, query string included) and old query parameters are rewritten once in the browser, so a bookmark or a shared link keeps working and points at the English form from then on — this is a migration path, not a permanent second vocabulary.

Old path	New path
/anmelden	/login
/lage	/overview
/geraete, /geraete/<id>	/devices, /devices/<id>
/ziele	/destinations
/suche	/search
/vorschlaege, /vorschlaege/<id>	/proposals, /proposals/<id>
/mandant	/tenant

Query parameters follow the same rule, for example ansicht=netz → view=network, fokus/fokusart=knoten → focus/focus_kind=node, szene=tabelle → scene=table, fenster → window, von/bis → from/to, land/protokoll/sortierung → country/proto/sort, typ/risiko/seit → type/risk/since, schwere/zeitraum → severity/in_window, sm → search_mode, art/ziel → kind/target. The full map is in the 0.38 release notes.