Online Reports Module

Purpose of use

With Online Reports, you can monitor the current state of subscriber traffic in real time to assess the quality of communication across multiple metrics, as well as the state of the network for debugging DPI configuration during initial setup or changes. You can read more about usage scenarios in here.

The composition of the online reports is the same as in the "Netflow" section, but there are specific features:

It is set to monitor either only one subscriber or one host.

Aggregation time can be from 5 seconds (instead of 15 minutes in Netflow), which is practically online visualization.

Quick Start

Go to "QoE analytics" → "Online reports".

Set the value of the "Aggregation period" setting.
We recommend setting a value close to netflow_timeout on the sending side. If you cannot get aggregation periods less than 10 minutes here, make QoE configuration settings according to the setup instructions.

Configure flow capture. To do this, click on the "magic wand" button on the "Filters" dashboard and select the desired type of flow capture. Set subscriber's login / IP or host / host IP.

Subscriber Flow Capture – Subscriber reports (speed, protocols, RTT, clickstream, etc.). Host Flow Capture – Analysis of traffic to the specified host.

The data collection begins immediately. The graph will fill up over time.

To control the data collection, there are "Start Data Collection" and "Stop Data Collection" buttons in the upper left corner of the "Reports" dashboard:

In the "Full raw log" field (under the graph) you can see what flows are currently passing through the selected subscriber / host protocol.
For the selected subscriber / host you can see various reports. The list is on the left side of the window. They are the same as in the Netflow section, but they show the situation online.

An example of an "Application Protocol Traffic" report by subscriber:

An example of an "Application Protocol Traffic" report by host:

Description of additional report settings

Settings menu:

Aggregation period – frequency of data update.

Window width – here you can select the "size" of the graph (the number of points from which the graph is built). You can set the value from 1 to 30.

Device – DPI selection for tracking.
In the settings menu you can select the device for which you want to see the report.
<color #00a2e8>Current DPI device - the device selected in the "DPI Control" at the moment.</color>

Settings.
You can adjust the report refresh frequency (how often the graph will rebuild and new lines will be added to the report), if necessary.

Refresh.

Cache clearing.
The cache is all the data from which the graph was formed. You can clear them and start the graph from a blank state. Once an hour the cache is cleared automatically.

Filters dashboard – here you will see the tracked subscribers/hosts. You can add a subscriber / host for tracking, edit or delete it.

Top application protocols – the current protocols of the subscriber / host are displayed here. The color of the protocol corresponds to its color on the graph.

Traffic by application protocols – here protocols are displayed graphically. You can see the volume of traffic on the vertical axis and time on the horizontal axis.

Full raw log – here you can see the full information about the subscriber / host.

Configuration of data collection and aggregation

Step 1. On the sending side (DPI)

Go to "SSG Control" → "Configuration".

In the "Groups" configuration, go to "Collection and analysis of statistics on protocols and directions".

In the "Parameters" configuration, change the value of the "Periodicity of data export in seconds (netflow_timeout)" parameter. This value must be less than or equal to the rotation values on the receiving side.

Save the configuration. Select the "Save without verification" option.

Restart the configuration. The traffic will be interrupted!

Step 2. On the receiving side (QoE)

Go to "Administrator" → "QoE Stor Configuration".

In the "Settings" section select the item "Receivers".

In the "Receivers" configuration, use the "pencil" button (edit) to set the desired rotation for each Netflow receiver in minutes or seconds (period of data loading into the database). We recommend to set the value of one minute in the "Rotation in minutes" field. These values must be greater than or equal to the netflow_timeout value on the sending side!
The time values in the rotation setting are not limited. Settings are made either in minutes or seconds. Simultaneous use of both fields is not allowed.
<color #ffc90e>It is important to set all Netflow receivers to the same values!</color>

Save and restart the configuration.

After applying these settings, the load on the database will increase and the GUI may be slower than usual.

After applying all the settings, you can make an online report.

Use Cases

Use case 1. Real-time subscriber traffic analysis

Live-view report is a way to monitor subscriber traffic in real time with aggregation interval from 5 seconds. This report collects metrics that affect the subscriber's connection quality evaluation: throughput, traffic speed, latency and packet loss, top protocols used.

The moment the subscriber calls technical support, the support engineer will be able to check:

whether the subscriber has enough bandwidth or not,

how a particular web-service is working,

whether the torrent is jamming the streaming services or not,

if there are any delays (RTT) in the Wi-Fi network.

Detailed configuration of online reports is described here. For this use case, you need to select the report “Traffic Speed” → “Traffic Speed”.

This functionality is available in the QoE Analytics module, BASE license.

Use Case 2. DPI Configuration Verification

The real-time network status view is the best tool for debugging DPI configuration during initial configuration as well as changes.

For example, the ISP can set priorities for protocols as follows:

YouTube — highest priority (cs_0),

Skype, WhatsApp — high priority (cs_1),

Torrent, P2P, Windows updates — low priority (cs_7).

After making the appropriate settings in the GUI or in the configuration file, you can go to the online report called "Traffic by application protocols". Its real-time graphs will demonstrate the changes: YouTube will take up all available bandwidth, and torrent will be limited.

Detailed configuration of online reports is described here. For this use case, you need to select the report “Traffic Speed” → “Traffic by applocation protocols”.

This functionality is available in the QoE Analytics module, BASE license.